feat(acr-webhook): polish work

Co-authored-by: Claude <noreply@anthropic.com>
Signed-off-by: dkarpele <karpelevich@gmail.com>

Author: dkarpele

cmd/run_test.go

@@ -73,6 +73,7 @@ func TestNewRunCommand(t *testing.T) {
 	asser.Equal(env.GetStringVal("HARBOR_WEBHOOK_SECRET", ""), controllerCommand.Flag("harbor-webhook-secret").Value.String())
 	asser.Equal(env.GetStringVal("CLOUDEVENTS_WEBHOOK_SECRET", ""), controllerCommand.Flag("cloudevents-webhook-secret").Value.String())
 	asser.Equal(env.GetStringVal("ALIYUN_ACR_WEBHOOK_SECRET", ""), controllerCommand.Flag("aliyun-acr-webhook-secret").Value.String())
+	asser.Equal(env.GetStringVal("ACR_WEBHOOK_SECRET", ""), controllerCommand.Flag("acr-webhook-secret").Value.String())
 	asser.Equal(strconv.Itoa(env.ParseNumFromEnv("WEBHOOK_RATELIMIT_ALLOWED", 0, 0, math.MaxInt)), controllerCommand.Flag("webhook-ratelimit-allowed").Value.String())
 
 	// TLS flags

cmd/webhook_test.go

@@ -45,6 +45,7 @@ func TestNewWebhookCommand(t *testing.T) {
 	asser.Equal(env.GetStringVal("HARBOR_WEBHOOK_SECRET", ""), controllerCommand.Flag("harbor-webhook-secret").Value.String())
 	asser.Equal(env.GetStringVal("CLOUDEVENTS_WEBHOOK_SECRET", ""), controllerCommand.Flag("cloudevents-webhook-secret").Value.String())
 	asser.Equal(env.GetStringVal("ALIYUN_ACR_WEBHOOK_SECRET", ""), controllerCommand.Flag("aliyun-acr-webhook-secret").Value.String())
+	asser.Equal(env.GetStringVal("ACR_WEBHOOK_SECRET", ""), controllerCommand.Flag("acr-webhook-secret").Value.String())
 	asser.Equal(strconv.Itoa(env.ParseNumFromEnv("WEBHOOK_RATELIMIT_ALLOWED", 0, 0, math.MaxInt)), controllerCommand.Flag("webhook-ratelimit-allowed").Value.String())
 
 	// TLS flags

docs/install/cmd/run.md

@@ -10,6 +10,14 @@ Runs the Argo CD Image Updater in a reconciliation loop with a set of options.
 
 ### Flags
 
+**--acr-webhook-secret *secret***
+
+Secret for validating Azure ACR webhooks. ACR has no built-in signing, so the
+secret is sent as the `Authorization` header value, which you configure on the
+webhook with `az acr webhook update --headers "Authorization=<secret>"`.
+
+Can also be set with the `ACR_WEBHOOK_SECRET` environment variable.
+
 **--aliyun-acr-webhook-secret *secret***
 
 Secret for validating Aliyun ACR webhooks.

pkg/webhook/acr.go

@@ -55,7 +55,7 @@ func (a *ACRWebhook) Validate(r *http.Request) error {
 		}
 
 		if subtle.ConstantTimeCompare([]byte(authHeader), []byte(a.secret)) != 1 {
-			return fmt.Errorf("incorrect webhook secret")
+			return fmt.Errorf("invalid webhook secret")
 		}
 	}
 

pkg/webhook/acr_test.go

@@ -29,12 +29,13 @@ func TestACRWebhook_Validate(t *testing.T) {
 	webhook := NewACRWebhook(secret)
 
 	tests := []struct {
-		name        string
-		method      string
-		contentType string
-		authHeader  string
-		noSecret    bool
-		expectError bool
+		name           string
+		method         string
+		contentType    string
+		authHeader     string
+		noSecret       bool
+		expectError    bool
+		expectedErrMsg string
 	}{
 		{
 			name:        "valid POST request with correct secret",
@@ -65,18 +66,20 @@ func TestACRWebhook_Validate(t *testing.T) {
 			expectError: true,
 		},
 		{
-			name:        "missing Authorization header when secret is configured",
-			method:      "POST",
-			contentType: "application/json",
-			authHeader:  "",
-			expectError: true,
+			name:           "missing Authorization header when secret is configured",
+			method:         "POST",
+			contentType:    "application/json",
+			authHeader:     "",
+			expectError:    true,
+			expectedErrMsg: "missing Authorization header when secret is configured",
 		},
 		{
-			name:        "incorrect secret",
-			method:      "POST",
-			contentType: "application/json",
-			authHeader:  "not-the-secret",
-			expectError: true,
+			name:           "incorrect secret",
+			method:         "POST",
+			contentType:    "application/json",
+			authHeader:     "not-the-secret",
+			expectError:    true,
+			expectedErrMsg: "invalid webhook secret",
 		},
 	}
 
@@ -99,8 +102,10 @@ func TestACRWebhook_Validate(t *testing.T) {
 
 			if tt.expectError {
 				assert.Error(t, err)
-			}
-			if !tt.expectError {
+				if tt.expectedErrMsg != "" {
+					assert.EqualError(t, err, tt.expectedErrMsg)
+				}
+			} else {
 				assert.NoError(t, err)
 			}
 		})