ci(maestro): pin actions#105 SHA + fix web Metro cache env poisoning

[ignaciosantise]

Summary

Two changes to .github/actions/walletkit-build-and-maestro/action.yml, bundled so downstream repos can test both against a single branch/SHA.

1. Pin maestro actions to the merged WalletConnect/actions#105 SHA

d291974 → 4cec02a4c535c254581471df287099a26d5eeffb (the squash-merge commit of WalletConnect/actions#105 on master) for:

• WalletConnect/actions/maestro/pay-tests
• WalletConnect/actions/maestro/setup
• WalletConnect/actions/maestro/permit2-reset

#105 added the web-only pay flows (in-app IC form) and the pay-onchain tags the web leg's parallel/serial split relies on.

2. Fix web Metro cache env poisoning

The web Cache Metro web build cache step warms node_modules/.cache (Expo/Metro's transform FileStore). Expo inlines EXPO_PUBLIC_* into the bundle at Babel transform time, and Metro's transform cache is not keyed on env values.

Callers that inject per-run ephemeral credentials — e.g. a downstream repo rotating EXPO_PUBLIC_TEST_PRIVATE_KEY (and thus the wallet address) every run — restored a cache built with a different .env and shipped the previous run's address baked into the exported bundle, so Maestro ran against the wrong account.

Fix:

• Hash the written .env into the cache key (alongside yarn.lock).
• Remove restore-keys — the <os>-web-metro- prefix fallback matched any older cache regardless of .env, so an exact-key miss still re-poisoned from a stale entry. Exact-match-only is what makes it safe.

Effect:

• Per-run-creds callers: .env differs every run → key always misses → cold build → correct address inlined.
• Stable-creds callers (this repo's E2E CI): .env identical across runs → exact key hit → full transform-cache speedup preserved.

Follow-up to #555 (Expo web leg).

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
deposit-app-demo	Error		Jul 1, 2026 7:40pm
pos-demo	Ready	Preview, Comment	Jul 1, 2026 7:40pm

[claude]

Claude finished @ignaciosantise's task in 58s —— View job

---

Review

• Gather context & read changed files
• Run breaking changes subagent
• Run data classification subagent
• Compile and post review

---

✅ No issues found

SHA bump of 3 composite action refs (pay-tests, setup, permit2-reset) from d291974 → 30fd5666325425f3a01e596e882625c7e96df540, plus the matching inline comment update. No contract surface changed (inputs, outputs, step IDs, env var names). Both breaking-change and data-classification checks returned clean.

⚠️ As noted in the PR description: this is pinned to a branch SHA on an open WalletConnect/actions#105. Remember to re-pin to the squash-merge SHA once #105 lands on main.

[Copilot]

Pull request overview

Updates the shared walletkit-build-and-maestro composite CI action to (1) pin Maestro-related WalletConnect actions to the merged SHA of WalletConnect/actions#105 and (2) prevent Expo web/Metro transform-cache reuse across differing .env values that would otherwise inline stale EXPO_PUBLIC_* values into the exported bundle.

Changes:

• Pin WalletConnect/actions/maestro/* usages to the squash-merge commit 4cec02a4c535c254581471df287099a26d5eeffb.
• Make the Metro web cache key include a hash of the written .env (alongside yarn.lock) to avoid env-induced cache poisoning.
• Remove restore-keys for the web Metro cache to prevent unsafe prefix-fallback restores across differing .env contents.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.