{
  "description": "Receiver is the Schema for the receivers API.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": [
        "string",
        "null"
      ]
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": [
        "string",
        "null"
      ]
    },
    "metadata": {
      "type": [
        "object",
        "null"
      ]
    },
    "spec": {
      "additionalProperties": false,
      "description": "ReceiverSpec defines the desired state of the Receiver.",
      "properties": {
        "events": {
          "description": "Events specifies the list of event types to handle,\ne.g. 'push' for GitHub or 'Push Hook' for GitLab.",
          "items": {
            "type": "string"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "interval": {
          "default": "10m",
          "description": "Interval at which to reconcile the Receiver with its Secret references.",
          "pattern": "^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$",
          "type": [
            "string",
            "null"
          ]
        },
        "oidcProviders": {
          "description": "OIDCProviders specifies the OIDC providers used to authenticate incoming\nrequests when Type is 'generic-oidc'. The provider whose IssuerURL matches\nthe token's 'iss' claim is used to verify the token signature, expiration\nand audience, and to evaluate the configured CEL validations against the\ntoken claims.",
          "items": {
            "additionalProperties": false,
            "description": "OIDCProvider configures an OIDC issuer used to authenticate requests for a\n'generic-oidc' Receiver.",
            "properties": {
              "audience": {
                "description": "Audience is the expected audience ('aud' claim) for tokens issued by\nthis provider. Defaults to 'notification-controller'.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "issuerURL": {
                "description": "IssuerURL is the OIDC issuer URL used for provider discovery. It must\nmatch the 'iss' claim of tokens issued by this provider.",
                "pattern": "^https?://",
                "type": "string"
              },
              "validations": {
                "description": "Validations is the list of CEL boolean expressions evaluated against the\ntoken claims and the variables. The request is accepted only if all of\nthem evaluate to true; the message of each failing expression is returned\nto the caller.\n\nAt least one validation is required. A valid signature alone does not\nauthorize a request: public issuers issue tokens to any caller on the\nplatform, so the validations must constrain the caller's identity claims\n(e.g. 'repository_owner' for GitHub Actions).",
                "items": {
                  "additionalProperties": false,
                  "description": "OIDCValidation is a CEL boolean expression evaluated against the OIDC token\nclaims and variables of a 'generic-oidc' Receiver.",
                  "properties": {
                    "expression": {
                      "description": "Expression is the CEL boolean expression to evaluate.",
                      "type": "string"
                    },
                    "message": {
                      "description": "Message is returned to the caller when the expression evaluates to false.",
                      "type": "string"
                    }
                  },
                  "required": [
                    "expression",
                    "message"
                  ],
                  "type": "object"
                },
                "minItems": 1,
                "type": "array"
              },
              "variables": {
                "description": "Variables is an optional list of named CEL expressions, evaluated in order\nand exposed as 'vars.\u003cname\u003e'. Each expression can read the token claims\nvia 'claims' and any variable defined before it. Use it to share\nsub-expressions across validations.",
                "items": {
                  "additionalProperties": false,
                  "description": "OIDCVariable is a named CEL expression evaluated against the OIDC token\nclaims of a 'generic-oidc' Receiver.",
                  "properties": {
                    "expression": {
                      "description": "Expression is the CEL expression that defines the variable value.",
                      "type": "string"
                    },
                    "name": {
                      "description": "Name is the variable name; it must be a valid CEL identifier.",
                      "type": "string"
                    }
                  },
                  "required": [
                    "expression",
                    "name"
                  ],
                  "type": "object"
                },
                "type": [
                  "array",
                  "null"
                ]
              }
            },
            "required": [
              "issuerURL",
              "validations"
            ],
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ],
          "x-kubernetes-list-map-keys": [
            "issuerURL"
          ],
          "x-kubernetes-list-type": "map"
        },
        "resourceFilter": {
          "description": "ResourceFilter is a CEL expression expected to return a boolean that is\nevaluated for each resource referenced in the Resources field when a\nwebhook is received. If the expression returns false then the controller\nwill not request a reconciliation for the resource.\nThe expression can read the resource metadata via 'res' and the webhook\nrequest body via 'req'. For generic-oidc receivers, the verified OIDC\ntoken claims are also available via 'claims'.\nWhen the expression is specified the controller will parse it and mark\nthe object as terminally failed if the expression is invalid or does not\nreturn a boolean.",
          "type": [
            "string",
            "null"
          ]
        },
        "resources": {
          "description": "A list of resources to be notified about changes.",
          "items": {
            "additionalProperties": false,
            "description": "ReceiverResource references a resource to be notified about changes, with an\noptional per-resource CEL filter.",
            "properties": {
              "apiVersion": {
                "description": "API version of the referent",
                "type": [
                  "string",
                  "null"
                ]
              },
              "filter": {
                "description": "Filter is a CEL expression expected to return a boolean that is evaluated\nfor each resource matched by this reference when a webhook is received,\nin addition to the top-level resourceFilter. A reconciliation is requested\nonly when both expressions (when set) return true.\nThe expression can read the resource metadata via 'res' and the webhook\nrequest body via 'req'. For generic-oidc receivers, the verified OIDC\ntoken claims are also available via 'claims'.\nWhen the expression is specified the controller will parse it and mark\nthe object as terminally failed if the expression is invalid or does not\nreturn a boolean.",
                "type": [
                  "string",
                  "null"
                ]
              },
              "kind": {
                "description": "Kind of the referent",
                "enum": [
                  "Bucket",
                  "GitRepository",
                  "Kustomization",
                  "HelmRelease",
                  "HelmChart",
                  "HelmRepository",
                  "ImageRepository",
                  "ImagePolicy",
                  "ImageUpdateAutomation",
                  "OCIRepository",
                  "ArtifactGenerator",
                  "ExternalArtifact",
                  "FluxInstance",
                  "ResourceSet",
                  "ResourceSetInputProvider"
                ],
                "type": "string"
              },
              "matchLabels": {
                "additionalProperties": {
                  "type": "string"
                },
                "description": "MatchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels\nmap is equivalent to an element of matchExpressions, whose key field is \"key\", the\noperator is \"In\", and the values array contains only \"value\". The requirements are ANDed.\nMatchLabels requires the name to be set to `*`.",
                "type": [
                  "object",
                  "null"
                ]
              },
              "name": {
                "description": "Name of the referent\nIf multiple resources are targeted `*` may be set.",
                "maxLength": 253,
                "minLength": 1,
                "type": "string"
              },
              "namespace": {
                "description": "Namespace of the referent",
                "maxLength": 253,
                "minLength": 1,
                "type": [
                  "string",
                  "null"
                ]
              }
            },
            "required": [
              "kind",
              "name"
            ],
            "type": "object"
          },
          "type": "array"
        },
        "secretRef": {
          "additionalProperties": false,
          "description": "SecretRef specifies the Secret containing the token used\nto validate the payload authenticity. The Secret must contain a 'token'\nkey. For GCR receivers, the Secret must also contain an 'email' key\nwith the IAM service account email configured on the Pub/Sub push\nsubscription, and an 'audience' key with the expected OIDC token audience.\n\nRequired for all receiver types except 'generic-oidc', which authenticates\nrequests using the OIDC token instead and must not set this field.",
          "properties": {
            "name": {
              "description": "Name of the referent.",
              "type": "string"
            }
          },
          "required": [
            "name"
          ],
          "type": [
            "object",
            "null"
          ]
        },
        "suspend": {
          "description": "Suspend tells the controller to suspend subsequent\nevents handling for this receiver.",
          "type": [
            "boolean",
            "null"
          ]
        },
        "type": {
          "description": "Type of webhook sender, used to determine\nthe validation procedure and payload deserialization.",
          "enum": [
            "generic",
            "generic-hmac",
            "generic-oidc",
            "github",
            "gitlab",
            "bitbucket",
            "harbor",
            "dockerhub",
            "quay",
            "gcr",
            "nexus",
            "acr",
            "cdevents"
          ],
          "type": "string"
        }
      },
      "required": [
        "resources",
        "type"
      ],
      "type": [
        "object",
        "null"
      ],
      "x-kubernetes-validations": [
        {
          "message": "generic-oidc receivers must define at least one oidcProvider",
          "rule": "self.type != 'generic-oidc' || (has(self.oidcProviders) \u0026\u0026 size(self.oidcProviders) \u003e 0)"
        },
        {
          "message": "oidcProviders can only be set when type is generic-oidc",
          "rule": "self.type == 'generic-oidc' || !has(self.oidcProviders) || size(self.oidcProviders) == 0"
        },
        {
          "message": "secretRef cannot be set when type is generic-oidc",
          "rule": "self.type != 'generic-oidc' || !has(self.secretRef)"
        },
        {
          "message": "secretRef is required when type is not generic-oidc",
          "rule": "self.type == 'generic-oidc' || has(self.secretRef)"
        }
      ]
    },
    "status": {
      "additionalProperties": false,
      "default": {
        "observedGeneration": -1
      },
      "description": "ReceiverStatus defines the observed state of the Receiver.",
      "properties": {
        "conditions": {
          "description": "Conditions holds the conditions for the Receiver.",
          "items": {
            "additionalProperties": false,
            "description": "Condition contains details for one aspect of the current state of this API Resource.",
            "properties": {
              "lastTransitionTime": {
                "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
                "format": "date-time",
                "type": "string"
              },
              "message": {
                "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
                "maxLength": 32768,
                "type": "string"
              },
              "observedGeneration": {
                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
                "format": "int64",
                "minimum": 0,
                "type": [
                  "integer",
                  "null"
                ]
              },
              "reason": {
                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
                "maxLength": 1024,
                "minLength": 1,
                "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
                "type": "string"
              },
              "status": {
                "description": "status of the condition, one of True, False, Unknown.",
                "enum": [
                  "True",
                  "False",
                  "Unknown"
                ],
                "type": "string"
              },
              "type": {
                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
                "maxLength": 316,
                "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
                "type": "string"
              }
            },
            "required": [
              "lastTransitionTime",
              "message",
              "reason",
              "status",
              "type"
            ],
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "lastHandledReconcileAt": {
          "description": "LastHandledReconcileAt holds the value of the most recent\nreconcile request value, so a change of the annotation value\ncan be detected.",
          "type": [
            "string",
            "null"
          ]
        },
        "observedGeneration": {
          "description": "ObservedGeneration is the last observed generation of the Receiver object.",
          "format": "int64",
          "type": [
            "integer",
            "null"
          ]
        },
        "webhookPath": {
          "description": "WebhookPath is the generated incoming webhook address in the format\nof '/hook/sha256sum(token+name+namespace)'.",
          "type": [
            "string",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ]
    }
  },
  "type": "object"
}