.github: fix redirecting into existing file when rendering resources

.github/workflows/publish.yml

@@ -1,6 +1,6 @@
 # Copyright 2026 Edgeless Systems GmbH
 # SPDX-License-Identifier: BUSL-1.1
-name: container
+name: publish
 on:
   workflow_dispatch:
   push:
@@ -36,8 +36,9 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          nix run .#render-k8s-resources > collateral-proxy.yml
+          out="$RUNNER_TEMP/collateral-proxy.yml"
+          nix run .#render-k8s-resources > "$out"
           gh release create "${{ github.ref_name }}" \
             --title "${{ github.ref_name }}" \
             --generate-notes \
-            collateral-proxy.yml
+            "$out"

flake.nix

@@ -78,9 +78,11 @@
             gzip
           ];
           text = ''
+            trap 'echo "push-collateral-proxy: failed (exit $?) at line $LINENO: $BASH_COMMAND" >&2' ERR
             tag="''${1:-dev}"
             tmp=$(mktemp)
             trap 'rm -f "$tmp"' EXIT
+            echo "push-collateral-proxy: pushing ${image}:$tag" >&2
             gunzip < "${container}" > "$tmp"
             crane push "$tmp" "${image}:$tag" >&2
             digest=$(crane digest "${image}:$tag")
@@ -97,9 +99,13 @@
             pkgs.gnused
           ];
           text = ''
+            trap 'echo "render-k8s-resources: failed (exit $?) at line $LINENO: $BASH_COMMAND" >&2' ERR
             tag="''${1:-v${version}}"
             template=${./collateral-proxy.yml}
-            grep -q '%%pin%%' "$template"
+            if ! grep -q '%%pin%%' "$template"; then
+              echo "render-k8s-resources: template $template is missing the %%pin%% placeholder" >&2
+              exit 1
+            fi
             ref=$(push-collateral-proxy "$tag")
             sed "s|%%pin%%|$ref|" "$template"
           '';