Add GitHub pipeline feature behind preview flag

[gambtho]

Summary

Adds GitHub-based deployment pipelines for AKS projects, gated behind a new Preview Features toggle in plugin settings (off by default).

When enabled, users can:

• Connect a GitHub repo and configure a CI/CD pipeline via a guided wizard
• Set up Copilot agent-driven containerization with PR tracking
• Configure workload identity (OIDC) for secure deployments
• Monitor pipeline runs and deployment health from a new Deploy tab
• Manage GitHub repository secrets for pipeline workflows

The existing Deploy Application button is preserved — pipeline features are purely additive.

Key changes

• Preview feature flag — PreviewFeaturesSettings UI toggle + usePreviewFeatures hook; four entry-point components return null when disabled
• GitHub auth — Browser OAuth flow with secure token storage, auth status button in project header
• GitHub API — Octokit wrapper for repos, PRs, workflow runs, issues, secrets, and app installation checks
• Pipeline state machine — useGitHubPipelineState with 15+ states, persistent storage, and polling infrastructure
• Pipeline orchestration — Agent template generation, PR/workflow management, probe helpers
• Wizard UI — Multi-step drawer wizard (auth → repo selection → agent setup → PR tracking → deployment status → workload identity)
• Deploy tab — Per-cluster deploy cards with pipeline status, container config extraction, and deploy-via-pipeline dialog
• Pipeline card — Overview section showing latest workflow run status
• OIDC support — az-cli commands for workload identity federation setup
• libsodium — Added for GitHub repository secret encryption

Test plan

• npm run tsc passes
• npm run lint passes
• npm run format -- --check passes
• All pipeline-related tests pass (153 tests across 8 files)
• Manual: toggle preview flag on/off, verify pipeline UI appears/disappears
• Manual: end-to-end pipeline wizard flow with a GitHub repo

For Issue:

• [FEATURE] GitHub Pipeline Deployment for AKS Desktop #353

[Copilot]

Pull request overview

This PR introduces a GitHub-based deployment pipeline flow (behind a “Preview Features” toggle) for AKS Desktop, including GitHub auth, repo readiness checks, pipeline orchestration, workload identity setup, and UI surfaces to configure and trigger deployments.

Changes:

• Add GitHub Pipelines preview feature settings and wire into plugin registration + UI.
• Implement end-to-end GitHub pipeline wizard (auth, repo selection, setup PR, agent trigger, PR/workflow polling, deployment status) and supporting GitHub/Azure utilities.
• Enhance deploy experience with pipeline run listing, pipeline redeploy dialog, and manual deploy edit prefill.

Reviewed changes

Copilot reviewed 57 out of 58 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
plugins/aks-desktop/src/utils/github/github-auth.ts	Updates default GitHub App slug and adds lint suppression for window bridge typing.
plugins/aks-desktop/src/utils/github/github-api.ts	Adds repo readiness check for deploy workflow and adds Actions secrets management helpers.
plugins/aks-desktop/src/utils/github/github-api.test.ts	Updates readiness/app installation tests to match new workflow slug and readiness shape.
plugins/aks-desktop/src/utils/azure/az-cli.ts	Adds workload identity management helpers via Azure CLI (identity, roles, federated creds).
plugins/aks-desktop/src/types/github.ts	Extends RepoReadiness to include deploy workflow presence.
plugins/aks-desktop/src/index.tsx	Registers plugin settings, deploy tab, pipeline overview card, and header actions.
plugins/aks-desktop/src/hooks/usePreviewFeatures.ts	Adds hook to merge preview feature defaults with stored config.
plugins/aks-desktop/src/hooks/usePreviewFeatures.test.ts	Adds unit tests for preview feature defaults vs stored config.
plugins/aks-desktop/src/components/PluginSettings/previewFeaturesStore.ts	Introduces ConfigStore-backed preview feature configuration.
plugins/aks-desktop/src/components/PluginSettings/PreviewFeaturesSettings.tsx	Adds UI for toggling preview features (GitHub Pipelines).
plugins/aks-desktop/src/components/GitHubPipeline/utils/statusDisplay.ts	Adds functions for workflow/pod/check status presentation.
plugins/aks-desktop/src/components/GitHubPipeline/utils/probeHelpers.ts	Adds YAML escaping + probe rendering helpers for agent payloads.
plugins/aks-desktop/src/components/GitHubPipeline/utils/pipelineStorage.ts	Adds localStorage persistence helpers for active pipeline resume/cancel.
plugins/aks-desktop/src/components/GitHubPipeline/utils/pipelineOrchestration.ts	Implements setup PR creation, secrets creation, and Copilot agent triggering.
plugins/aks-desktop/src/components/GitHubPipeline/utils/pipelineOrchestration.test.ts	Adds unit tests for orchestration steps and issue payload security.
plugins/aks-desktop/src/components/GitHubPipeline/utils/getWizardStep.ts	Adds mapping from pipeline state → wizard step index.
plugins/aks-desktop/src/components/GitHubPipeline/utils/agentTemplates.ts	Adds agent config/workflow templates, branch naming, and config validation.
plugins/aks-desktop/src/components/GitHubPipeline/utils/agentTemplates.test.ts	Adds unit tests for generated agent config/templates and validation.
plugins/aks-desktop/src/components/GitHubPipeline/types.ts	Introduces pipeline state machine types and tracking shapes.
plugins/aks-desktop/src/components/GitHubPipeline/hooks/useWorkloadIdentitySetup.ts	Adds hook to orchestrate Azure managed identity + federated credential setup.
plugins/aks-desktop/src/components/GitHubPipeline/hooks/useWorkflowPolling.ts	Adds polling for GitHub Actions workflow runs after PR merge.
plugins/aks-desktop/src/components/GitHubPipeline/hooks/usePolling.ts	Adds generic polling hook used by PR/workflow/agent discovery polling.
plugins/aks-desktop/src/components/GitHubPipeline/hooks/usePipelineAnnotationSync.ts	Syncs configured pipeline repos + identity metadata into namespace annotations.
plugins/aks-desktop/src/components/GitHubPipeline/hooks/usePRPolling.ts	Adds polling for PR merge/close state and status checks.
plugins/aks-desktop/src/components/GitHubPipeline/hooks/useGitHubAuth.ts	Adds OAuth/token lifecycle management with cross-react-tree synchronization.
plugins/aks-desktop/src/components/GitHubPipeline/hooks/useDeploymentHealth.ts	Adds K8s deployment/pod/service health monitoring for pipeline deployments.
plugins/aks-desktop/src/components/GitHubPipeline/hooks/useAgentPRDiscovery.ts	Adds polling to discover Copilot agent-generated PR via issue timeline.
plugins/aks-desktop/src/components/GitHubPipeline/constants.ts	Adds web event constant for opening the pipeline wizard drawer.
plugins/aks-desktop/src/components/GitHubPipeline/components/WorkloadIdentitySetup.tsx	Adds UI for workload identity setup progress and error handling.
plugins/aks-desktop/src/components/GitHubPipeline/components/WizardShell.tsx	Adds reusable wizard shell with step indicator and cancel confirmation.
plugins/aks-desktop/src/components/GitHubPipeline/components/RepoSelector.tsx	Adds repository picker UI backed by GitHub repo listing.
plugins/aks-desktop/src/components/GitHubPipeline/components/PipelineConfiguredScreen.tsx	Adds post-configure completion UI.
plugins/aks-desktop/src/components/GitHubPipeline/components/PRStatusScreen.tsx	Adds UI for PR/issue progress and status checks.
plugins/aks-desktop/src/components/GitHubPipeline/components/GitHubAuthStatusButton.tsx	Adds header button showing GitHub auth status and sign-in action.
plugins/aks-desktop/src/components/GitHubPipeline/components/GitHubAuthScreen.tsx	Adds GitHub auth UX screen (permissions + browser auth waiting state).
plugins/aks-desktop/src/components/GitHubPipeline/components/DeploymentStatusScreen.tsx	Adds deployment progress UI combining workflow status and K8s health.
plugins/aks-desktop/src/components/GitHubPipeline/components/ConnectSourceStep.tsx	Adds connect-source step UI with app-installation guidance.
plugins/aks-desktop/src/components/GitHubPipeline/components/AgentSetupReview.tsx	Adds review screen for setup PR / agent trigger config, incl. container settings.
plugins/aks-desktop/src/components/GitHubPipeline/fixtures/pipelineConfig.ts	Adds fixtures for pipeline orchestration/template tests.
plugins/aks-desktop/src/components/GitHubPipeline/GitHubPipelineWizard.tsx	Adds the main GitHub pipeline wizard component and state-driven rendering.
plugins/aks-desktop/src/components/GitHubPipeline/GitHubAuthContext.tsx	Adds context/provider wrapper for GitHub auth usage across UI.
plugins/aks-desktop/src/components/Deployments/hooks/usePipelineRuns.ts	Adds hook to fetch recent workflow runs across configured repos.
plugins/aks-desktop/src/components/Deployments/PipelineCard.tsx	Adds overview card listing pipeline runs and opening wizard drawer.
plugins/aks-desktop/src/components/DeployWizard/utils/yamlGenerator.ts	Annotates manual deployments for provenance tracking.
plugins/aks-desktop/src/components/DeployWizard/hooks/useContainerConfiguration.ts	Adds support for initializing container config from partial overrides.
plugins/aks-desktop/src/components/DeployWizard/components/ConfigureContainer.tsx	Allows skipping container image requirement for pipeline setup path.
plugins/aks-desktop/src/components/DeployWizard/DeployWizard.tsx	Adds edit-mode support via initial container config to jump into configure step.
plugins/aks-desktop/src/components/DeployTab/utils/extractContainerConfig.ts	Adds extraction from live K8s resources to prefill DeployWizard for edits.
plugins/aks-desktop/src/components/DeployTab/utils/extractContainerConfig.test.ts	Adds unit tests for deployment/service → container config extraction.
plugins/aks-desktop/src/components/DeployTab/hooks/usePipelineStatus.ts	Adds pipeline configured repo discovery via namespace annotations + local fallback.
plugins/aks-desktop/src/components/DeployTab/hooks/usePipelineSettings.ts	Adds localStorage-backed per-user pipeline enablement settings.
plugins/aks-desktop/src/components/DeployTab/hooks/useClusterDeployStatus.ts	Adds deployment/service status watcher with provenance derived from annotations.
plugins/aks-desktop/src/components/DeployTab/components/PipelineDeployDialog.tsx	Adds dialog to dispatch workflow_dispatch with deployment parameters.
plugins/aks-desktop/src/components/DeployTab/components/ClusterDeployCard.tsx	Adds per-namespace deploy UI (manual deploy/edit + pipeline redeploy).
plugins/aks-desktop/src/components/DeployTab/DeployTab.tsx	Introduces a new Deploy tab gated by preview feature + user settings.
plugins/aks-desktop/src/components/ConfigurePipeline/ConfigurePipelineButton.tsx	Adds header button + drawer hosting the pipeline wizard.
plugins/aks-desktop/package.json	Adds libsodium-wrappers dependency and its TypeScript types.
plugins/aks-desktop/locales/en/translation.json	Adds strings for preview features UI.
plugins/aks-desktop/locales/zh-Hant/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/zh-Hans/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/tr/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/sv/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/ru/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/pt-PT/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/pt-BR/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/pl/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/nl/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/ko/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/ja/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/it/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/id/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/hu/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/fr/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/es/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/de/translation.json	Adds placeholder keys for new preview features strings.
plugins/aks-desktop/locales/cs/translation.json	Adds placeholder keys for new preview features strings.
headlamp	Updates Headlamp submodule pointer.

Files not reviewed (1)

• plugins/aks-desktop/package-lock.json: Language not supported

Comments suppressed due to low confidence (5)

plugins/aks-desktop/src/utils/azure/az-cli.ts:1

• The same GITHUB_NAME_PATTERN is used for branch, but it disallows /. Git branch names commonly include slashes (e.g. feature/foo), which would cause false validation failures and block federated credential creation. Use a separate, branch-appropriate validator (allowing / while still preventing traversal like ..) or relax the branch validation to support common Git branch naming.
  plugins/aks-desktop/src/utils/azure/az-cli.ts:1
• The same GITHUB_NAME_PATTERN is used for branch, but it disallows /. Git branch names commonly include slashes (e.g. feature/foo), which would cause false validation failures and block federated credential creation. Use a separate, branch-appropriate validator (allowing / while still preventing traversal like ..) or relax the branch validation to support common Git branch naming.
  plugins/aks-desktop/src/components/GitHubPipeline/utils/pipelineStorage.ts:1
• Avoid leaving console.log statements in production code paths (especially ones that can reveal internal state like storage keys). Consider removing this or switching to the project's debug logging facility so it can be gated/disabled in production builds.
  plugins/aks-desktop/src/components/Deployments/hooks/usePipelineRuns.ts:1
• JSON.stringify(repos) in a dependency array adds repeated serialization cost and can still be unstable if key order changes. Prefer deriving a small deterministic key (e.g., join ${owner}/${repo}@${defaultBranch} values) or requiring callers to pass a stable repos reference so useMemo isn't needed.
  plugins/aks-desktop/src/components/GitHubPipeline/utils/probeHelpers.ts:1
• escapeYamlValue is security- and correctness-sensitive for embedding user-provided values into YAML. Add unit tests covering backslashes, quotes, newlines/CRLF, tabs, and a case with multiple escapes combined, plus a regression test that ensures the generated YAML remains parseable.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 58 out of 59 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• plugins/aks-desktop/package-lock.json: Language not supported

Comments suppressed due to low confidence (8)

plugins/aks-desktop/src/components/GitHubPipeline/hooks/useAgentWorkflowProgress.ts:1

• After the first poll cycle, runUrl is always returned as null, so consumers will lose the previously discovered URL once the next poll result overwrites the prior data. Persist the discovered run URL (e.g., store it in a ref/state and always include it in subsequent poll results, or return the last known URL when runIdRef.current is set).
  plugins/aks-desktop/src/utils/azure/az-cli.ts:1
• This validation rejects branch names containing / (e.g. release/v1), which is a common Git branch naming pattern and can be a default branch. Since runCommandAsync is called with an argv array (not shell interpolation), you can safely relax the branch validation to allow / (while still excluding whitespace/control chars) so federated credential creation doesn't fail for legitimate repos.
  plugins/aks-desktop/src/components/GitHubPipeline/hooks/useWorkflowPolling.ts:1
• This import is used only for typing (octokit: Octokit | null) but is brought in as a runtime value import, which can increase bundle size. Switch to a type-only import (import type { Octokit } ...) here (and similarly in other hooks/components that only use Octokit as a type).
  plugins/aks-desktop/src/components/GitHubPipeline/utils/pipelineStorage.ts:1
• Leftover console.log will be noisy in production and may leak internal state keys into logs. Prefer removing it or routing through an existing debug logging facility behind a dev flag.
  plugins/aks-desktop/src/utils/github/github-api.ts:1
• New GitHub Actions secrets helpers (getRepoPublicKey, createOrUpdateRepoSecret, setRepoSecrets) are added without corresponding unit tests, while this module already has comprehensive test coverage. Add tests that verify: (1) correct Octokit endpoints/params are called, (2) empty/whitespace secrets are filtered, and (3) encryption path is exercised by mocking libsodium-wrappers (including ready, from_base64, crypto_box_seal, to_base64).
  plugins/aks-desktop/src/utils/github/github-api.ts:1
• New GitHub Actions secrets helpers (getRepoPublicKey, createOrUpdateRepoSecret, setRepoSecrets) are added without corresponding unit tests, while this module already has comprehensive test coverage. Add tests that verify: (1) correct Octokit endpoints/params are called, (2) empty/whitespace secrets are filtered, and (3) encryption path is exercised by mocking libsodium-wrappers (including ready, from_base64, crypto_box_seal, to_base64).
  plugins/aks-desktop/src/utils/github/github-api.ts:1
• New GitHub Actions secrets helpers (getRepoPublicKey, createOrUpdateRepoSecret, setRepoSecrets) are added without corresponding unit tests, while this module already has comprehensive test coverage. Add tests that verify: (1) correct Octokit endpoints/params are called, (2) empty/whitespace secrets are filtered, and (3) encryption path is exercised by mocking libsodium-wrappers (including ready, from_base64, crypto_box_seal, to_base64).
  plugins/aks-desktop/src/index.tsx:1
• Introducing a new @ts-ignore for a public registration API makes this harder to maintain and can mask legitimate type breakages. If Headlamp supports isEnabled here, prefer updating/augmenting the local type definitions (or adding a small typed wrapper around registerProjectOverviewSection) so this stays type-safe without suppressing errors.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 64 out of 65 changed files in this pull request and generated 1 comment.

Files not reviewed (1)

• plugins/aks-desktop/package-lock.json: Language not supported

Comments suppressed due to low confidence (4)

plugins/aks-desktop/src/utils/github/github-api.ts:1

• issue.pull_requeston an issue timeline cross-reference does not includemerged_at(it typically only includes URLs), somergedwill be reported asfalseeven when the PR is merged. Since you're already fetching the PR details viaoctokit.pulls.get, set merged based on the PR response (pr.mergedorpr.merged_at`) instead of the issue payload.
  plugins/aks-desktop/src/components/GitHubPipeline/hooks/useWorkflowPolling.ts:1
• This imports Octokit as a runtime value, but the file only uses it as a type. Switching to a type-only import (import type { Octokit } ...) avoids bundling in Octokit unnecessarily. Same issue appears in other new modules in this PR (e.g., usePRPolling.ts, useAgentWorkflowProgress.ts, useAgentPRDiscovery.ts, usePipelineRuns.ts, RepoSelector.tsx).
  plugins/aks-desktop/src/components/GitHubPipeline/components/WorkloadIdentitySetup.tsx:1
• setupWorkloadIdentity returns a Promise, but the click handler doesn't await it or explicitly mark it as intentionally fire-and-forget. To avoid unhandled-rejection edge cases (and to satisfy common no-floating-promises lint setups), either make handleSetup async and await setupWorkloadIdentity(config), or call it with void setupWorkloadIdentity(config) and ensure errors are handled inside the hook (which you already do).
  plugins/aks-desktop/src/utils/azure/az-cli.ts:1
• The namespace validation pattern is overly permissive (allows uppercase and underscores) and may accept values Kubernetes will reject, while also making validation behavior inconsistent across the codebase. Since this is guarding a JMESPath expression, consider validating against Kubernetes namespace DNS label rules (lowercase alphanumerics + '-', max 63, must start/end alphanumeric). This keeps the injection protection while avoiding confusing false-positives that later fail inside az/K8s.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

Copilot reviewed 63 out of 64 changed files in this pull request and generated 7 comments.

Files not reviewed (1)

• plugins/aks-desktop/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[sniok]

tested without feature flag toggled just to make sure everything still works and it looks okay

the only thing is some empty cards in an overview tab but that's not critical