Receiver.spec.oidcProviders[]

Audience is the expected audience ('aud' claim) for tokens issued by this provider. Defaults to 'notification-controller'.

IssuerURL is the OIDC issuer URL used for provider discovery. It must match the 'iss' claim of tokens issued by this provider.

• pattern: ^https?://

Validations is the list of CEL boolean expressions evaluated against the token claims and the variables. The request is accepted only if all of them evaluate to true; the message of each failing expression is returned to the caller. At least one validation is required. A valid signature alone does not authorize a request: public issuers issue tokens to any caller on the platform, so the validations must constrain the caller's identity claims (e.g. 'repository_owner' for GitHub Actions).

• minItems: 1

Variables is an optional list of named CEL expressions, evaluated in order and exposed as 'vars.<name>'. Each expression can read the token claims via 'claims' and any variable defined before it. Use it to share sub-expressions across validations.