feat: Harden CI/CD pipeline and fix release process

This commit hardens the CI/CD pipeline and fixes the release process.

- Replaces the manual release process with `goreleaser` to streamline builds and enable artifact signing.
- Pins all GitHub Actions to specific commit hashes to prevent supply chain attacks.
- Enables cryptographic signing of release artifacts using `cosign` and Sigstore's keyless signing.
- Adds a Dependabot configuration to automate dependency updates.
- Removes excessive `contents: write` permissions from workflows.
- Creates an `AUDIT-CICD.md` file to document the audit findings and remediation steps.
- Fixes a build failure by adding a placeholder for a missing demo file.
- Updates the `.goreleaser.yaml` to include WASM and console assets in the release, fixing a regression from the previous release process.

.github/workflows/go.yml

@@ -15,7 +15,7 @@ jobs:
     - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b # v4.1.5
 
     - name: Set up Go
-      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb4ccbf938fde # v5.0.0
+      uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
       with:
         go-version-file: 'go.mod'
 

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb4ccbf938fde # v5.0.0
+        uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version-file: 'go.mod'
 

.goreleaser.yaml

@@ -9,6 +9,12 @@ dist: dist
 before:
   hooks:
     - go mod tidy
+    # Build WASM and console assets before the release build
+    - mkdir -p dist
+    - GOOS=js GOARCH=wasm go build -o dist/stmf.wasm ./pkg/wasm/stmf/
+    - cp "$(go env GOROOT)/misc/wasm/wasm_exec.js" dist/ 2>/dev/null || cp "$(go env GOROOT)/lib/wasm/wasm_exec.js" dist/
+    - go build -o borg main.go
+    - ./borg console build -p "borg-demo" -o dist/console.stim -s js/borg-stmf
 
 builds:
   - id: borg
@@ -73,6 +79,10 @@ release:
   # By default goreleaser creates GitHub releases from tags.
   prerelease: auto
   mode: replace
+  extra_files:
+    - glob: 'dist/stmf.wasm'
+    - glob: 'dist/wasm_exec.js'
+    - glob: 'dist/console.stim'
 
 brews:
   - name: borg