- webhook.js: fail-closed on missing WEBHOOK_SECRET (exits at startup, never accepts unsigned requests) - webhook.js: single-slot queue — push during deploy is held and runs after current deploy completes (not silently dropped) - deploy.sh + health-check.sh: URL corrected to /api/healthz
4.6 KiB
4.6 KiB