Add signatureValueFile fields for webhook notification

docs/content/en/docs-dev/operator-manual/piped/configuration-reference.md

@@ -248,3 +248,4 @@ Must be one of the following structs:
 | url | string | The URL where notification event will be sent to. | Yes |
 | signatureKey | string | The HTTP header key used to store the configured signature in each event. Default is "PipeCD-Signature". | No |
 | signatureValue | string | The value of signature included in header of each event request. It can be used to verify the received events. | No |
+| signatureValueFile | string | The path to the signature value file. | No |

pkg/app/piped/notifier/webhook.go

@@ -82,7 +82,13 @@ func (w *webhook) sendEvent(ctx context.Context, event model.NotificationEvent)
 		return
 	}
 
-	req.Header.Add(w.config.SignatureKey, w.config.SignatureValue)
+	signature, err := w.config.LoadSignatureValue()
+	if err != nil {
+		w.logger.Error("unable to load webhook signature value", zap.Error(err))
+		return
+	}
+
+	req.Header.Add(w.config.SignatureKey, signature)
 
 	resp, err := w.httpClient.Do(req)
 	if err != nil {

pkg/config/piped.go

@@ -20,6 +20,7 @@ import (
 	"errors"
 	"fmt"
 	"os"
+	"strings"
 
 	"github.com/pipe-cd/pipecd/pkg/model"
 )
@@ -610,9 +611,27 @@ type NotificationReceiverSlack struct {
 }
 
 type NotificationReceiverWebhook struct {
-	URL            string `json:"url"`
-	SignatureKey   string `json:"signatureKey" default:"PipeCD-Signature"`
-	SignatureValue string `json:"signatureValue"`
+	URL                string `json:"url"`
+	SignatureKey       string `json:"signatureKey" default:"PipeCD-Signature"`
+	SignatureValue     string `json:"signatureValue"`
+	SignatureValueFile string `json:"signatureValueFile"`
+}
+
+func (n *NotificationReceiverWebhook) LoadSignatureValue() (string, error) {
+	if n.SignatureValue != "" && n.SignatureValueFile != "" {
+		return "", errors.New("only either signatureValue or signatureValueFile can be set")
+	}
+	if n.SignatureValue != "" {
+		return n.SignatureValue, nil
+	}
+	if n.SignatureValueFile != "" {
+		val, err := os.ReadFile(n.SignatureValueFile)
+		if err != nil {
+			return "", err
+		}
+		return strings.TrimSuffix(string(val), "\n"), nil
+	}
+	return "", nil
 }
 
 type SecretManagement struct {

pkg/config/piped_test.go

@@ -319,3 +319,48 @@ func TestPipedEventWatcherValidate(t *testing.T) {
 		})
 	}
 }
+
+func TestNotificationReceiverWebhook_LoadSignatureValue(t *testing.T) {
+	testcase := []struct {
+		name    string
+		webhook *NotificationReceiverWebhook
+		want    string
+		wantErr bool
+	}{
+		{
+			name: "set signatureValue",
+			webhook: &NotificationReceiverWebhook{
+				URL:            "https://example.com",
+				SignatureValue: "foo",
+			},
+			want:    "foo",
+			wantErr: false,
+		},
+		{
+			name: "set signatureValueFile",
+			webhook: &NotificationReceiverWebhook{
+				URL:                "https://example.com",
+				SignatureValueFile: "testdata/piped/notification-receiver-webhook",
+			},
+			want:    "foo",
+			wantErr: false,
+		},
+		{
+			name: "set both of them",
+			webhook: &NotificationReceiverWebhook{
+				URL:                "https://example.com",
+				SignatureValue:     "foo",
+				SignatureValueFile: "testdata/piped/notification-receiver-webhook",
+			},
+			want:    "",
+			wantErr: true,
+		},
+	}
+	for _, tc := range testcase {
+		t.Run(tc.name, func(t *testing.T) {
+			got, err := tc.webhook.LoadSignatureValue()
+			assert.Equal(t, tc.wantErr, err != nil)
+			assert.Equal(t, tc.want, got)
+		})
+	}
+}

pkg/config/testdata/piped/notification-receiver-webhook

@@ -0,0 +1 @@
+foo