ci(portal): sign orca webhook POST with HMAC-SHA256

When `orca webhooks add` registers a webhook it generates a signing secret by default; orca then requires X-Hub-Signature-256 on inbound POSTs (the public master at :6880 means anyone could otherwise fire a deploy by crafting the JSON body). Adds the signing step using the standard github-shaped header. The secret is consumed from a new Gitea Actions secret ORCA_WEBHOOK_SECRET on this repo — value provided out-of-band from the master. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
ci(portal): retarget image build to registry.meghsakha.com + orca webhook
2026-06-10 12:18:12 +02:00 · 2026-06-10 12:12:44 +02:00
1 changed files with 1 additions and 14 deletions
@@ -11,20 +11,7 @@ export type HostMatch =
  | { kind: "unknown" };
 // Longest-first so `stage.breakpilot.com` is matched before `breakpilot.com`.
-// Built-ins cover dev (localhost) + the canonical breakpilot.com targets.
+const APEX_HOSTS = ["stage.breakpilot.com", "breakpilot.com", "localhost"];
 // PORTAL_APEX_HOSTS is a comma-separated env override for per-environment
 // hosts (e.g. portal-dev.meghsakha.com while breakpilot.com isn't registered).
 const APEX_HOSTS = (() => {
  const base = ["stage.breakpilot.com", "breakpilot.com", "localhost"];
  const extra = (process.env.PORTAL_APEX_HOSTS ?? "")
    .split(",")
    .map((h) => h.trim().toLowerCase())
    .filter(Boolean);
  // Longest-first to keep the suffix-strip loop correct.
  return Array.from(new Set([...extra, ...base])).sort(
    (a, b) => b.length - a.length,
  );
 })();
 const APEX_SET = new Set(APEX_HOSTS);
 export function parseHost(host: string | null | undefined): HostMatch {