refactor: rewrite cuttle in Go + remote backends + local-canonical profiles

.github/release-please-config.json

@@ -1,14 +1,15 @@
 {
   "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
-  "release-type": "python",
+  "release-type": "go",
   "include-component-in-tag": false,
   "bump-minor-pre-major": true,
   "bump-patch-for-minor-pre-major": true,
   "packages": {
     ".": {
-      "package-name": "cuttle-browser",
-      "skip-changelog": true,
-      "extra-files": [{ "type": "generic", "path": "SKILL.md" }]
+      "package-name": "cuttle",
+      "extra-files": [
+        "internal/cli/SKILL.md"
+      ]
     }
   }
 }

.github/workflows/ci.yml

@@ -1,30 +1,157 @@
 name: ci
 
-# Lint + type-check the authored Python (the `just check` gate, in check-only
-# mode - CI never mutates). Runs on human PRs and pushes to main. NOTE: the
-# release PR is opened by github-actions via github.token, which GitHub does not
-# let trigger workflows, so this does not run on it - that PR only bumps version
-# strings and needs no code CI. Heavier gates (`just smoke`, real-amd64) stay
-# manual pre-merge; see AGENTS.md.
 on:
-  pull_request:
   push:
     branches: [main]
+  pull_request:
 
+# Read-only by default; the release job elevates for its own publishing.
 permissions:
   contents: read
 
-concurrency:
-  group: ci-${{ github.ref }}
-  cancel-in-progress: true
+# Concurrency is per-job, not workflow-level: a build stays cancellable, but the
+# release job must never be cancelled mid-publish.
 
 jobs:
-  check:
+  build-and-test:
+    runs-on: ubuntu-latest
+    concurrency:
+      group: build-${{ github.ref }}
+      cancel-in-progress: true
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v7
+        with:
+          go-version-file: go.mod
+      - uses: docker/setup-buildx-action@v4
+
+      - name: Lint
+        uses: golangci/golangci-lint-action@v9
+        with:
+          version: v2.12
+
+      - name: Test
+        run: |
+          go install gotest.tools/gotestsum@latest
+          gotestsum --format github-actions -- -race -coverprofile=coverage.out -covermode=atomic ./...
+
+      - name: Vuln
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
+      # helm is preinstalled on ubuntu-latest; guard the chart against drift.
+      - name: Helm lint
+        run: |
+          helm lint ops/helm/cuttle
+          helm template ops/helm/cuttle >/dev/null
+
+      # Build the amd64 image and smoke it over raw CDP (per-seed isolation,
+      # stealth coherence, WebGL via ANGLE). buildx GHA cache reuses the apt +
+      # clark/clearcote + KasmVNC layers so only a Chrome bump re-downloads them.
+      - name: Build image (cached)
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ops/docker/Dockerfile
+          platforms: linux/amd64
+          load: true
+          tags: cuttle:ci
+          cache-from: type=gha
+          cache-to: type=gha,mode=max,ignore-error=true
+
+      - name: Smoke (Go harness over CDP)
+        run: |
+          set -euo pipefail
+          docker run -d --name cuttle-smoke -p 127.0.0.1:19222:9222 --shm-size=2g cuttle:ci
+          for _ in $(seq 1 60); do
+            curl -sf http://127.0.0.1:19222/json/version >/dev/null 2>&1 && break
+            sleep 1
+          done
+          CUTTLE_URL=http://127.0.0.1:19222 go run ./test/smoke
+
+      - name: Teardown
+        if: always()
+        run: docker rm -f cuttle-smoke >/dev/null 2>&1 || true
+
+  # Runs only on push to main, and only after build-and-test is green.
+  # release-please maintains the release PR; merging it cuts the tag + GitHub
+  # release, and the gated steps then publish (GoReleaser binaries + Homebrew
+  # cask, and the GHCR image) in this same run - no PAT-triggered tag handoff.
+  release:
+    needs: build-and-test
+    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # tag + release, GoReleaser upload
+      pull-requests: write # release-please PR
+      packages: write # push image to GHCR
+    concurrency:
+      group: release-${{ github.ref }}
+      cancel-in-progress: false
     steps:
+      # release-please-action is API-driven and needs no checkout.
+      - uses: googleapis/release-please-action@v5
+        id: rp
+        with:
+          config-file: .github/release-please-config.json
+          manifest-file: .github/.release-please-manifest.json
+
+      # Everything below runs only when merging the release PR actually cut a
+      # release (release_created == true).
       - uses: actions/checkout@v7
-      - uses: astral-sh/setup-uv@v8.3.2
-      - run: uv run ty check
-      - run: uv run ruff check --output-format github
-      - run: uv run ruff format --check
-      - run: uv run python scripts/check-skill-version.py
+        if: steps.rp.outputs.release_created == 'true'
+        with:
+          fetch-depth: 0 # GoReleaser needs full history + the new tag
+
+      - uses: actions/setup-go@v7
+        if: steps.rp.outputs.release_created == 'true'
+        with:
+          go-version-file: go.mod
+
+      - uses: goreleaser/goreleaser-action@v7
+        if: steps.rp.outputs.release_created == 'true'
+        with:
+          version: "~> v2"
+          args: release --clean --config ops/config/goreleaser.yaml
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          # Push the Homebrew cask to the separate tap repo.
+          GH_RELEASE_TOKEN: ${{ secrets.GH_RELEASE_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v4
+        if: steps.rp.outputs.release_created == 'true'
+
+      - name: Log in to GHCR
+        if: steps.rp.outputs.release_created == 'true'
+        uses: docker/login-action@v4
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Image metadata
+        id: meta
+        if: steps.rp.outputs.release_created == 'true'
+        uses: docker/metadata-action@v6
+        with:
+          images: ghcr.io/glim-sh/cuttle
+          tags: |
+            type=raw,value=${{ steps.rp.outputs.version }}
+            type=raw,value=${{ steps.rp.outputs.major }}.${{ steps.rp.outputs.minor }}
+            type=raw,value=latest
+            type=sha
+
+      # clark/clearcote ship linux-x64 prebuilts only, so the image is amd64-only.
+      - name: Build and push image
+        if: steps.rp.outputs.release_created == 'true'
+        uses: docker/build-push-action@v7
+        with:
+          context: .
+          file: ops/docker/Dockerfile
+          platforms: linux/amd64
+          push: true
+          build-args: |
+            VERSION=${{ steps.rp.outputs.version }}
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}