From 07c7e75430237793596abc4c7c2ccecc22724298 Mon Sep 17 00:00:00 2001
From: allaun <allaun@researchstack.info>
Date: Sun, 5 Jul 2026 22:40:34 -0500
Subject: [PATCH] docs(infra): document webhook secret injection pattern in
 hooks.yaml template

---
 infra/webhook/hooks.yaml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/infra/webhook/hooks.yaml b/infra/webhook/hooks.yaml
index 367dec85..7b426202 100644
--- a/infra/webhook/hooks.yaml
+++ b/infra/webhook/hooks.yaml
@@ -8,10 +8,11 @@
   trigger-rule:
     and:
       - match:
+          # Secret injected at deploy time from k8s secret webhook-secret via
+          # the cluster-side ConfigMap render (see infra/webhook/deployment.yaml).
+          # The rendered value is NOT committed to git.
           type: payload-hmac-sha256
-          secret:
-            source: env
-            name: WEBHOOK_SECRET
+          secret: "__WEBHOOK_SECRET__"
           parameter:
             source: header
             name: X-Hub-Signature-256
@@ -21,3 +22,4 @@
           parameter:
             source: payload
             name: ref
+