From b40dd896bbe22e1efd0f8f1f72278fe11181ea60 Mon Sep 17 00:00:00 2001
From: allaun <allaun@researchstack.info>
Date: Sun, 5 Jul 2026 23:22:01 -0500
Subject: [PATCH] fix(webhook): port shebang to /bin/sh and add automatic
 package installation

---
 infra/webhook/deploy.sh       | 10 +++++-----
 infra/webhook/deployment.yaml |  8 +++++++-
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/infra/webhook/deploy.sh b/infra/webhook/deploy.sh
index 3159361f..3b20f022 100644
--- a/infra/webhook/deploy.sh
+++ b/infra/webhook/deploy.sh
@@ -1,8 +1,8 @@
-#!/bin/bash
-set -euo pipefail
+#!/bin/sh
+set -eu
 
 REPO="${1:-}"
-if [[ -z "$REPO" ]]; then
+if [ -z "$REPO" ]; then
   echo "Usage: $0 <repo-name>" >&2
   exit 1
 fi
@@ -23,7 +23,7 @@ log "Git updated to $(git rev-parse --short HEAD)"
 case "$REPO" in
   SilverSight)
     # Homarr
-    if [[ -f "$SECRETS_DIR/homarr-values.enc.yaml" ]]; then
+    if [ -f "$SECRETS_DIR/homarr-values.enc.yaml" ]; then
       log "Deploying Homarr..."
       sops --decrypt --output-type yaml "$SECRETS_DIR/homarr-values.enc.yaml" > /tmp/homarr-values.yaml
       helm upgrade --install homarr oci://ghcr.io/homarr-labs/charts/homarr \
@@ -34,7 +34,7 @@ case "$REPO" in
     fi
 
     # Authentik
-    if [[ -f "$SECRETS_DIR/authentik-values.enc.yaml" ]]; then
+    if [ -f "$SECRETS_DIR/authentik-values.enc.yaml" ]; then
       log "Deploying Authentik..."
       sops --decrypt --output-type yaml "$SECRETS_DIR/authentik-values.enc.yaml" > /tmp/authentik-values.yaml
       helm upgrade --install authentik oci://ghcr.io/goauthentik/helm-charts/authentik \
diff --git a/infra/webhook/deployment.yaml b/infra/webhook/deployment.yaml
index c1a8d9b5..d106e18b 100644
--- a/infra/webhook/deployment.yaml
+++ b/infra/webhook/deployment.yaml
@@ -23,7 +23,7 @@ spec:
       serviceAccountName: webhook-deployer
       containers:
         - name: webhook
-          image: ghcr.io/adnanh/webhook:latest
+          image: almir/webhook:latest
           args:
             - -hooks=/config/hooks.yaml
             - -verbose
@@ -31,6 +31,12 @@ spec:
           ports:
             - containerPort: 9000
               name: http
+          securityContext:
+            runAsUser: 0
+          lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh", "-c", "apk add --no-cache git helm sops"]
           env:
             - name: WEBHOOK_SECRET
               valueFrom: