fix(ci): fix PHP gating, add multi-user-basic matrix entry, upload debug artifacts

PHP setup was gated behind needs-playwright but Astrolabe build needs
composer unconditionally. Add multi-user-basic CI matrix entry with
proper marker filtering. Upload Playwright screenshots and service logs
as artifacts on failure for easier debugging.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/test.yml

@@ -37,14 +37,20 @@ jobs:
         include:
           - mode: single-user
             profile: single-user
-            markers: "(smoke and not oauth and not keycloak and not login_flow) or (integration and not oauth and not keycloak and not login_flow)"
+            markers: "(smoke and not oauth and not keycloak and not login_flow and not multi_user_basic) or (integration and not oauth and not keycloak and not login_flow and not multi_user_basic)"
             wait-port: 8000
             needs-playwright: false
             extra-args: >-
-              --ignore=tests/integration/test_multi_user_basic_auth.py
               --ignore=tests/integration/test_qdrant_collection_creation.py
               --ignore=tests/rag_evaluation/
 
+          - mode: multi-user-basic
+            profile: multi-user-basic
+            markers: "multi_user_basic"
+            wait-port: 8003
+            needs-playwright: false
+            extra-args: ""
+
           # NOTE: Playwright browser tests are skipped in CI (no browser grant flow).
           # These entries still run non-Playwright tests marked with the same markers.
           - mode: oauth
@@ -68,14 +74,13 @@ jobs:
         with:
           submodules: 'true'
 
-      # Build OIDC app (only needed for oauth/login-flow modes)
       - name: Set up PHP 8.4
-        if: matrix.needs-playwright
         uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # 2.36.0
         with:
           php-version: 8.4
           coverage: none
 
+      # OIDC app only needed for oauth/login-flow modes
       - name: Install OIDC app composer dependencies
         if: matrix.needs-playwright
         run: |
@@ -175,6 +180,17 @@ jobs:
             ${{ matrix.extra-args }} 2>/dev/null \
             | tail -1 || true
 
-      - name: Show service logs on failure
+      - name: Collect service logs on failure
         if: failure()
-        run: docker compose --profile ${{ matrix.profile }} logs --tail=100
+        run: docker compose --profile ${{ matrix.profile }} logs --tail=500 > /tmp/docker-compose-logs.txt 2>&1
+
+      - name: Upload debug artifacts
+        if: failure()
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        with:
+          name: debug-${{ matrix.mode }}
+          path: |
+            /tmp/*.png
+            /tmp/docker-compose-logs.txt
+          retention-days: 7
+          if-no-files-found: ignore

pyproject.toml

@@ -75,6 +75,7 @@ markers = [
     "smoke: Critical path smoke tests for quick validation",
     "keycloak: OAuth tests that utilize keycloak external identity provider",
     "login_flow: Login Flow v2 integration tests (ADR-022)",
+    "multi_user_basic: Multi-user BasicAuth pass-through tests (ADR-020)",
 ]
 testpaths = [
     "tests",

tests/integration/test_multi_user_basic_auth.py

@@ -10,6 +10,7 @@ import pytest
 
 
 @pytest.mark.integration
+@pytest.mark.multi_user_basic
 async def test_basic_auth_pass_through_notes_search(nc_mcp_basic_auth_client):
     """Test BasicAuth pass-through with notes search tool."""
     # Call tool - BasicAuth header is set at connection level by fixture
@@ -27,6 +28,7 @@ async def test_basic_auth_pass_through_notes_search(nc_mcp_basic_auth_client):
 
 
 @pytest.mark.integration
+@pytest.mark.multi_user_basic
 async def test_basic_auth_pass_through_notes_create(nc_mcp_basic_auth_client):
     """Test BasicAuth pass-through with notes create tool."""
     # Create a note using BasicAuth
@@ -47,6 +49,7 @@ async def test_basic_auth_pass_through_notes_create(nc_mcp_basic_auth_client):
 
 
 @pytest.mark.integration
+@pytest.mark.multi_user_basic
 async def test_basic_auth_pass_through_get_note(nc_mcp_basic_auth_client):
     """Test BasicAuth pass-through with get note tool."""
     # First create a note to get