ci: fail e2e ref lookup unless the branch is missing

[piotr-iohk]

Fixes the two correctness gaps Phil flagged on the app PRs that call resolve-e2e-ref@main:

• bitkit-android#1318 (review, comment)
• bitkit-ios#767 (review, transport, migration checkout)

Please include ben-kaufman and pwltr as reviewers (same as the twin app PRs).

Missing ref vs transport failure

git ls-remote --exit-code returns 2 when no ref matches. DNS, auth, and other lookup failures return a different status (128 for the fatal cases checked here). The action treated every nonzero status as “branch missing”, so a transient lookup could soft-fall back to main and let CI pass against a different harness.

resolve-e2e-ref now captures the status and stderr:

• 0 — use the selected branch
• 2 — missing ref: soft-fallback to main on the default companion path, hard-fail for an explicit custom e2e_branch
• anything else — fail the step with ::error and the ls-remote stderr. No fallback.

The same split is in determine-e2e-branch.yml. That job is the first lookup. If it still treated a transport error as “missing”, it would emit main, and resolve-e2e-ref would then skip the re-check because the selected ref is already the fallback.

Migration wallet setup re-resolves before checkout

iOS passes a ref from a separate successful resolve-e2e-ref job into migration-wallet-setup.yml. “Re-run failed jobs” does not re-run that job, so a companion deleted after resolve stayed stale and checkout failed again.

The reusable workflow now runs resolve-e2e-ref immediately before checkout, pinned to this repo the same way the app workflows call it:

uses: synonymdev/bitkit-e2e-tests/.github/actions/resolve-e2e-ref@main

The workflow is called from bitkit-ios and bitkit-android, so the action reference has to name this repository. A workspace-relative ./.github/actions/... would look in the caller checkout instead.

Input contract (backward compatible)

Input	Required	Meaning
e2e_branch	yes	Candidate branch to re-validate. Existing callers can keep passing an already-resolved ref (iOS passes needs.resolve-e2e-ref.outputs.ref).
e2e_branch_input	no	main | default-feature-branch | custom branch name. Empty inherits the caller workflow_dispatch input e2e_branch, then default-feature-branch. A custom name hard-fails when the ref is missing; the default companion path soft-falls back to main.

No app-repo change is required for the current iOS caller: a deleted companion soft-falls back on re-run, and a dispatch that named a custom branch still hard-fails because that name is on github.event.inputs.e2e_branch. Callers can pass e2e_branch_input explicitly to override that.

Verification

• Real git ls-remote --exit-code: existing main → 0, absent ref → 2, unresolvable host → 128 (fatal: unable to access … Could not resolve host).
• Action script: status 2 + default companion → main; status 2 + custom name → hard-fail; status 1 and 128 → fail with stderr, no ref output; empty or already-fallback selected skips ls-remote.
• determine-e2e-branch under bash --noprofile --norc -eo pipefail (the GitHub Actions shell: bash invocation): ref_status returning 2 from if ref_status still soft-falls back to main and the step continues. A found ref is kept. Transport status 128 fails with no fallback. A missing custom branch still hard-fails.