ci: add arkavo-fork go leg to the swift ↔ go xtest matrix

[arkavo-com]

Why two legs

Since #53 the Swift writer emits the spec container name manifest.json. Released upstream Go (otdfctl/v0.37.0) only reads 0.manifest.json, so the swift-encrypt → go-decrypt cell fails on main with tdfReader.Manifest failed: zip: file not found. The upstream fix is opentdf/platform#4063 (open); the arkavo fork carries the equivalent change in arkavo-org/opentdf-platform#37 (open).

This PR turns community-swift into a go-source matrix so both peers are exercised on every PR and main push:

Leg	Go client (otdfctl + sdk)	What it proves
upstream	released opentdf/platform otdfctl/* tag, resolved exactly as before	interop with what the ecosystem ships today; stays red until #4063 lands in a tag
arkavo-fork	built from source at arkavo-org/opentdf-platform@fork-ref via the fork's go.work	interop with the fork's reader; green once #37 merges into the fork's main

Platform service stays upstream in both legs

Only the Go client comes from the fork. The fork's platform service is CWT-only for auth and cannot start against the harness's Keycloak IdP, so start-up-with-containers-macos keeps its opentdf/platform default in both legs.

How the fork leg builds

sdk/go/src/<channel> is a symlink to platform-fork/otdfctl. The harness Makefile resolves the real path and picks up the enclosing go.work ("Using platform go.work"), so the fork's in-tree sdk/ is what otdfctl links against — no replace directives. The channel is arkavo-<sanitised ref> (e.g. go@arkavo-main), which never matches the harness's released-version regex, so it is treated as a head build. Both upload-artifact names carry the matrix key.

Pointing the fork leg at a branch or SHA

gh workflow run xtest.yml --ref <branch> -f fork-ref=tdf-container-spec-compliance

fork-ref defaults to main; it flows through resolve-refs like the other pins and appears in the run summary table.

Expected state

• upstream: red on test_tdf_roundtrip[small-swift@main-go@v0.37.0-…-tdf] until fix(sdk): read the TDF manifest under the spec name manifest.json opentdf/platform#4063 ships in an otdfctl/* tag.
• arkavo-fork with default fork-ref: main: red on the same cell (fork main at 9f0398e3 predates feat: Add TDF-JSON and TDF-CBOR format support #37).
• arkavo-fork with fork-ref: tdf-container-spec-compliance (or main after feat: Add TDF-JSON and TDF-CBOR format support #37 merges): green.

Unchanged: --focus swift, all pytest flags, main is not branch-protected so the job rename is free.

🤖 Generated with Claude Code

https://claude.ai/code/session_01LZJTQWb6AAPQCh5QJwEaqU

[gitar-bot]

Note

Automatic reviews are paused because your team has used its included automatic processing for this billing period (headroom scales with your seat count). You can still comment "Gitar review" to run one anytime, and automatic reviews resume on their own by October 1. Add seats for more headroom.
Learn more

Code Review ✅ Approved

🟢 Low risk

Adds arkavo-fork Go leg to the Swift ↔ Go cross-test matrix to validate interoperability with the fork's manifest reader while keeping the platform service upstream in both legs. No issues found.

Review coverage

Rules No rules evaluated

Functional validation Not enabled · Set up

Auto-approval Not enabled · Set up

_{Was this helpful? React with 👍 / 👎 | Gitar}

[arkavo-com]

Two runs of the new matrix, per-leg cells (--focus swift):

Run 1, PR default fork-ref: main — https://github.com/arkavo-org/OpenTDFKit/actions/runs/35287293044

leg	swift→go	go→swift	swift→swift	container_layout[swift]
upstream (otdfctl/v0.37.0)	❌ zip: file not found	✅	✅	✅
arkavo-fork (main @ 9f0398e3)	❌ same	✅	✅	✅

Run 2, dispatched with fork-ref: tdf-container-spec-compliance (arkavo-org/opentdf-platform#37) — https://github.com/arkavo-org/OpenTDFKit/actions/runs/35287732303

leg	swift→go	go→swift	swift→swift	container_layout[swift]
upstream	❌ same	✅	✅	✅
arkavo-fork (21a5d063)	✅	✅	✅	✅

So the fork leg goes green by default once arkavo-org/opentdf-platform#37 merges, and the upstream leg goes green once opentdf/platform#4063 ships in an otdfctl tag. Until then: one pass, one fail, both visible.

[arkavo-com]

Run 3, default fork-ref: main after arkavo-org/opentdf-platform#37 merged (fork main dfcc6d68) — https://github.com/arkavo-org/OpenTDFKit/actions/runs/35288260707

leg	swift→go	go→swift	swift→swift	container_layout[swift]
upstream (otdfctl/v0.37.0)	❌ zip: file not found	✅	✅	✅
arkavo-fork (main)	✅	✅	✅	✅

This is now the default state on every PR: fork leg green, upstream leg red until opentdf/platform#4063 ships in an otdfctl tag.