token-broker module fails to build: authlib pinned to pre-rename commit with old module path #537

Summary

The token-broker module does not build at v0.4.0-rc.1. Its authlib dependency is pinned to a commit that predates the Kagenti → Rossoctl rename, so the pinned go.mod still declares the old module path while token-broker/go.mod requires the new one. Go rejects the mismatch and the build fails before compilation.

$ cd token-broker && go build ./...
cmd/main.go:33:2: github.com/rossoctl/cortex/authbridge/authlib@v0.0.0-20260619001334-ce3417655ee8: parsing go.mod:
	module declares its path as: github.com/kagenti/kagenti-extensions/authbridge/authlib
	        but was required as: github.com/rossoctl/cortex/authbridge/authlib

Root cause

token-broker/go.mod requires:

github.com/rossoctl/cortex/authbridge/authlib v0.0.0-20260619001334-ce3417655ee8

Commit ce3417655ee8 is dated 2026-06-18, before the rename landed in cortex. At that commit authbridge/authlib/go.mod still declares module github.com/kagenti/kagenti-extensions/authbridge/authlib. The requirement path and the declared path disagree, which is a hard error in the Go module system — no amount of go mod tidy works around it, and go get also refuses to proceed while the existing requirement is unresolvable.

This went unnoticed because token-broker is a separate Go module and is not built by any CI workflow (.github/workflows/release.yml builds only operator/Dockerfile and operator/cmd/agentcard-signer/Dockerfile). Nothing in CI compiles this module, so the breakage is invisible.

Fix

Bump the pin to a post-rename cortex commit. Verified working against the v0.7.0-rc.1 commit 520dc8a30534303f6279f79c4af15837d1683c94:

github.com/rossoctl/cortex/authbridge/authlib v0.0.0-20260915...-520dc8a30534

After the bump plus go mod tidy:

• go build ./... succeeds
• go test ./... passes across all 8 packages (cmd, internal/api, internal/auth, internal/cache, internal/core, internal/oauth, internal/session, pkg/oauth)

There is no API drift. token-broker uses exactly two symbols from authlib — validation.NewLazyJWKSVerifier and validation.Verifier — and authbridge/authlib/plugins/jwtvalidation/validation/ has a zero-line diff between ce3417655ee8 and v0.7.0-rc.1. Both signatures are byte-identical. The only problem is the module path, not the API.

Follow-up: add CI coverage

The underlying reason this shipped broken is that no CI job compiles the module. Even without resolving how token-broker is packaged (see #536), a minimal go build ./... / go test ./... job for token-broker/ would have caught this at the commit that introduced it. Recommend adding that regardless of the packaging outcome.

Relationship to #536

#536 covers folding bundle-service and token-broker into the operator image so they ship in releases. This issue is narrower and independent: the module is broken on its own terms today.

It also removes the main schedule risk noted in #536. That issue flagged the stale authlib pin as an unknown worth timeboxing, on the assumption that three months of drift might mean real API work. It does not — the fix is a one-line go.mod bump. Folding token-broker in is therefore comparable in size to bundle-service, and the two need not be split across releases on that basis.

/cc @davidhadas @cwiklik