OpenChoreo Fixes Webhook Signature Bypass in Autobuild Endpoint

The OpenChoreo project has addressed a medium-severity security vulnerability in its autobuild webhook endpoint (`POST /api/v1alpha1/autobuild`) with the release of versions 1.0.3, 1.1.3, and 1.2.0-rc.2, according to the GitHub Security Advisory database. The issue allowed attackers to bypass webhook signature validation by exploiting a flaw in how the endpoint selected the git provider for authentication. Specifically, the provider was determined by a client-supplied header (`X-Event-Key`) rather than the component's configuration, and Bitbucket webhooks were accepted without validating their signatures. This enabled unauthorized triggering of builds and, in cases where auto-deploy was enabled, unauthorized deployment of attacker-specified code. The vulnerability also posed a risk of resource exhaustion through repeated unauthenticated build triggers.

The patch ensures that Bitbucket webhooks are validated using HMAC-SHA256 against the configured secret, mandates non-empty secrets for all git providers, and enforces that the authenticated provider matches the component's configured git provider. Operators should verify that all auto-build components have correctly configured secrets for their declared git providers before upgrading. Additionally, they should audit network exposure of the autobuild webhook endpoint to ensure it is not unnecessarily reachable from untrusted sources. This vulnerability highlights the importance of robust authentication mechanisms and strict adherence to configuration-based validation patterns in webhook handling.