feat: harden Miranda for v0.7.0 release candidate

.github/workflows/release.yml

@@ -11,21 +11,33 @@ jobs:
   goreleaser:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0 # full history for changelog
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           # Pin an exact floor, not "1.26.x": go.mod's toolchain directive pins
-          # go1.26.4 for the stdlib CVE fixes, and the wildcard guarantees no
+          # go1.26.5 for the stdlib CVE fixes, and the wildcard guarantees no
           # minimum version (setup-go could resolve an older patch).
-          go-version: "1.26.4"
+          go-version: "1.26.5"
           cache-dependency-path: go/go.sum # module lives in go/, not repo root
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: web/package-lock.json
+      - name: release gate
+        run: |
+          cd go && go test ./...
+          go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
+          cd ../web && npm ci && npm test
+          npm audit --omit=dev
+          cd .. && ./scripts/verify-reproducible.sh
       # cosign must be on PATH before goreleaser: the `signs:` block shells out to
       # it to keyless-sign checksums.txt. No key material is configured — signing
       # uses the job's OIDC identity (hence id-token: write above).
-      - uses: sigstore/cosign-installer@v3
-      - uses: goreleaser/goreleaser-action@v7
+      - uses: sigstore/cosign-installer@f713795cb21599bc4e5c4b58cbad1da852d7eeb9 # v3
+      - uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7
         with:
           version: "~> v2"
           args: release --clean

.github/workflows/test.yml

@@ -11,11 +11,11 @@ jobs:
   go:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           # Match release.yml: exact floor pinned for the stdlib CVE fixes.
-          go-version: "1.26.4"
+          go-version: "1.26.5"
           cache-dependency-path: go/go.sum # module lives in go/, not repo root
       - name: gofmt
         run: |
@@ -24,15 +24,29 @@ jobs:
       - name: vet
         working-directory: go
         run: go vet ./...
+      - name: vulnerability scan
+        working-directory: go
+        run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
       - name: test
         working-directory: go
         run: go test ./...
+      - name: race
+        working-directory: go
+        run: go test -race -count=1 ./...
+      - name: parser fuzz smoke
+        working-directory: go
+        run: |
+          go test ./internal/pairing -run=^$ -fuzz=FuzzDecodeCode -fuzztime=5s
+          go test ./internal/signal -run=^$ -fuzz=FuzzDecodeInboundSignal -fuzztime=5s
+          go test ./internal/identity -run=^$ -fuzz=FuzzRevocationJSON -fuzztime=5s
+      - name: reproducible binaries
+        run: ./scripts/verify-reproducible.sh
 
   web:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "24"
           cache: npm
@@ -41,6 +55,8 @@ jobs:
         run: npm ci
       - working-directory: web
         run: npm test
+      - working-directory: web
+        run: npm audit --omit=dev
 
   # The Go and web jobs together are the byte-identical crypto gate: go test
   # writes/asserts testdata/ vectors and npm test asserts the JS side matches the

.goreleaser.yaml

@@ -17,35 +17,41 @@ builds:
     env: [CGO_ENABLED=0]
     goos: [linux, darwin]
     goarch: [amd64, arm64]
+    flags: [-trimpath, -buildvcs=false]
+    mod_timestamp: "{{ .CommitTimestamp }}"
     ldflags:
-      - -s -w
+      - -s -w -buildid=
       - -X github.com/srcful/terminal-relay/go/internal/version.Version={{ .Version }}
       - -X github.com/srcful/terminal-relay/go/internal/version.Commit={{ .ShortCommit }}
-      - -X github.com/srcful/terminal-relay/go/internal/version.Date={{ .Date }}
+      - -X github.com/srcful/terminal-relay/go/internal/version.Date={{ .CommitDate }}
   - id: mir-agent
     main: ./cmd/mir-agent
     binary: mir-agent
     dir: go
     env: [CGO_ENABLED=0]
     goos: [linux, darwin]
     goarch: [amd64, arm64]
+    flags: [-trimpath, -buildvcs=false]
+    mod_timestamp: "{{ .CommitTimestamp }}"
     ldflags:
-      - -s -w
+      - -s -w -buildid=
       - -X github.com/srcful/terminal-relay/go/internal/version.Version={{ .Version }}
       - -X github.com/srcful/terminal-relay/go/internal/version.Commit={{ .ShortCommit }}
-      - -X github.com/srcful/terminal-relay/go/internal/version.Date={{ .Date }}
+      - -X github.com/srcful/terminal-relay/go/internal/version.Date={{ .CommitDate }}
   - id: mir-signal
     main: ./cmd/mir-signal
     binary: mir-signal
     dir: go
     env: [CGO_ENABLED=0]
     goos: [linux, darwin]
     goarch: [amd64, arm64]
+    flags: [-trimpath, -buildvcs=false]
+    mod_timestamp: "{{ .CommitTimestamp }}"
     ldflags:
-      - -s -w
+      - -s -w -buildid=
       - -X github.com/srcful/terminal-relay/go/internal/version.Version={{ .Version }}
       - -X github.com/srcful/terminal-relay/go/internal/version.Commit={{ .ShortCommit }}
-      - -X github.com/srcful/terminal-relay/go/internal/version.Date={{ .Date }}
+      - -X github.com/srcful/terminal-relay/go/internal/version.Date={{ .CommitDate }}
 
 archives:
   # One archive entry PER build id. A single entry covering multiple builds would

Makefile

@@ -1,8 +1,8 @@
-# terminal-relay — local dev
+# Miranda — local development
 
 PREFIX ?= $(HOME)/.local/bin
 
-.PHONY: build test race install dev
+.PHONY: build test race reproduce install dev
 
 build:
 	cd go && go build -o ../bin/mir-signal ./cmd/mir-signal
@@ -15,6 +15,9 @@ test:
 race:
 	cd go && go test -race -count=1 ./...
 
+reproduce:
+	./scripts/verify-reproducible.sh
+
 # install the CLIs onto your PATH (default ~/.local/bin; override with PREFIX=...)
 install: build
 	mkdir -p "$(PREFIX)"