ci(e2e-pay): point maestro actions to latest merged SHA

[ignaciosantise]

Summary

Points the WalletConnect Pay Maestro E2E actions to the latest merged SHA d385e7a80fb4a3d378ee685021f3f7e24ccdf291 from WalletConnect/actions.

Changes

• .github/workflows/ci_e2e_pay_tests.yml — bump maestro/pay-tests, maestro/setup, and maestro/permit2-reset to the new SHA (Android + iOS lanes).
• scripts/setup-maestro-pay-tests.sh — bump the default pinned REF.

Left claude/auto-review@master untouched (not a maestro action).

🤖 Generated with Claude Code

[claude]

Claude finished @ignaciosantise's task in 2m 30s —— View job

---

Review Complete

• Read changed files
• Run breaking changes subagent
• Run data classification subagent
• Post review findings

---

🔄 Full Review — SHA bump only; no logic changes in this PR.

Breaking changes: None found.

Found 2 issue(s) — pre-existing, not introduced by this PR

Issue 1: iOS job interpolates payment secrets directly into CLI args

ID: dcl-ci-e2e-pay-ios-cli-secret-args-f3a1
File: .github/workflows/ci_e2e_pay_tests.yml:390
Severity: LOW
Category: security / data_classification

Context:

• Pattern: The Run Maestro iOS tests step (lines 383–398) interpolates ${{ secrets.WPAY_* }} directly into maestro --env CLI arguments. The Android job (lines 129–134) correctly hoists the same secrets into an env: block and references them as shell variables.
• Risk: CLI arguments are readable via /proc/<pid>/cmdline; env vars are not exposed that way.
• Impact: During maestro test execution another process on the runner could read the payment API keys from the process arg list.

Recommendation: Mirror the Android pattern — add a step env: block and reference vars as $WPAY_…:

env:
  WPAY_CUSTOMER_KEY_SINGLE_NOKYC: ${{ secrets.WPAY_CUSTOMER_KEY_SINGLE_NOKYC }}
  # ... other WPAY_* secrets
run: |
  maestro test \
    --env WPAY_CUSTOMER_KEY_SINGLE_NOKYC=$WPAY_CUSTOMER_KEY_SINGLE_NOKYC \
    ...

Fix this →

---

Issue 2: Android debug keystore not cleaned up after build

ID: dcl-ci-e2e-pay-keystore-disk-residue-b2c7
File: .github/workflows/ci_e2e_pay_tests.yml:100
Severity: LOW
Category: security / data_classification

Context:

• Pattern: Line 100 decodes secrets.KEYSTORE to android/app/debug.keystore. The cleanup step at lines 171–173 deletes only build/; the keystore file is never explicitly removed.
• Risk: Code-signing material persists on the runner for the full job duration. The artifact upload is scoped to /tmp/ paths, so it won't be captured today, but a future scope change could inadvertently include it.

Recommendation: Add an if: always() cleanup after the emulator run:

- name: Clean up signing artifacts
  if: always()
  run: rm -f packages/reown_walletkit/example/android/app/debug.keystore

Fix this →

[claude]

Claude Code is working…

I'll analyze this and get back to you.

View job run