feat(go-validate): Go fast-path sidecar for the /validate hot path

.env.example

@@ -1915,3 +1915,37 @@ OPENBAO_ROLE=
 # or let build_and_run.sh generate one. Do NOT reuse the old "dev-root-token"
 # literal — the preflight validator rejects it.
 OPENBAO_TOKEN=
+
+# ---------------------------------------------------------------------------
+# Go /validate fast-path sidecar (go-validate) - issue #1652, PR #1653
+# ---------------------------------------------------------------------------
+# nginx routes the /validate auth_request subrequest to this sidecar. It fast-paths
+# the configured-IdP RS256 bearer path and reverse-proxies everything else to the
+# Python auth-server, so it is a SAFE transparent proxy until the fast-path vars
+# below are set. Leave VALIDATE_UPSTREAM_URL unset on deployments without the sidecar
+# (Terraform/ECS, Helm, podman/prebuilt compose): /validate then defaults to the
+# auth-server, i.e. unchanged behavior.
+#
+# Route /validate to the sidecar (docker-compose default). Set to
+# http://auth-server:8888 to bypass the sidecar entirely.
+# ENABLE/DISABLE SWITCH (docker-compose): this routes nginx /validate.
+#   http://go-validate:8899  -> fast path ON (route through the sidecar) [default]
+#   http://auth-server:8888   -> fast path OFF (bypass the sidecar, pure Python)
+VALIDATE_UPSTREAM_URL=http://go-validate:8899
+# JWKS endpoint the sidecar fetches signing keys from (must be reachable from the
+# sidecar container). Auto-derived from KEYCLOAK_URL + KEYCLOAK_REALM when empty.
+VALIDATE_JWKS_URL=
+# Accepted token issuers - the `iss` claim. Leave empty to auto-derive the SAME
+# three URLs Python accepts (external + internal + localhost realm), so browser-login
+# AND service/M2M tokens both fast-path. Accepts a comma/space-separated LIST to
+# override; a token whose iss matches ANY member is accepted (others -> Python).
+VALIDATE_ISSUER=
+# Accepted token audiences - the `aud` claim. Leave empty to auto-derive the SAME set
+# Python accepts (KEYCLOAK_CLIENT_ID + KEYCLOAK_M2M_CLIENT_ID + "mcp-gateway"). Accepts
+# a comma/space-separated LIST; a token whose aud contains ANY member is accepted.
+# Do NOT use "account": it rides on every realm token and is refused as an audience
+# (accepting it is a cross-client confused-deputy; Python rejects it too). A non-matching
+# audience is deferred to Python, never a 401.
+VALIDATE_AUDIENCE=
+# JWKS cache refresh interval (seconds).
+JWKS_REFRESH_SECONDS=300

.github/workflows/release-images.yml

@@ -37,12 +37,18 @@ jobs:
         include:
           - service: auth-server
             dockerfile: docker/Dockerfile.auth
+            context: .
           - service: registry
             dockerfile: docker/Dockerfile.registry
+            context: .
           - service: mcpgw
             dockerfile: docker/Dockerfile.mcp-server
+            context: .
             extra_build_args: |-
               SERVER_DIR=servers/mcpgw
+          - service: go-validate
+            dockerfile: go-validate/Dockerfile
+            context: go-validate
 
     steps:
       - name: Checkout code
@@ -86,7 +92,7 @@ jobs:
         id: push
         uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
-          context: .
+          context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
           push: true
           platforms: linux/amd64,linux/arm64