From f6fa736e45ddcc31857f7c0c27fb079c3ca3342c Mon Sep 17 00:00:00 2001
From: Renuka Fernando <renukapiyumal@gmail.com>
Date: Tue, 25 Aug 2026 15:51:38 +0530
Subject: [PATCH] ci: send azure webhook signature as x-webhook-checksum

The Azure DevOps Incoming WebHook service connection reads the HMAC
signature from the `x-webhook-checksum` header and expects the bare
hex digest, not GitHub's `X-Hub-Signature: sha1=<hex>` format. The
mismatched header name caused the webhook to reject requests with
`RequiredHeaderSignatureNotFound` (HTTP 500).

Send the checksum under the correct header and drop the `sha1=`
prefix so Azure can verify the payload.

Signed-off-by: Renuka Fernando <renukapiyumal@gmail.com>
---
 .github/workflows/platform-api-cloud-release.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/platform-api-cloud-release.yml b/.github/workflows/platform-api-cloud-release.yml
index c19d4f2eb0..8dbe5ec380 100644
--- a/.github/workflows/platform-api-cloud-release.yml
+++ b/.github/workflows/platform-api-cloud-release.yml
@@ -67,13 +67,13 @@ jobs:
 
           echo "Payload:"; cat payload.json
 
-          # Azure verifies HMAC-SHA1(secret, body) against the X-Hub-Signature header,
-          # formatted as "sha1=<hex>".
-          SIG="sha1=$(openssl dgst -sha1 -hmac "$AZURE_WEBHOOK_SECRET" payload.json | awk '{print $NF}')"
+          # Azure verifies HMAC-SHA1(secret, body) against the x-webhook-checksum
+          # header. The value is the bare hex digest (no "sha1=" prefix).
+          CHECKSUM="$(openssl dgst -sha1 -hmac "$AZURE_WEBHOOK_SECRET" payload.json | awk '{print $NF}')"
 
           HTTP_CODE=$(curl -sS --connect-timeout 10 --max-time 60 -o response.txt -w '%{http_code}' -X POST "$AZURE_WEBHOOK_URL" \
             -H "Content-Type: application/json" \
-            -H "X-Hub-Signature: $SIG" \
+            -H "x-webhook-checksum: $CHECKSUM" \
             --data-binary @payload.json)
 
           echo "Azure webhook responded with HTTP ${HTTP_CODE}"