feat: add /deploy-plugins webhook route + deploy-plugins script

cmd/webhook/main.go

@@ -17,21 +17,84 @@ import (
 	"github.com/dtoro/oikos/internal/safego"
 )
 
+type webhookHandler struct {
+	secret string
+	script string
+}
+
+func (h *webhookHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodPost {
+		http.Error(w, "method not allowed", 405)
+		return
+	}
+
+	body, err := io.ReadAll(r.Body)
+	if err != nil {
+		http.Error(w, "read body failed", 400)
+		return
+	}
+
+	sigHex := r.Header.Get("X-Hub-Signature-256")
+	if sigHex == "" {
+		http.Error(w, "missing signature", 401)
+		return
+	}
+
+	mac := hmac.New(sha256.New, []byte(h.secret))
+	mac.Write(body)
+	expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
+
+	if !hmac.Equal([]byte(sigHex), []byte(expected)) {
+		slog.Warn("webhook: invalid signature")
+		http.Error(w, "invalid signature", 401)
+		return
+	}
+
+	slog.Info("webhook: deploy triggered", "script", h.script)
+	w.WriteHeader(http.StatusAccepted)
+	w.Write([]byte(`{"status":"deploy started"}`))
+
+	safego.Go("webhook:"+h.script, func() {
+		apiToken := ""
+		if sec != nil {
+			apiToken = secrets.ResolveSecret(ctx, sec, "api_token", "")
+		}
+		cmd := exec.Command(h.script)
+		cmd.Dir = repoDir
+		cmd.Env = append(os.Environ(),
+			"REPO_DIR="+repoDir,
+			"PROFILE=full",
+			"OIKOS_API_TOKEN="+apiToken,
+		)
+		cmd.Stdout = os.Stdout
+		cmd.Stderr = os.Stderr
+		start := time.Now()
+		if err := cmd.Run(); err != nil {
+			slog.Error("webhook: deploy failed", "script", h.script, "error", err, "duration", time.Since(start))
+			return
+		}
+		slog.Info("webhook: deploy succeeded", "script", h.script, "duration", time.Since(start))
+	})
+}
+
+var ctx context.Context
+var sec *secrets.Manager
+var repoDir string
+
 func main() {
-	ctx := context.Background()
+	ctx = context.Background()
 
 	port := os.Getenv("WEBHOOK_LISTEN")
 	if port == "" {
 		port = ":9797"
 	}
 
-	repoDir := os.Getenv("WEBHOOK_REPO_DIR")
+	repoDir = os.Getenv("WEBHOOK_REPO_DIR")
 	if repoDir == "" {
 		repoDir = os.Getenv("HOME") + "/Projects/oikos"
 	}
 
-	// Create secrets manager once, share between HMAC resolution and deploy
-	sec := newSecrets()
+	sec = newSecrets()
 	secret := resolveWebhookHMAC(ctx, sec)
 	if secret == "" {
 		fmt.Fprintln(os.Stderr, "WEBHOOK_HMAC_SECRET must be set (env var or Infisical webhook_hmac-secret)")
@@ -39,60 +102,8 @@ func main() {
 	}
 
 	mux := http.NewServeMux()
-	mux.HandleFunc("/deploy", func(w http.ResponseWriter, r *http.Request) {
-		if r.Method != http.MethodPost {
-			http.Error(w, "method not allowed", 405)
-			return
-		}
-
-		body, err := io.ReadAll(r.Body)
-		if err != nil {
-			http.Error(w, "read body failed", 400)
-			return
-		}
-
-		sigHex := r.Header.Get("X-Hub-Signature-256")
-		if sigHex == "" {
-			http.Error(w, "missing signature", 401)
-			return
-		}
-
-		mac := hmac.New(sha256.New, []byte(secret))
-		mac.Write(body)
-		expected := "sha256=" + hex.EncodeToString(mac.Sum(nil))
-
-		if !hmac.Equal([]byte(sigHex), []byte(expected)) {
-			slog.Warn("webhook: invalid signature")
-			http.Error(w, "invalid signature", 401)
-			return
-		}
-
-		slog.Info("webhook: deploy triggered")
-		w.WriteHeader(http.StatusAccepted)
-		w.Write([]byte(`{"status":"deploy started"}`))
-
-		safego.Go("webhook:deploy", func() {
-			apiToken := ""
-			if sec != nil {
-				apiToken = secrets.ResolveSecret(ctx, sec, "api_token", "")
-			}
-			cmd := exec.Command(repoDir + "/scripts/deploy.sh")
-			cmd.Dir = repoDir
-			cmd.Env = append(os.Environ(),
-				"REPO_DIR="+repoDir,
-				"PROFILE=full",
-				"OIKOS_API_TOKEN="+apiToken,
-			)
-			cmd.Stdout = os.Stdout
-			cmd.Stderr = os.Stderr
-			start := time.Now()
-			if err := cmd.Run(); err != nil {
-				slog.Error("webhook: deploy failed", "error", err, "duration", time.Since(start))
-				return
-			}
-			slog.Info("webhook: deploy succeeded", "duration", time.Since(start))
-		})
-	})
+	mux.Handle("/deploy", &webhookHandler{secret: secret, script: repoDir + "/scripts/deploy.sh"})
+	mux.Handle("/deploy-plugins", &webhookHandler{secret: secret, script: repoDir + "/scripts/deploy-plugins.sh"})
 
 	mux.HandleFunc("/healthz", func(w http.ResponseWriter, r *http.Request) {
 		w.WriteHeader(200)
@@ -106,7 +117,6 @@ func main() {
 	}
 }
 
-// newSecrets creates the Infisical secrets manager from env vars.
 func newSecrets() *secrets.Manager {
 	return secrets.NewManagerFromConfig(
 		os.Getenv("OIKOS_INFISICAL_SITE_URL"),
@@ -118,8 +128,6 @@ func newSecrets() *secrets.Manager {
 	)
 }
 
-// resolveWebhookHMAC fetches the webhook HMAC secret from Infisical,
-// falling back to the WEBHOOK_HMAC_SECRET env var.
 func resolveWebhookHMAC(ctx context.Context, sec *secrets.Manager) string {
 	envFallback := os.Getenv("WEBHOOK_HMAC_SECRET")
 	if sec == nil {