Enable "Arduino IDE" workflow use by contributors

[per1234]

GitHub Actions workflows may require access to privileged information in order to perform certain operations. GitHub provides the capability for doing this via "repository secrets".

For security reasons, repository secrets are only accessible to a GitHub Actions workflow run when it is triggered by an event from within the repository containing the secret. This means that a workflow which requires such secrets would fail when run in a fork (unless the fork owner has set up their own secrets with suitable values).

In order to make the relevant components of the CI system friendly for use in forks by contributors validating their work in preparation for submitting a PR, when the operations that require access to a secret are supplemental, those operations should be configured to only run from branches of the parent repository.

Due to its unfortunate monolithic design, in addition to operations useful to contributors, the "Arduino IDE" workflow contains several such supplemental operations:

• Code signing
• Publishing release artifacts to Arduino's server

Some attempt was previously made to configure the workflow to skip these operations when run in forks, but that configuration was not done correctly. This made the workflow only usable by contributors with a deep enough understanding of GitHub Actions to be able to make the necessary modifications provisionally every time they needed to use the workflow.

The average contributor would not be capable or willing to do this, which might result in PRs being submitted in a less validated state, increasing the burden on maintainers.

The specific misconfigurations

build job conditional on the workflow running from arduino/arduino-ide

The job itself can run just fine in a fork, so there is no reason to impose this restriction.

Since the time this conditional was added, some changes have been made to the GitHub Actions system which makes this sort of configuration unnecessary:

• GitHub Actions is globally disabled in forks by default
• Workflows which contain a schedule trigger (as is the case with this one) are individually disabled by default, requiring the repository owner to enable it specifically even after enabling GitHub Actions in general.

This means this workflow will never run unexpectedly in a fork. The fork owner will always have intentionally enabled it.

So this conditional can be removed completely.

Code signing conditional on PR being submitted from a branch of the base repo

This would cause a spurious failure of the signing operation on PRs made within the contributor's fork when the signing secrets were not defined.

The more appropriate condition of whether the signing secrets are defined or not is now used. The environment variable name has been updated accordingly.

release job conditional on running from arduino/arduino-ide

The GitHub release creation step of this job can run in any repository. It is only the step that uploads to Arduino's AWS server which would only make sense to run from arduino/arduino-ide.

So the conditional is moved to the AWS upload step, allowing contributors to test the workflow's release operation in their forks to validate related proposals.

Reviewer checklist

• PR addresses a single concern.
• The PR has no duplicates (please search among the Pull Requests before creating one)
• PR title and description are properly filled.
• Docs have been added / updated (for bug fixes / features)

[AlbyIanna]

Thank you @per1234 !