simuport deploy gateway

Deploy   POST https://deploy.simuport.com/hooks/<project-id>
         HMAC-SHA256 sign the request body with the shared secret in the
         X-Hub-Signature-256 header; body includes:
           {"ref":"refs/heads/main","after":"<git-sha>"}
         Response: {"app","sha","container","status_url","logs_url"} for this
         deploy. No signature or wrong ref: 403. Wrong signature: 500 with
         "Error occurred while evaluating hook rules." (webhook 2.8 semantics).
         A re-trigger of a sha still deploying joins it ("note":"already running").
         Optional: "pusher":{"name":"<who>"} is recorded in the status as "by";
         "target":"<git-sha>" deploys that commit instead of the tip (it must
         already be on main: a rollback, or a redeploy); an empty "after" keys
         the deploy by the tip of main resolved now. The ops page sends these.

Status   GET  https://deploy.simuport.com/hooks/deploy-status?app=<project-id>&sha=<git-sha>
         -> {"state": queued|running|success|failure|timeout|cancelled|lost|skipped, ...}
         Terminal: success, failure, timeout (per-app cap hit), cancelled,
         lost (the deploy process died without a word), skipped (non-main ref).

Logs     GET  https://deploy.simuport.com/hooks/deploy-logs?app=<project-id>&sha=<git-sha>
         -> raw deploy log, open from the moment the deploy is queued

Cancel   POST https://deploy.simuport.com/hooks/deploy-cancel      (HMAC-signed body)
           {"app":"<project-id>","sha":"<git-sha>","by":"<who, optional>"}
         -> {"result": "stopped"|"not running"}; the deploy records "cancelled"

List     POST https://deploy.simuport.com/hooks/deploy-list        (HMAC-signed body)
           {"app":"<project-id>","limit":"20"}   (both optional)
         -> deploys running now + the last state transitions

Key      Shared HMAC secret looks like:  1574****d510    sha256: b0c33af4
         Eyeball the masked key, or verify by hash (reveals nothing):
           printf %s "$DEPLOY_WEBHOOK_SECRET" | sha256sum

Status and logs need no auth — the git sha is the access (the repo is private).
The sha appears in proxy access logs; treat anyone with those as able to read.
Cancel and list take the shared secret, like the trigger.

Projects:
  - safedrop-project-web
  - scifm-datafactory
  - simulingua-web
  - simuport-logging