CI: Harden security and tweak performance

This improves CI/CD pipeline for better security, resource efficiency,
and reliability.
- Add minimal GitHub token permissions (contents:read, actions:read)
- Add concurrency control to cancel redundant workflow runs
- Add job-level and step-level timeouts across all workflows

Performance Optimizations:
- Add APT package caching for Linux runners
- Add RISC-V toolchain caching with platform-specific keys
- Add build artifacts caching (softfloat, mini-gdbstub, build/)
- Enable recursive submodule checkout for dependency caching
- Use -q flag for wget to reduce noise

Timeout breakdown:
- Checkout: 2 minutes
- Cache operations: 2 minutes
- Dependency installation: 10-15 minutes
- Build tests: 10-30 minutes (depending on complexity)
- System tests: 15 minutes
- Full jobs: 60-180 minutes

Author: jserv

.github/workflows/build-linux-artifacts.yml

@@ -47,10 +47,8 @@ jobs:
         with:
           submodules: 'true'
       - name: Install dependencies
-        run: |
-          sudo apt-get update -q=2
-          sudo apt-get upgrade -q=2
-          sudo apt-get install -q=2 build-essential git
+        uses: ./.github/actions/setup-rv32emu
+        timeout-minutes: 30
       - name: Build Linux image
         run: |
           make build-linux-image

.github/workflows/deploy-wasm.yml

@@ -21,10 +21,9 @@ jobs:
     steps:
       - name: Check out the repo
         uses: actions/checkout@v4
-      - name: install-dependencies
-        run: |
-              sudo apt-get update -q=2
-              sudo apt-get install -q=2 device-tree-compiler
+      - name: Install dependencies
+        uses: ./.github/actions/setup-rv32emu
+        timeout-minutes: 30
       - name: Verify if the JS or HTML files has been modified
         id: changed-files
         uses: tj-actions/changed-files@v46
@@ -57,7 +56,7 @@ jobs:
         run: |
               make artifact
               # get from rv32emu-prebuilt
-              wget -O build/shareware_doom_iwad.zip "https://raw.githubusercontent.com/sysprog21/rv32emu-prebuilt/doom-artifact/shareware_doom_iwad.zip"
+              curl -fSsL -o build/shareware_doom_iwad.zip "https://raw.githubusercontent.com/sysprog21/rv32emu-prebuilt/doom-artifact/shareware_doom_iwad.zip"
               unzip -d build/ build/shareware_doom_iwad.zip
       - name: build with emcc and move application files to /tmp
         if: ${{ steps.changed-files.outputs.any_modified == 'true' ||
@@ -152,7 +151,7 @@ jobs:
         run: |
               make artifact
               # get from rv32emu-prebuilt
-              wget -O build/shareware_doom_iwad.zip "https://raw.githubusercontent.com/sysprog21/rv32emu-prebuilt/doom-artifact/shareware_doom_iwad.zip"
+              curl -fSsL -o build/shareware_doom_iwad.zip "https://raw.githubusercontent.com/sysprog21/rv32emu-prebuilt/doom-artifact/shareware_doom_iwad.zip"
               unzip -d build/ build/shareware_doom_iwad.zip
       - name: build with emcc and move application files to /tmp
         if: ${{ steps.changed-files.outputs.any_modified == 'true' ||