Summary

build-attested.yaml failed after successfully attesting the binaries because
goreleaser's Homebrew (brews) pipe templates {{ .Env.HOMEBREW_DEPLOY_KEY }},
an env var only wired into on-tag.yaml. With the key absent, goreleaser errors
("map has no entry for key") and the run dies before uploading the artifact.

Motivation / Context

build-attested.yaml produces on-demand SLSA-attested binaries (as a job
artifact) for exercising the e2e signing flows locally and in CI without cutting
a release tag. It was erroring on every run, so no artifact was ever produced.
Setting HOMEBREW_DEPLOY_KEY to an empty string makes the existing
skip_upload template evaluate true, so the Homebrew tap publish is skipped
cleanly. on-tag.yaml still supplies the real secret for production releases.

Fixes: N/A
Related: #1214, #1215

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• Build/CI/tooling

Component(s) Affected

• Other: GitHub Actions CI workflow (.github/workflows/build-attested.yaml)

Implementation Notes

The cosign attestation step itself already worked; only the Homebrew publish
pipe broke. The empty env var keeps the key present in goreleaser's .Env map
(goreleaser hard-errors on a missing key) while skip_upload (not .Env.HOMEBREW_DEPLOY_KEY) short-circuits the tap publish.

Testing

Re-ran the workflow via workflow_dispatch after the fix
(run 27303432250): completed successfully and uploaded the
aicr-attested-binaries artifact (4 archives, ~87 MB). CI-only YAML change; no
Go code touched.

Risk Assessment

• Low — Isolated CI workflow change, easy to revert

Rollout notes: N/A. on-tag.yaml production releases are unaffected (they
provide the real HOMEBREW_DEPLOY_KEY secret).

Checklist

• Changes follow existing patterns in the codebase
• Commits are cryptographically signed (git commit -S)
• I did not skip/disable tests to make CI green
• Go test/lint gates: N/A (CI workflow YAML only, no Go changes)