fix: onprem 2.11.26 update engine with fixed dependency 'kube-integration' (#405) (#418)

* Update `ENGINE_IMAGE` to version 3.2.26 and revise security annotation

* Document `WEBHOOK_BASE_URL` usage and update `TEMPLATE_ENGINE` image to version 0.15.7

* Update security annotation and bump `engine` to 3.2.26, `pikolo` to 0.15.7

* Fix broken dependency in `kube-integration` and update `engine` to version 3.2.26

* Fix broken dependency in `kube-integration` and update `engine` to version 3.2.26

* Fix broken dependency in `kube-integration` and update `engine` to version 3.2.26

* Revise bug fix annotation for "pipeline runtime" in Helm chart metadata

* Update engine to 3.3.0. ECR integration with Service Account uses the region of integration

* helm-docs

* Document `WEBHOOK_BASE_URL` configuration for externally-reachable Git providers

* Refine `WEBHOOK_BASE_URL` documentation and update chart metadata with engine version 3.3.0 changes

* Update README: improve webhook configuration note formatting

* Add "Configure platform URL for Git webhooks" section to README

---------

Co-authored-by: andrii-codefresh <andrii@codefresh.io>
Co-authored-by: Zhenya Tikhonov <zhenya.tikhonov@octopus.com>

Author: 3 people

README.md

@@ -37,6 +37,7 @@ Helm chart for deploying [Codefresh On-Premises](https://codefresh.io/docs/docs/
   - [Projects pipelines limit](#projects-pipelines-limit)
   - [Enable session cookie](#enable-session-cookie)
   - [X-Frame-Options response header](#x-frame-options-response-header)
+  - [Configure platform URL for Git webhooks](#configure-platform-url-for-git-webhooks)
   - [Image digests in containers](#image-digests-in-containers)
   - [Hermes configuration](#hermes-configuration)
 - [Configuring OIDC Provider](#configuring-oidc-provider)
@@ -1466,6 +1467,20 @@ cfapi:
     USE_SHA256_GITHUB_SIGNATURE: "true"
 ```
 
+### Configure platform URL for Git webhooks
+
+By default Codefresh registers webhooks using CF_HOST_NAME/EXTERNAL_URL (the same hostname used for the UI/API).
+ If that hostname is internal-only and unreachable by the Git provider, set WEBHOOK_BASE_URL
+to an externally-reachable hostname; it is used only for webhook registration, everything else keeps using CF_HOST_NAME/EXTERNAL_URL.
+> [!IMPORTANT]
+> This only affects webhooks registered after the change - existing triggers must be deleted and recreated.
+
+```yaml
+cfapi:
+  env:
+    WEBHOOK_BASE_URL: "https://external.mydomain.com"
+```
+
 ### Image digests in containers
 
 In Codefresh On-Prem 2.6.x all Codefresh owner microservices include image digests in the default subchart values.

README.md.gotmpl

@@ -37,6 +37,7 @@ Helm chart for deploying [Codefresh On-Premises](https://codefresh.io/docs/docs/
   - [Projects pipelines limit](#projects-pipelines-limit)
   - [Enable session cookie](#enable-session-cookie)
   - [X-Frame-Options response header](#x-frame-options-response-header)
+  - [Configure platform URL for Git webhooks](#configure-platform-url-for-git-webhooks)
   - [Image digests in containers](#image-digests-in-containers)
   - [Hermes configuration](#hermes-configuration)
 - [Configuring OIDC Provider](#configuring-oidc-provider)
@@ -1475,6 +1476,20 @@ cfapi:
     USE_SHA256_GITHUB_SIGNATURE: "true"
 ```
 
+### Configure platform URL for Git webhooks
+
+By default Codefresh registers webhooks using CF_HOST_NAME/EXTERNAL_URL (the same hostname used for the UI/API).
+ If that hostname is internal-only and unreachable by the Git provider, set WEBHOOK_BASE_URL
+to an externally-reachable hostname; it is used only for webhook registration, everything else keeps using CF_HOST_NAME/EXTERNAL_URL.
+> [!IMPORTANT]
+> This only affects webhooks registered after the change - existing triggers must be deleted and recreated.
+
+```yaml
+cfapi:
+  env:
+    WEBHOOK_BASE_URL: "https://external.mydomain.com"
+```
+
 ### Image digests in containers
 
 In Codefresh On-Prem 2.6.x all Codefresh owner microservices include image digests in the default subchart values.

charts/codefresh/values.yaml

@@ -540,13 +540,13 @@ runtimeImages:
   DOCKER_BUILDER_IMAGE: quay.io/codefresh/cf-docker-builder:1.6.7@sha256:65070d16c54e84ce0bfd16d2e7389d82a5ee1215e3431aa441558dfbc843fdb2
   DOCKER_PULLER_IMAGE: quay.io/codefresh/cf-docker-puller:8.0.39@sha256:18b95752bbd76a37eecc69b41186ec3987d5a86cf28bd91485fbc00087922463
   DOCKER_PUSHER_IMAGE: quay.io/codefresh/cf-docker-pusher:6.0.32@sha256:b1bc264903ff747c5496fd6a851f5586fd17e1da6550058a2af4689cd69d8155
-  ENGINE_IMAGE: quay.io/codefresh/engine:3.2.25@sha256:04d1a998593633333f4626121aa452ff4962d1b1dd9b9043f41f2e5bd2482a18
+  ENGINE_IMAGE: quay.io/codefresh/engine:3.3.0@sha256:8a0d47eefc6648902fc7fbde132206750257a8cc703d6d871296f8eb2438b285
   FS_OPS_IMAGE: quay.io/codefresh/fs-ops:1.2.13@sha256:1f7ab2fddb3b8bb4153046261367e296c6c9ac3b224f48cd2028371a9f0e2bcf
   GIT_CLONE_IMAGE: quay.io/codefresh/cf-git-cloner:10.3.13@sha256:d5eae428c4896847795202036645a90fdad5f2f68a3eb08bf8ca7e65e450b5ed
   KUBE_DEPLOY: quay.io/codefresh/cf-deploy-kubernetes:18.0.2@sha256:a9642f66c7696367b43f2931bab6f647f9f91262e194609e64a19ea362a7c873
   PIPELINE_DEBUGGER_IMAGE: quay.io/codefresh/cf-debugger:1.3.14@sha256:7a5890afcfdad4a9aa4eec1a218cb468d52855540c847b3809085415751bbaa7
-  TEMPLATE_ENGINE: quay.io/codefresh/pikolo:0.15.4@sha256:8df766d7cf2cfd9a3781a5d3a29007c483b559e5088e53af2886b0321c75abf6
-  CR_6177_FIXER: docker.io/library/alpine:latest
+  TEMPLATE_ENGINE: quay.io/codefresh/pikolo:0.15.7@sha256:1c1ff75feceb8d4e6ffa09b933605d0a1476bf64890f247be186da3200a9d004
+  CR_6177_FIXER: docker.io/library/alpine:3.24
   GC_BUILDER_IMAGE: docker.io/library/alpine:3.24
 
 #--------------------
@@ -585,6 +585,8 @@ cfapi: &cf-api
       OIDC_PROVIDER_PROTOCOL: '{{ .Values.global.oidcProviderProtocol }}'
       OIDC_PROVIDER_TOKEN_ENDPOINT: '{{ .Values.global.oidcProviderTokenEndpoint }}'
       DEFAULT_SYSTEM_TYPE: PROJECT_ONE
+      # Configure platform URL for Git webhooks
+      WEBHOOK_BASE_URL: ""
   # -- Secrets configuration
   secrets:
     secret: