Use local anchor test action

[metapileks]

The anchor-test job caches ./node_modules/ under a constant key and then runs root yarn. Since #488 made @metadaoproject/programs a link:./sdk symlink, re-linking over a cache saved with the old copy layout makes yarn delete files from sdk/node_modules through the symlink, failing with Cannot find module '.../sdk/node_modules/superstruct/lib/index.cjs'. Any PR with a pre-#488 cache entry hits this after merging develop (#486, #481).

The cache step lives inside metadaoproject/anchor-test, so this copies the action (v2.3, 876dde6) verbatim into .github/actions/anchor-test/ and appends hashFiles('yarn.lock') to the cache key. No restore-keys: a lockfile change means a clean install (~17s) instead of a re-link over a foreign tree. The workflow now uses the local action with the same inputs.

Greptile Summary

This PR vendors the Anchor test composite action and makes the Node dependency cache sensitive to the root lockfile.

• Replaces the externally referenced Anchor test action with a repository-local action.
• Adds the yarn.lock hash to the node_modules cache key without fallback restore keys.
• Preserves the workflow’s existing Anchor, Solana CLI, and Node version inputs.

Confidence Score: 5/5

The PR appears safe to merge, with no actionable behavioral, security, or repository-rule violations identified.

The cache key no longer matches pre-change caches, no restore prefix can reintroduce them, and the local action is invoked only after checkout while preserving the caller’s inputs.

Important Files Changed

Filename	Overview
.github/actions/anchor-test/action.yml	Adds the local composite test action with lockfile-aware dependency caching and the existing setup and test sequence.
.github/workflows/anchor-test.yaml	Switches the test job from the pinned external action to the checked-out local action.

_{Reviews (1): Last reviewed commit: "use local anchor test action" | Re-trigger Greptile}

[github-actions]

Repository Guard

• Cargo.lock: pass
• yarn.lock (sdk): pass
• yarn.lock (root): pass
• Repo guard: pass

Repository Guard

Cargo dependency pinning

• Status: pass
• Every programs/*/Cargo.toml dep uses =x.y.z, a path = .. workspace ref, or a git dep with a 40-char rev.

Cross-program Anchor/Solana version consistency

• Status: pass
• anchor-lang and anchor-spl are pinned to the version declared in repo-guard.toml across every program.

solana-program crate pin

• Status: pass
• Every solana-program = "=X" declaration is =1.17.14 (locked to match Cargo.lock).

Anchor.toml solana_version

• Status: pass
• Anchor.toml declares solana_version = "1.17.34" (local-dev install for anchor test).

Crate minimum age

• Status: pass
• All Cargo deps changed by this PR are at least 14 days old on crates.io.

Yarn package.json pinning

• Status: pass
• All package.json deps use exact versions (no ^, ~, ranges).

npm minimum age

• Status: pass
• All npm deps changed by this PR are at least 14 days old.

Workflow toolchain consistency

• Status: pass
• Every workflow declares anchor-version: 0.29.0.
• Per-file solana-cli-version values match [toolchain.workflow_solana_cli] in repo-guard.toml.

GitHub Action SHA pinning

• Status: pass
• Every third-party action is pinned to a SHA in [actions.sha_allowlist].

Sensitive program / config changes

• Status: warn
• Review hint only (CODEOWNERS is the merge gate). Lines below match heuristics for security-sensitive changes:
• High-sensitivity files touched: .github/repo-guard.toml

Overall status: pass

Lockfile freshness (Cargo.lock + yarn.lock) is checked by the workflow directly and cannot be bypassed. The sensitive-diff section is a review hint - CODEOWNERS handles the actual merge gate.