Use PAT to clone private test-datasets submodule in CI.

Document the CHEMSPECTRA_TEST_FILES_PAT secret setup for maintainers.

Author: Nicolass67

.github/workflows/unit_test.yml

@@ -9,6 +9,20 @@ jobs:
     - uses: actions/checkout@v5
       with:
         submodules: recursive
+        # chem-spectra-test-files is private; use a PAT with repo read access,
+        # or enable org-wide GITHUB_TOKEN access, or make the dataset repo public.
+        token: ${{ secrets.CHEMSPECTRA_TEST_FILES_PAT != '' && secrets.CHEMSPECTRA_TEST_FILES_PAT || github.token }}
+    - name: Verify test-datasets submodule
+      run: |
+        if [ ! -f test-datasets/catalog/datasets.json ]; then
+          echo "::error::Submodule test-datasets is missing."
+          echo "chem-spectra-test-files is a private repository."
+          echo "Fix options:"
+          echo "  1. Add repo secret CHEMSPECTRA_TEST_FILES_PAT (read access to ComPlat/chem-spectra-test-files)"
+          echo "  2. Enable org setting: Actions may access other repositories in ComPlat"
+          echo "  3. Make ComPlat/chem-spectra-test-files public"
+          exit 1
+        fi
     - uses: actions/setup-python@v6
       with:
         check-latest: true

INSTALL.md

@@ -152,3 +152,22 @@ gunicorn -w 4 -b 0.0.0.0:3007 server:app --daemon
 ```sh
 python -m pytest
 ```
+
+### 3.1. CI configuration (maintainers)
+
+The `test-datasets` submodule points to
+[ComPlat/chem-spectra-test-files](https://github.com/ComPlat/chem-spectra-test-files),
+which is currently **private**. GitHub Actions cannot clone it without credentials.
+
+Choose one fix:
+
+1. **Recommended for open test data:** make `chem-spectra-test-files` public.
+2. **Repository secret:** add `CHEMSPECTRA_TEST_FILES_PAT` on `chem-spectra-app`
+   (Settings → Secrets and variables → Actions). Use a fine-grained PAT or classic
+   PAT with read access to `ComPlat/chem-spectra-test-files`.
+3. **Organization setting:** in ComPlat org settings, allow GitHub Actions
+   workflows to access other private repositories (then the default
+   `GITHUB_TOKEN` may be sufficient).
+
+The workflow validates that `test-datasets/catalog/datasets.json` exists after
+checkout and prints these instructions if the submodule failed to initialize.