fix(bots): use repo's setup-poetry for connector deps (JFrog mirror, egress-safe)

The hand-rolled 'poetry install' failed on the protected runner: it hard-failed
on the repo's pre-existing stale poetry.lock, and the relock fallback couldn't
reach pypi.org (runner is egress-blocked). The repo already ships a setup-poetry
composite that configures poetry against the internal JFrog mirror, runs
'poetry lock', and installs the connector — the maintained, egress-safe path.
Swap all three engineer workflows to './.github/actions/setup-poetry' (also
provides Python), replacing the bespoke pip/poetry steps.

Co-authored-by: Isaac

Author: eric-wang-1990

.github/workflows/engineer-bot-e2e.yml

@@ -39,8 +39,8 @@ jobs:
           app-id: ${{ secrets.ENGINEER_BOT_APP_ID }}
           private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }}
 
-      - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      - name: Setup Poetry + connector deps (for pytest self-verify)
+        uses: ./.github/actions/setup-poetry
         with:
           python-version: '3.11'
 
@@ -65,15 +65,6 @@ jobs:
           engine-ref: b6205fb502566d617a456ccf3c37f3e4e3072ccd
           engine-token: ${{ steps.engine-token.outputs.token }}
 
-      - name: Install connector deps (for pytest self-verify)
-        run: |
-          python -m pip install --upgrade poetry
-          poetry install --no-interaction || {
-            echo "::warning::poetry install failed (likely a stale lock); relocking on the runner and retrying."
-            poetry lock --no-interaction
-            poetry install --no-interaction
-          }
-
       - name: Resolve test issue #864 + gather context
         id: ctx
         env:

.github/workflows/engineer-bot-followup.yml

@@ -93,8 +93,11 @@ jobs:
           app-id: ${{ secrets.ENGINEER_BOT_APP_ID }}
           private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }}
 
-      - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      # Python + connector deps via the repo's OWN setup-poetry action (JFrog
+      # mirror + poetry lock + install) — egress-safe, tolerates a stale lock.
+      # The agent runs `poetry run python -m pytest tests/unit` to verify fixups.
+      - name: Setup Poetry + connector deps (for pytest self-verify)
+        uses: ./.github/actions/setup-poetry
         with:
           python-version: '3.11'
 
@@ -122,21 +125,6 @@ jobs:
           engine-ref: b6205fb502566d617a456ccf3c37f3e4e3072ccd
           engine-token: ${{ steps.engine-token.outputs.token }}
 
-      # Product env-prep: install the connector's own deps so a fixup can be
-      # verified with `poetry run python -m pytest`. Analog of a driver repo's
-      # build/restore step.
-      - name: Install connector deps (for pytest self-verify)
-        # Resilient to a stale poetry.lock (see engineer-bot.yml): try the locked
-        # install, and if pyproject/lock have drifted, relock on the runner and
-        # retry so the agent still gets a working test env.
-        run: |
-          python -m pip install --upgrade poetry
-          poetry install --no-interaction || {
-            echo "::warning::poetry install failed (likely a stale lock); relocking on the runner and retrying."
-            poetry lock --no-interaction
-            poetry install --no-interaction
-          }
-
       # Run the follow-up. Inlines the engine's bot-run env contract for
       # engineer:followup, plus the authenticated push remote bot-run would set
       # up (followup pushes fixup commits via a plain `git push`, which doesn't

.github/workflows/engineer-bot.yml

@@ -68,8 +68,14 @@ jobs:
           app-id: ${{ secrets.ENGINEER_BOT_APP_ID }}
           private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }}
 
-      - name: Setup Python
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6.3.0
+      # Python + connector deps via the repo's OWN setup-poetry action: it
+      # configures poetry against the internal JFrog mirror (the protected runner
+      # is egress-blocked from pypi.org), runs `poetry lock` (tolerating a stale
+      # lock), and installs the connector + its deps. This is the maintained,
+      # egress-safe way this repo installs itself — the agent then runs
+      # `poetry run python -m pytest tests/unit` to self-verify its red→green fix.
+      - name: Setup Poetry + connector deps (for pytest self-verify)
+        uses: ./.github/actions/setup-poetry
         with:
           python-version: '3.11'
 
@@ -134,26 +140,6 @@ jobs:
           engine-ref: b6205fb502566d617a456ccf3c37f3e4e3072ccd
           engine-token: ${{ steps.engine-token.outputs.token }}
 
-      # Product env-prep: REF-mode install brings ONLY the engine, not this repo's
-      # own deps. Install them so the agent can run `poetry run python -m pytest`
-      # to SELF-VERIFY its red→green fix (without this: "No module named pytest"
-      # → static reasoning). This is the Python analog of a driver repo's
-      # `dotnet restore` / build step.
-      - name: Install connector deps (for pytest self-verify)
-        # Resilient to a stale poetry.lock: modern poetry refuses `install` when
-        # pyproject.toml has drifted from the lock. That's a repo-maintenance
-        # state the bot must not hard-fail on — it just needs a working env to
-        # run tests. So try the locked install first, and if it fails, relock and
-        # retry. (A relock only affects this ephemeral runner; nothing is
-        # committed unless the agent's fix itself touches deps.)
-        run: |
-          python -m pip install --upgrade poetry
-          poetry install --no-interaction || {
-            echo "::warning::poetry install failed (likely a stale lock); relocking on the runner and retrying."
-            poetry lock --no-interaction
-            poetry install --no-interaction
-          }
-
       - name: Run author (bug-fix)
         id: author
         # Run from RUNNER_TEMP so the engine-rendered prompt's context file