feat: run platform int. tests via docker compose

.github/docker-compose.platform.env

@@ -0,0 +1,8 @@
+# Single source of truth for the opentdf/platform version pinned in
+# docker-compose.platform.override.yaml. Passed to `docker compose` via
+# --env-file so PLATFORM_VERSION only has to be declared once.
+#
+# NanoTDF rewrap (kas ec rewrap) breaks against every platform release
+# newer than this that was tried (v0.16.0 through :nightly), so we're
+# pinned here for now -- see issue #26.
+PLATFORM_VERSION=v0.8.1

.github/docker-compose.platform.override.yaml

@@ -0,0 +1,86 @@
+# Overrides for docker-compose.platform.yaml needed to run the platform
+# integration tests in CI (and locally). See issue #26 for the background
+# on each of these -- briefly:
+#
+# - The platform's Keycloak provisioning data and policy fixtures must come
+#   from the SAME git tag as the platform image (docker-compose.platform.yaml
+#   already pins the image itself to PLATFORM_VERSION, declared once in
+#   docker-compose.platform.env -- pass that file via `docker compose
+#   --env-file`). NanoTDF rewrap (kas ec rewrap) breaks against every
+#   platform release newer than that tag was tried against (v0.16.0 through
+#   :nightly), independent of otdfctl/SDK version, so everything is pinned
+#   for now.
+# - The Keycloak provisioning data (download-keycloak-data below) is also
+#   patched with `directAccessGrantsEnabled: true` on the "opentdf" client
+#   via `yq`, which our integration tests need for the OAuth2 password grant
+#   (see tests/integration/support_sdk.py::get_user_access_token). This
+#   mirrors how the pre-docker-compose CI patched the same file with `yq`
+#   after checking out the platform repo at this tag -- see git history of
+#   platform-integration-test.yaml before this pipeline used docker compose.
+# - Keycloak's plaintext port is published and opentdf.yaml's issuer is
+#   patched to match, instead of going through Caddy's TLS route. Our
+#   Connect RPC client for KAS (pyqwest-based) cannot disable TLS
+#   certificate verification for https:// URLs, so the platform and
+#   Keycloak endpoints used by the Python SDK/tests need to stay plaintext.
+#   (otdfctl doesn't have this limitation and is fine going through Caddy.)
+# - Every file the base compose file fetches from opentdf/platform@main is
+#   repinned here to the same git tag as PLATFORM_VERSION (`service/<version>`),
+#   so nothing in this pipeline tracks main unpinned -- see download-init-script
+#   below. The one exception is generate-pqc-keys: the PQC keygen tool
+#   (service/cmd/keygen) doesn't exist yet at service/${PLATFORM_VERSION}, and
+#   the opentdf.yaml pinned to that tag only references the RSA/EC keys that
+#   generate-keys already creates, not PQC/hybrid ones -- so its output isn't
+#   consumed at this pin. It's turned into a no-op below instead of being
+#   pointed at a ref that doesn't have the tool. Revisit both when
+#   PLATFORM_VERSION is next bumped.
+services:
+  download-platform-config:
+    command: ['wget', '-O', '/configs/opentdf.yaml', 'https://raw.githubusercontent.com/opentdf/platform/service/${PLATFORM_VERSION}/opentdf-example.yaml']
+
+  download-fixtures:
+    command: ['wget', '-O', '/configs/service/internal/fixtures/policy_fixtures.yaml', 'https://raw.githubusercontent.com/opentdf/platform/service/${PLATFORM_VERSION}/service/internal/fixtures/policy_fixtures.yaml']
+
+  download-init-script:
+    # Unlike download-platform-config/download-fixtures below, the base
+    # service sets `entrypoint: /bin/sh`, so the command must be shell
+    # script text (`-c ...`), not an exec-form argv list -- otherwise sh
+    # tries to run "wget" as a script file and exits 2.
+    command:
+      - -c
+      - |
+        wget -O /configs/init-temp-keys.sh 'https://raw.githubusercontent.com/opentdf/platform/service/${PLATFORM_VERSION}/.github/scripts/init-temp-keys.sh'
+
+  generate-pqc-keys:
+    image: alpine:3.23
+    entrypoint: /bin/sh
+    command:
+      - -c
+      - |
+        echo "Skipping PQC key generation: service/cmd/keygen doesn't exist at service/${PLATFORM_VERSION}, and its output isn't referenced by opentdf.yaml at that pin."
+    restart: "no"
+
+  download-keycloak-data:
+    command:
+      - -c
+      - |
+        apk add --no-cache yq
+        wget -O /configs/keycloak_data.yaml 'https://raw.githubusercontent.com/opentdf/platform/service/${PLATFORM_VERSION}/service/cmd/keycloak_data.yaml'
+        yq -i '.realms[0].clients[0].client.directAccessGrantsEnabled = true' /configs/keycloak_data.yaml
+        echo "Downloaded keycloak_data.yaml (service/${PLATFORM_VERSION}) and patched directAccessGrantsEnabled for the opentdf client"
+
+  keycloak:
+    ports:
+      - "8888:8888"
+
+  patch-platform-config:
+    command:
+      - sh
+      - -c
+      - |
+        apk add --no-cache sed
+        sed -i 's|http://keycloak:8888|http://keycloak.opentdf.local:8888|g' /configs/opentdf.yaml
+        echo "Patched opentdf.yaml to use keycloak.opentdf.local:8888 (plaintext)"
+
+volumes:
+  configs:
+    name: opentdf_configs