feat: install gh and copilot-review in Kubeflow image

CHANGELOG.md

@@ -12,6 +12,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 - Add CHANGELOG.md and require changelog entries in PRs (#165)
 - Add drag-to-resize handle for chat input textarea (#170)
 - Add timestamp display and expandable details panel to message turns (#176)
+- Preinstall GitHub CLI and pinned `gh-copilot-review` extension in the Kubeflow image (#194)
 
 ### Fixed
 - Fix saved prompts written to wrong localStorage key during navigation (#187)

docker/kubeflow/Dockerfile

@@ -30,6 +30,7 @@ FROM alpine:3.21
 RUN apk add --no-cache \
     bash \
     git \
+    github-cli \
     curl \
     openssh-client \
     neovim \
@@ -71,12 +72,26 @@ RUN addgroup -g 1000 jovyan && \
 # Create directories (including s6 runtime directory for rootless mode)
 # /run must be writable by jovyan for s6-overlay's preinit writability test
 RUN mkdir -p /home/jovyan/.config/opencode \
+             /home/jovyan/.config/gh \
+             /home/jovyan/.local/share/gh \
              /home/jovyan/.local/share/opencode \
              /home/jovyan/.s6-runtime \
              /opt/opencode-ui \
              /tmp_home \
              /run
 
+RUN printf 'git_protocol: https\nversion: "1"\n' > /home/jovyan/.config/gh/config.yml && \
+    printf 'github.com:\n    git_protocol: https\n' > /home/jovyan/.config/gh/hosts.yml
+
+# Install GitHub Copilot review extension for the runtime user.
+# The extension has no tags/releases, so pin to an audited commit for reproducibility.
+ARG GH_COPILOT_REVIEW_REF=1dfe6cd4abf66f8d45cbc0b3de26cf202fd27910
+RUN mkdir -p /home/jovyan/.local/share/gh/extensions/gh-copilot-review && \
+    git -C /home/jovyan/.local/share/gh/extensions/gh-copilot-review init && \
+    git -C /home/jovyan/.local/share/gh/extensions/gh-copilot-review remote add origin https://github.com/ChrisCarini/gh-copilot-review && \
+    git -C /home/jovyan/.local/share/gh/extensions/gh-copilot-review fetch --depth 1 origin "${GH_COPILOT_REVIEW_REF}" && \
+    git -C /home/jovyan/.local/share/gh/extensions/gh-copilot-review checkout FETCH_HEAD
+
 # Copy default OpenCode config (disables amazon-bedrock to avoid S3/MinIO credential confusion)
 COPY docker/kubeflow/opencode-default-config.json /home/jovyan/.config/opencode/opencode.json
 

docker/kubeflow/README.md

@@ -8,6 +8,7 @@ This image combines:
 
 - **OpenCode API Server** (runs on internal port 4096)
 - **Prefix-Aware Web UI** (serves on port 8888, proxies to API)
+- **GitHub CLI and Copilot Review extension** (`gh` + `gh-copilot-review`)
 
 The UI automatically adapts to any URL prefix set by Kubeflow's `NB_PREFIX` environment variable.
 
@@ -116,6 +117,12 @@ spec:
 | `BRANDING_NAME`    | (empty)                 | Optional branding name shown in UI|
 | `BRANDING_URL`     | (empty)                 | Optional URL for branding link    |
 
+## Preinstalled Developer Tooling
+
+- `gh` is preinstalled in the image and available to the runtime user (`jovyan`).
+- `gh-copilot-review` is preinstalled for `jovyan` and can be used with `gh copilot-review <pr-number>`.
+- The extension is pinned in `docker/kubeflow/Dockerfile` via `GH_COPILOT_REVIEW_REF` for reproducible builds.
+
 ## Configuration Directories
 
 | Path                                  | Description                 |