[CI/CD] Create Comprehensive GitHub Actions Workflow for Testing, Coverage, and Release

[KarenZita01]

Description

The validate-ci.sh (2.5KB) and validate-ci.ps1 (3.9KB) scripts provide CI validation, but there is no dedicated .github/workflows/ci.yml or .github/workflows/test.yml workflow file. The sanity_check.sh (5.3KB) script performs sanity checks but isn't automated in CI. The tarpaulin.toml (418 bytes) configures code coverage but coverage reporting is not enforced as a PR gate.

CI gaps:

• No GitHub Actions workflow for automated testing on PRs
• No code coverage enforcement in CI
• No WASM build verification step
• No lint/clippy check in CI
• No fuzz test automation
• No contract size regression check
• No vulnerability scanning (cargo-audit)
• No multi-platform build matrix (Linux, macOS, Windows)

Technical Context & Impact

• Affected Components/Files: .github/workflows/ (missing), validate-ci.sh, validate-ci.ps1, sanity_check.sh, tarpaulin.toml
• Impact: Development Workflow, Code Quality, Regression Prevention

Step-by-Step Implementation Guide

1. Create .github/workflows/ci.yml with jobs:
   • test: cargo test --all-packages on ubuntu-latest, macOS-latest
   • lint: cargo clippy --all-targets -- -D warnings
   • coverage: cargo tarpaulin --out Xml --fail-under 70
   • wasm-build: cargo build --target wasm32-unknown-unknown --release
   • security-audit: cargo audit
   • contract-size: Check WASM filesize < 200KB
2. Add PR gate: All CI jobs must pass; coverage diff annotated on PRs
3. Create .github/workflows/fuzz.yml: Run cargo fuzz run fuzz_target_1 -- -max_total_time=300 nightly
4. Add .github/workflows/release.yml: Build, sign, and deploy WASM artifacts on tag push
5. Integrate sanity_check.sh: Convert key checks into CI test steps
6. Add .github/dependabot.yml for automated dependency updates
7. Create .github/CODEOWNERS for automatic PR reviewer assignment

Verification & Testing Steps

1. Push CI workflow to a branch and verify GitHub Actions runs successfully
2. Force a test failure and verify PR is blocked
3. Check coverage report is generated and exceeds threshold
4. Verify WASM build produces valid .wasm file under size limit
5. Test fuzz workflow on schedule trigger
6. Verify dependabot creates PRs for dependency updates