Refresh external OIDC bridge integration

[miki3421]

Summary

Refresh the external OIDC bridge integration with the latest merged CLI, readiness, and test fixes, plus the open workflow-hardening change.

The integration keeps the identity provider external to the cluster and uses openserverless-admin-api as the local OIDC bridge for namespace authentication.

Submodules

• admin-api → miki3421/openserverless-admin-api:ci/pin-docker-actions (3a1b1be, ci: pin Docker image actions by commit apache/openserverless-admin-api#29); includes merged readiness PR setup the testing repo and run the tests for docker apache/openserverless#28
• cli → apache/openserverless-cli:main (39d3e3d, merged PR discuss versions apache/openserverless#30)
• testing → apache/openserverless-testing:main (192a6b3, merged PR Setup the testing infrastucture apache/openserverless#7)
• olaris → apache/openserverless-task:main (dd2427d, merged PR Update README with build instructions and warning apache/openserverless#207)

Additional integration fixes

• the root Taskfile tags the admin-api image from the admin-api commit instead of reusing the operator commit tag
• the admin-api image workflow pins Docker actions to reviewed commit SHAs

Validation

• task --dry admin-api resolves the admin-api gitlink tag
• git diff --check
• admin-api workflow parses successfully as YAML
• rendered manifests accepted by kubectl apply --dry-run=client
• ./testing/tests/11-sso-mock.sh kind completed successfully in Lima/Kind after a transient ingress 503 retry

Notes

This parent PR remains open. The workflow pinning change is isolated in apache/openserverless-admin-api#29.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request