Harden channel-publish gate: require CHANNEL_DEPLOY_KEY (was silent skip)

release.sh

@@ -11,7 +11,7 @@
 #
 # Run from a plugin/theme checkout (CWD = the source repo at the tagged commit).
 # Expects env: GITHUB_REPOSITORY, GITHUB_REF_NAME, GITHUB_SERVER_URL, GITHUB_TOKEN.
-# Optional env (step 6 — channel publish; skipped entirely if the key is unset):
+# Env (step 6 — channel publish; CHANNEL_DEPLOY_KEY is REQUIRED):
 #   CHANNEL_DEPLOY_KEY   SSH private key with WRITE access to the channel repo.
 #   CHANNEL_SSH_PORT     SSH port for the Gitea host        (default 30009).
 #   CHANNEL_BRANCH       branch of the channel repo to push (default main).
@@ -154,9 +154,9 @@ curl -fsS -X POST "${API}/releases/${REL_ID}/assets?name=${ZIP}" -H "${AUTH}" \
   -F "attachment=@${ZIP};type=application/zip" >/dev/null
 echo "Released ${GITHUB_REF_NAME}."
 
-# --- 6. publish to the self-hosted update channel (skipped without deploy key) -
+# --- 6. publish to the self-hosted update channel (requires CHANNEL_DEPLOY_KEY) -
 if [ -z "${CHANNEL_DEPLOY_KEY:-}" ]; then
-  echo "CHANNEL_DEPLOY_KEY not set — skipping channel publish."; exit 0
+  echo "::error::CHANNEL_DEPLOY_KEY not set — cannot publish to the required channel"; exit 1
 fi
 log "Publish to channel ${CHANNEL}"
 SSH_HOST="${HOST#https://}"; SSH_HOST="${SSH_HOST#http://}"