From cc1f3737aa24fd87fa24f5022650f8f331201bba Mon Sep 17 00:00:00 2001 From: Dave Mihalcik Date: Wed, 5 Aug 2026 09:33:48 -0500 Subject: [PATCH] fix(xtest): pull Keycloak 26.4 bootstrap on the main platform lane The start-up-with-containers action overlays docker-compose.yaml from a frozen ref, not from platform-ref. That ref defaulted to the pqc-enabled tag, which still pins keycloak/keycloak:25.0 -- so every lane ran a Keycloak that cannot issue DPoP-bound access tokens, even though platform main's own compose has been on ghcr.io/opentdf/keycloak-standard:26.4.0 with KC_FEATURES: dpop since opentdf/platform#3792. The visible symptom is test_dpop.py::test_dpop_happy_path_roundtrip failing for any SDK that checks token binding: the token comes back typ=Bearer with no cnf.jkt, and the js CLI rejects it. The other test_dpop.py cases already skip themselves on token_type != DPoP. Bump the action pin to #3792 (input set is a strict superset) and pass bootstrap-ref: main for the main lane only. Released platform tags stay on the 25.0 bootstrap -- they predate the move to standard Keycloak token exchange. Signed-off-by: Dave Mihalcik --- .github/workflows/xtest.yml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/xtest.yml b/.github/workflows/xtest.yml index 34a5589bb..e8def58a2 100644 --- a/.github/workflows/xtest.yml +++ b/.github/workflows/xtest.yml @@ -306,9 +306,17 @@ jobs: ######## SPIN UP PLATFORM BACKEND ############# - name: Check out and start up platform with deps/containers id: run-platform - uses: opentdf/platform/test/start-up-with-containers@6dd5f649347fb2314c6090ea6d090a5c673d58a6 # ci-startup-yaml-fix (opentdf/platform#3750) + uses: opentdf/platform/test/start-up-with-containers@18b8070f7ae1e3547234342f42d0d686dc77788f # keycloak-26.4 (opentdf/platform#3792) with: platform-ref: ${{ fromJSON(needs.resolve-versions.outputs.platform-tag-to-sha)[matrix.platform-tag] }} + # The action overlays docker-compose.yaml from bootstrap-ref, independent + # of platform-ref. The default `pqc-enabled` tag is still Keycloak 25.0, + # which cannot issue DPoP-bound access tokens, so test_dpop.py roundtrips + # fail with a plain Bearer token. main's compose is Keycloak 26.4 with + # KC_FEATURES: dpop. Only the main lane gets it -- released platform tags + # predate the switch to standard Keycloak token exchange and still need + # the 25.0 bootstrap. + bootstrap-ref: ${{ matrix.platform-tag == 'main' && 'main' || 'pqc-enabled' }} ec-tdf-enabled: true extra-keys: ${{ steps.load-extra-keys.outputs.EXTRA_KEYS }} log-type: json