chore: production-ready CI/CD

Apply the production-ready CI/CD plan:
- Phase 1: cross-cutting workflow fixes (action version pins,
  book-build path fix, video-build dynamic version + guards,
  permissions+concurrency blocks)
- Phase 2: per-repo CI hardening (drop continue-on-error,
  add OS/compiler matrices, fix repo-specific bugs)
- Phase 3: complete release matrix (Linux/Windows/macOS/embedded
  binaries, real CycloneDX + SPDX SBOMs via anchore/sbom-action,
  cosign keyless signing, conditional Apple notarization /
  Authenticode / GPG signing gated on secrets)

All workflow files pass actionlint clean.

Author: srpatcha

.github/workflows/book-build.yml

@@ -42,20 +42,20 @@ jobs:
       - name: Check book source
         id: check
         run: |
-          if [ ! -f book.md ]; then
+          if [ ! -f docs/book/book.md ]; then
             echo "has_book=false" >> $GITHUB_OUTPUT
             echo "lines=0" >> $GITHUB_OUTPUT
             echo "images=0" >> $GITHUB_OUTPUT
             echo "tables=0" >> $GITHUB_OUTPUT
-            echo "WARNING: book.md not found"
+            echo "WARNING: docs/book/book.md not found"
             exit 0
           fi
           echo "has_book=true" >> $GITHUB_OUTPUT
-          LINES=$(wc -l < book.md)
-          IMAGES=$(grep -c '!\[' book.md || echo 0)
-          TABLES=$(grep -c '^|' book.md || echo 0)
-          CODE=$(grep -c '```' book.md || echo 0)
-          CHAPTERS=$(grep -c '^## ' book.md || echo 0)
+          LINES=$(wc -l < docs/book/book.md)
+          IMAGES=$(grep -c '!\[' docs/book/book.md || echo 0)
+          TABLES=$(grep -c '^|' docs/book/book.md || echo 0)
+          CODE=$(grep -c '```' docs/book/book.md || echo 0)
+          CHAPTERS=$(grep -c '^## ' docs/book/book.md || echo 0)
           echo "lines=$LINES" >> $GITHUB_OUTPUT
           echo "images=$IMAGES" >> $GITHUB_OUTPUT
           echo "tables=$TABLES" >> $GITHUB_OUTPUT
@@ -104,7 +104,7 @@ jobs:
 
       - name: Clean source
         run: |
-          sed -i 's/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]//g' book.md
+          sed -i 's/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]//g' docs/book/book.md
           echo "Control characters cleaned"
 
       - name: Extract metadata
@@ -114,9 +114,9 @@ jobs:
           echo "repo_name=$REPO_NAME" >> $GITHUB_OUTPUT
           echo "pdf_name=${REPO_NAME}-guide.pdf" >> $GITHUB_OUTPUT
           # Extract title from frontmatter or first heading
-          TITLE=$(grep -m1 '^title:' book.md | sed 's/^title: *"*//;s/"*$//' || echo "")
+          TITLE=$(grep -m1 '^title:' docs/book/book.md | sed 's/^title: *"*//;s/"*$//' || echo "")
           if [ -z "$TITLE" ]; then
-            TITLE=$(head -10 book.md | grep "^# " | head -1 | sed 's/^# //')
+            TITLE=$(head -10 docs/book/book.md | grep "^# " | head -1 | sed 's/^# //')
           fi
           if [ -z "$TITLE" ]; then TITLE="$REPO_NAME — Official Guide"; fi
           echo "title=$TITLE" >> $GITHUB_OUTPUT

.github/workflows/build.yml

@@ -6,6 +6,13 @@ on:
   pull_request:
     branches: [master, main]
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   test-host:
     name: Host Build & Tests

.github/workflows/ci.yml

@@ -13,11 +13,13 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build (${{ matrix.os }})
     runs-on: ${{ matrix.os }}
-    continue-on-error: true
     strategy:
       fail-fast: false
       matrix:
@@ -27,15 +29,13 @@ jobs:
       - name: Configure
         run: cmake -B build -DEBLDR_BUILD_TESTS=ON
       - name: Build
-        run: cmake --build build --config Release
+        run: cmake --build build --config Release --parallel
       - name: Test
-        if: runner.os == 'Linux'
         run: ctest --test-dir build --output-on-failure -C Release
 
   cross-compile:
     name: Cross (${{ matrix.board }})
     runs-on: ubuntu-latest
-    continue-on-error: true
     strategy:
       fail-fast: false
       matrix:
@@ -57,7 +57,7 @@ jobs:
       - name: Install cross-compiler
         run: |
           sudo apt-get update
-          sudo apt-get install -y ${{ matrix.pkg }} || true
+          sudo apt-get install -y ${{ matrix.pkg }}
       - name: Cross-compile
         run: |
           if [ -f "${{ matrix.toolchain }}" ]; then
@@ -67,30 +67,28 @@ jobs:
             cmake -B build -DEBLDR_BOARD=${{ matrix.board }} \
               -DCMAKE_SYSTEM_NAME=Linux
           fi
-          cmake --build build || true
+          cmake --build build --parallel
 
   sanitize:
     name: Sanitizers
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
       - name: Build with sanitizers
         run: |
           cmake -B build \
             -DEBLDR_BUILD_TESTS=ON \
             -DEBLDR_SANITIZE=ON
-          cmake --build build
+          cmake --build build --parallel
       - name: Run tests under sanitizers
-        run: ctest --test-dir build --output-on-failure
         env:
           ASAN_OPTIONS: detect_leaks=1:halt_on_error=1
           UBSAN_OPTIONS: halt_on_error=1
+        run: ctest --test-dir build --output-on-failure
 
   security-hardening:
     name: Security Hardening Build
     runs-on: ubuntu-latest
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
       - name: Build with all security options
@@ -101,6 +99,6 @@ jobs:
             -DEBLDR_REQUIRE_SIGNATURES=ON \
             -DEBLDR_RECOVERY_AUTH=ON \
             -DEBLDR_VERIFY_STAGE1=ON
-          cmake --build build
+          cmake --build build --parallel
       - name: Run tests
-        run: ctest --test-dir build --output-on-failure
+        run: ctest --test-dir build --output-on-failure

.github/workflows/cross-repo-dispatch.yml

@@ -4,6 +4,9 @@ on:
   push:
     branches: [master]
 
+permissions:
+  contents: read
+
 jobs:
   notify-dependents:
     name: Trigger dependent repos

.github/workflows/eosim-sanity.yml

@@ -8,6 +8,13 @@ on:
 env:
   EOSIM_VERSION: "0.1.0"
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   install-validate:
     name: Install & Validate (${{ matrix.os }}, Python ${{ matrix.python-version }})

.github/workflows/nightly.yml

@@ -5,6 +5,13 @@ on:
     - cron: "0 2 * * *"  # 2:00 AM UTC daily
   workflow_dispatch:       # Manual trigger
 
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   native-build:
     name: Native (${{ matrix.os }})