From 7dc868cdb7086c42ea352f30ec4ce419fe74405b Mon Sep 17 00:00:00 2001
From: Natalie Rose <natalie@omg.lol>
Date: Tue, 15 Sep 2026 01:25:36 +1000
Subject: [PATCH] Add deploy webhook ping

---
 .tangled/workflows/build.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/.tangled/workflows/build.yml b/.tangled/workflows/build.yml
index 4126969c..65c185f0 100644
--- a/.tangled/workflows/build.yml
+++ b/.tangled/workflows/build.yml
@@ -24,3 +24,25 @@ steps:
         --cache-to "type=registry,ref=atcr.io/tlecommunity.com/app:buildcache,mode=max" \
         .
       docker push "atcr.io/tlecommunity.com/app:latest"
+
+  - name: Deploy Webhook
+    command: |
+      set -euo pipefail
+
+      payload=$(jq -nc \
+        --arg actor "${GITHUB_ACTOR:-unknown}" \
+        --arg ref "${TANGLED_REF:-unknown}" \
+        --arg commit "${TANGLED_SHA:-unknown}" \
+        --arg ci_run_url "${TANGLED_REPOSITORY}/actions/runs/${TANGLED_PIPELINE_ID}" \
+        '{actor: $actor, ref: $ref, commit: $commit, ci_run_url: $ci_run_url}')
+
+      sig=$(printf '%s' "$payload" \
+        | openssl dgst -sha256 -hmac "$DEPLOY_WEBHOOK_SECRET" \
+        | sed 's/^.* //')
+
+      curl -fsS --retry 3 --retry-delay 5 --retry-connrefused \
+        -X POST \
+        -H 'Content-Type: application/json' \
+        -H "X-Hub-Signature-256: sha256=${sig}" \
+        --data "$payload" \
+        "$DEPLOY_WEBHOOK_ENDPOINT"
-- 
2.51.2