Add GitHub Actions release workflow

Automate CLI releases via GitHub Actions triggered by pushing version tags.
The workflow uses goreleaser-pro to build binaries, publish to npm, and
update the Homebrew tap.

Required secrets: GORELEASER_KEY, NPM_TOKEN, HOMEBREW_TAP_TOKEN

Author: rgarcia

.github/workflows/release.yaml

@@ -0,0 +1,44 @@
+name: Release CLI
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Clean templates
+        run: make clean-templates
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: '~> v2'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.HOMEBREW_TAP_TOKEN }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

DEVELOPMENT.md

@@ -58,26 +58,45 @@ A typical workflow we encounter is updating the API and integrating those change
 
 ### Releasing a new version
 
-Prerequisites:
+Releases are automated via GitHub Actions. Simply push a version tag and the release workflow will handle the rest.
 
-- Make sure you have **goreleaser-pro** installed via `brew install --cask goreleaser/tap/goreleaser-pro`. You will need a license key (in 1pw), and then `export GORELEASER_KEY=<the key>`. **Note: goreleaser-pro is required, not the standard goreleaser version.**
+#### To release:
 
-- Grab the NPM token for our org (in 1pw) and run `npm config set '//registry.npmjs.org/:_authToken'=<the token>`
+```bash
+# Find the latest version
+git describe --abbrev=0
 
-- export a `GITHUB_TOKEN` with repo and write:packages permissions: https://github.com/settings/tokens/new?scopes=repo,write:packages.
+# Create and push a new tag (bump version following https://semver.org/)
+git tag -a v<VERSION> -m "Version <VERSION>"
+git push origin v<VERSION>
+```
 
-With a clean tree on the branch you want to release (can be main or a pr branch you're about to merge, doesn't matter), run:
+The release workflow will automatically:
+- Build binaries for darwin, linux, and windows (amd64 and arm64)
+- Create a GitHub release with changelog
+- Publish to npm as `@onkernel/cli`
+- Update the Homebrew formula in `onkernel/homebrew-tap`
 
-```bash
-make release-dry-run
-```
+#### Required GitHub Secrets
 
-This will check that everything is working, but not actually release anything.
-You should see one error about there not being a git tag, and that's fine.
+The following secrets must be configured in the repository settings:
 
-To actually release, run:
+| Secret | Description |
+|--------|-------------|
+| `GORELEASER_KEY` | GoReleaser Pro license key (required for npm and homebrew publishing) |
+| `NPM_TOKEN` | npm access token for publishing `@onkernel/cli` |
+| `HOMEBREW_TAP_TOKEN` | GitHub PAT with write access to `onkernel/homebrew-tap` repository |
+
+#### Local dry-run (optional)
+
+To test the release process locally before pushing a tag:
+
+Prerequisites:
+- Install **goreleaser-pro** via `brew install --cask goreleaser/tap/goreleaser-pro`
+- Export `GORELEASER_KEY=<license key from 1pw>`
 
 ```bash
-# use `git describe --abbrev=0` to find the latest version and then bump it following https://semver.org/
-./scripts/release.sh <version> [description]
+make release-dry-run
 ```
+
+This will check that everything is working without actually releasing anything.