Run the versioning http-tests in CI when the test token is configured

A VERSIONING_TEST_TOKEN repo secret + VERSIONING_TEST_REPO repo variable
activate versioning for the CI stack: credentials.trig is generated, the
versioning config is appended to the test system.trig with a per-run
path prefix (isolates concurrent runs), and a compose overlay enables
the credentials secret. Forks get no secrets, so the stack boots as
before and the suite's skip-guards make the scripts no-ops.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: namedgraph

.github/workflows/http-tests.yml

@@ -10,6 +10,8 @@ jobs:
       ASF_ARCHIVE: https://archive.apache.org/dist/
       JENA_VERSION: 6.1.0
       BASE_URI: https://localhost:4443/
+      VERSIONING_TEST_TOKEN: ${{ secrets.VERSIONING_TEST_TOKEN }} # absent on forks - the versioning suite then skips
+      VERSIONING_TEST_REPO: ${{ vars.VERSIONING_TEST_REPO }}
     steps:
       - name: Install Linux packages
         run: sudo apt-get update && sudo apt-get install -qq raptor2-utils libxml2-utils && sudo apt-get install curl
@@ -42,8 +44,35 @@ jobs:
           printf "%s" "${{ secrets.HTTP_TEST_SECRETARY_CERT_PASSWORD }}" > ./secrets/secretary_cert_password.txt
           printf "%s" "${{ secrets.HTTP_TEST_SECRETARY_CERT_PASSWORD }}" > ./secrets/client_truststore_password.txt
         shell: bash
+      - name: Enable graph versioning
+        if: env.VERSIONING_TEST_TOKEN != ''
+        run: |
+          printf '@prefix a:\t<https://w3id.org/atomgraph/core#> .\n\n<urn:linkeddatahub:versioning/end-user>\n{\n    <urn:linkeddatahub:versioning/end-user> a:authToken "%s" .\n}\n' "$VERSIONING_TEST_TOKEN" > ./secrets/credentials.trig
+          cat >> ./http-tests/config/system.trig <<EOF
+
+          # GitHub-backed graph versioning (appended by CI; per-run path prefix isolates concurrent runs)
+
+          @prefix doap:	<http://usefulinc.com/ns/doap#> .
+          @prefix github:	<https://w3id.org/atomgraph/linkeddatahub/services/github#> .
+
+          <urn:linkeddatahub:apps/end-user>
+          {
+              <urn:linkeddatahub:apps/end-user> lapp:versioningRepository <urn:linkeddatahub:versioning/end-user> .
+          }
+
+          <urn:linkeddatahub:versioning/end-user>
+          {
+              <urn:linkeddatahub:versioning/end-user> a doap:GitRepository ;
+                  doap:location <https://github.com/$VERSIONING_TEST_REPO> ;
+                  github:branch "main" ;
+                  github:pathPrefix "graphs-${{ github.run_id }}" .
+          }
+          EOF
+          echo "COMPOSE_VERSIONING=-f ./http-tests/docker-compose.versioning.yml" >> "$GITHUB_ENV"
+          echo "VERSIONING_PATH_PREFIX=graphs-${{ github.run_id }}" >> "$GITHUB_ENV"
+        shell: bash
       - name: Build Docker image & Run Docker containers
-        run: docker compose -f docker-compose.yml -f ./http-tests/docker-compose.http-tests.yml --env-file ./http-tests/.env up --build -d
+        run: docker compose -f docker-compose.yml -f ./http-tests/docker-compose.http-tests.yml ${COMPOSE_VERSIONING:-} --env-file ./http-tests/.env up --build -d
       - name: Wait for the server to start...
         run: while ! (status=$(curl -k -s -w "%{http_code}\n" https://localhost:4443 -o /dev/null) && echo "$status" && echo "$status" | grep "403") ; do sleep 1 ; done # wait for the webapp to start (returns 403 by default)
       - name: Fix certificate permissions on the host
@@ -54,6 +83,8 @@ jobs:
         run: ./run.sh "$PWD/ssl/owner/cert.pem" "${{ secrets.HTTP_TEST_OWNER_CERT_PASSWORD }}" "$PWD/ssl/secretary/cert.pem" "${{ secrets.HTTP_TEST_SECRETARY_CERT_PASSWORD }}"
         shell: bash
         working-directory: http-tests
+        env:
+          GITHUB_TOKEN: ${{ secrets.VERSIONING_TEST_TOKEN }} # the versioning suite (and its gh api calls) authenticate with this; empty = suite skips
       - name: Generate test summary
         if: always()
         run: python3 scripts/generate_test_summary.py http-tests/out http-tests/out/report.md

http-tests/docker-compose.versioning.yml

@@ -0,0 +1,8 @@
+# enables the credentials secret for the graph versioning http-tests; added by CI only when the test token is configured
+secrets:
+  credentials:
+    file: ../secrets/credentials.trig
+services:
+  linkeddatahub:
+    secrets:
+      - credentials

http-tests/versioning/DELETE-removes-file.sh

@@ -25,7 +25,7 @@ add-agent-to-group.sh \
 
 slug=$(uuidgen | tr '[:upper:]' '[:lower:]')
 doc_url="${END_USER_BASE_URL}${slug}/"
-path="graphs/${slug}.nt"
+path="${VERSIONING_PATH_PREFIX:-graphs}/${slug}.nt"
 
 # create a document and wait for its file to appear
 

http-tests/versioning/GET-timemap.sh

@@ -25,7 +25,7 @@ add-agent-to-group.sh \
 
 slug=$(uuidgen | tr '[:upper:]' '[:lower:]')
 doc_url="${END_USER_BASE_URL}${slug}/"
-path="graphs/${slug}.nt"
+path="${VERSIONING_PATH_PREFIX:-graphs}/${slug}.nt"
 
 # create a document and wait for its versioning commit
 

http-tests/versioning/GET-version.sh

@@ -25,7 +25,7 @@ add-agent-to-group.sh \
 
 slug=$(uuidgen | tr '[:upper:]' '[:lower:]')
 doc_url="${END_USER_BASE_URL}${slug}/"
-path="graphs/${slug}.nt"
+path="${VERSIONING_PATH_PREFIX:-graphs}/${slug}.nt"
 
 put_document()
 {

http-tests/versioning/PUT-creates-commit.sh

@@ -38,7 +38,7 @@ echo "<${doc_url}> <http://www.w3.org/1999/02/22-rdf-syntax-ns#type> <https://ww
 
 # wait for the async versioning commit to appear in the repository
 
-path="graphs/${slug}.nt"
+path="${VERSIONING_PATH_PREFIX:-graphs}/${slug}.nt"
 
 for i in $(seq 1 30); do
     if gh api "repos/${VERSIONING_TEST_REPO}/contents/${path}?ref=main" > /dev/null 2>&1; then