Merge pull request #563 from Azure/thgamble/fix-agent-template

fix: pin kubelogin version, add actions:read, instruct two-job split in agent templates

Author: gambtho

plugins/aks-desktop/src/components/GitHubPipeline/constants.ts

@@ -31,6 +31,9 @@ export const SCHEMA_VERSION = 1;
 /** Version of the containerization-assist-mcp used in agent setup steps. */
 export const CONTAINERIZATION_MCP_VERSION = '1.3.2';
 
+/** Pinned kubelogin version for AAD-enabled AKS clusters. */
+export const KUBELOGIN_VERSION = 'v0.1.6';
+
 /** Default polling interval for GitHub API checks (5 seconds). */
 export const POLLING_INTERVAL_MS = 5_000;
 

plugins/aks-desktop/src/components/GitHubPipeline/utils/agentTemplates.test.ts

@@ -3,6 +3,7 @@
 
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
 import { createContainerConfig, createValidConfig } from '../__fixtures__/pipelineConfig';
+import { KUBELOGIN_VERSION } from '../constants';
 import type { PipelineConfig } from '../types';
 import {
   generateAgentConfig,
@@ -84,6 +85,23 @@ describe('agentTemplates', () => {
       expect(result).not.toContain('Trigger on push to main');
     });
 
+    it('should instruct agent to pin kubelogin version instead of skip-cache', () => {
+      const result = generateAgentConfig(validConfig);
+      expect(result).toContain(`kubelogin-version: '${KUBELOGIN_VERSION}'`);
+      expect(result).not.toContain('skip-cache: true');
+    });
+
+    it('should instruct agent to include actions: read permission', () => {
+      const result = generateAgentConfig(validConfig);
+      expect(result).toContain('actions: read');
+    });
+
+    it('should instruct agent to split workflow into two jobs', () => {
+      const result = generateAgentConfig(validConfig);
+      expect(result).toContain('buildImage');
+      expect(result).toContain('needs: [buildImage]');
+    });
+
     it('should include optional fields when provided', () => {
       const config: PipelineConfig = {
         ...validConfig,

plugins/aks-desktop/src/components/GitHubPipeline/utils/agentTemplates.ts

@@ -5,6 +5,7 @@ import { getServiceAccountName } from '../../../utils/kubernetes/serviceAccountN
 import {
   CONTAINERIZATION_MCP_VERSION,
   DEFAULT_IMAGE_TAG,
+  KUBELOGIN_VERSION,
   PIPELINE_WORKFLOW_FILENAME,
 } from '../constants';
 import type { PipelineConfig } from '../types';
@@ -305,7 +306,9 @@ Generate \`.github/workflows/${PIPELINE_WORKFLOW_FILENAME}\` with the following:
 - Do NOT add a \`push\` trigger — deployment is always triggered explicitly
 - Use \`azure/login@v2\` with OIDC (\`secrets.AZURE_CLIENT_ID\`, \`secrets.AZURE_TENANT_ID\`, \`secrets.AZURE_SUBSCRIPTION_ID\`)
 - Use \`azure/aks-set-context@v4\` with cluster \`\${{ inputs.cluster-name }}\` and resource group \`\${{ inputs.resource-group }}\`
-- Install kubelogin (required for AAD-enabled AKS clusters): \`azure/use-kubelogin@v1\` with \`skip-cache: true\`
+- The deploy job MUST include \`actions: read\` in its permissions block (required for GITHUB_TOKEN access)
+- Split the workflow into two jobs: a \`buildImage\` job (build + push to ACR) and a \`deploy\` job (apply manifests) with \`needs: [buildImage]\`
+- Install kubelogin (required for AAD-enabled AKS clusters): \`azure/use-kubelogin@v1\` with \`kubelogin-version: '${KUBELOGIN_VERSION}'\`
 - Convert kubeconfig to use kubelogin: \`kubelogin convert-kubeconfig -l workloadidentity\`${
     config.acrLoginServer
       ? `\n- Build and push the container image using ACR Tasks: \`az acr build --registry \${{ secrets.AZURE_ACR_NAME }} --image ${config.appName}:\${{ github.sha }} .\`\n- Update the container image reference in manifests to use \`${config.acrLoginServer}/${config.appName}:\${{ github.sha }}\``