Added
oauth.server.tokenExchangeBroker.targets[].type: credential provider discriminator for broker targets. Defaults tooidc-exchange(downstream Dex RFC 8693 exchange) when omitted; additional provider types will be added in future releases.oauth.server.tokenExchangeBroker.targets[].type: github-appmints GitHub App installation tokens. Configure viagithubApp.appId,githubApp.installationId(orgithubApp.owner+githubApp.repofor auto-discovery),githubApp.privateKeyRef(RSA PEM in a Kubernetes Secret), and optionalgithubApp.repositories/githubApp.permissionsscope restriction.
Changed
- Broker credential minting extracted behind a
CredentialProviderinterface and anoidc-exchangeprovider dispatched through a registry (internal/oauth). No behaviour change; the oidc-exchange provider preserves per-(endpoint, connector, user) token caching.