Fix and improve file permission linters; update tests to mirror actual usage #5988

	name: e2e tests

	on:
	push:
	branches: ["main"]
	pull_request:
	branches: ["main"]

	env:
	SOURCE_DATE_EPOCH: 1669683910

	permissions: {}

	jobs:
	rebuild:
	name: rebuild
	runs-on: ubuntu-latest
	permissions:
	contents: read

	strategy:
	fail-fast: false
	matrix:
	cfg:
	# build and rebuild examples
	- cargo-build.yaml
	- gnu-hello.yaml
	- go-build.yaml
	- minimal.yaml
	- npm-install.yaml
	- pnpm-install.yaml

	- melange.yaml # special; builds melange itself

	container:
	image: alpine:latest
	options: \|
	--cap-add NET_ADMIN --cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor:unconfined

	steps:
	- uses: step-security/harden-runner@ec9f2d5744a09debf3a187a3f4f675c53b671911 # v2.13.0
	with:
	egress-policy: audit

	- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
	- uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
	with:
	go-version-file: "go.mod"

	- name: Fetch dependencies
	run: \|
	apk upgrade -Ua
	apk add go build-base git bubblewrap jq

	- name: Build melange
	run: \|
	make melange
	./melange keygen

	- name: Build package
	run: \|
	path=examples/${{matrix.cfg}}
	if [ "${{matrix.cfg}}" == "melange.yaml" ]; then
	path="melange.yaml"
	fi
	./melange build $path --arch=x86_64 --namespace=wolfi

	- name: Rebuild package
	run: \|
	./melange rebuild ./packages/x86_64/*.apk

	- name: Upload APKs
	uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
	if: always()
	with:
	path: \|
	packages/**
	rebuilt-packages/**
	name: rebuild-${{matrix.cfg}}

Provide feedback