ci(release): add SLSA L3 + cosign release workflow, fix README badges

[kanywst]

Summary

• Adds .github/workflows/release.yml. Pushing a v* tag now produces a signed, attested wasm release artifact with SLSA v1.0 build provenance, a SHA-256 checksum, and a Sigstore cosign keyless signature.
• Fixes the CI and OpenSSF Scorecard badges in README, which were still pointing at github.com/kanywst/zopa from before the repo moved to the 0-draft org. They were silently 404-ing on the rendered README.
• Records the pipeline under the Unreleased section in CHANGELOG.

Pipeline shape

```
v* tag
│
├─ build → zopa-.wasm + .sha256
├─ provenance → slsa-github-generator (reusable, isolated builder)
│ attaches zopa-.wasm.intoto.jsonl
├─ sign → cosign sign-blob (keyless, OIDC)
│ attaches zopa-.wasm.sigstore.json
└─ release → softprops/action-gh-release attaches .wasm + .sha256
and writes auto-generated release notes
```

After a release, consumers can verify with:

```bash

checksum

shasum -a 256 -c zopa-vX.Y.Z.wasm.sha256

cosign verify (keyless, identity = this workflow)

cosign verify-blob
--bundle zopa-vX.Y.Z.wasm.sigstore.json
--certificate-identity-regexp "^https://github.com/0-draft/zopa/.github/workflows/release.yml@"
--certificate-oidc-issuer "https://token.actions.githubusercontent.com"
zopa-vX.Y.Z.wasm

slsa-verifier

slsa-verifier verify-artifact
--provenance-path zopa-vX.Y.Z.wasm.intoto.jsonl
--source-uri github.com/0-draft/zopa
--source-tag vX.Y.Z
zopa-vX.Y.Z.wasm
```

Notes / decisions

• All actions are SHA-pinned except slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v2.1.0, which must be tag-pinned per upstream's binary-fetch convention. The same exception is taken in 0-draft/sigil; the check-pins.sh / pin-actions.sh helpers there skip this path. The reasoning is left as an inline comment in the workflow.
• No long-lived secrets. All credentials (Sigstore Fulcio cert, SLSA OIDC token, GitHub Release write) are minted via OIDC per run.
• --release=small matches what CI already builds, so the artifact size stays at the documented ~50 KB.
• The artifact name is zopa-<tag>.wasm rather than bare zopa.wasm so the file name carries the version when downloaded outside the Release page.
• Followed the sigil release.yml shape: harden-runner egress audit, persist-credentials: false, and the cosign v4 single-bundle output (--bundle) instead of the deprecated --output-signature / --output-certificate pair.

Test plan

• CI passes on this PR (this workflow only fires on tag push, so no run yet)
• After merge, push a throwaway tag (e.g. `v0.0.1-rc1`) and confirm the four-stage pipeline succeeds
• Verify the resulting release page contains: `zopa-v0.0.1-rc1.wasm`, `.sha256`, `.sigstore.json`, `.intoto.jsonl`
• Run `cosign verify-blob` and `slsa-verifier verify-artifact` against the published artifacts
• Visually confirm the README badges (CI, Scorecard) render in green on the rendered README

[coderabbitai]

Warning

Rate limit exceeded

@kanywst has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 6 minutes and 19 seconds before requesting another review.

To continue reviewing without waiting, purchase usage credits in the billing tab.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 84ae8218-d5fe-4722-a9a1-3c5fc43c70ab

📥 Commits

Reviewing files that changed from the base of the PR and between cf3cf8e and f78b161.

📒 Files selected for processing (3)

• .github/workflows/release.yml
• CHANGELOG.md
• README.md

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/release-workflow

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}