feat(taskspawner): add contextSources to TaskTemplate for cross-syste…

[knechtionscoding]

What type of PR is this?

/kind feature

What this PR does / why we need it:

Add a contextSources field to TaskTemplate that declaratively fetches data from external HTTP endpoints during the spawner's discovery cycle and makes responses available as {{.Context.}} template variables. This gives agents rich, pre-fetched cross-system context from the first token, improving first-attempt success rates and reducing cost.

• New ContextSource and HeaderFromSecret API types with kubebuilder validation markers
• New internal/contextfetch package with parallel fetching via errgroup, Secret-based header resolution, JSONPath filtering (reusing existing PaesslerAG/jsonpath dependency), URL template rendering, HTTPS-by-default scheme validation, and configurable response size limits
• Integration in both the polling spawner loop and webhook handler
• RBAC: grant secrets get to kelos-spawner-role and kelos-webhook-role
• Required flag (default false) controls whether fetch failures block task creation or degrade gracefully to empty strings

Which issue(s) this PR is related to:

Fixes #881

Special notes for your reviewer:

Example:

taskTemplate:
  contextSources:
    - name: errorDetails
      url: "https://sentry.io/api/0/organizations/my-org/issues/?query={{.Number}}"
      headersFrom:
        - header: Authorization
          secretRef:
            name: sentry-credentials
          key: auth-header
      jsonPathFilter: "$[0].culprit"
  promptTemplate: |
    Fix bug #{{.Number}}: {{.Title}}

    {{.Body}}
    {{- if .Context.errorDetails}}

    ## Sentry context
    {{.Context.errorDetails}}
    {{- end}}

Does this PR introduce a user-facing change?

feat: add context sources to a task to allow for fetching http information

---

Summary by cubic

Adds contextSources to TaskTemplate to fetch external HTTP data before task creation and expose results as .Context.* in templates. This gives agents pre-fetched cross-system context from the first token.

• New Features

  • Added TaskTemplate.contextSources with unique names (max 8) and .Context.NAME template access.
  • New API types: ContextSource, HeaderFromSecret with validation (timeouts, size limits, HTTPS-by-default).
  • New internal/contextfetch with parallel fetch, URL/body templating, Secret-based headers, JSONPath filtering via PaesslerAG/jsonpath, and a required flag to block or degrade.
  • Integrated in spawner loop and webhook handler; CRDs/Helm/install manifests updated with CEL name-uniqueness XValidation; RBAC updated for secrets.get.

• Migration

  • Apply updated CRDs and RBAC (spawner and webhook roles need secrets.get).
  • Use HTTPS endpoints by default; set allowInsecure: true only when needed.

^{Written for commit cb6289d. Summary will update on new commits. Review in cubic}

[cubic-dev-ai]

1 issue found across 10 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="internal/contextfetch/fetcher.go">

<violation number="1" location="internal/contextfetch/fetcher.go:232">
P2: Template rendering is non-strict, so missing variables may silently render as `<no value>` and still trigger outbound HTTP requests.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}