Add GitHub Actions release workflow (#64)

## Summary

- Add a GitHub Actions workflow to automate CLI releases on tag push
- Update DEVELOPMENT.md with simplified release instructions
- Release process is now: just push a version tag (e.g., `git tag -a
v1.2.3 -m "Version 1.2.3" && git push origin v1.2.3`)

## Required Secrets

Before using, configure these secrets in the repository settings:

| Secret | Description |
|--------|-------------|
| `GORELEASER_KEY` | GoReleaser Pro license key (in 1pw) |
| `NPM_TOKEN` | npm access token for publishing `@onkernel/cli` (in 1pw)
|
| `HOMEBREW_TAP_TOKEN` | GitHub PAT with write access to
`onkernel/homebrew-tap` repo |

## What the workflow does

1. Triggers on push of `v*` tags
2. Checks out code with full history
3. Sets up Go and Node.js
4. Runs `make clean-templates` to remove node_modules/.venv from
templates
5. Runs goreleaser-pro to:
   - Build binaries for darwin/linux/windows × amd64/arm64
   - Create GitHub release with changelog
   - Publish to npm as `@onkernel/cli`
   - Commit updated Homebrew formula to `onkernel/homebrew-tap`

## Test plan

- [ ] Add the required secrets to the repository
- [ ] Push a test tag to verify the workflow runs successfully
- [ ] Verify GitHub release is created
- [ ] Verify npm package is published
- [ ] Verify Homebrew formula is updated in the tap repo

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Automates CLI releases via GitHub Actions and updates docs
accordingly.
> 
> - Adds `./.github/workflows/release.yaml` to trigger on `v*` tags, set
up Go/Node, clean templates, and run `goreleaser-pro` with `GH_PAT`,
`GORELEASER_KEY`, and `NPM_TOKEN`
> - Rewrites `DEVELOPMENT.md` to document tag-based releases, required
secrets, and optional local dry-run
> - Removes legacy `scripts/release.sh` manual tagging/release script
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
2164fc0. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: rgarcia

.github/workflows/release.yaml

@@ -0,0 +1,44 @@
+name: Release CLI
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: "go.mod"
+          cache: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Clean templates
+        run: make clean-templates
+
+      - name: Run GoReleaser
+        uses: goreleaser/goreleaser-action@v6
+        with:
+          distribution: goreleaser-pro
+          version: '~> v2'
+          args: release --clean
+        env:
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
+          GORELEASER_KEY: ${{ secrets.GORELEASER_KEY }}
+          NPM_TOKEN: ${{ secrets.NPM_TOKEN }}

DEVELOPMENT.md

@@ -58,26 +58,45 @@ A typical workflow we encounter is updating the API and integrating those change
 
 ### Releasing a new version
 
-Prerequisites:
+Releases are automated via GitHub Actions. Simply push a version tag and the release workflow will handle the rest.
 
-- Make sure you have **goreleaser-pro** installed via `brew install --cask goreleaser/tap/goreleaser-pro`. You will need a license key (in 1pw), and then `export GORELEASER_KEY=<the key>`. **Note: goreleaser-pro is required, not the standard goreleaser version.**
+#### To release:
 
-- Grab the NPM token for our org (in 1pw) and run `npm config set '//registry.npmjs.org/:_authToken'=<the token>`
+```bash
+# Find the latest version
+git describe --abbrev=0
 
-- export a `GITHUB_TOKEN` with repo and write:packages permissions: https://github.com/settings/tokens/new?scopes=repo,write:packages.
+# Create and push a new tag (bump version following https://semver.org/)
+git tag -a v<VERSION> -m "Version <VERSION>"
+git push origin v<VERSION>
+```
 
-With a clean tree on the branch you want to release (can be main or a pr branch you're about to merge, doesn't matter), run:
+The release workflow will automatically:
+- Build binaries for darwin, linux, and windows (amd64 and arm64)
+- Create a GitHub release with changelog
+- Publish to npm as `@onkernel/cli`
+- Update the Homebrew formula in `onkernel/homebrew-tap`
 
-```bash
-make release-dry-run
-```
+#### Required GitHub Secrets
 
-This will check that everything is working, but not actually release anything.
-You should see one error about there not being a git tag, and that's fine.
+The following secrets must be configured in the repository settings:
 
-To actually release, run:
+| Secret | Description |
+|--------|-------------|
+| `GH_PAT` | GitHub Personal Access Token with `repo` scope. Must have write access to both this repository (for creating releases) and `onkernel/homebrew-tap` (for updating the Homebrew formula). Create at https://github.com/settings/tokens/new?scopes=repo |
+| `GORELEASER_KEY` | GoReleaser Pro license key (required for npm and homebrew publishing) |
+| `NPM_TOKEN` | npm access token for publishing `@onkernel/cli` |
+
+#### Local dry-run (optional)
+
+To test the release process locally before pushing a tag:
+
+Prerequisites:
+- Install **goreleaser-pro** via `brew install --cask goreleaser/tap/goreleaser-pro`
+- Export `GORELEASER_KEY=<license key from 1pw>`
 
 ```bash
-# use `git describe --abbrev=0` to find the latest version and then bump it following https://semver.org/
-./scripts/release.sh <version> [description]
+make release-dry-run
 ```
+
+This will check that everything is working without actually releasing anything.