In my workflow, I want to be able to clean up the macOS keychain regardless of whether the job succeeded:

   - name: Delete keychain (macOS)
     run: security delete-keychain signing.keychain

From the documentation, I can do this so that this step always runs:

   - name: Delete keychain (macOS)
     run: security delete-keychain signing.keychain
     if: ${{ always() }}

However, my workflow is also run on Windows and Ubuntu, so I only want to run this step on macOS:

    runs-on: ${{ matrix.os }}
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    ...

name: Delete keychain (macOS)

run: security delete-keychain signing.keychain

if: matrix.os == 'macos-latest' && ${{ always() }}

Despite the matrix.os == 'macos-latest' condition, this step still runs on Windows and Ubuntu. Is there a way I can always run this command on macOS only?