test: require pinned LocalAgent contracts in CI

.github/workflows/run-tests.yml

@@ -196,6 +196,30 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v4
 
+      - name: Read official plugin source pin
+        id: plugin-source
+        run: |
+          python3 - <<'PY'
+          import json
+          import os
+          import re
+          from pathlib import Path
+
+          lock = json.loads(Path('tests/fixtures/legacy_plugin_identity_sources.json').read_text())
+          assert lock['repository'] == 'langbot-app/langbot-plugins'
+          assert re.fullmatch(r'[0-9a-f]{40}', lock['revision'])
+          with open(os.environ['GITHUB_OUTPUT'], 'a') as output:
+              output.write(f"revision={lock['revision']}\n")
+          PY
+
+      - name: Checkout pinned official plugin sources
+        uses: actions/checkout@v4
+        with:
+          repository: langbot-app/langbot-plugins
+          ref: ${{ steps.plugin-source.outputs.revision }}
+          path: .contract-sources/langbot-plugins
+          persist-credentials: false
+
       - name: Set up Python
         uses: actions/setup-python@v5
         with:
@@ -208,7 +232,28 @@ jobs:
         run: uv sync --dev
 
       - name: Run E2E startup tests
-        run: uv run pytest tests/e2e -q --tb=short
+        run: uv run pytest tests/e2e --ignore=tests/e2e/test_local_runner_fake_provider.py -q --tb=short
+
+      - name: Check Docker for the required LocalAgent Box contract
+        run: docker info
+
+      - name: Run required LocalAgent contracts
+        env:
+          LANGBOT_LEGACY_PLUGIN_ROOT: ${{ github.workspace }}/.contract-sources/langbot-plugins
+        run: |
+          uv run --no-sync pytest tests/e2e/test_local_runner_fake_provider.py \
+            -q --tb=short -rs --junitxml=local-agent-results.xml
+          python scripts/assert-required-tests.py local-agent-results.xml \
+            --module tests.e2e.test_local_runner_fake_provider \
+            --name-prefix test_local_runner_ --expected-tests 6
+
+      - name: Upload LocalAgent contract results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: local-agent-contract-results
+          path: local-agent-results.xml
+          if-no-files-found: ignore
 
       - name: E2E Test Summary
         if: always()