ci(maestro): bump WalletConnect/actions for redesigned /collect IC form

[ignaciosantise]

Bump WalletConnect/actions maestro refs for the redesigned /collect IC form

WalletConnect/buyer-experience PR #914 redesigns the hosted KYC webview (the /collect route the sample wallet opens in a WebView). The native Maestro pay flows drive that webview by visible text, so they were updated in WalletConnect/actions#106 (submit is now "Confirm", the "Confirm your details" dialog is gone, and consent is an inline "I agree" checkbox). The verified KYC sequence is: scroll to "I agree" → tap it → scroll to "Confirm" → tap it.

This PR pins every WalletConnect/actions/maestro/* ref (pay-tests / setup / permit2-reset) to the merged-master SHA that contains those flow changes.

• Pinned SHA: ddc7c0f9acd8b1576e9a78f0ef67f4b8fbb36db2 (squash-merge of fix(maestro/pay-tests): adapt KYC flows to redesigned /collect inline IC form WalletConnect/actions#106, now master tip).

✅ Ready to merge — remaining requirement

• fix(maestro/pay-tests): adapt KYC flows to redesigned /collect inline IC form WalletConnect/actions#106 is merged to master. ✔
• buyer-experience #914 must be deployed to the env this wallet's /collect webview loads (prod/staging) before the pay-tagged Maestro runs will pass — the flows now expect the redesigned form.

Validation

Android Maestro pay runs were dispatched on this branch against the merged action and exercised the new KYC flow (scroll + tap "I agree", scroll + tap "Confirm").

🤖 Generated with Claude Code

[claude]

Claude finished @ignaciosantise's task in 1m 8s —— View job

---

Review Complete

• Gather context
• Read changed files
• Run breaking changes subagent
• Run data classification subagent
• Post review findings

---

✅ No issues found

Summary: All 6 changed lines are SHA pin bumps for WalletConnect/actions composite actions (maestro/pay-tests, maestro/setup, maestro/permit2-reset) across the Android and iOS jobs. SHAs are pinned by full commit hash (good practice). No pull_request_target, no data classification issues, no breaking changes.

One observation worth noting: prior to this PR, maestro/setup was pinned to a different SHA (0730e32) than pay-tests/permit2-reset (3fd66ca). This PR aligns all three to the same provisional SHA — that alignment is correct and the previous divergence was likely an earlier unintentional drift.

The provisional SHA concern (a6436df is a branch tip, not a merged-master commit) is already well-documented in both the PR description and inline comments. Merge sequencing requirements are clearly spelled out.

[claude]

Claude finished @ignaciosantise's task in 2m 31s —— View job

---

🔄 Incremental Review:

• Gather context
• Read changed file
• Run breaking changes subagent
• Run data classification subagent
• Post review findings

---

✅ No new issues in the SHA-pinned lines themselves. One pre-existing issue surfaced in the iOS job (not introduced by this PR).

Found 1 issue(s)

Issue 1: iOS Maestro step passes WPAY secrets as inline CLI arguments

ID: dcl-ci_e2e_pay_tests-secrets-cli-args-a4f2
File: .github/workflows/ci_e2e_pay_tests.yml:401
Severity: MEDIUM
Category: security / data_classification

Context:

• Pattern: The iOS Run Maestro iOS tests step (lines 394–409) expands six ${{ secrets.WPAY_* }} expressions directly into the maestro CLI argument string. The Android job (lines 127–153) does this correctly — secrets are in the step env: block and passed as shell variables.
• Risk: GitHub Actions expands ${{ secrets.* }} before the shell starts, placing literal secret values in the process command-line string visible via /proc/<pid>/cmdline. Any process in the same job — including the composite WalletConnect/actions/maestro/* steps — can enumerate running processes and read those values.
• Impact: WPAY customer/merchant API keys exposed to a compromised or supply-chain-attacked composite action running in the same job.
• Trigger: Any step in the iOS job that calls ps or reads /proc after the maestro process starts.

Recommendation: Mirror the Android pattern — declare secrets in env:, reference as shell vars:

- name: Run Maestro iOS tests
  id: maestro_ios
  env:
    WPAY_CUSTOMER_KEY_SINGLE_NOKYC: ${{ secrets.WPAY_CUSTOMER_KEY_SINGLE_NOKYC }}
    WPAY_MERCHANT_ID_SINGLE_NOKYC: ${{ secrets.WPAY_MERCHANT_ID_SINGLE_NOKYC }}
    WPAY_CUSTOMER_KEY_MULTI_NOKYC: ${{ secrets.WPAY_CUSTOMER_KEY_MULTI_NOKYC }}
    WPAY_MERCHANT_ID_MULTI_NOKYC: ${{ secrets.WPAY_MERCHANT_ID_MULTI_NOKYC }}
    WPAY_CUSTOMER_KEY_MULTI_KYC: ${{ secrets.WPAY_CUSTOMER_KEY_MULTI_KYC }}
    WPAY_MERCHANT_ID_MULTI_KYC: ${{ secrets.WPAY_MERCHANT_ID_MULTI_KYC }}
  run: |
    maestro test \
      --env APP_ID=com.walletconnect.flutterwallet.internal \
      --env WPAY_CUSTOMER_KEY_SINGLE_NOKYC=$WPAY_CUSTOMER_KEY_SINGLE_NOKYC \
      --env WPAY_MERCHANT_ID_SINGLE_NOKYC=$WPAY_MERCHANT_ID_SINGLE_NOKYC \
      --env WPAY_CUSTOMER_KEY_MULTI_NOKYC=$WPAY_CUSTOMER_KEY_MULTI_NOKYC \
      --env WPAY_MERCHANT_ID_MULTI_NOKYC=$WPAY_MERCHANT_ID_MULTI_NOKYC \
      --env WPAY_CUSTOMER_KEY_MULTI_KYC=$WPAY_CUSTOMER_KEY_MULTI_KYC \
      --env WPAY_MERCHANT_ID_MULTI_KYC=$WPAY_MERCHANT_ID_MULTI_KYC \
      --include-tags pay \
      --test-output-dir /tmp/maestro-output \
      .maestro/

Fix this →

[Copilot]

Pull request overview

This PR updates the E2E Pay CI workflow to pin all WalletConnect/actions Maestro action usages (pay test flow sync, CLI setup, and Permit2 reset) to a newer commit SHA that includes the updated Maestro flows for the redesigned /collect KYC webview.

Changes:

• Bumped WalletConnect/actions/maestro/pay-tests to ddc7c0f9acd8b1576e9a78f0ef67f4b8fbb36db2.
• Bumped WalletConnect/actions/maestro/setup to ddc7c0f9acd8b1576e9a78f0ef67f4b8fbb36db2.
• Bumped WalletConnect/actions/maestro/permit2-reset to ddc7c0f9acd8b1576e9a78f0ef67f4b8fbb36db2.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.