chore(deps): refresh plugin locks and validate every plugin

.github/workflows/test.yml

@@ -19,7 +19,7 @@ jobs:
     name: Unit tests (bats)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           submodules: recursive
 
@@ -35,7 +35,7 @@ jobs:
     name: Shellcheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Run shellcheck
         run: shellcheck --severity=error src/crabcode
@@ -52,7 +52,7 @@ jobs:
       run:
         working-directory: plugins/draw
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: ${{ matrix.node }}
@@ -68,10 +68,33 @@ jobs:
         working-directory: plugins/draw/ui
       - run: npm run test:integration
 
+  plugins:
+    name: ${{ matrix.plugin }} build and test (Node ${{ matrix.node }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    strategy:
+      fail-fast: false
+      matrix:
+        plugin: [promptfoo, tax]
+        node: [20, 22, 24]
+    defaults:
+      run:
+        working-directory: plugins/${{ matrix.plugin }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
+        with:
+          node-version: ${{ matrix.node }}
+          cache: npm
+          cache-dependency-path: plugins/${{ matrix.plugin }}/package-lock.json
+      - run: npm ci
+      - run: npm run build
+      - run: npm test
+
   ci-success:
     name: CI Success
     runs-on: ubuntu-latest
-    needs: [unit, lint, draw]
+    needs: [unit, lint, draw, plugins]
     # The shared action waits for all PR checks on this commit; on push to main
     # it can also pick up unrelated branch checks (for example Dependabot).
     if: ${{ always() && github.event_name == 'pull_request' }}