Pipelines to Production — AI-Accelerated CI/CD for Java

Shortlink: https://aka.ms/pipelines-to-production

Demo repo for the JDConf 2026 session: Pipelines to Production — AI-Accelerated CI/CD for Java.

This project demonstrates how AI assists at every stage of a Java CI/CD pipeline — from test generation to deployment — while keeping humans in the loop.

---

What's Inside

Path	Description
src/	Spring Boot order-processing service (Java 21, Spring Boot 3.5)
.github/workflows/ai-pipeline.yml	GitHub Actions workflow with Copilot CLI build analysis
k8s/	Kubernetes manifests for AKS (Deployment, Service, HPA)
aca/	Azure Container Apps deployment configuration
Dockerfile	Multi-stage Docker build using Microsoft OpenJDK 21
Demo_Script_AI_CICD_Pipeline.md	Step-by-step live demo script (~7 min)
Speaker_Notes.md	Slide-by-slide speaker notes for the full talk

The Five Demo Steps

1. Generate Unit Tests — Copilot Agent Mode analyzes OrderService.java and generates comprehensive JUnit 5 tests with edge cases
2. AI Code Review — Copilot reviews for OWASP Top 10 vulnerabilities (the service includes intentional security issues for this demo)
3. Copilot CLI in GitHub Actions — Automated build analysis that summarizes Maven output on every push
4. Kubernetes Manifest Generation — AI generates deployment YAML with correct Spring Boot Actuator probes and JVM-appropriate resource limits
5. Guardrails — Demonstrates the human-in-the-loop approval model: AI proposes, humans approve

Prerequisites

• Java 21+ (Microsoft Build of OpenJDK recommended)
• Maven 3.9+
• VS Code with:
  • Extension Pack for Java
  • GitHub Copilot
  • GitHub Copilot Chat
• GitHub CLI with Copilot extension: gh extension install github/gh-copilot

Quick Start

# Clone the repo
git clone https://github.com/bbenz/pipelines-to-production.git
cd pipelines-to-production

# Build and run tests
mvn clean verify

# Run the service locally
mvn spring-boot:run

# Test the endpoints
curl http://localhost:8080/api/orders
curl -X POST http://localhost:8080/api/orders \
  -H "Content-Type: application/json" \
  -d '{"customerName":"Alice","product":"Widget","quantity":3,"totalPrice":29.97}'
curl http://localhost:8080/api/orders/search?name=alice

API Endpoints

Method	Path	Description
GET	/api/orders	List all orders
GET	/api/orders/{id}	Get order by ID
POST	/api/orders	Create a new order
GET	/api/orders/search?name=	Search orders by customer name
GET	/actuator/health/readiness	Kubernetes readiness probe
GET	/actuator/health/liveness	Kubernetes liveness probe

Deploy to Azure

Option 1: Azure Kubernetes Service (AKS)

The k8s/ directory includes a deployment script that creates all Azure resources from scratch:

# Make the script executable
chmod +x k8s/deploy-to-aks.sh

# Edit the environment variables at the top of the script:
#   RESOURCE_GROUP, LOCATION, AKS_CLUSTER_NAME, ACR_NAME, etc.
vi k8s/deploy-to-aks.sh

# Run the script
./k8s/deploy-to-aks.sh

The script will:

1. Create a resource group and Azure Container Registry (ACR)
2. Build and push the Docker image to ACR using az acr build (skips if image already exists)
3. Create an AKS cluster attached to the ACR (skips if cluster already exists)
4. Install kubectl if not already present (downloads the Linux binary directly)
5. Fetch AKS credentials and set your kubectl context to the new cluster
6. Patch deployment.yaml with the real ACR image reference
7. Apply all Kubernetes manifests (Deployment, Service, HPA)
8. Wait for the rollout and display pod/service status
9. Expose the service via LoadBalancer and wait for the external IP
10. Print curl commands to test the running service

If you already have an AKS cluster, set your kubectl context manually:

# Install kubectl if needed
az aks install-cli

# Set kubectl to use your existing AKS cluster
az aks get-credentials \
  --resource-group <your-resource-group> \
  --name <your-aks-cluster> \
  --overwrite-existing

# Verify the context is set
kubectl config current-context

# If AKS needs pull access to your ACR, attach it
az aks update \
  --resource-group <your-resource-group> \
  --name <your-aks-cluster> \
  --attach-acr <your-acr-name>

To expose the service externally after deployment:

kubectl patch svc order-service -p '{"spec":{"type":"LoadBalancer"}}'

To tear down all resources:

az group delete --name <your-resource-group> --yes --no-wait

Test the Service on AKS

After deploying, expose the service and call it with curl:

# Expose the service with a public IP (if not already LoadBalancer)
kubectl patch svc order-service -p '{"spec":{"type":"LoadBalancer"}}'

# Wait for the external IP to be assigned (may take 1-2 minutes)
kubectl get svc order-service --watch

# Once EXTERNAL-IP is assigned, set it as a variable
export SERVICE_IP=$(kubectl get svc order-service -o jsonpath='{.status.loadBalancer.ingress[0].ip}')
echo "Service IP: ${SERVICE_IP}"

# List all orders (empty initially)
curl http://${SERVICE_IP}/api/orders

# Create an order
curl -X POST http://${SERVICE_IP}/api/orders \
  -H "Content-Type: application/json" \
  -d '{"customerName":"Alice","product":"Widget","quantity":3,"totalPrice":29.97}'

# List orders again (should show the new order)
curl http://${SERVICE_IP}/api/orders

# Search by customer name
curl "http://${SERVICE_IP}/api/orders/search?name=alice"

# Check health endpoints (used by K8s probes)
curl http://${SERVICE_IP}/actuator/health/readiness
curl http://${SERVICE_IP}/actuator/health/liveness

Option 2: Azure Container Apps (ACA)

# Deploy directly from source
az containerapp up \
  --name order-service \
  --resource-group <your-rg> \
  --source .

GitHub Actions — AI Build Analysis

The workflow in .github/workflows/ai-pipeline.yml runs on every push and PR. It:

1. Builds the project with Maven
2. Installs Copilot CLI on the runner
3. Prompts Copilot to analyze the build output
4. Writes a human-readable summary to the workflow's Summary tab

Setup: Add a COPILOT_PAT secret to your repository with a GitHub PAT that has Copilot access.

Intentional Security Issues (For Demo)

OrderService.java contains intentional commented vulnerabilities for the AI code-review demo:

• SQL injection pattern — string concatenation in searchByCustomerName() simulating unsafe query building
• Missing input validation — createOrder() accepts negative quantities and null fields
• Sensitive data logging — customer names logged in plaintext
• Mutable collection exposure — getAllOrders() returns the internal list directly

These are marked with // VULNERABILITY: comments. In the demo, Copilot detects and suggests fixes for each.

Resources

Resource	Link
This repo	https://aka.ms/pipelines-to-production
Copilot CLI + GitHub Actions	docs.github.com
Copilot CLI Reference	docs.github.com
GitHub Copilot	github.com/features/copilot
VS Code Extension Pack for Java	marketplace.visualstudio.com
Microsoft Build of OpenJDK	learn.microsoft.com
Azure Kubernetes Service	learn.microsoft.com
Azure Container Apps	learn.microsoft.com
Microsoft Foundry	ai.azure.com
GitHub Models	github.com/marketplace/models
Agentic DevOps Blog	azure.microsoft.com/blog
Spring Boot Actuator	docs.spring.io

License

This project is provided as demo material for educational purposes.