Use standardized workflows

.github/workflows/ci.yaml

@@ -10,26 +10,5 @@ on:
 
 jobs:
   build:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os:
-          - macos-13
-          - macos-14
-          - ubuntu-22.04
-          - windows-2022
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.work
-          cache-dependency-path: "**/go.sum"
-
-      - name: run checks
-        run: go run ./build check
-
-      - name: build snapshot
-        if: startsWith(matrix.os, 'ubuntu-')
-        run: go run ./build snapshot
+    uses: wasilibs/actions/.github/workflows/ci.yaml@eeee5d072ee283c12eb68e2c4969012fae3d6dd0
+    secrets: inherit

.github/workflows/release.yaml

@@ -5,18 +5,12 @@ on:
     tags:
       - v*
 
-jobs:
-  build:
-    name: Release
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version-file: go.work
-          cache-dependency-path: "**/go.sum"
+permissions:
+  id-token: write
+  attestations: write
+  contents: write
 
-      - run: go run ./build release
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+jobs:
+  release:
+    uses: wasilibs/actions/.github/workflows/release.yaml@eeee5d072ee283c12eb68e2c4969012fae3d6dd0
+    secrets: inherit

.github/workflows/update.yaml

@@ -0,0 +1,15 @@
+name: "Update Upstream"
+
+on:
+  schedule:
+    - cron: "5 4 * * *"
+  workflow_dispatch:
+
+permissions:
+  id-token: write
+  attestations: write
+
+jobs:
+  build:
+    uses: wasilibs/actions/.github/workflows/update.yaml@eeee5d072ee283c12eb68e2c4969012fae3d6dd0
+    secrets: inherit