fix(webhook): port shebang to /bin/sh and add automatic package installation

infra/webhook/deploy.sh

@@ -1,8 +1,8 @@
-#!/bin/bash
-set -euo pipefail
+#!/bin/sh
+set -eu
 
 REPO="${1:-}"
-if [[ -z "$REPO" ]]; then
+if [ -z "$REPO" ]; then
   echo "Usage: $0 <repo-name>" >&2
   exit 1
 fi
@@ -23,7 +23,7 @@ log "Git updated to $(git rev-parse --short HEAD)"
 case "$REPO" in
   SilverSight)
     # Homarr
-    if [[ -f "$SECRETS_DIR/homarr-values.enc.yaml" ]]; then
+    if [ -f "$SECRETS_DIR/homarr-values.enc.yaml" ]; then
       log "Deploying Homarr..."
       sops --decrypt --output-type yaml "$SECRETS_DIR/homarr-values.enc.yaml" > /tmp/homarr-values.yaml
       helm upgrade --install homarr oci://ghcr.io/homarr-labs/charts/homarr \
@@ -34,7 +34,7 @@ case "$REPO" in
     fi
 
     # Authentik
-    if [[ -f "$SECRETS_DIR/authentik-values.enc.yaml" ]]; then
+    if [ -f "$SECRETS_DIR/authentik-values.enc.yaml" ]; then
       log "Deploying Authentik..."
       sops --decrypt --output-type yaml "$SECRETS_DIR/authentik-values.enc.yaml" > /tmp/authentik-values.yaml
       helm upgrade --install authentik oci://ghcr.io/goauthentik/helm-charts/authentik \

infra/webhook/deployment.yaml

@@ -23,7 +23,7 @@ spec:
       serviceAccountName: webhook-deployer
       containers:
         - name: webhook
-          image: ghcr.io/adnanh/webhook:latest
+          image: almir/webhook:latest
           args:
             - -hooks=/config/hooks.yaml
             - -verbose
@@ -31,6 +31,12 @@ spec:
           ports:
             - containerPort: 9000
               name: http
+          securityContext:
+            runAsUser: 0
+          lifecycle:
+            postStart:
+              exec:
+                command: ["/bin/sh", "-c", "apk add --no-cache git helm sops"]
           env:
             - name: WEBHOOK_SECRET
               valueFrom: