WIP: rewrite webhook-handler

[shreddedbacon]

General Checklist

• Affected Issues have been mentioned in the Closing issues section
• Documentation has been written/updated
• PR title is ready for inclusion in changelog

Database Migrations

• If your PR contains a database migation, it MUST be the latest in date order alphabetically

Description

WIP

This is a substantial rewrite of the webhook-handler which consolidates the webhook-handler and webhooks2tasks services. Additionally, the API will now call out to the api-sidecar-handler service to handle triggering deployments and environment removals, this allows for shared code between the webhook-handler and api-sidecar-handler.

One way this is done is by moving from individual go services with their own go.mod files, into a mono repo setup. There are some remaining services that will need to be converted in a follow up pullrequest though. I left them out of this to try to reduce the amount of changes.

Requires uselagoon/lagoon-charts#858

[github-actions]

Overview

Image reference	testlagoon/api:main	lagoon/api:ci-latest
- digest	b2355f4cabfc	5d5e8ffffbad
- tag	main	ci-latest
- provenance	https://github.com/uselagoon/lagoon.git/commit/c8c20f64490e316af429d5e5078104fe82832b5f
- vulnerabilities
- platform	linux/amd64	linux/amd64
- size	150 MB	170 MB (+20 MB)
- packages	1579	1490 (-89)
Base Image	node:22-alpine also known as: • 22-alpine3.22 • jod-alpine • jod-alpine3.22	node:22-alpine also known as: • 22-alpine3.23 • 22.22-alpine • 22.22-alpine3.23 • 22.22.0-alpine • 22.22.0-alpine3.23 • jod-alpine • jod-alpine3.23
- vulnerabilities

Environment Variables (1 changes)

• ± 1 changed
• 16 unchanged

 BASH_ENV=/home/.bashrc
 ELASTICSEARCH_URL=http://logs-db-service:9200
 ENV=/home/.bashrc
 HOME=/home
 KEYCLOAK_ADMIN_API_CLIENT_SECRET=bb86d344-a52d-11ef-b872-4f4337ee24f0
 KEYCLOAK_API_CLIENT_SECRET=39d5282d-3684-4026-b4ed-04bbc034b61a
 LAGOON=node
 LAGOON_LOCALDEV_HTTP_PORT=3000
 LAGOON_VERSION=development
 LOGSDB_ADMIN_PASSWORD=admin
 NODE_ENV=production
-NODE_VERSION=22.21.1
+NODE_VERSION=22.22.0
 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
 REDIS_PASSWORD=admin
 TMP=/tmp
 TMPDIR=/tmp
 YARN_VERSION=1.22.22

Labels (1 changes)

• ± 1 changed
• 8 unchanged

 org.opencontainers.image.authors=The Lagoon Authors
-org.opencontainers.image.base.name=docker.io/node:22-alpine3.22
+org.opencontainers.image.base.name=docker.io/node:22-alpine3.23
 org.opencontainers.image.description=The system services needed to run a lagoon-core in production and locally
 org.opencontainers.image.licenses=Apache 2.0
 org.opencontainers.image.source=https://github.com/uselagoon/lagoon
 org.opencontainers.image.title=lagoon-core/api - the API service for Lagoon
 org.opencontainers.image.url=https://github.com/uselagoon/lagoon
 org.opencontainers.image.version=development
 repository=https://github.com/uselagoon/lagoon

Packages and Vulnerabilities (96 package changes and 2 vulnerability changes)

• ➕ 1 packages added
• ➖ 69 packages removed
• ♾️ 26 packages changed
• 1243 packages unchanged

• ✔️ 2 vulnerabilities removed

Changes for packages of type apk (23 changes)

	Package	Version testlagoon/api:main	Version lagoon/api:ci-latest
♾️	alpine-base	3.22.2-r0	3.23.2-r0
♾️	alpine-baselayout	3.7.0-r0	3.7.1-r8
♾️	alpine-baselayout-data	3.7.0-r0	3.7.1-r8
♾️	alpine-keys	2.5-r0	2.6-r0
♾️	alpine-release	3.22.2-r0	3.23.2-r0
♾️	apk-tools	2.14.9-r3	3.0.3-r1
♾️	busybox	1.37.0-r19	1.37.0-r30
♾️	busybox-binsh	1.37.0-r19	1.37.0-r30
♾️	ca-certificates	20250911-r0	20251003-r0
♾️	ca-certificates-bundle	20250911-r0	20251003-r0
♾️	gcc	14.2.0-r6	15.2.0-r2
➕	libapk		3.0.3-r1
➖	libapk2	2.14.9-r3
♾️	libgcc	14.2.0-r6	15.2.0-r2
♾️	libstdc++	14.2.0-r6	15.2.0-r2
♾️	musl	1.2.5-r10	1.2.5-r21
♾️	musl-utils	1.2.5-r10	1.2.5-r21
♾️	pax-utils	1.3.8-r1	1.3.8-r2
♾️	scanelf	1.3.8-r1	1.3.8-r2
♾️	ssl_client	1.37.0-r19	1.37.0-r30
♾️	tar	1.35-r3	1.35-r4
♾️	zstd	1.5.7-r0	1.5.7-r2
♾️	zstd-libs	1.5.7-r0	1.5.7-r2

Changes for packages of type github (1 changes)

	Package	Version testlagoon/api:main	Version lagoon/api:ci-latest
♾️	node	22.21.1	22.22.0

Changes for packages of type npm (72 changes)

	Package	Version testlagoon/api:main	Version lagoon/api:ci-latest
➖	@postman/form-data	3.1.1
➖	@postman/tough-cookie	4.1.3-postman.1
➖	@postman/tunnel-agent	0.6.4
➖	asn1	0.2.6
➖	assert-plus	1.0.0
➖	aws-sign2	0.7.0
➖	aws4	1.13.2
➖	bcrypt-pbkdf	1.0.2
➖	bluebird	2.11.0
➖	brotli	1.3.3
➖	caseless	0.12.0
➖	chardet	2.0.0
➖	charset	1.0.1
➖	cli-progress	3.12.0
➖	cli-table3	0.6.5
♾️	commander	8.3.0	7.2.0
➖	core-util-is	1.0.3
➖	csv-parse	4.16.3
➖	dashdash	1.14.1
➖	des.js	1.1.0
➖	ecc-jsbn	0.1.2
➖	extend	3.0.2
➖	extsprintf	1.4.1
➖	file-type	3.9.0
➖	filesize	10.1.4
➖	forever-agent	0.6.1
➖	getpass	0.1.7
➖	har-schema	2.0.0
➖	har-validator	5.1.5
➖	http-reasons	0.1.0
➖	http-signature	1.3.6
➖	httpntlm	1.8.13
➖	httpreq	1.1.1
➖	is-typedarray	1.0.0
➖	isstream	0.1.2
➖	jose	4.14.4
➖	js-md4	0.3.2
➖	js-sha512	0.9.0
➖	json-schema	0.4.0
➖	jsprim	2.0.2
➖	liquid-json	0.3.1
➖	mime-format	2.0.1
➖	newman	6.2.1
➖	node-forge	1.3.1
		Removed vulnerabilities (2):
➖	node-forge-flash	0.0.0
➖	node-oauth1	1.3.0
➖	oauth-sign	0.9.0
➖	object-hash	1.3.1
➖	parse-ms	2.1.0
➖	performance-now	2.1.0
➖	postman-collection	4.4.0
➖	postman-collection-transformer	4.1.8
➖	postman-request	2.88.1-postman.34
➖	postman-runtime	7.39.1
➖	postman-sandbox	4.7.1
➖	postman-url-encoder	3.0.5
➖	pretty-ms	7.0.1
➖	process-nextick-args	2.0.1
➖	psl	1.15.0
♾️	qs	6.5.3	6.13.0
➖	serialised-error	1.1.3
➖	sshpk	1.18.0
♾️	stack-trace	0.0.9	0.0.10
➖	stream-length	1.0.2
➖	teleport-javascript	1.0.0
➖	tweetnacl	0.14.5
➖	underscore	1.12.1
➖	uvm	2.1.1
➖	verror	1.10.0
➖	webhook-handler	0.9.0
➖	webhooks2tasks	1.0.0
♾️	xmlbuilder	15.1.1	11.0.1