- id: deploy
  execute-command: /scripts/deploy.sh
  command-working-directory: /repos
  pass-arguments-to-command:
    - source: payload
      name: repository.name
  response-message: "Deploy triggered"
  trigger-rule:
    and:
      - match:
          # Secret injected at deploy time from k8s secret webhook-secret via
          # the cluster-side ConfigMap render (see infra/webhook/deployment.yaml).
          # The rendered value is NOT committed to git.
          type: payload-hmac-sha256
          secret: "__WEBHOOK_SECRET__"
          parameter:
            source: header
            name: X-Hub-Signature-256
      - match:
          type: value
          value: refs/heads/main
          parameter:
            source: payload
            name: ref