feat: Add integration test workflow + Python 3.12 setuptools fix (#611)

* feat: Add GitHub Actions workflow to trigger IIAB integration tests

This workflow enables automated integration testing with Internet-in-a-Box (IIAB):

- Triggers on PR labeled 'test-iiab-integration'
- Triggers on merge to master
- Dispatches events to ascoderu/iiab-lokole-tests repository
- Posts test results back to PRs

Related to integration test suite at:
https://github.com/ascoderu/iiab-lokole-tests

* fix: Use pull_request_target to enable secrets access for labeled fork PRs

This implements the 'safe to test' pattern used by major OSS projects:
- Maintainers explicitly approve fork PRs by adding test-iiab-integration label
- pull_request_target runs in base repo context with access to secrets
- Safe because we don't checkout/execute PR code, only read metadata
- Enables integration testing for fork PRs after maintainer review

Fixes the workflow failure on fork PRs while maintaining security.

* chore: Remove trailing whitespace

* fix: add setuptools for Python 3.12+ compatibility

Python 3.12+ no longer includes setuptools by default, but flask-security
3.0.0 imports pkg_resources which requires it. This fixes the error:
ModuleNotFoundError: No module named 'pkg_resources'

* fix: pin setuptools <73 as newer versions removed pkg_resources

Setuptools 73+ removed pkg_resources module which is still required by
flask-security 3.0.0. Testing showed:
- setuptools 72.2.0: ✅ pkg_resources available (deprecated but works)
- setuptools 82.0.0: ❌ pkg_resources removed

Constraint: setuptools>=65.5.0,<73.0.0

* fix: Add setuptools constraint to requirements.txt for gunicorn compatibility

API server was crashing with 'ModuleNotFoundError: No module named pkg_resources'
because gunicorn requires pkg_resources from setuptools, but setuptools 73+
removed this module.

The constraint was already in requirements-webapp.txt for the client, but
requirements.txt (used by API/worker containers) was missing it, causing
the API container to fail on startup.

Root cause: docker/app/Dockerfile installs both requirements-webapp.txt AND
requirements.txt, but the latter lacked the setuptools constraint, allowing
pip to install setuptools 73+ which doesn't provide pkg_resources.

Fix: Add setuptools>=65.5.0,<73.0.0 to requirements.txt to ensure pkg_resources
is available for gunicorn in Python 3.9 API/worker containers.

Fixes: Integration test failures where API container exits with code 1

Author: dahagag

.github/workflows/trigger-integration-tests.yml

@@ -0,0 +1,51 @@
+name: Trigger Integration Tests
+
+on:
+  # Use pull_request_target for fork PRs to access secrets when labeled by maintainers
+  # This is safe because:
+  # 1. We don't checkout or execute any code from the PR
+  # 2. We only read PR metadata and dispatch to another repo
+  # 3. The label must be manually added by someone with write access
+  pull_request_target:
+    types: [labeled]
+  push:
+    branches:
+      - master
+
+jobs:
+  trigger-on-label:
+    if: github.event_name == 'pull_request_target' && contains(github.event.pull_request.labels.*.name, 'test-iiab-integration')
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Trigger integration tests
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.INTEGRATION_TEST_PAT }}
+          repository: ascoderu/iiab-lokole-tests
+          event-type: test-integration-lokole
+          client-payload: |
+            {
+              "pr_number": ${{ github.event.pull_request.number }},
+              "ref": "${{ github.event.pull_request.head.ref }}",
+              "sha": "${{ github.event.pull_request.head.sha }}",
+              "repo": "${{ github.repository }}"
+            }
+
+  trigger-on-merge:
+    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Trigger post-merge tests
+        uses: peter-evans/repository-dispatch@v2
+        with:
+          token: ${{ secrets.INTEGRATION_TEST_PAT }}
+          repository: ascoderu/iiab-lokole-tests
+          event-type: lokole-merged
+          client-payload: |
+            {
+              "branch": "${{ github.ref_name }}",
+              "sha": "${{ github.sha }}",
+              "repo": "${{ github.repository }}"
+            }

requirements-webapp.txt

@@ -1,3 +1,4 @@
+setuptools>=65.5.0,<73.0.0  # Required for pkg_resources in Python 3.12+ (no longer included by default). Upper bound because setuptools 73+ removed pkg_resources
 Babel==2.14.0  # 2.14.0+ required for Python 3.13 (removed cgi module dependency)
 Flask-BabelEx==0.9.4
 pytz  # Required by Flask-BabelEx (no longer a transitive dep of Babel 2.14+)

requirements.txt

@@ -1,6 +1,7 @@
 Flask==2.2.1
 Flask-Cors==3.0.10
 Pillow==10.4.0  # 10.1.0+ required for Python 3.13 support
+setuptools>=65.5.0,<73.0.0  # Required for pkg_resources (gunicorn dependency). setuptools 73+ removed pkg_resources
 apache-libcloud==3.6.0
 applicationinsights==0.11.10
 beautifulsoup4==4.11.1