feat(e2e): add apps-e2e shared workflow + composite actions - #43

Open

MaximusHaximus wants to merge 1 commit into

mainfrom

feat/apps-e2e-shared-workflow

GitHub Advanced Security / CodeQL succeeded Jun 3, 2026 in 3s

4 new alerts including 4 medium severity security vulnerabilities

New alerts in code changed by this pull request

Security Alerts:

4 medium

See annotations below for details.

View all branch alerts.

Annotations

Check warning on line 88 in .github/actions/e2e-snapshot-restore/action.yml

Code scanning / CodeQL

Environment variable built from user-controlled sources Medium

Potential environment variable injection in [# The consuming repo's e2e suite reads this env var to switch from the kurtosis CLI path to the sidecar JSON path. Writing to GITHUB_ENV propagates it to every subsequent step in the calling job without the consumer having to know the magic name. echo "E2E_SNAPSHOT_ADDRESSES_JSON=${ADDRS_PATH}" >> "$GITHUB_ENV"](1), which may be controlled by an external user.

Check warning on line 149 in .github/workflows/apps-e2e.yml

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow or composite action Medium

Unpinned 3rd party Action 'E2E (kurtosis devnet)' step

uses '0xPolygon/pipelines/.github/actions/e2e-snapshot-restore' with ref 'main', not a pinned commit hash

Check warning on line 161 in .github/workflows/apps-e2e.yml

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow or composite action Medium

Unpinned 3rd party Action 'E2E (kurtosis devnet)' step

uses '0xPolygon/pipelines/.github/actions/e2e-cold-start' with ref 'main', not a pinned commit hash

Check warning on line 176 in .github/workflows/apps-e2e.yml

Code scanning / CodeQL

Unpinned tag for a non-immutable Action in workflow or composite action Medium

Unpinned 3rd party Action 'E2E (kurtosis devnet)' step

uses '0xPolygon/pipelines/.github/actions/e2e-dump' with ref 'main', not a pinned commit hash