ci: migrate release process from GitHub Actions to Buildkite with Chinmina

[jamestelfer]

Purpose

Simplify and consolidate the cfparams release process by removing the dependency on GitHub Actions and AWS Secrets Manager. The current hybrid approach requires Buildkite to trigger GitHub Actions, which then performs the actual release work. This is complicated and relies on long-lived credentials stored in AWS Secrets Manager.

Going for a Buildkite-only pipeline with Chinmina for ephemeral GitHub authentication makes the release process more straightforward.

Notably:

1. Chinmina provides short-lived tokens scoped to specific operations, eliminating the need to manage and rotate secrets in AWS Secrets Manager.
2. git-cliff works better for pre-release versions than our previous strategy, and gets rid of a Node dependency.

Context

• Base infrastructure now provides Chinmina profiles: pipeline:binary-release for releases/tags and org:homebrew-tap-publish for homebrew tap updates
• Chinmina token plugin documentation: https://chinmina.github.io/guides/customizing-permissions/

Required follow-up before release

The .goreleaser.yaml change from brews: to homebrew_casks: is correct for GoReleaser v2 — pre-compiled binaries should be Casks, not Formulas. However, existing users of brew install cultureamp/tap/cfparams will hit a silent failure once the Formula is replaced by a Cask in the tap.

cultureamp/homebrew-tap changes

Replace Formula/cfparams.rb with a disabled stub:

class Cfparams < Formula
  desc "Wrangle parameters for AWS CloudFormation"
  homepage "https://github.com/cultureamp/cfparams"

  # cfparams is now distributed as a Homebrew cask.
  # Install with: brew install --cask cultureamp/tap/cfparams
  disable\! date: "2026-04-10", because: :discontinued, replacement_cask: "cfparams"

  def install; end
end

This makes brew install cultureamp/tap/cfparams fail with a clear message pointing to the cask, rather than silently doing nothing.

Also ensure the tap has a Casks/ directory — GoReleaser writes the cask file there by default (since directory: Formula was removed from .goreleaser.yaml).

After the first release

Update the README install command from brew install cultureamp/tap/cfparams to brew install --cask cultureamp/tap/cfparams once the install path is confirmed.

[anshbajpai01]

LGTM

[jamestelfer]

Before this merges I'll do a once-over to make sure there isn't anything left over here.

[jamestelfer]

Required follow-up: homebrew-tap formula deprecation

The .goreleaser.yaml change from brews: to homebrew_casks: is correct for GoReleaser v2 — pre-compiled binaries should be Casks, not Formulas. However, existing users who have brew install cultureamp/tap/cfparams will hit a silent failure once the Formula is replaced by a Cask in the tap.

Required change in cultureamp/homebrew-tap

Replace Formula/cfparams.rb with a disabled stub:

class Cfparams < Formula
  desc "Wrangle parameters for AWS CloudFormation"
  homepage "https://github.com/cultureamp/cfparams"

  # cfparams is now distributed as a Homebrew cask.
  # Install with: brew install --cask cultureamp/tap/cfparams
  disable\! date: "2026-04-10", because: :discontinued, replacement_cask: "cfparams"

  def install; end
end

This makes brew install cultureamp/tap/cfparams fail with a clear message pointing to the cask, rather than silently doing nothing.

Also check

• The tap will need a Casks/ directory; GoReleaser writes the cask file there by default (since directory: Formula was removed from .goreleaser.yaml)
• Update the README install command from brew install cultureamp/tap/cfparams to brew install --cask cultureamp/tap/cfparams after the first cask-based release confirms the install path

This tap change should land at the same time as or before this PR is merged and a release is cut.