feat: deploy github webhook server in dev environment

[gjkim42]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Deploys the GitHub webhook server in the dev environment and converts the kelos-reviewer TaskSpawner from polling-based to webhook-based.

• Add --github-webhook-secret-name and --webhook-resource-requests flags to kelos install
• Update deploy-dev workflow to install the webhook server, manage rollouts, and scrape metrics
• Fix ExtractGitHubWorkItem to always include Number, Body, URL, and Branch in template vars (avoids "map has no entry for key" errors)
• Convert kelos-reviewer from githubPullRequests (polling) to githubWebhook (issue_comment events)

Which issue(s) this PR is related to:

N/A

Special notes for your reviewer:

• The webhook server deploys to kelos-system namespace and requires a secret named github-webhook-secret with a WEBHOOK_SECRET key
• The kelos-reviewer now triggers on issue_comment events with /kelos review in the body, filtered by author (gjkim42, kelos-bot[bot])

Does this PR introduce a user-facing change?

Add --github-webhook-secret-name and --webhook-resource-requests flags to kelos install for deploying the GitHub webhook server. Fix webhook template rendering to always include standard variables.

[cubic-dev-ai]

2 issues found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/cli/install_test.go">

<violation number="1" location="internal/cli/install_test.go:713">
P2: `TestInstallCommand_WebhookResourceRequestsFlag` is a false-positive test: it searches global dry-run output for `cpu: 10m`/`memory: 64Mi`, which can come from non-webhook manifests, so webhook request regressions may go undetected.</violation>
</file>

<file name="internal/cli/install.go">

<violation number="1" location="internal/cli/install.go:74">
P2: `--webhook-resource-requests` is accepted without `--github-webhook-secret-name`, but in that case the webhook server is not enabled and the flag has no effect. Add validation to reject this unsupported flag combination.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

[cubic-dev-ai]

P2: TestInstallCommand_WebhookResourceRequestsFlag is a false-positive test: it searches global dry-run output for cpu: 10m/memory: 64Mi, which can come from non-webhook manifests, so webhook request regressions may go undetected.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/cli/install_test.go, line 713:

<comment>`TestInstallCommand_WebhookResourceRequestsFlag` is a false-positive test: it searches global dry-run output for `cpu: 10m`/`memory: 64Mi`, which can come from non-webhook manifests, so webhook request regressions may go undetected.</comment>

<file context>
@@ -678,6 +678,60 @@ func TestInstallCommand_NoControllerResourcesByDefault(t *testing.T) {
+		}
+	})
+
+	for _, expected := range []string{"cpu: 10m", "memory: 64Mi"} {
+		if !strings.Contains(output, expected) {
+			t.Errorf("expected %q in output when --webhook-resource-requests is set", expected)
</file context>

Suggested change

	for _, expected := range []string{"cpu: 10m", "memory: 64Mi"} {
	if !strings.Contains(output, expected) {
	t.Errorf("expected %q in output when --webhook-resource-requests is set", expected)
	}
	}
	webhookDeployment := extractYAMLDocument(t, []byte(output), "kind: Deployment\nmetadata:\n name: kelos-webhook-github")
	for _, expected := range []string{"cpu: 10m", "memory: 64Mi"} {
	if !strings.Contains(webhookDeployment, expected) {
	t.Errorf("expected %q in webhook deployment when --webhook-resource-requests is set", expected)
	}
	}

[cubic-dev-ai]

P2: --webhook-resource-requests is accepted without --github-webhook-secret-name, but in that case the webhook server is not enabled and the flag has no effect. Add validation to reject this unsupported flag combination.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At internal/cli/install.go, line 74:

<comment>`--webhook-resource-requests` is accepted without `--github-webhook-secret-name`, but in that case the webhook server is not enabled and the flag has no effect. Add validation to reject this unsupported flag combination.</comment>

<file context>
@@ -69,6 +71,23 @@ func newInstallCommand(cfg *ClientConfig) *cobra.Command {
 				controllerResourceLimits,
 				ghproxyAllowedUpstreams,
 			))
+			if githubWebhookSecretName != "" || webhookResourceRequests != "" {
+				webhookVals := map[string]interface{}{}
+				if githubWebhookSecretName != "" {
</file context>

Suggested change

	if githubWebhookSecretName != "" || webhookResourceRequests != "" {
	if webhookResourceRequests != "" && githubWebhookSecretName == "" {
	return fmt.Errorf("--webhook-resource-requests requires --github-webhook-secret-name")
	}
	if githubWebhookSecretName != "" || webhookResourceRequests != "" {