Migrate CI from Cirrus CI to GitHub Actions

[fkorotkov-oai]

What changed

• replace Cirrus CI lint and macOS test jobs with GitHub Actions
• move tag and dry-run releases to GoReleaser Pro
• keep the publish environment and release secrets exclusive to tag-triggered releases; manual snapshots run in a separate secretless job
• publish the Softnet Homebrew formula to openai/homebrew-tools through a pull request using short-lived GitHub App tokens
• remove Sentry release side effects

Release setup

The tag-only release job uses the publish environment, which provides GORELEASER_KEY, RELEASE_APP_ID, and RELEASE_APP_PRIVATE_KEY. The release app needs contents write access to openai/softnet, plus contents and pull-request write access to openai/homebrew-tools. The manual snapshot job uses no environment or secrets.

Validation

• actionlint (allowing the custom Cirrus macOS runner labels)
• goreleaser check --soft with GoReleaser Pro 2.16.0
• env -u GORELEASER_KEY goreleaser release --skip=publish --snapshot --clean
• cargo fmt --check
• cargo clippy --all-targets --all-features -- -D warnings

With the Pro key explicitly unset, the GoReleaser snapshot built both macOS architectures, created the universal archive, and generated dist/homebrew/Formula/softnet.rb. cargo test built successfully and reached the test binary, whose configured sudo -E runner cannot execute in the local sandbox; the migrated test jobs run on the configured macOS runners.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6c2553c3ff

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Gate tag releases on CI

When this tag workflow reaches goreleaser release --clean, it publishes without any preceding lint or test job; the new CI workflow only runs on PRs, merge groups, manual runs, and pushes to the main branch, so tag pushes do not exercise it. The removed Cirrus release task depended on both Lint and Test, so tagging a broken commit can now publish artifacts before formatting, clippy, or the macOS test matrix has passed; add equivalent checks to this workflow or otherwise make tag releases wait for a tag-triggered CI run.

Useful? React with 👍 / 👎.