feat: dedicated CLI release workflow (macOS binaries + Linux docker)

[d-g-town]

Why

legacy-backend/cli/.goreleaser.yaml now builds the darwin targets with CGO_ENABLED=1 so 99designs/keyring can use the real macOS Keychain backend (gated behind //go:build darwin && cgo). darwin+CGO can't cross-compile from Linux, so the shared single-Linux-job release-from-tag.yaml would fail on the next porter-v* tag.

A macOS runner, by contrast, can build every binary target — darwin natively with CGO, and linux/windows via pure-Go CGO_ENABLED=0 cross-compile. The only thing it can't do is build the linux Docker image (no Docker daemon). So this runs the whole goreleaser release on macOS and moves only the image to a Linux job. No goreleaser Pro.

Jobs

• build-binaries (macos-15-large): goreleaser release --clean --parallelism=4 --skip=validate — all binaries, archives, checksums, R2 blobs (goreleaser's native S3 uploader), Homebrew formula, and the GitHub release.
• build-docker (ubuntu-latest, needs: build-binaries): builds the linux/amd64 binary (CGO_ENABLED=0), the porter-cli image, and recreates the :<ver> / :latest manifests the old docker_manifests pipe produced. Publishes the R2 latest pointer here too (macOS runners don't ship the AWS CLI).

Notes

• GHCR login uses secrets.GITHUB_TOKEN, matching the proven shared workflow — the app-token variant (use GitHub app token for GHCR push #14) was reverted in 97ad992.
• Image tags strip the leading v (tagVersion=v1.2.3 → 1.2.3-amd64 / 1.2.3 / latest) to match what goreleaser's {{ .Version }} produced.
• The shared release-from-tag.yaml is untouched — monolith/agent releases are unaffected.

Companion change

Depends on porter-dev/code#5903, which removes the dockers:/docker_manifests: sections from the CLI's .goreleaser.yaml and routes porter-v* tags here. Both must ship together — this workflow only works at a code tag that has those goreleaser sections removed.

First-run verification

• darwin arm64+amd64 binaries open the macOS Keychain (proves CGO linked, not the file fallback).
• linux/windows binaries + checksums + R2 blobs + Homebrew + GitHub release from the macOS job.
• porter-cli image + :latest/:version manifests from the Linux job; latest pointer updated.
• darwin/arm64 CGO cross-compile from the Intel macos-15-large host (relies on the universal macOS SDK).

🤖 Generated with Claude Code

[charlievieth]

Cross-compilation for Darwin/macOS works on Linux with this change since it only requires dynamically linking to the CoreFoundation and Security.framework libraries, which Go can do without the libraries being present on the machine where the Darwin binary is being built. A full explanation can be found here: https://github.com/porter-dev/code/pull/5903#issuecomment-4606008125.

CC: @d-g-town