fix(release): pass HOMEBREW_DEPLOY_KEY secret to goreleaser

Add homebrew_deploy_key input to go-build-release action and pass it
from on-tag workflow. Skip upload gracefully when key is not set.

Author: mchmarny

.github/actions/go-build-release/action.yml

@@ -24,6 +24,10 @@ inputs:
     description: 'ko version (e.g. v0.18.0)'
     required: false
     default: 'v0.18.0'
+  homebrew_deploy_key:
+    description: 'SSH deploy key for pushing Homebrew formula'
+    required: false
+    default: ''
 
 outputs:
   release_outcome:
@@ -52,6 +56,7 @@ runs:
       env:
         GITHUB_TOKEN: ${{ github.token }}
         GOFLAGS: -mod=vendor
+        HOMEBREW_DEPLOY_KEY: ${{ inputs.homebrew_deploy_key }}
         # Repository paths are fully specified in .goreleaser.yaml kos.repositories
       run: |
         set -euo pipefail

.github/workflows/on-tag.yaml

@@ -89,6 +89,7 @@ jobs:
         uses: ./.github/actions/go-build-release
         with:
           ko_version: ${{ steps.versions.outputs.ko }}
+          homebrew_deploy_key: ${{ secrets.HOMEBREW_DEPLOY_KEY }}
 
       - name: Malware Scan Release Binaries
         if: steps.release.outcome == 'success'

.goreleaser.yaml

@@ -170,6 +170,7 @@ brews:
       git:
         url: "ssh://git@github.com/NVIDIA/homebrew-aicr.git"
         private_key: "{{ .Env.HOMEBREW_DEPLOY_KEY }}"
+    skip_upload: "{{ if .Env.HOMEBREW_DEPLOY_KEY }}false{{ else }}true{{ end }}"
     commit_author:
       name: github-actions
       email: github-actions@github.com