fix(xtest): pull Keycloak 26.4 bootstrap on the main platform lane

[dmihalcik-virtru]

What

Bump the start-up-with-containers pin to 18b8070f (opentdf/platform#3792) and pass bootstrap-ref: main on the main platform lane only.

Why

The action overlays docker-compose.yaml from bootstrap-ref, independent of platform-ref. That input defaults to the pqc-enabled tag, which is still pinned to keycloak/keycloak:25.0 — a Keycloak that cannot issue DPoP-bound access tokens. So every lane ran KC 25 even though platform main's own compose has been ghcr.io/opentdf/keycloak-standard:26.4.0 with KC_FEATURES: dpop since #3792, and service/cmd/keycloak_data.yaml provisions opentdf-dpop with dpop.bound.access.tokens: "true".

The visible symptom: test_dpop.py::test_dpop_happy_path_roundtrip fails for any SDK that checks token binding. The token comes back typ=Bearer with no cnf.jkt, and the js CLI rejects it:

[CRITICAL] DPoP requested but the access token is not bound (missing cnf.jkt)

go and java pass only because they don't assert cnf.jkt. The other test_dpop.py cases already self-skip on token_type != DPoP; the SDK-level roundtrips gate on the platform well-known and SDK features, not on IdP capability, so they run and fail. This is what keeps opentdf/web-sdk#939 red.

Released platform tags keep the 25.0 bootstrap — they predate the move to standard Keycloak token exchange (opentdf/platform#3754).

Testing

Dispatched against this branch with platform-ref=main, js-ref=refs/pull/939/merge, focus-sdk=js — https://github.com/opentdf/tests/actions/runs/31016132383 — all three lanes green (go@main, java@main, js@pull-939).

Confirmed Keycloak 26.4 came up, and these ran rather than skipped:

PASSED test_dpop.py::test_dpop_happy_path_roundtrip[small-js@pull-939-js@pull-939-in_focus0]
PASSED test_dpop.py::test_dpop_happy_path_roundtrip[small-js@pull-939-java@main-in_focus0]
PASSED test_dpop.py::test_dpop_rejects_replayed_jti[small-js@pull-939-in_focus0]
PASSED test_dpop.py::test_dpop_rejects_tampered_proof_htu[small-js@pull-939-in_focus0]
PASSED test_dpop.py::test_dpop_bearer_scheme_warns_but_accepted_for_dpop_token[small-js@pull-939-in_focus0]

The nonce-dependent cases still skip, correctly — dpop-challenge is off by default, so require_nonce is unset.

Notes

• The new action's input set is a strict superset of the old pin's; no call-site changes beyond bootstrap-ref.
• start-additional-kas is left at 6dd5f649 — it downloads no compose.
• Overlaps chore(xtest): validate e2e against Keycloak 26.4 (DSPX-4190) #568 (DSPX-4190), which took the broader approach of moving every lane to 26.4 via a platform PR branch. This is the narrow slice needed now; chore(xtest): validate e2e against Keycloak 26.4 (DSPX-4190) #568's remaining checklist (re-point the pqc-enabled tag, align vulnerability.yml) still stands.

Summary by CodeRabbit

• Chores
  • Updated platform startup workflows to use the Keycloak 26.4 revision.
  • Adjusted bootstrap selection so the main platform lane uses the main configuration while released tags retain the PQC-enabled configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 253706f5-3372-4a39-9fbf-c1d7091a38ba

📥 Commits

Reviewing files that changed from the base of the PR and between 268b2f8 and cc1f373.

📒 Files selected for processing (1)

• .github/workflows/xtest.yml

---

📝 Walkthrough

Walkthrough

The platform test workflow updates the startup action revision. It selects the main bootstrap for the main lane and pqc-enabled for released platform tags.

Changes

Platform startup workflow

Layer / File(s)	Summary
Update platform startup selection .github/workflows/xtest.yml	The workflow uses the Keycloak 26.4 startup action revision. Conditional selection assigns main to the main lane and pqc-enabled to released platform tags.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• opentdf/tests#563: Updates the pinned platform startup action in the same workflow.

Suggested reviewers: jakedoublev

Poem

A rabbit checks the startup trail,
main hops forward without fail.
Tags take the PQC way,
Keycloak guides the test today.
The workflow blooms, neat and bright.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the xtest workflow change to use the Keycloak 26.4 bootstrap on the main platform lane.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch DSPX-3397-xtest-keycloak-264

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

X-Test Results

✅ java@main-v0.24.0
✅ java@main-main
✅ go@v0.36.0-main
✅ go@main-main
✅ go@main-v0.24.0
✅ go@v0.36.0-v0.24.0
✅ js@main-v0.24.0
✅ js@main-main
✅ js@v0.4.0-main
✅ js@v0.4.0-v0.24.0