feat: produce CLI build artifacts on PR builds (#1932)

## Summary

- Adds `.goreleaser.pr.yaml` — a stripped-down GoReleaser config (builds
+ archives + checksum only, no brews/chocolateys/winget/changelog) with
snapshot version `0.0.0-<short-sha>` so it never sorts above real
releases
- Adds `build-artifacts` job to `validate.yml` that cross-compiles for
linux/windows/darwin on every non-draft PR push, then creates a GitHub
Release tagged `v0.0.0-<short-sha>` (prerelease) with the zips +
checksums — no auth needed to download since release assets on public
repos are public
- Adds `cleanup-pr-releases.yml` scheduled workflow that deletes
`v0.0.0-*` releases older than 14 days

### Usage

Test it out:


[v0.0.0-7b76d461](https://github.com/speakeasy-api/speakeasy/releases/tag/v0.0.0-7b76d461)

```bash
VERSION=0.0.0-7b76d461 curl -fsSL https://raw.githubusercontent.com/speakeasy-api/speakeasy/main/install.sh | sh
```

✻ Clauded...

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

Author: danielkov

.github/workflows/cleanup-pr-releases.yml

@@ -0,0 +1,26 @@
+name: Cleanup PR Build Releases
+
+on:
+  schedule:
+    - cron: "0 3 * * *" # Daily at 3 AM UTC
+
+jobs:
+  cleanup:
+    name: Delete old PR build releases
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - name: Delete PR build releases older than 14 days
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          cutoff=$(date -u -d '14 days ago' +%Y-%m-%dT%H:%M:%SZ)
+
+          gh release list --repo speakeasy-api/speakeasy --limit 100 --json tagName,createdAt \
+            | jq -r --arg cutoff "$cutoff" \
+              '.[] | select(.tagName | startswith("v0.0.0-")) | select(.createdAt < $cutoff) | .tagName' \
+            | while read -r tag; do
+                echo "Deleting release ${tag}"
+                gh release delete "${tag}" --repo speakeasy-api/speakeasy --yes --cleanup-tag
+              done

.github/workflows/validate.yml

@@ -116,3 +116,37 @@ jobs:
       - run: go test -json -v -timeout=20m ./... | gotestfmt
         env:
           SPEAKEASY_API_KEY: ${{ secrets.SPEAKEASY_API_KEY }}
+  build-artifacts:
+    name: Build PR Artifacts
+    if: ${{ github.event.pull_request.draft == false }}
+    permissions:
+      contents: write
+    runs-on:
+      group: ubuntu-latest-large
+    steps:
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.head.sha }}
+      - name: Set short SHA
+        run: echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> "$GITHUB_ENV"
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        with:
+          go-version-file: "go.mod"
+      - name: Configure git for private modules
+        env:
+          GIT_AUTH_TOKEN: ${{ secrets.BOT_REPO_TOKEN }}
+        run: git config --global url."https://speakeasybot:${GIT_AUTH_TOKEN}@github.com".insteadOf "https://github.com"
+      - uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
+        with:
+          version: '~> v2'
+          args: release --snapshot --clean --config .goreleaser.pr.yaml
+      - name: Create release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "v0.0.0-${SHORT_SHA}" \
+            --title "PR Build (${SHORT_SHA})" \
+            --notes "Built from commit ${{ github.event.pull_request.head.sha }} on PR #${{ github.event.pull_request.number }}" \
+            --prerelease \
+            dist/*.zip dist/checksums.txt

.goreleaser.pr.yaml

@@ -0,0 +1,28 @@
+# yaml-language-server: $schema=https://goreleaser.com/static/schema.json
+# Stripped-down GoReleaser config for PR snapshot builds.
+# Produces cross-compiled archives named like releases but versioned with the commit SHA.
+version: 2
+
+before:
+  hooks:
+    - go mod tidy
+    - go generate ./...
+    - go run scripts/completions.go
+builds:
+  - env:
+      - CGO_ENABLED=0
+    goos:
+      - linux
+      - windows
+      - darwin
+    ldflags:
+      - "-s -w -X main.version={{.Version}} -X main.commit={{.Commit}} -X main.date={{.Date}} -X main.builtBy=goreleaser -X main.artifactArch={{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
+archives:
+  - name_template: "{{ .ProjectName }}_{{ .Os }}_{{ .Arch }}{{ if .Arm }}v{{ .Arm }}{{ end }}"
+    formats: [zip]
+    files:
+      - completions/*
+checksum:
+  name_template: "checksums.txt"
+snapshot:
+  version_template: "0.0.0-{{ .ShortCommit }}"