Implement conditional GPG signing in CI builds to preserve validation while handling missing secrets

[Copilot]

The Maven CI build was failing with gpg: signing failed: No secret key because the workflow was attempting to sign artifacts without proper GPG key configuration. Rather than simply skipping GPG and JavaDoc generation, this implements a conditional approach that preserves validation when possible.

Problem

The pom.xml contains the maven-gpg-plugin configured to run during the verify phase for all builds, but regular CI builds don't have access to the GPG secrets that are properly configured for releases.

Solution

Updated the CI workflow with conditional logic to handle GPG keys intelligently:

• When GPG secrets are available (main repository builds): Runs full mvn clean install with both GPG signing and JavaDoc generation
• When GPG secrets are not available (fork PR builds): Runs mvn clean install -Dgpg.skip=true but still generates JavaDoc

Benefits

• ✅ GPG signing is validated in CI builds when secrets are available
• ✅ JavaDoc generation is always validated to catch documentation issues early
• ✅ Fork PRs can build successfully without requiring GPG secrets
• ✅ All 202 tests continue to pass in both scenarios
• ✅ Release workflow remains unchanged and properly configured for Maven Central deployment
• ✅ Updated to use modern GitHub Actions (setup-java@v3, checkout@v4) with proper caching

This approach ensures maximum validation coverage while gracefully handling the security constraints of fork-based contributions.

Fixes #7.

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[nathanfunk]

I don't want to just skip the javadoc and gpg signing. It is important that these are both run after every merge to master to ensure no issues are introduced.

[nathanfunk]

@copilot I don't want to just skip the javadoc and gpg signing. It is important that these are both run after every merge to master to ensure no issues are introduced.

[Copilot]

@copilot I don't want to just skip the javadoc and gpg signing. It is important that these are both run after every merge to master to ensure no issues are introduced.

I've updated the solution to address your requirements. Instead of always skipping GPG and JavaDoc, the CI workflow now uses conditional logic:

• When GPG secrets are available (main repo builds): Runs full mvn clean install with both GPG signing and JavaDoc generation
• When GPG secrets are not available (PR builds from forks): Runs mvn clean install -Dgpg.skip=true but still generates JavaDoc

This ensures both GPG signing and JavaDoc are validated in CI builds whenever possible, while gracefully handling cases where GPG keys aren't available. All 202 tests pass and JavaDoc artifacts are successfully generated.

The workflow now uses the same modern actions and GPG configuration as your release workflow for consistency.

Commit: 2d18e4a