ci: fix platform-api cloud-release webhook trigger and signature

[renuka-fernando]

Purpose

Bring the Platform API Cloud Release workflow fixes already landed on (or in flight for) platform-api/v0.10.x over to main, so a merge into main triggers the Azure DevOps build correctly. The workflow header comment requires this file to stay identical across the release branches it lists. On main today it still has two problems:

1. Wrong signature header/format. Azure's Incoming WebHook service connection reads the HMAC from the x-webhook-checksum header and expects the bare hex digest, but the workflow sent GitHub's X-Hub-Signature: sha1=<hex>, so Azure rejected requests with RequiredHeaderSignatureNotFound (HTTP 500).
2. Secrets unset on fork-PR merges. The pull_request: [closed] trigger gives no repository secrets to runs for PRs opened from forks, so those merges failed the pre-flight secret check.

Approach

• Send the HMAC-SHA1 checksum under the x-webhook-checksum header and drop the sha1= prefix (bare hex digest).
• Switch the trigger from pull_request: [closed] to push on the release branches (main, platform-api/v0.10.x); a merge produces a push, which runs with full secret access and executes the workflow version on the pushed branch.
• Drop the merged-PR if: guard and replace the pull_request-specific BRANCH/COMMIT expressions with github.ref_name / github.sha.

Related Issues

N/A

Related PRs

• ci: fix platform-api cloud-release webhook trigger and signature #3311 (header/checksum fix, merged into platform-api/v0.10.x)
• ci: trigger platform-api cloud release on push, not pull_request #3312 (push-trigger, open against platform-api/v0.10.x)

Automation tests

N/A — CI workflow change only. Verified against the Azure DevOps webhook with a manual curl matching the header/checksum format, and via a manual workflow_dispatch run.

Security checks

• Followed secure coding standards? yes
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes — the secret is still read from secrets.AZURE_WEBHOOK_SECRET.

Checklist

• Tests added or updated (unit, integration, etc.)
• Samples updated (if applicable)

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: ceb5ca27-bfd5-4ab7-afc7-39c86199af58

📥 Commits

Reviewing files that changed from the base of the PR and between 0a09d90 and cd56b8e.

📒 Files selected for processing (1)

• .github/workflows/platform-api-cloud-release.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The release workflow now runs on pushes to main and platform-api/v0.10.x. It uses push-based branch and commit context and sends the webhook checksum in the updated header format.

Changes

Release workflow delivery

Layer / File(s)	Summary
Push trigger and release context .github/workflows/platform-api-cloud-release.yml	The workflow trigger changed to push for the release branches. The job no longer checks pull request merge conditions and uses github.ref_name and github.sha.
Webhook signature format .github/workflows/platform-api-cloud-release.yml	The request header changed to x-webhook-checksum and now carries the bare HMAC-SHA1 digest.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to cd56b

This localized workflow change updates the cloud-release trigger and webhook signature handling; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: anugayan, arshardh, ashera96

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CI workflow, webhook trigger, and signature fixes.
Description check	✅ Passed	The description explains the purpose, implementation approach, related issues and PRs, validation steps, and key security information. It omits or only partially covers several template sections, incl…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description explains the purpose, implementation approach, related issues and PRs, validation steps, and key security information. It omits or only partially covers several template sections, including Goals, User stories, Documentation, FindSecurityBugs verification, Samples, and Test environment, but the core information is complete for this CI-only change.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}