Provision ephemeral namespace-per-PR environments using GitHub Actions and kubectl

Steps

1. Add a GitHub Actions workflow triggered on pull_request with types: [opened, synchronize, reopened] to create the environment and a separate trigger on pull_request with types: [closed] to destroy it.
2. In the create job, use kubectl create namespace pr-${{ github.event.pull_request.number }} (or a sanitized slug) to provision an isolated namespace for the PR.
3. Deploy your application into the namespace using helm upgrade --install or kubectl apply -f with --namespace pr-${{ github.event.pull_request.number }} to scope all resources to the PR namespace.
4. Post the preview URL as a pull request comment using the GitHub REST API (POST /repos/{owner}/{repo}/issues/{pr_number}/comments) so reviewers can access the environment.
5. In the cleanup job (triggered on PR close), run kubectl delete namespace pr-${{ github.event.pull_request.number }} to remove all resources in that namespace automatically.
6. Store the kubeconfig in a GitHub Actions encrypted secret and export it to KUBECONFIG in the workflow; restrict the service account used to only the necessary namespaces and verbs.