ci(auth): add GitHub Actions workflow for prompts tenant isolation tests (#5758)

## Summary

- Add a new GitHub Actions workflow that provisions K8s service account
tokens via minikube and runs the prompts tenant isolation integration
tests with real `oauth2_token` auth
- Tests use Alice/Bob pattern with separate K8s service accounts
(`ogx-user1`, `ogx-user2`) to verify cross-tenant data isolation

> **Depends on:** #5756 (multi-tenancy core) — merge that PR first, then
rebase this one.

## Test plan

- [x] Workflow YAML validated locally
- [x] Integration test file runs when server is configured with auth
(`tests/integration/responses/test_prompts_access_control.py`)
- [x] Tests skip gracefully when `ALICE_TOKEN`/`BOB_TOKEN` env vars are
not set

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Signed-off-by: Francisco Javier Arceo <farceo@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: franciscojavierarceo

.github/workflows/README.md

@@ -13,7 +13,7 @@ OGX uses GitHub Actions for Continuous Integration (CI). Below is a table detail
 | File Processors Tests | [file-processors-tests.yml](file-processors-tests.yml) | Run file processors integration tests |
 | Installer CI | [install-script-ci.yml](install-script-ci.yml) | Test the installation script |
 | Integration Auth Tests | [integration-auth-tests.yml](integration-auth-tests.yml) | Run the integration test suite with Kubernetes authentication |
-| Integration Responses & Conversations Auth Tests | [integration-responses-conversations-auth-tests.yml](integration-responses-conversations-auth-tests.yml) | Run responses and conversations auth tests with Kubernetes authentication |
+| Integration Responses, Conversations & Prompts Auth Tests | [integration-responses-conversations-auth-tests.yml](integration-responses-conversations-auth-tests.yml) | Run responses, conversations, and prompts auth tests with Kubernetes authentication |
 | SqlStore Integration Tests | [integration-sql-store-tests.yml](integration-sql-store-tests.yml) | Run the integration test suite with SqlStore |
 | Integration Tests (Replay) | [integration-tests.yml](integration-tests.yml) | Run the integration test suites from tests/integration in replay mode |
 | Vector IO Integration Tests | [integration-vector-io-tests.yml](integration-vector-io-tests.yml) | Run the integration test suite with various VectorIO providers |

.github/workflows/integration-responses-conversations-auth-tests.yml

@@ -1,6 +1,6 @@
-name: Integration Responses & Conversations Auth Tests
+name: Integration Responses, Conversations & Prompts Auth Tests
 
-run-name: Run responses and conversations auth tests with Kubernetes authentication
+run-name: Run responses, conversations, and prompts auth tests with Kubernetes authentication
 
 on:
   push:
@@ -218,6 +218,16 @@ jobs:
                   when:
                     - user is owner
                   description: Users can access their own responses
+                - permit:
+                    actions: [create]
+                    resource: sql_record::prompts::*
+                  description: Any authenticated user can create prompts
+                - permit:
+                    actions: [read, update, delete]
+                    resource: sql_record::prompts::*
+                  when:
+                    - user is owner
+                  description: Users can only access their own prompts
           EOF
           yq eval '.server.auth.provider_config.type = "${{ matrix.auth-provider }}"' -i "$run_dir/config.yaml"
           yq eval '.server.auth.provider_config.tls_cafile = "${{ env.KUBERNETES_CA_CERT_PATH }}"' -i "$run_dir/config.yaml"

scripts/integration-responses-conversations-auth-tests.sh

@@ -32,6 +32,18 @@ uv run pytest tests/integration/conversations/test_openai_conversations.py \
 echo ""
 echo "✓ Conversations isolation tests completed successfully!"
 
+echo ""
+echo "Running prompts isolation tests..."
+
+uv run pytest tests/integration/responses/test_prompts_access_control.py \
+    -k "TestPromptsAccessControl" \
+    --stack-config="$OGX_SERVER_URL" \
+    -v -s \
+    --color=yes || exit 1
+
+echo ""
+echo "✓ Prompts isolation tests completed successfully!"
+
 # Run responses access control tests if INFERENCE_MODEL is set
 # Uses record-if-missing mode: replays from recordings if available, records if API key is set
 if [ -n "${INFERENCE_MODEL:-}" ]; then