IFC-2304: Runtime resolution of webhook custom headers

[polmichel]

Why

Webhook custom headers defined via CoreKeyValue schema entities (from IFC-2303) need to be resolved at send time. Static headers pass their value through directly, while environment variable headers must read from os.environ on the worker at dispatch time. Without this, the schema-level header definitions have no runtime effect.

Closes IFC-2304

What changed

• Header resolution at send time: Static headers are passed through as-is; environment variable headers are resolved from os.environ on the worker when the webhook fires. Missing env vars are logged as warnings and skipped (no crash).
• Custom headers override defaults: Headers defined on a webhook can override built-in defaults like Content-Type, giving full control over the HTTP request.
• Headers extracted from schema relationships: When a webhook is loaded (from DB or cache), its CoreKeyValue peers are mapped to a lightweight runtime model that carries through the send pipeline.
• Cache-aware: Custom headers survive the to_cache()/from_cache() roundtrip so cached webhooks retain their header configuration.

How to review

1. Start with backend/infrahub/webhook/models.py — the WebhookHeader model and changes to _assign_headers()
2. Then backend/infrahub/webhook/tasks/process.py — the extraction logic and plumbing into convert_node_to_webhook
3. Finally the tests in backend/tests/unit/webhook/

How to test

uv run pytest backend/tests/unit/webhook/

Impact & rollout

• Deployment notes: Requires the schema PR (#8590) to be merged first. Environment variables referenced by CoreEnvironmentVariableKeyValue headers must be set on the worker environment.

Checklist

• Tests added/updated
• External docs updated (if user-facing or ops-facing change)
• Internal .md docs updated (internal knowledge and AI code tools knowledge)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (4)

• main
• stable
• develop
• release-.*

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 50f67631-6116-4a9a-b19d-b27af22dcca9

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codspeed-hq]

Merging this PR will improve performance by 38.93%

⚡ 12 improved benchmarks

Performance Changes

	Benchmark	BASE	HEAD	Efficiency
⚡	test_query_one_model	463.7 ms	352.5 ms	+31.56%
⚡	test_get_menu	245 ms	193.5 ms	+26.64%
⚡	test_load_node_to_db_node_schema	66.3 ms	52.1 ms	+27.4%
⚡	test_graphql_generate_schema	516.2 ms	371.6 ms	+38.93%
⚡	test_schemabranch_duplicate	7.3 ms	5.8 ms	+26.04%
⚡	test_schemabranch_process	1,027 ms	822.1 ms	+24.93%
⚡	test_relationshipmanager_getpeer	156.7 µs	132 µs	+18.65%
⚡	test_nodemanager_querypeers	1.5 ms	1.2 ms	+22.21%
⚡	test_base_schema_duplicate_CoreProposedChange	2.1 ms	1.7 ms	+27.43%
⚡	test_get_schema	324 ms	258.1 ms	+25.54%
⚡	test_query_rel_one	662.6 ms	499.9 ms	+32.57%
⚡	test_query_rel_many	692.2 ms	522.7 ms	+32.42%

---

_{Comparing pmi-20260312-webhoos-headers-runtime-engine (f0f6996) with stable (43d16b8)¹}

Footnotes

1. No successful run was found on pmi-20260227-webhooks-ifc-2272 (9bd3f98) during the generation of this report, so stable (43d16b8) was used instead as the comparison base. There might be some changes unrelated to this pull request in this report. ↩

[ogenstad]

LGTM. Nice work! I think we can revisit some of the typing parts once we've locked down the namespace and consider our options at that point.