ci: add E2E for pmg action server-mode (#354)

* ci: add E2E for pmg action server-mode

Exercises the safedep/pmg action with server-mode enabled: the action
starts the proxy daemon and injects HTTP_PROXY + CA env vars, then bare
npm/pip installs are intercepted. Asserts benign installs pass, malicious
npm/pip installs are blocked, and 'pmg proxy stop --fail-on-violation'
fails the job on the blocks.

Scoped via paths to action.yml and the proxy server sources so it only
runs when relevant. Complements persistent-proxy-e2e.yml, which covers
the branch's proxy internals via raw pmg proxy commands.

* ci: extract shared proxy E2E assertions into composite action

Both the action server-mode E2E and the persistent-proxy E2E run the same
benign/malicious install assertions. Factor them into a local composite
action (.github/actions/proxy-e2e-assertions) so the assertions live in one
place and both workflows exercise the composite itself.

Proxy teardown (pmg proxy stop --fail-on-violation) stays inline in each
workflow since the setup/teardown differs per binary-under-test (released
binary via the action vs. branch build via make).

.github/workflows/persistent-proxy-e2e.yml

@@ -24,7 +24,6 @@ jobs:
       SAFEDEP_API_KEY: ${{ secrets.SAFEDEP_CLOUD_API_KEY }}
       SAFEDEP_TENANT_ID: ${{ secrets.SAFEDEP_CLOUD_TENANT_DOMAIN}}
       PMG_CLOUD_ENABLED: "true"
-      PMG_CLOUD_ENDPOINT_ID: github-actions/${{ github.repository }}
     defaults:
       run:
         shell: bash
@@ -60,49 +59,13 @@ jobs:
       - name: Inject proxy env
         run: pmg proxy env >> "$GITHUB_ENV"
 
-      - name: Verify proxy env is set
-        run: |
-          echo "HTTP_PROXY=$HTTP_PROXY"
-          test -n "$HTTP_PROXY"
-
-      - name: Benign npm install succeeds
-        run: |
-          mkdir benign-test && cd benign-test
-          npm init -y
-          npm install lodash@4.17.21
-          test -d node_modules/lodash
-          cd .. && rm -rf benign-test
-
-      - name: Malicious npm install is blocked
-        run: |
-          mkdir mal-npm && cd mal-npm
-          npm init -y
-          # The install MUST fail (proxy blocks it). Assert that, instead of
-          # continue-on-error which would hide a regression where it succeeds.
-          if npm --no-cache --prefer-online install safedep-test-pkg@0.1.3; then
-            echo "ERROR: malicious npm install succeeded but should have been blocked"
-            exit 1
-          fi
-          echo "OK: malicious npm install was blocked"
-          cd .. && rm -rf mal-npm
-
-      - name: Malicious pip install is blocked (python3 -m pip)
-        run: |
-          python3 -m venv venv && source venv/bin/activate
-          if python3 -m pip install safedep-test-pkg; then
-            echo "ERROR: malicious pip install succeeded but should have been blocked"
-            deactivate
-            exit 1
-          fi
-          echo "OK: malicious pip install was blocked"
-          deactivate && rm -rf venv
+      - name: Run proxy E2E assertions
+        uses: ./.github/actions/proxy-e2e-assertions
 
       - name: Stop proxy and verify it fails on the blocks
         if: always()
+        shell: bash
         run: |
-          # We blocked packages above, so --fail-on-violation must exit non-zero.
-          # Assert that (a green test means the gate works), and always run so the
-          # daemon is stopped even if an earlier step failed.
           if pmg proxy stop --fail-on-violation; then
             echo "ERROR: stop should have exited non-zero (packages were blocked)"
             exit 1