chore(ci): update e2e test environments to Keycloak 26.4

.github/scripts/init-temp-keys.cmd

@@ -21,4 +21,4 @@ set hostKeyDir=%hostKeyDir%/keys
 set "hostKeyDir=%hostKeyDir:\=/%"
 
 openssl pkcs12 -export -in keys/keycloak-ca.pem -inkey keys/keycloak-ca-private.pem -out keys/ca.p12 -nodes -passout pass:password
-docker run -v %hostKeyDir%:/keys --entrypoint keytool keycloak/keycloak:25.0 -importkeystore -srckeystore /keys/ca.p12 -srcstoretype PKCS12 -destkeystore /keys/ca.jks -deststoretype JKS -srcstorepass "password" -deststorepass "password" -noprompt
+docker run -v %hostKeyDir%:/keys --entrypoint keytool keycloak/keycloak:26.4 -importkeystore -srckeystore /keys/ca.p12 -srcstoretype PKCS12 -destkeystore /keys/ca.jks -deststoretype JKS -srcstorepass "password" -deststorepass "password" -noprompt

.github/scripts/init-temp-keys.sh

@@ -79,7 +79,7 @@ docker run \
   -v $(pwd)/keys:/keys \
   --entrypoint keytool \
   --user $(id -u):$(id -g) \
-  keycloak/keycloak:25.0 \
+  keycloak/keycloak:26.4 \
   -importkeystore \
   -srckeystore /keys/ca.p12 \
   -srcstoretype PKCS12 \

docker-compose.yaml

@@ -30,6 +30,7 @@ services:
       KC_BOOTSTRAP_ADMIN_USERNAME: admin
       KC_BOOTSTRAP_ADMIN_PASSWORD: changeme
       #KC_HOSTNAME_URL: http://localhost:8888/auth
+      KC_FEATURES: dpop
       KC_HEALTH_ENABLED: "true"
       KC_HTTPS_KEY_STORE_PASSWORD: "password"
       KC_HTTPS_KEY_STORE_FILE: "/truststore/truststore.jks"

service/entityresolution/integration/keycloak_test.go

@@ -180,6 +180,7 @@ func (a *KeycloakTestAdapter) createKeycloakContainerConfig() internal.Container
 		Env: map[string]string{
 			"KC_BOOTSTRAP_ADMIN_USERNAME": a.config.AdminUser,
 			"KC_BOOTSTRAP_ADMIN_PASSWORD": a.config.AdminPass,
+			"KC_FEATURES":                 "dpop",
 			"KC_HTTP_ENABLED":             "true",
 			"KC_HOSTNAME_STRICT":          "false",
 			"KC_HEALTH_ENABLED":           "true",

test/integration/oauth/oauth_test.go

@@ -34,7 +34,6 @@ import (
 
 const (
 	standardKeycloakImage = "ghcr.io/opentdf/keycloak-standard:26.4.0"
-	customKeycloakImage   = "ghcr.io/opentdf/keycloak:sha-8a6d35a"
 )
 
 type OAuthSuite struct {
@@ -572,6 +571,7 @@ func setupStandardKeycloak(ctx context.Context, t *testing.T) (tc.Container, str
 		Env: map[string]string{
 			"KC_BOOTSTRAP_ADMIN_USERNAME": "admin",
 			"KC_BOOTSTRAP_ADMIN_PASSWORD": "admin", // #nosec G101 -- test-only Keycloak admin password
+			"KC_FEATURES":                 "dpop",
 		},
 
 		WaitingFor: wait.ForHTTP("/realms/master/.well-known/openid-configuration").
@@ -606,7 +606,7 @@ func setupStandardKeycloak(ctx context.Context, t *testing.T) (tc.Container, str
 
 func setupCustomKeycloakForCertExchange(ctx context.Context, t *testing.T) (tc.Container, string) {
 	containerReq := tc.ContainerRequest{
-		Image:        customKeycloakImage,
+		Image:        standardKeycloakImage,
 		ExposedPorts: []string{"8082/tcp", "8083/tcp"},
 		Cmd: []string{
 			"start-dev", "--http-port=8082", "--https-port=8083", "--verbose",
@@ -622,17 +622,24 @@ func setupCustomKeycloakForCertExchange(ctx context.Context, t *testing.T) (tc.C
 		},
 		Env: map[string]string{
 			"KC_BOOTSTRAP_ADMIN_USERNAME":   "admin",
-			"KC_BOOTSTRAP_ADMIN_PASSWORD":   "admin",
-			"KEYCLOAK_ADMIN":                "admin",
-			"KEYCLOAK_ADMIN_PASSWORD":       "admin", // #nosec G101 -- test-only Keycloak admin password
+			"KC_BOOTSTRAP_ADMIN_PASSWORD":   "admin", // #nosec G101 -- test-only Keycloak admin password
+			"KC_FEATURES":                   "dpop",
 			"KC_HTTPS_KEY_STORE_PASSWORD":   "password",
 			"KC_HTTPS_KEY_STORE_FILE":       "/truststore/truststore.jks",
 			"KC_HTTPS_CERTIFICATE_FILE":     "/etc/x509/tls/localhost.crt",
 			"KC_HTTPS_CERTIFICATE_KEY_FILE": "/etc/x509/tls/localhost.key",
 			"KC_HTTPS_CLIENT_AUTH":          "request",
 		},
 
-		WaitingFor: wait.ForLog("Running the server").WithStartupTimeout(2 * time.Minute),
+		// Wait on an actual HTTP response rather than the "Running the server" log line:
+		// in Keycloak 26.4 that message is printed (as the dev-mode warning) before the HTTP
+		// connector is accepting connections, which races the admin login below.
+		WaitingFor: wait.ForHTTP("/realms/master/.well-known/openid-configuration").
+			WithPort("8082/tcp").
+			WithStatusCodeMatcher(func(status int) bool {
+				return status == http.StatusOK
+			}).
+			WithStartupTimeout(2 * time.Minute),
 	}
 
 	keycloak := startKeycloakContainer(ctx, t, containerReq)

test/start-up-with-containers/action.yaml

@@ -7,6 +7,14 @@ inputs:
     required: false
     description: 'The ref to check out for the platform'
     default: 'main'
+  bootstrap-ref:
+    required: false
+    description: >-
+      Ref of opentdf/platform to fetch the bootstrap files (docker-compose.yaml,
+      init-temp-keys.sh, watch.sh) from. These files are executed, so this is
+      restricted to an allowlist: [main, pqc-enabled]. Defaults to
+      the pqc-enabled tag.
+    default: 'pqc-enabled'
   extra-keys:
     required: false
     description: A JSON array containing extra keys for the KAS to load. Each object should have 'kid', 'alg', 'private', and 'cert' fields.
@@ -55,6 +63,7 @@ runs:
       shell: bash
       env:
         PLATFORM_REF: ${{ inputs.platform-ref }}
+        BOOTSTRAP_REF: ${{ inputs.bootstrap-ref }}
         EXTRA_KEYS: ${{ inputs.extra-keys }}
         EC_TDF_ENABLED: ${{ inputs.ec-tdf-enabled }}
         PQC_ENABLED: ${{ inputs.pqc-enabled }}
@@ -70,6 +79,18 @@ runs:
           exit 1
         fi
 
+        # Validate bootstrap-ref against an explicit allowlist. The bootstrap files
+        # (docker-compose.yaml, init-temp-keys.sh, watch.sh) are executed, so only
+        # vetted refs are permitted rather than an arbitrary branch/tag.
+        case "${BOOTSTRAP_REF}" in
+          main|pqc-enabled)
+            ;;
+          *)
+            echo "Error: bootstrap-ref must be one of: main, pqc-enabled."
+            exit 1
+            ;;
+        esac
+
         # Validate extra-keys (must be a valid JSON array)
         if ! jq -e 'type == "array"' <<< "${EXTRA_KEYS}" > /dev/null 2>&1; then
           echo "Error: extra-keys must be a valid JSON array."
@@ -155,10 +176,14 @@ runs:
         persist-credentials: false
     - name: Download latest init-temp-keys.sh, docker-compose.yaml, and watch.sh
       shell: bash
+      env:
+        BOOTSTRAP_REF: ${{ inputs.bootstrap-ref }}
       run: |
-        curl --retry 5 --retry-delay 2 --retry-all-errors -sSfL https://raw.githubusercontent.com/opentdf/platform/refs/tags/pqc-enabled/.github/scripts/init-temp-keys.sh > otdf-test-platform/.github/scripts/init-temp-keys.sh
-        curl --retry 5 --retry-delay 2 --retry-all-errors -sSfL https://raw.githubusercontent.com/opentdf/platform/refs/tags/pqc-enabled/docker-compose.yaml > otdf-test-platform/docker-compose.yaml
-        curl --retry 5 --retry-delay 2 --retry-all-errors -sSfL https://raw.githubusercontent.com/opentdf/platform/refs/tags/pqc-enabled/.github/scripts/watch.sh > otdf-test-platform/.github/scripts/watch.sh
+        # Bare ref form resolves branches, tags, and SHAs (e.g. the default pqc-enabled tag).
+        base="https://raw.githubusercontent.com/opentdf/platform/${BOOTSTRAP_REF}"
+        curl --retry 5 --retry-delay 2 --retry-all-errors -sSfL "${base}/.github/scripts/init-temp-keys.sh" > otdf-test-platform/.github/scripts/init-temp-keys.sh
+        curl --retry 5 --retry-delay 2 --retry-all-errors -sSfL "${base}/docker-compose.yaml" > otdf-test-platform/docker-compose.yaml
+        curl --retry 5 --retry-delay 2 --retry-all-errors -sSfL "${base}/.github/scripts/watch.sh" > otdf-test-platform/.github/scripts/watch.sh
     - name: Set up go (platform's go version)
       id: setup-go
       uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0