docs: updated readme with WEBHOOK_BASE_URL variable

* Update `ENGINE_IMAGE` to version 3.2.26 and revise security annotation

* Document `WEBHOOK_BASE_URL` usage and update `TEMPLATE_ENGINE` image to version 0.15.7

* Update security annotation and bump `engine` to 3.2.26, `pikolo` to 0.15.7

* Fix broken dependency in `kube-integration` and update `engine` to version 3.2.26

* Fix broken dependency in `kube-integration` and update `engine` to version 3.2.26

* Fix broken dependency in `kube-integration` and update `engine` to version 3.2.26

* Revise bug fix annotation for "pipeline runtime" in Helm chart metadata

* Update engine to 3.3.0. ECR integration with Service Account uses the region of integration

* helm-docs

* Document `WEBHOOK_BASE_URL` configuration for externally-reachable Git providers

* Refine `WEBHOOK_BASE_URL` documentation and update chart metadata with engine version 3.3.0 changes

* Update README: improve webhook configuration note formatting

* Add "Configure platform URL for Git webhooks" section to README

---------

Co-authored-by: andrii-codefresh <andrii@codefresh.io>
Co-authored-by: Zhenya Tikhonov <zhenya.tikhonov@octopus.com>

(cherry picked from commit aeb0720)

Author: vitalii-codefresh

README.md

@@ -37,6 +37,7 @@ Helm chart for deploying [Codefresh On-Premises](https://codefresh.io/docs/docs/
   - [Projects pipelines limit](#projects-pipelines-limit)
   - [Enable session cookie](#enable-session-cookie)
   - [X-Frame-Options response header](#x-frame-options-response-header)
+  - [Configure platform URL for Git webhooks](#configure-platform-url-for-git-webhooks)
   - [Image digests in containers](#image-digests-in-containers)
   - [Hermes configuration](#hermes-configuration)
 - [Configuring OIDC Provider](#configuring-oidc-provider)
@@ -1447,6 +1448,20 @@ cfapi:
     USE_SHA256_GITHUB_SIGNATURE: "true"
 ```
 
+### Configure platform URL for Git webhooks
+
+By default Codefresh registers webhooks using CF_HOST_NAME/EXTERNAL_URL (the same hostname used for the UI/API).
+ If that hostname is internal-only and unreachable by the Git provider, set WEBHOOK_BASE_URL
+to an externally-reachable hostname; it is used only for webhook registration, everything else keeps using CF_HOST_NAME/EXTERNAL_URL.
+> [!IMPORTANT]
+> This only affects webhooks registered after the change - existing triggers must be deleted and recreated.
+
+```yaml
+cfapi:
+  env:
+    WEBHOOK_BASE_URL: "https://external.mydomain.com"
+```
+
 ### Image digests in containers
 
 In Codefresh On-Prem 2.6.x all Codefresh owner microservices include image digests in the default subchart values.

README.md.gotmpl

@@ -37,6 +37,7 @@ Helm chart for deploying [Codefresh On-Premises](https://codefresh.io/docs/docs/
   - [Projects pipelines limit](#projects-pipelines-limit)
   - [Enable session cookie](#enable-session-cookie)
   - [X-Frame-Options response header](#x-frame-options-response-header)
+  - [Configure platform URL for Git webhooks](#configure-platform-url-for-git-webhooks)
   - [Image digests in containers](#image-digests-in-containers)
   - [Hermes configuration](#hermes-configuration)
 - [Configuring OIDC Provider](#configuring-oidc-provider)
@@ -1456,6 +1457,20 @@ cfapi:
     USE_SHA256_GITHUB_SIGNATURE: "true"
 ```
 
+### Configure platform URL for Git webhooks
+
+By default Codefresh registers webhooks using CF_HOST_NAME/EXTERNAL_URL (the same hostname used for the UI/API).
+ If that hostname is internal-only and unreachable by the Git provider, set WEBHOOK_BASE_URL
+to an externally-reachable hostname; it is used only for webhook registration, everything else keeps using CF_HOST_NAME/EXTERNAL_URL.
+> [!IMPORTANT]
+> This only affects webhooks registered after the change - existing triggers must be deleted and recreated.
+
+```yaml
+cfapi:
+  env:
+    WEBHOOK_BASE_URL: "https://external.mydomain.com"
+```
+
 ### Image digests in containers
 
 In Codefresh On-Prem 2.6.x all Codefresh owner microservices include image digests in the default subchart values.

charts/codefresh/values.yaml

@@ -546,7 +546,7 @@ runtimeImages:
   KUBE_DEPLOY: quay.io/codefresh/cf-deploy-kubernetes:18.0.2@sha256:a9642f66c7696367b43f2931bab6f647f9f91262e194609e64a19ea362a7c873
   PIPELINE_DEBUGGER_IMAGE: quay.io/codefresh/cf-debugger:1.3.14@sha256:7a5890afcfdad4a9aa4eec1a218cb468d52855540c847b3809085415751bbaa7
   TEMPLATE_ENGINE: quay.io/codefresh/pikolo:0.15.7@sha256:1c1ff75feceb8d4e6ffa09b933605d0a1476bf64890f247be186da3200a9d004
-  CR_6177_FIXER: docker.io/library/alpine:latest
+  CR_6177_FIXER: docker.io/library/alpine:3.24
   GC_BUILDER_IMAGE: docker.io/library/alpine:3.24
 
 #--------------------
@@ -585,6 +585,8 @@ cfapi: &cf-api
       OIDC_PROVIDER_PROTOCOL: '{{ .Values.global.oidcProviderProtocol }}'
       OIDC_PROVIDER_TOKEN_ENDPOINT: '{{ .Values.global.oidcProviderTokenEndpoint }}'
       DEFAULT_SYSTEM_TYPE: PROJECT_ONE
+      # Configure platform URL for Git webhooks
+      WEBHOOK_BASE_URL: ""
   # -- Secrets configuration
   secrets:
     secret: