From 4d75e84503202f2bee4aab060c8fabdc63f23555 Mon Sep 17 00:00:00 2001
From: xj <gh-xj@users.noreply.github.com>
Date: Sun, 1 Mar 2026 22:48:10 -0800
Subject: [PATCH] fix: address review findings on plugin/runtime and CI
 portability

---
 .github/workflows/docs-deploy.yml | 5 +++++
 src/config/schema.rs              | 3 +++
 2 files changed, 8 insertions(+)

diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index e44839830..6ea5e254a 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -73,6 +73,11 @@ jobs:
               with:
                   fetch-depth: 0
 
+            - name: Setup Node.js
+              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+              with:
+                  node-version: "22"
+
             - name: Resolve docs diff scope
               id: scope
               shell: bash
diff --git a/src/config/schema.rs b/src/config/schema.rs
index 9e08b8b38..d008ba0dc 100644
--- a/src/config/schema.rs
+++ b/src/config/schema.rs
@@ -5353,6 +5353,9 @@ pub struct WatiConfig {
     ///
     /// Supports `X-Hub-Signature-256` HMAC verification and Bearer-token fallback.
     /// Can also be set via `ZEROCLAW_WATI_WEBHOOK_SECRET`.
+    /// Default: `None` (unset).
+    /// Compatibility/migration: additive key for existing deployments; set this
+    /// before enabling inbound WATI webhooks. Remove (or set null) to roll back.
     #[serde(default)]
     pub webhook_secret: Option<String>,
     /// Tenant ID for multi-channel setups (optional).