feat: add GitHub Action for one-step PMG setup in CI (#263)

* feat: add GitHub Action for one-step PMG setup in CI

Composite action at repo root that downloads PMG (with SHA-256 verification
against the upstream checksums.txt), runs `pmg setup install`, and wires
shims onto $GITHUB_PATH so subsequent `npm install` / `pip install` calls
are transparently analyzed.

Defaults are conservative: malware blocking + dependency cooldown + proxy
mode (matching PMG's own defaults). Sandbox is opt-in because enabling
Landlock/Bubblewrap on ubuntu-latest requires relaxing AppArmor
user-namespace restrictions.

Cloud sync uses the documented SAFEDEP_API_KEY / SAFEDEP_TENANT_ID env-var
fallback so we skip the keychain codepath that has no usable backend in
headless CI. When cloud is enabled and no endpoint-id is supplied, the
action sets PMG_CLOUD_ENDPOINT_ID=github-actions/${GITHUB_REPOSITORY} so
events aggregate per repository instead of per ephemeral runner hostname.

Closes #248.

https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh

* fix(action): drop github.repository template from input description

Action manifest validation rejected the action.yml because the endpoint-id
input description contained ${{ github.repository }} — template expressions
aren't evaluated in input description text and trip the validator with
"Unrecognized named-value: 'github'". This caused every job using uses: ./
to fail before any step ran.

Also switch the config-file e2e job to verify the staged file directly
instead of calling `pmg config get`, which is not in the v0.13.0 release
that "latest" resolves to today.

https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh

* fix(action): address review comments on PR #263

- Drop opinionated defaults on PMG_* toggle inputs. All defaults are now
  empty strings, and the action only exports PMG_* env vars when the
  caller explicitly sets the input. Without this, defaults like
  PMG_PARANOID=false silently shadowed config-file overrides because env
  vars beat config.yml in Viper precedence.
- Verify cached PMG against upstream checksums.txt on every cache hit.
  The cached tarball is stored alongside the binary and re-hashed against
  the freshly-fetched checksums.txt; on drift, the cache entry is evicted
  and re-downloaded.
- Export PMG_* env vars BEFORE running `pmg setup install` so settings
  like disable-telemetry actually apply during setup, not just to
  subsequent package-manager calls.
- Add `|| true` to the grep that extracts the expected checksum so
  set -e doesn't kill the script before the friendly error message fires
  when no checksum entry is found.
- Pin third-party actions (actions/checkout, actions/setup-node) to
  commit SHAs to match the repo's supply-chain hardening convention.
- Fix the malicious-package E2E test capturing tee's exit code instead
  of npm's; redirect to a file and check the actual command exit code.
- Add an E2E job that asserts PMG_PARANOID is unset when only
  config-file is provided — regression guard for the precedence fix.

https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh

* ci(action-e2e): scope sandbox tests to action setup, not PMG runtime

The landlock job was running `npm install express` with no explicit
sandbox profile and the default profile blocks something npm needs
(PMG's own e2e uses `--sandbox-profile npm-restrictive` to make this
viable). Bubblewrap happened to pass, but verifying the default sandbox
profile is permissive enough for arbitrary package installs is PMG's
e2e responsibility — this workflow's job is to assert the action wires
sandbox config correctly.

Switch both drivers to a matrix and verify only what the action owns:
PMG_SANDBOX_* env vars propagated, pmg binary runs, bwrap is installed
when requested, AppArmor user-ns restriction relaxed.

https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh

* ci(action-e2e): bump setup-node to 24

Node 20 reached end-of-life and setup-node now warns on it. Match the
version pinned by publish-npm.yml (the repo's newest workflow). Updated
the README and docs/github-action.md quick-start examples to match.

https://claude.ai/code/session_01ARb8ZiBiJjvhWjchBXraAh

---------

Co-authored-by: Claude <noreply@anthropic.com>

.github/workflows/action-e2e.yml

@@ -0,0 +1,153 @@
+name: Action E2E
+
+on:
+  pull_request:
+    branches: [main]
+    paths:
+      - action.yml
+      - docs/github-action.md
+      - .github/workflows/action-e2e.yml
+  push:
+    branches: [main]
+    paths:
+      - action.yml
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ (github.event_name == 'pull_request' && github.ref) || github.run_id }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  default-config:
+    name: Default config installs and protects
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 24
+      - uses: ./
+      - name: PATH wiring
+        run: |
+          set -e
+          which pmg
+          which npm
+          test "$(command -v npm)" = "$HOME/.pmg/bin/npm"
+      - name: Install a benign package
+        run: |
+          mkdir t && cd t
+          npm init -y
+          npm install express@5.2.1
+          test -d node_modules/express
+      - name: Block a known-malicious package
+        shell: bash
+        run: |
+          set -eo pipefail
+          mkdir m && cd m
+          npm init -y
+          set +e
+          npm --prefer-online --no-cache i safedep-test-pkg@0.1.3 >out.log 2>&1
+          code=$?
+          set -e
+          cat out.log
+          if [ "$code" -eq 0 ]; then
+            echo "::error::Expected install to fail (malicious package), but it succeeded." >&2
+            exit 1
+          fi
+          grep -qi "Malicious package blocked" out.log
+
+  custom-config-file:
+    name: config-file input overrides defaults
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 24
+      - name: Write custom PMG config
+        run: |
+          cat > pmg.yml <<'YAML'
+          paranoid: true
+          dependency_cooldown:
+            enabled: true
+            days: 365
+          YAML
+      - uses: ./
+        with:
+          config-file: pmg.yml
+      - name: Verify config staged into PMG config dir
+        run: |
+          set -e
+          dest="${XDG_CONFIG_HOME:-$HOME/.config}/safedep/pmg/config.yml"
+          test -f "$dest"
+          grep -q "^paranoid: true" "$dest"
+          grep -q "days: 365" "$dest"
+      - name: Verify env doesn't shadow file-based tuning
+        shell: bash
+        run: |
+          # With no explicit "paranoid" input, the action must not export
+          # PMG_PARANOID — otherwise it would override the staged config.
+          if [ -n "${PMG_PARANOID:-}" ]; then
+            echo "::error::PMG_PARANOID leaked into env ($PMG_PARANOID); would shadow config-file" >&2
+            exit 1
+          fi
+
+  sandbox-setup:
+    name: Sandbox setup (${{ matrix.driver }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        driver: [landlock, bubblewrap]
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
+        with:
+          node-version: 24
+      - uses: ./
+        with:
+          sandbox: "true"
+          sandbox-driver: ${{ matrix.driver }}
+      - name: Sandbox env vars propagated
+        shell: bash
+        run: |
+          set -e
+          test "$PMG_SANDBOX_ENABLED" = "true"
+          test "$PMG_SANDBOX_DRIVER" = "${{ matrix.driver }}"
+          pmg version
+      - name: Bubblewrap binary installed when driver=bubblewrap
+        if: matrix.driver == 'bubblewrap'
+        run: bwrap --version
+      - name: AppArmor user-ns restriction relaxed
+        shell: bash
+        run: |
+          # systemctl-stop is best-effort; just confirm the sysctl is now 0
+          # so unprivileged user namespaces work for either driver.
+          v=$(cat /proc/sys/kernel/apparmor_restrict_unprivileged_userns 2>/dev/null || echo "missing")
+          echo "apparmor_restrict_unprivileged_userns=$v"
+          test "$v" = "0" -o "$v" = "missing"
+
+  non-linux-fail-fast:
+    name: Action fails fast on non-Linux runners
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - name: Action must exit non-zero
+        id: run
+        continue-on-error: true
+        uses: ./
+      - name: Verify it failed
+        shell: bash
+        run: |
+          test "${{ steps.run.outcome }}" = "failure"