pin localstack image for ci tests

Author: KSemenenko

AGENTS.md

@@ -322,6 +322,7 @@ Ask first:
 ### Likes
 
 - Repository-facing docs, especially `README.md`, should stay in English and describe only the current supported behavior, not transitional legacy or fallback paths.
+- Temporary root-level `*.plan.md` files should be removed once a task is complete and their contents are no longer needed.
 
 ### Dislikes
 

Tests/ManagedCode.Storage.Tests/Common/ContainerImages.cs

@@ -4,6 +4,6 @@ public class ContainerImages
 {
     public const string Azurite = "mcr.microsoft.com/azure-storage/azurite:latest";
     public const string FakeGCSServer = "fsouza/fake-gcs-server:latest";
-    public const string LocalStack = "localstack/localstack:latest";
+    public const string LocalStack = "localstack/localstack:4.14.0";
     public const string Sftp = "atmoz/sftp:alpine";
 }

Tests/ManagedCode.Storage.Tests/Common/ContainerImagesTests.cs

@@ -0,0 +1,14 @@
+using ManagedCode.Storage.Tests.Common;
+using Shouldly;
+using Xunit;
+
+namespace ManagedCode.Storage.Tests.Common;
+
+public sealed class ContainerImagesTests
+{
+    [Fact]
+    public void LocalStack_ShouldUsePinnedPreAuthRelease()
+    {
+        ContainerImages.LocalStack.ShouldBe("localstack/localstack:4.14.0");
+    }
+}

docs/Development/setup.md

@@ -56,5 +56,6 @@ dotnet format ManagedCode.Storage.slnx
 ## Notes
 
 - Start Docker Desktop (or your Docker daemon) before running the full test suite.
+- AWS and Orleans integration tests intentionally pin LocalStack to `localstack/localstack:4.14.0`; do not switch them back to `latest`, because the end-of-March 2026 `latest` image became auth-gated and breaks CI without a token.
 - Never commit secrets (cloud keys, OAuth tokens, connection strings). Use environment variables or user secrets.
 - Credentials for cloud-drive providers are documented in `docs/Development/credentials.md`.

docs/Testing/strategy.md

@@ -45,6 +45,7 @@ Tests are grouped by “surface” and provider:
 Where possible, tests run without real cloud accounts:
 
 - Azure/AWS/GCS/SFTP suites use **Testcontainers** (Azurite, LocalStack, FakeGcsServer, SFTP container).
+- The LocalStack-backed AWS and Orleans flows are pinned to `localstack/localstack:4.14.0` because the end-of-March 2026 `latest` image became auth-gated and is no longer safe for anonymous CI runs.
 - Browser-local coverage uses Playwright against `Tests/ManagedCode.Storage.BrowserServerHost/` and `Tests/ManagedCode.Storage.BrowserWasmHost/` so `ManagedCode.Storage.Browser` is exercised through real Chromium flows with IndexedDB metadata and OPFS payloads in both Interactive Server and standalone WASM modes.
 - Those same hosts also wire `ManagedCode.Storage.VirtualFileSystem` over the browser provider, so browser VFS write, read, move, delete, large-file, small-file overwrite, and multi-tab concurrency flows are verified end to end in the browser rather than through in-process fakes.
 - The Interactive Server host explicitly raises `HubOptions.MaximumReceiveMessageSize` so browser-to-server chunk reads can exceed the default 32 KB SignalR limit during large-stream verification.