Fix build: fetch latest upstream webhook release tarball

Upstream stopped shipping bare binaries; 2.8.2 URL 404s. Resolve the latest
release at build time so scheduled rebuilds track upstream.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SNMztZDM1qUGnixHeevkuw

.gitlab-ci.yml

@@ -9,7 +9,7 @@ build:
   before_script:
     - docker login -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD" "$CI_REGISTRY"
   script:
-    - docker build -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" -t "$CI_REGISTRY_IMAGE:latest" .
+    - docker build --pull -t "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHORT_SHA" -t "$CI_REGISTRY_IMAGE:latest" .
     - docker push --all-tags "$CI_REGISTRY_IMAGE"
   rules:
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH

Dockerfile

@@ -1,12 +1,17 @@
 FROM alpine:latest
 
+# ponytail: resolves latest upstream release at build time via the /releases/latest redirect
+# (no GitHub API rate limit); pin WEBHOOK_VERSION if a release ever breaks.
+ARG WEBHOOK_VERSION=latest
 RUN apk add --no-cache \
     curl \
     docker-cli \
     docker-cli-compose && \
-    wget -O /usr/local/bin/webhook \
-      https://github.com/adnanh/webhook/releases/download/2.8.2/webhook-linux-amd64 && \
-    chmod +x /usr/local/bin/webhook
+    v="$WEBHOOK_VERSION" && \
+    [ "$v" != latest ] || v=$(basename "$(curl -sIL -o /dev/null -w '%{url_effective}' https://github.com/adnanh/webhook/releases/latest)") && \
+    curl -fsSL "https://github.com/adnanh/webhook/releases/download/$v/webhook-linux-amd64.tar.gz" \
+      | tar xz --strip-components=1 -C /usr/local/bin webhook-linux-amd64/webhook && \
+    webhook -version
 
 EXPOSE 9000
 ENTRYPOINT ["webhook"]