mirror of
https://github.com/opensourcepos/opensourcepos.git
synced 2026-05-29 10:47:53 -04:00
832b0e686f
Security fixes: - Use jq for JSON payload construction (prevents script injection) - Add HMAC-SHA256 signature verification for webhook security - Move untrusted inputs to env: blocks instead of inline interpolation Robustness fixes: - Add curl timeouts (--connect-timeout 10, --max-time 120) - Fail when DEPLOY_WEBHOOK_URL is missing (was incorrectly succeeding) - Add set -euo pipefail for error handling - Fix required_contexts JSON array syntax (-F required_contexts[]) - Add deployment: false to prevent duplicate deployment records Workflow improvements: - Add concurrency groups to serialize same-environment deployments - Remove unused skip_approval input - Fix workflow_call inputs (removed required: true where default exists) - Use vars.DEPLOY_URL for configurable environment URLs