From 506dcf897a25589d3fade7965032c498c4cec0d4 Mon Sep 17 00:00:00 2001
From: Charlotte Hartmann Paludo <git@charlotteharludo.com>
Date: Wed, 15 Jul 2026 14:54:43 +0200
Subject: [PATCH] .github: fix redirecting into existing file when rendering
 resources

---
 .github/workflows/publish.yml | 7 ++++---
 flake.nix                     | 8 +++++++-
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 51751a0..0edbf5a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -1,6 +1,6 @@
 # Copyright 2026 Edgeless Systems GmbH
 # SPDX-License-Identifier: BUSL-1.1
-name: container
+name: publish
 on:
   workflow_dispatch:
   push:
@@ -36,8 +36,9 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          nix run .#render-k8s-resources > collateral-proxy.yml
+          out="$RUNNER_TEMP/collateral-proxy.yml"
+          nix run .#render-k8s-resources > "$out"
           gh release create "${{ github.ref_name }}" \
             --title "${{ github.ref_name }}" \
             --generate-notes \
-            collateral-proxy.yml
+            "$out"
diff --git a/flake.nix b/flake.nix
index 895f2f4..055a2f3 100644
--- a/flake.nix
+++ b/flake.nix
@@ -78,9 +78,11 @@
             gzip
           ];
           text = ''
+            trap 'echo "push-collateral-proxy: failed (exit $?) at line $LINENO: $BASH_COMMAND" >&2' ERR
             tag="''${1:-dev}"
             tmp=$(mktemp)
             trap 'rm -f "$tmp"' EXIT
+            echo "push-collateral-proxy: pushing ${image}:$tag" >&2
             gunzip < "${container}" > "$tmp"
             crane push "$tmp" "${image}:$tag" >&2
             digest=$(crane digest "${image}:$tag")
@@ -97,9 +99,13 @@
             pkgs.gnused
           ];
           text = ''
+            trap 'echo "render-k8s-resources: failed (exit $?) at line $LINENO: $BASH_COMMAND" >&2' ERR
             tag="''${1:-v${version}}"
             template=${./collateral-proxy.yml}
-            grep -q '%%pin%%' "$template"
+            if ! grep -q '%%pin%%' "$template"; then
+              echo "render-k8s-resources: template $template is missing the %%pin%% placeholder" >&2
+              exit 1
+            fi
             ref=$(push-collateral-proxy "$tag")
             sed "s|%%pin%%|$ref|" "$template"
           '';