ci: fix startup-failing workflows (release secrets-in-if, docs no-trigger) [skip release]

release.yml referenced the secrets context directly in step if: conditions, which is not allowed and made the whole workflow invalid (startup failure on every push). Hoist the signing-key check into a job-level env var (HAS_SIGNING_KEY) and reference env.* in the if: conditions instead. docs.yml and deploy-docs.yml had their on: trigger commented out; a workflow with no on: key is invalid and reports a startup failure on every push. Give them a valid on: workflow_dispatch: so they stay dormant but valid.

Author: TNFR AI Agent

.github/workflows/deploy-docs.yml

@@ -1,20 +1,11 @@
 name: Deploy Documentation to GitHub Pages (DISABLED)
 
-# DISABLED: Documentation now built locally only
-# To re-enable, remove this comment and uncomment the 'on' section below
-
-# on:
-#   push:
-#     branches:
-#       - main
-#     paths:
-#       - 'docs/**'
-#       - 'mkdocs.yml'
-#       - '.github/workflows/deploy-docs.yml'
-#       - 'README.md'
-#       - 'src/**/README.md'
-#       - '*.md'
-# workflow_dispatch:
+# DISABLED: Documentation is now built locally only. This workflow stays valid
+# but only runs on manual dispatch (a workflow with no 'on:' trigger is invalid
+# and reports a startup failure on every push). To re-enable automatic deploys,
+# add the push triggers under 'on:' below.
+on:
+  workflow_dispatch: {}
 
 permissions:
   contents: write

.github/workflows/docs.yml

@@ -1,19 +1,11 @@
 name: Build and Deploy Documentation (DISABLED)
 
-# DISABLED: Documentation now built locally only
-# To re-enable, remove this comment and uncomment the 'on' section below
-
-# on:
-#   push:
-#     branches: [ main ]
-#   workflow_dispatch: {}
-#   pull_request:
-#     paths:
-#       - 'mkdocs.yml'
-#       - 'docs/**'
-#       - 'README.md'
-#       - 'src/**/README.md'
-#       - '*.md'
+# DISABLED: Documentation is now built locally only. This workflow stays valid
+# but only runs on manual dispatch (a workflow with no 'on:' trigger is invalid
+# and reports a startup failure on every push). To re-enable automatic builds,
+# add the push / pull_request triggers under 'on:' below.
+on:
+  workflow_dispatch: {}
 
 jobs:
   build-deploy:

.github/workflows/release.yml

@@ -126,6 +126,10 @@ jobs:
     permissions:
       contents: write
       id-token: write
+    env:
+      # The secrets context cannot be referenced directly in step if: conditions,
+      # so resolve the signing-key availability once here as a job env var.
+      HAS_SIGNING_KEY: ${{ secrets.PYPI_SIGNING_KEY != '' && secrets.PYPI_SIGNING_KEY_ID != '' }}
     steps:
       - name: Checkout release tag
         uses: actions/checkout@v5
@@ -176,7 +180,7 @@ jobs:
           python -m pip install build python-semantic-release
 
       - name: Import PyPI signing key
-        if: ${{ secrets.PYPI_SIGNING_KEY != '' && secrets.PYPI_SIGNING_KEY_ID != '' }}
+        if: ${{ env.HAS_SIGNING_KEY == 'true' }}
         env:
           PYPI_SIGNING_KEY: ${{ secrets.PYPI_SIGNING_KEY }}
         run: |
@@ -189,7 +193,7 @@ jobs:
         run: python -m build
 
       - name: Sign distributions
-        if: ${{ secrets.PYPI_SIGNING_KEY != '' && secrets.PYPI_SIGNING_KEY_ID != '' && steps.build.outcome == 'success' }}
+        if: ${{ env.HAS_SIGNING_KEY == 'true' && steps.build.outcome == 'success' }}
         env:
           GPG_KEY_ID: ${{ secrets.PYPI_SIGNING_KEY_ID }}
           GPG_PASSPHRASE: ${{ secrets.PYPI_SIGNING_KEY_PASSPHRASE }}