Clarify built-in token support for public team-memory source reads

[Changyong Gong (chagong)]

Summary

• Remove the misleading source-github-token input requirement for an independent, source-scoped credential. Its existing ${{ github.token }} default supports same-repository and supported public cross-repository reads; explicit overrides remain supported and explicitly empty/invalid tokens still fail without fallback.
• Extend existing offline tests for caller-token/override routing across public-source REST and GraphQL reads, including rebase PR resolution, ancestry checks, complete 1,000-commit pagination, source name/ID and workflow/run identity guards, public-only source/coordinator visibility, and authentication failures without retry or anonymous fallback.
• Lock down the distinct dispatch-write requirement: successful public target reads followed by a denied dispatch do not trigger credential fallback or retry.

No authentication backend, runtime Python, workflow, action pin, permission, public documentation, README, contributor guide, or runtime prompt/policy changes. The production helper was already compatible, so no redundant authentication plumbing was introduced or removed. IssueLens's own workflows keep their built-in-token defaults.

Existing diagnostic evidence and limits

The prior public-source diagnostic in microsoft/vscode-java-pack, at b18190a1cb932fdf0b5e02815af05075546b7e58, used only the actual built-in job GITHUB_TOKEN with Actions/Contents/Pull requests read access (implicit Metadata). It completed 43 authenticated REST/GraphQL reads and semantic checks across six already-merged public callers, without anonymous fallback, another tested token, or agent/wiki invocation.

That diagnostic was not rerun or changed for this PR. All six source tips matched the approved after SHA, so conditional after-to-tip ancestry reads were skipped, not live-tested. It did not live-prove pagination, private-repository behavior, or the seventh source, vscode-gradle/develop. New regression tests are mocked/offline and do not establish live GitHub permissions, OIDC, hosted execution, or wiki publication.

Preserved boundaries and remaining requirement

Canonical source name-to-ID allowlisting, public source and coordinator restrictions, trusted workflow loading, exact source run/head/default-branch checks, complete bounded inventory/PR discovery, ref-race rejection, wiki/privacy authorization and receipt validation, the fixed queue with no cancellation, immutable pins, and no-retry/no-redirect behavior remain unchanged.

Public source reads do not grant dispatch writes. Cross-repository callers still need a target-authorized token with Contents read and Actions write. This PR does not fix callers failing before dispatch because their dispatch-App credentials are missing, and demands no Java Pack or Java caller changes. Those migrations remain separate.

Validation

On Python 3.12.10, from tests:

py -3 -m unittest -q test_team_memory_coordinator test_team_memory_push test_team_memory_workflow test_issuelens_action test_workflow_dispatch_action

116 tests passed (baseline: 111). Changed-file/action Python syntax compilation and git diff --check also passed. Self-reviewed the four-file diff against current main.

Automatic PR CI passed at head 75d087ba1283df40dfae663e5bd8c6167138a147: application tests (Python 3.13), MCP tests (Python 3.12/3.13), MCP package build/install (Python 3.12/3.13), and workflow validation. CLA also passed: all seven checks successful.

No deployment, settings/secrets/variables changes, manual workflow dispatch/rerun, agent/wiki invocation, or external-repository edits.

[Copilot]

🟡 Changes recommended

Public documentation still states that cross-repository reads require an independent source credential.

1 open finding

• Update docs to reflect built-in token support for public reads · New

What changed in this PR

Clarifies token routing for public team-memory source reads and strengthens regression coverage.

Changes:

• Documents built-in token support and separate dispatch-write permissions.
• Expands source-token, authentication, pagination, and dispatch tests.

File	Description
.github/​actions/​issuelens/​action.yml	Clarifies source-token defaults.
tests/​test_team_memory_coordinator.py	Expands source-read credential tests.
tests/​test_team_memory_workflow.py	Verifies token metadata contracts.
tests/​test_workflow_dispatch_action.py	Tests denied dispatch writes.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Changyong Gong (chagong)]

Confirmed: those public docs still describe an independent source-read credential, so the inconsistency is real. The current user explicitly excluded public documentation from this PR: “we don't need to update any public docs, so remove all of you doc updates”. I’m therefore not changing the action README, guide, queue/MCP READMEs, or adding assertions that require those edits.

The action input description is corrected and the default-token/override behavior has offline regression coverage; dispatch-write authentication remains separate. Documentation alignment is deferred under the current scope, not fixed by this PR, so I’m leaving this thread unresolved.