Decouple website build from build-image to reduce CI feedback loop

[friedrichg]

Problem

The Cortex documentation website build is currently coupled to the build-image Docker container. The build image bundles Hugo, Node.js, postcss-cli, and autoprefixer (see build-image/Dockerfile lines 6-11, 28-36, 38).

Rebuilding the build image takes ~80 minutes (see #7339). Any change to website tooling (Hugo version, Node.js version, PostCSS dependencies) requires a full image rebuild, blocking all CI until the new image is available.

Additionally:

• website/package-lock.json is not used by any build process — the build image installs npm packages globally, so transitive dependency versions are uncontrolled
• Dependabot PRs for website dependencies (e.g. Bump js-yaml from 3.14.1 to 3.14.2 in /website #7124, Bump lodash from 4.17.21 to 4.17.23 in /website #7228) patch the lockfile but have zero effect on what actually runs in CI
• The deploy_website job runs inside the build image just to execute a shell script that does git push to gh-pages

Proposal

Extract the website build into a standalone GitHub Actions job that uses actions/setup-go, actions/setup-node, and a direct Hugo binary download instead of the build image. This:

1. Eliminates the 80-minute rebuild cycle for website tooling changes
2. Makes package-lock.json meaningful via npm ci
3. Allows removing Node.js/Hugo from the build image, making it smaller and faster to build
4. Enables independent Dependabot updates for website dependencies

Related

• Upgrade build image to 1.25.8 #7339 (build image update takes 80+ min)
• Bump js-yaml from 3.14.1 to 3.14.2 in /website #7124 (Dependabot js-yaml bump — patches unused lockfile)
• Bump lodash from 4.17.21 to 4.17.23 in /website #7228 (Dependabot lodash bump — patches unused lockfile)