Given the following project structure:

.
├── cmd
│  ├── awscodecommitsource
│  │   ├── go.mod
│  │   ├── go.sum
│  │   └── main.go
│  └── controller
│      └── main.go
├── go.mod
└── go.sum

and the following manifest (simplified):

apiVersion: apps/v1
kind: Deployment
metadata:
  name: aws-sources-controller
    spec:
      containers:
      - name: controller
        image: ko://github.com/triggermesh/aws-event-sources/cmd/controller
        env:
        - name: AWSCODECOMMITSOURCE_IMAGE
          value: ko://github.com/triggermesh/aws-event-sources/cmd/awscodecommitsource

ko builds the image for cmd/controller but ignores cmd/awscodecommitsource, and keeps the literal value.

After removing go.mod and go.sum from cmd/awscodecommitsource, ko builds both images and replaces the value accordingly.