🤖 fix: render GoReleaser channel templates when GORELEASER_CHANNEL is unset (#138)

## What broke

The v0.1.1 release build
([run](https://github.com/coder/coder-k8s/actions/runs/36110595919))
failed before publishing anything:

```
template: failed to apply "{{ eq .Env.GORELEASER_CHANNEL \"main\" }}": map has no entry for key "GORELEASER_CHANNEL"
```

`release.yaml` never sets `GORELEASER_CHANNEL`, and GoReleaser rejects a
template that reads a missing `.Env` key. The changelog template already
used `index .Env`; the `release.disable` and both `dockers_v2` `disable`
templates did not. No binaries, archives or images were published for
v0.1.1.

## Fix

- `.goreleaser.yaml`: read the channel with `index .Env
"GORELEASER_CHANNEL"` in all three templates.
- `.github/workflows/release.yaml`: set `GORELEASER_CHANNEL: release`
explicitly.
- `hack/main_publish_test.go`: `TestReleaseAndImageChannels` renders the
release and both `dockers_v2` disable templates with `missingkey=error`
for the `main`, empty, `release` and unset channels, and checks which
pipes run on each (release and the release image off only on `main`; the
`:main` image on only on `main`).

## Validation

- The new test fails on the v0.1.1 config with the same `map has no
entry` error, and passes on this PR.
- `make verify-vendor`, `make build`, `make lint`, `make test` and
actionlint pass.
- A local `goreleaser release --clean --skip=announce,publish` cannot
reproduce the failure: the release and image pipes it fails in are
skipped when publishing is skipped. The unit test is the gate for those
templates. The real check is the next release run.

![The channel test passes on this PR and fails with the v0.1.1
config](https://github.com/user-attachments/assets/3726ad51-d271-4127-bad3-ddbfabb15909)

Terminal recording (vhs capture; timing approximate):


https://github.com/user-attachments/assets/8c3c135a-cf06-4b60-b457-3610cc7daffa

## After this lands

Cut v0.1.2 from `main`. The v0.1.1 tag stays: its source already
contains #136, but it has no release artifacts.

---
_Generated with [`xum`](https://github.com/coder/xum) • Model:
`anthropic:claude-opus-5-5` • Thinking: `medium` • Cost: `$1754.57`_

Author: ThomasK33

.github/workflows/release.yaml

@@ -43,6 +43,7 @@ jobs:
           args: release --clean
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GORELEASER_CHANNEL: release
 
       - name: Compute release image tag
         id: release_image_tag

.goreleaser.yaml

@@ -31,11 +31,11 @@ archives:
       - README.md
 
 release:
-  disable: '{{ eq .Env.GORELEASER_CHANNEL "main" }}'
+  disable: '{{ eq (index .Env "GORELEASER_CHANNEL") "main" }}'
 
 dockers_v2:
   - id: coder-k8s-image-main
-    disable: '{{ ne .Env.GORELEASER_CHANNEL "main" }}'
+    disable: '{{ ne (index .Env "GORELEASER_CHANNEL") "main" }}'
     dockerfile: Dockerfile.goreleaser
     ids:
       - coder-k8s
@@ -64,7 +64,7 @@ dockers_v2:
       - "--provenance=false"
 
   - id: coder-k8s-image-release
-    disable: '{{ eq .Env.GORELEASER_CHANNEL "main" }}'
+    disable: '{{ eq (index .Env "GORELEASER_CHANNEL") "main" }}'
     dockerfile: Dockerfile.goreleaser
     ids:
       - coder-k8s

hack/main_publish_test.go

@@ -51,6 +51,67 @@ func TestChangelogChannels(t *testing.T) {
 	}
 }
 
+// The release workflow does not set GORELEASER_CHANNEL, and GoReleaser fails a template that reads a missing
+// .Env key ("map has no entry"). Every channel-dependent disable template must render for an unset channel,
+// and pick the right pipes per channel.
+func TestReleaseAndImageChannels(t *testing.T) {
+	data, err := os.ReadFile("../.goreleaser.yaml")
+	if err != nil {
+		t.Fatal(err)
+	}
+	var config struct {
+		Release struct {
+			Disable string `json:"disable"`
+		} `json:"release"`
+		DockersV2 []struct {
+			ID      string `json:"id"`
+			Disable string `json:"disable"`
+		} `json:"dockers_v2"`
+	}
+	if err := yaml.Unmarshal(data, &config); err != nil {
+		t.Fatal(err)
+	}
+	// want maps each template to whether it must be disabled on the main channel (and enabled otherwise).
+	type check struct {
+		name, text     string
+		disabledOnMain bool
+	}
+	checks := []check{{name: "release", text: config.Release.Disable, disabledOnMain: true}}
+	for _, d := range config.DockersV2 {
+		switch d.ID {
+		case "coder-k8s-image-main":
+			checks = append(checks, check{name: d.ID, text: d.Disable, disabledOnMain: false})
+		case "coder-k8s-image-release":
+			checks = append(checks, check{name: d.ID, text: d.Disable, disabledOnMain: true})
+		default:
+			t.Fatalf("unexpected dockers_v2 id %q; add it to this test", d.ID)
+		}
+	}
+	if len(checks) != 3 {
+		t.Fatalf("expected release plus two dockers_v2 entries, got %d checks", len(checks))
+	}
+	for _, c := range checks {
+		tmpl, err := template.New(c.name).Option("missingkey=error").Parse(c.text)
+		if err != nil {
+			t.Fatalf("%s: %v", c.name, err)
+		}
+		for _, channel := range []string{"main", "", "release", "unset"} {
+			env := map[string]string{}
+			if channel != "unset" {
+				env["GORELEASER_CHANNEL"] = channel
+			}
+			var result strings.Builder
+			if err := tmpl.Execute(&result, struct{ Env map[string]string }{Env: env}); err != nil {
+				t.Fatalf("%s, channel %q: %v", c.name, channel, err)
+			}
+			wantDisabled := (channel == "main") == c.disabledOnMain
+			if (result.String() == "true") != wantDisabled {
+				t.Fatalf("%s disabled = %q for channel %q", c.name, result.String(), channel)
+			}
+		}
+	}
+}
+
 // `goreleaser release --clean` deletes its output directory. dist/ holds the tracked install bundle, so
 // GoReleaser writes to .goreleaser-dist instead, and .gitignore must ignore that whole directory to keep the
 // release worktree clean.