v0.9.1

The webhook endpoint now runs on the Quarkiverse GitHub App extension. There are no new settings,
no schema changes and no new GitHub App permissions. A monitor or proxy that checks the webhook's
status codes should expect 400 instead of 401 for a missing or mismatched signature; a valid
delivery still gets 200.

Changed

• The Quarkiverse GitHub App extension (io.quarkiverse.githubapp:quarkus-github-app 2.16.0)
  now serves POST /api/webhook: it checks X-Hub-Signature-256 against GITHUB_WEBHOOK_SECRET
  and parses the delivery, then WebhookEvents routes it as before (deduplication, pauses,
  trigger filters, commands, CI rechecks). The replies follow the extension: 400 for a missing
  or mismatched signature (previously 401), 500 for a signed body that is not JSON (previously
  400), and 200 with an empty body for an accepted delivery. Startup still fails without a
  webhook secret. (#1291, #1303, #1308)

Dependencies

• Bumped the actions group (#1307), the frontend npm dependencies (#1305) and the website docs
  dependencies (#1306)

Errata

• The [0.9.0] section's Changed entry about the webhook entry and the Quarkiverse GitHub
  App extension describes this release, not v0.9.0. It was added to the changelog after v0.9.0
  was tagged, and v0.9.0 still uses WebhookController and WebhookVerifier. The change is
  described under Changed above.

What's Changed

Features

• refactor(webhook): adopt Quarkiverse GitHub App extension for webhook entry by @omatheusmesmo in #1291

Fixes

• fix(webhook): drop merge-conflict text from the security model and the dead ping route by @devops-thiago in #1311

Other changes

• test(webhook): verify observer routing and payload rejection by @devops-thiago in #1303
• test(webhook): pin the rejection of a mismatched signature and clear two Sonar findings by @devops-thiago in #1308
• chore(release): prepare v0.9.1 by @devops-thiago in #1309
• Release v0.9.1 by @devops-thiago in #1310

New Contributors

• @omatheusmesmo made their first contribution in #1291

Full Changelog: v0.9.0...v0.9.1