Make package generation and GPG signing optional in the CD build

[GuanzhouSong]

Fixes#20

Problem

Setup GPG runs unconditionally in the CD build, so a fork without GPG_PRIVATE_KEY gets a failed step on every run. The continue-on-error: true that hides it is also a hazard upstream: if the key ever becomes invalid, the run keeps going and republishes the site with an unsigned APT repository in place of a signed one. apt-get update then fails for every client pinned with signed-by, so a silently skipped signature is a user-visible outage rather than a cosmetic regression.

Change

The secrets context is not readable from a step-level if:, so a new first step resolves two independent feature flags into step outputs (binding the secret to that one step also keeps it out of every other step's environment):

Flag	Controlled by	Default
Package repositories	BUILD_PACKAGES variable	on in documentdb/documentdb.github.io, off in forks
Package signing	GPG_PRIVATE_KEY secret	off when the secret is unset

• Signing absent - the GPG import step is skipped rather than failed, and a workflow warning notes the repositories will be unsigned.
• Signing present - continue-on-error is gone, so an unusable key fails the run. The artifact check additionally asserts InRelease, Release.gpg and the exported keyring were produced. RPM metadata signing is best-effort inside download_packages.sh, so that one is surfaced as a warning instead of failing the deployment.
• Packaging off - Install packaging tools, Download DocumentDB packages and Verify generated package components are all skipped. The static site build, docs verification, artifact upload and Pages deploy are untouched and always run.

Turning packaging off upstream would publish a site with no /deb, /rpm or keyring, so that consequence is called out in a comment next to the variable.

The run summary now reports which optional halves executed and why.

Result for a fork

Enable Pages (Settings > Pages > Source: GitHub Actions), push, and the workflow builds the site and deploys it with no secrets and no red steps. Set BUILD_PACKAGES=true to exercise the packaging path as well.

Validation

Local:

• actionlint clean on both workflows; the repository's own yaml-ls-check gate passes (153 files); npm test passes (129 tests)
• Flag resolution exercised across 7 combinations of BUILD_PACKAGES (unset / true / false / TRUE / invalid), upstream vs fork, and key present vs absent, including the invalid-value error path
• The verification block tested against fixtures for signing-disabled, signing-enabled-with-missing-signatures, signing-enabled-and-complete, unsigned RPM metadata, and a deb-only artifact with no out/rpm directory. Pre-existing checks confirmed still failing correctly for missing release-info.json and missing per-architecture APT metadata

End to end in a fork with no secrets and no variables:

• Default fork run: packaging and signing steps skipped, site built and deployed to Pages in 1m34s with zero failed steps - the exact case from [IMPROVEMENT] Make GPG signing and packaging optional in CD build #20. / returned 200, /deb/dists/stable/Release returned 404
• With BUILD_PACKAGES=true and still no key: packaging ran unsigned and the run stayed green, emitting the intended warning annotation. Published /deb/dists/stable/Release, /packages/release-info.json and /rpm/rhel9/repodata/repomd.xml (200), while InRelease, Release.gpg and the keyring were correctly absent (404)

Against the real upstream key, via workflow_dispatch on this branch:

• The build job passed every step including Setup GPG, real Release signing, and the new strict verification. The imported key id matched the one already published at documentdb.io/documentdb-archive-keyring.gpg, and no warning annotations were emitted, so dpkg-sig and RPM metadata signing both succeeded
• The deploy job was blocked by the main-only github-pages environment policy, so that dry run could not touch production. Confirmed afterwards: the branch deployment recorded state failure and never activated, the previous main deployment remained success, and documentdb.io, InRelease and the keyring all still served 200