{
  "name": "bizOS CI Failure Notify",
  "active": false,
  "nodes": [
    {
      "parameters": {
        "content": "## bizOS CI / deploy failure webhook\n\nPath: `POST /webhook/bizos/ci-failure`\n\nSet `BIZOS_WEBHOOK_SECRET` in n8n env to match GitHub secret `N8N_WEBHOOK_SECRET`.\n\nGitHub Actions posts here when `N8N_CI_WEBHOOK_URL` is configured. For localhost-only n8n, prefer **bizOS GitHub Actions Poll** (no inbound webhook required).\n\nReplace **Log Route** with Slack/email before activation.",
        "height": 220,
        "width": 460
      },
      "id": "sticky-note-bizos-ci",
      "name": "Setup Notes",
      "type": "n8n-nodes-base.stickyNote",
      "typeVersion": 1,
      "position": [
        80,
        -140
      ]
    },
    {
      "parameters": {
        "httpMethod": "POST",
        "path": "bizos/ci-failure",
        "responseMode": "onReceived",
        "options": {}
      },
      "id": "webhook-bizos-ci-failure",
      "name": "CI Failure Webhook",
      "type": "n8n-nodes-base.webhook",
      "typeVersion": 2,
      "position": [
        260,
        0
      ]
    },
    {
      "parameters": {
        "jsCode": "const crypto = require('crypto');\n\nconst secret = $env.BIZOS_WEBHOOK_SECRET;\nif (!secret) {\n  throw new Error('BIZOS_WEBHOOK_SECRET is not configured in n8n');\n}\n\nconst headers = $input.first().json.headers ?? {};\nconst signature = headers['x-signature'] ?? headers['X-Signature'];\nif (!signature) {\n  throw new Error('Missing X-Signature header');\n}\n\nconst idempotencyKey = headers['x-idempotency-key'] ?? headers['X-Idempotency-Key'];\nconst body = $input.first().json.body;\nconst rawBody = typeof body === 'string' ? body : JSON.stringify(body);\n\nconst expected = crypto.createHmac('sha256', secret).update(rawBody).digest('hex');\nif (expected.length !== signature.length || !crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(signature))) {\n  throw new Error('Invalid webhook signature');\n}\n\nconst payload = typeof body === 'string' ? JSON.parse(body) : body;\nif (idempotencyKey && payload.idempotencyKey && idempotencyKey !== payload.idempotencyKey) {\n  throw new Error('Idempotency key mismatch');\n}\n\nreturn [{ json: { ...payload, verified: true } }];"
      },
      "id": "code-verify-ci-signature",
      "name": "Verify Signature",
      "type": "n8n-nodes-base.code",
      "typeVersion": 2,
      "position": [
        520,
        0
      ]
    },
    {
      "parameters": {
        "values": {
          "string": [
            {
              "name": "workflow",
              "value": "bizos-ci-failure-notify"
            },
            {
              "name": "channel",
              "value": "ops-ci"
            },
            {
              "name": "title",
              "value": "=[bizOS] CI failure: {{ $json.workflow ?? $json.event }}"
            },
            {
              "name": "message",
              "value": "=Repo {{ $json.repo }} \u00b7 branch {{ $json.branch }} \u00b7 SHA {{ $json.sha }} \u00b7 {{ $json.runUrl ?? 'no run URL' }}"
            },
            {
              "name": "severity",
              "value": "={{ $json.event === 'deploy.failure' ? 'critical' : 'high' }}"
            },
            {
              "name": "routedAt",
              "value": "={{ $now.toISO() }}"
            }
          ]
        },
        "options": {}
      },
      "id": "set-ci-notification",
      "name": "Build Notification",
      "type": "n8n-nodes-base.set",
      "typeVersion": 3,
      "position": [
        780,
        0
      ]
    },
    {
      "parameters": {
        "values": {
          "string": [
            {
              "name": "status",
              "value": "routed"
            }
          ]
        },
        "options": {}
      },
      "id": "set-ci-log",
      "name": "Log Route",
      "type": "n8n-nodes-base.set",
      "typeVersion": 3,
      "position": [
        1040,
        0
      ]
    }
  ],
  "connections": {
    "CI Failure Webhook": {
      "main": [
        [
          {
            "node": "Verify Signature",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Verify Signature": {
      "main": [
        [
          {
            "node": "Build Notification",
            "type": "main",
            "index": 0
          }
        ]
      ]
    },
    "Build Notification": {
      "main": [
        [
          {
            "node": "Log Route",
            "type": "main",
            "index": 0
          }
        ]
      ]
    }
  },
  "settings": {
    "executionOrder": "v1",
    "saveManualExecutions": true,
    "callerPolicy": "workflowsFromSameOwner"
  },
  "meta": {
    "templateCredsSetupCompleted": false,
    "description": "Sanitized template for CI/deploy failure notifications. active: false until ops review."
  }
}