Reuse pinned IssueLens team-memory dispatcher

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: chagong

.github/actions/queue-team-memory/README.md

@@ -5,6 +5,12 @@ The [push caller](../../workflows/team-memory-post-merge.yml) only preserves
 source identities and dispatches the [coordinator](../../workflows/team-memory-coordinator.yml).
 Manual reconciliation now runs through the coordinator too, not the old push
 workflow. No source caller logs in to Azure or invokes the agent.
+The caller reuses `microsoft/IssueLens/.github/actions/queue-team-memory`;
+this directory contains only Java coordinator validation, setup guidance, and
+contract tests, not a second dispatch action.
+Its prerequisite is [microsoft/IssueLens#51](https://github.com/microsoft/IssueLens/pull/51),
+pinned at `521b1ff80a70140e286ced7500d0b150cf9e6d6c`. Review and merge that
+prerequisite first; these repository changes need no hosted runtime deployment.
 
 Both workflows require **`ISSUELENS_TEAM_MEMORY_COORDINATOR_ENABLED=true`**.
 This is a new, disabled-by-default repository variable: the existing
@@ -33,14 +39,14 @@ public visibility, and default branches. These sources currently configure
 The two Spring repositories are not included: they currently have no
 `.github/issuelens.yml` policy. An allowlist entry is not a source migration or
 authorization to ignore policy. Only Java Pack's caller changes in this PR.
-Other repositories must adopt this action in separate reviewed PRs.
+Other repositories must adopt the shared IssueLens action in separate reviewed PRs.
 Renames, transfers, branch changes, or private sources require another review.
 
 The hosted agent must resolve each source's policy and privacy constraints,
 verify that its validated destination is this wiki, and stop rather than
 override a conflicting policy. Requests explicitly require this destination;
 the pinned client's final receipt validator rejects any other wiki. Neither
-the dispatch action nor its allowlist grants wiki write access.
+the shared dispatch action nor the coordinator's allowlist grants wiki write access.
 
 ## Future external callers
 
@@ -51,16 +57,23 @@ needed for a remote reference:
 
 ```yaml
 - name: Queue Java team-memory update
-  uses: microsoft/vscode-java-pack/.github/actions/queue-team-memory@FULL_REVIEWED_COMMIT_SHA
+  uses: microsoft/IssueLens/.github/actions/queue-team-memory@521b1ff80a70140e286ced7500d0b150cf9e6d6c
   with:
+    coordinator-repository: microsoft/vscode-java-pack
+    coordinator-workflow: team-memory-coordinator.yml
+    coordinator-ref: main
     source-token: ${{ github.token }}
     dispatch-token: ${{ steps.dispatch-token.outputs.token }}
 ```
 
-Replace the placeholder with the reviewed, merged 40-character revision of
-this action; do not use a moving branch. The caller must obtain
+The shared IssueLens action is pinned to the immutable prerequisite revision.
+Do not use a moving branch. All three coordinator inputs must be supplied
+together. `coordinator-ref: main` is the destination
+branch, independently of a source default branch such as `develop`.
+The caller must obtain
 `steps.dispatch-token.outputs.token` using a **dedicated dispatch GitHub App**,
-restricted to Java Pack with **Actions write**. The read and dispatch tokens
+restricted to Java Pack with **Actions write and Contents read** (the latter
+validates the target branch). The read and dispatch tokens
 are separate inputs. An explicitly empty token fails; it never falls back.
 Do not distribute the hosted IssueLens App's private key to source workflows.
 A source repository's `GITHUB_TOKEN` remains repository-scoped regardless of
@@ -107,16 +120,20 @@ default-branch push from the exact source workflow. Its artifact contains
 repository/run/workflow identities, before/after SHAs, and commit IDs only:
 no commit messages, bodies, code, credentials, or agent output. It is capped
 at 64 KiB and 1,000 commits and retained for seven days.
+Before its single POST, the shared action revalidates the source and uses the
+dispatch token to validate the target repository, exact active workflow path,
+and independently selected target branch/full SHA.
 
 Before downloading, the coordinator authenticates source run/attempt and
 artifact metadata, repository IDs, workflow, branch, actors, digest, expiry,
 and size. Pinned artifact download enforces the digest. Preflight repeats the
 metadata checks, validates the downloaded identity-only schema, and reuses
 IssueLens's complete bounded push/PR discovery and merge revalidation. The
-client is pinned to the actual merged revision of
-[microsoft/IssueLens#50](https://github.com/microsoft/IssueLens/pull/50),
-`4175ea71e170938826fb847e6bd5108f0f5597cf`. Only the small Java provenance
-adapter is local; request, stream, discovery, and receipt machinery is not
+client and dispatch action are pinned to the same shared-dispatcher prerequisite
+revision, `521b1ff80a70140e286ced7500d0b150cf9e6d6c`, built on the merged
+[microsoft/IssueLens#50](https://github.com/microsoft/IssueLens/pull/50).
+Only the small Java provenance adapter is local; request, stream, discovery,
+and receipt machinery is not
 copied or monkey-patched. The pilot's IssueLens-only coordinator adapter is
 deliberately not called.
 
@@ -142,5 +159,7 @@ With the pinned IssueLens action files available locally, set
 python -m unittest discover -s .github/actions/queue-team-memory/tests
 ```
 
-The focused CI workflow loads the same immutable client revision. These checks
-use fake API/stream responses and make no dispatch, Azure, or wiki calls.
+The focused CI workflow loads the same immutable client and shared-action
+revision. These checks pass the shared dispatcher's actual snapshot through
+Java preflight and use fake API/stream responses; they make no dispatch, Azure,
+or wiki calls.

.github/actions/queue-team-memory/action.yml

@@ -1,4 +1,4 @@
-"""Identity-only Java dispatch and cross-repository adapter for the pinned IssueLens client."""
+"""Java coordinator provenance adapter for the pinned IssueLens client."""
 
 import argparse
 import importlib.util
@@ -15,7 +15,6 @@
 COORDINATOR_WORKFLOW = ".github/workflows/team-memory-coordinator.yml"
 SOURCE_INPUTS = ("SOURCE_RUN_ID", "SOURCE_RUN_ATTEMPT", "SOURCE_ARTIFACT_ID")
 MAX_SOURCE_BYTES = 64 * 1024
-MAX_PUSH_COMMITS = 1000
 # Reviewed public sources with an existing policy targeting the Java Pack wiki.
 SOURCES = {
     COORDINATOR: (104967329, "main"),
@@ -72,18 +71,14 @@ def redirect_request(self, *args, **kwargs):
         return None
 
 
-def github_request(path, token, payload=None):
+def github_read(path, token):
     require(isinstance(token, str) and token.strip(), "Required GitHub token is empty")
-    return urllib.request.Request(
+    request = urllib.request.Request(
         "https://api.github.com" + path,
-        data=None if payload is None else json.dumps(payload).encode("utf-8"),
         headers={"Authorization": "Bearer " + token, "Accept": "application/vnd.github+json",
                  "Content-Type": "application/json", "X-GitHub-Api-Version": "2022-11-28"},
     )
-
-
-def github_read(path, token):
-    with urllib.request.build_opener(NoRedirect()).open(github_request(path, token), timeout=30) as response:
+    with urllib.request.build_opener(NoRedirect()).open(request, timeout=30) as response:
         content = response.read(4 * 1024 * 1024 + 1)
     require(len(content) <= 4 * 1024 * 1024, "GitHub response exceeds its size limit")
     result = json.loads(content, object_pairs_hook=unique_object)
@@ -118,22 +113,6 @@ def workflow_context(repository, workflow, event_name, token):
     return current, event
 
 
-def validate_push(event, reference, head):
-    require(all(event.get(flag) is False for flag in ("created", "deleted", "forced")),
-            "Created, deleted, or forced refs require manual PR reconciliation")
-    before, after = full_sha(event.get("before")), full_sha(event.get("after"))
-    require(before != after and event.get("ref") == reference and head == after
-            and isinstance(event.get("head_commit"), dict) and event["head_commit"].get("id") == after,
-            "Push source identity mismatch")
-    commits = event.get("commits")
-    require(isinstance(commits, list) and 0 < len(commits) <= MAX_PUSH_COMMITS
-            and all(isinstance(item, dict) for item in commits), "Missing or oversized push inventory")
-    shas = [full_sha(item.get("id")) for item in commits]
-    require(len(set(shas)) == len(shas) and after in shas and before not in shas,
-            "Push inventory has duplicate or mismatched identities")
-    return before, after, shas
-
-
 def source_event_path():
     return Path(os.environ["RUNNER_TEMP"]) / "issuelens-team-memory-source" / "source-event.json"
 
@@ -144,62 +123,6 @@ def outputs(values):
             output.write(f"{name}={value}\n")
 
 
-def push_snapshot():
-    repository = os.environ["GITHUB_REPOSITORY"]
-    current, event = workflow_context(repository, SOURCE_WORKFLOW, "push", os.environ["GH_TOKEN"])
-    before, after, shas = validate_push(event, os.environ["GITHUB_REF"], os.environ["GITHUB_SHA"])
-    require(os.environ["GITHUB_WORKFLOW_SHA"] == after, "Source workflow revision does not match the push")
-    actors = [os.environ[name] for name in ("GITHUB_ACTOR", "GITHUB_TRIGGERING_ACTOR")]
-    require(all(re.fullmatch(r"[A-Za-z0-9-]+(?:\[bot\])?", actor) for actor in actors), "Invalid source actors")
-    return {
-        "metadata": {
-            "repository": repository, "repository_id": current["id"], "base_ref": current["default_branch"],
-            "event_name": "push", "event_action": "push",
-            "actor_login": actors[0], "triggering_actor": actors[1],
-            "workflow_ref": os.environ["GITHUB_WORKFLOW_REF"], "workflow_sha": after,
-            "run_id": positive(os.environ["GITHUB_RUN_ID"]), "run_attempt": positive(os.environ["GITHUB_RUN_ATTEMPT"]),
-        },
-        "event": {
-            "repository": {"id": current["id"], "full_name": repository}, "ref": event["ref"],
-            "before": before, "after": after, "created": False, "deleted": False, "forced": False,
-            "commits": [{"id": sha} for sha in shas], "head_commit": {"id": after},
-        },
-    }
-
-
-def prepare_dispatch():
-    snapshot = push_snapshot()
-    content = json.dumps(snapshot, separators=(",", ":")).encode("utf-8")
-    require(len(content) <= MAX_SOURCE_BYTES, "Source event exceeds 64 KiB")
-    path = source_event_path()
-    path.parent.mkdir(exist_ok=True)
-    path.write_bytes(content)
-    outputs({"source-event-path": path})
-    print("Prepared identity-only team-memory source event")
-
-
-def dispatch():
-    token = os.environ["DISPATCH_TOKEN"]
-    require(token.strip(), "dispatch-token must be non-empty")
-    snapshot = read_json(source_event_path(), MAX_SOURCE_BYTES)
-    expected = push_snapshot()
-    require(snapshot == expected and matching_metadata(snapshot["metadata"], expected["metadata"]),
-            "Source event changed before dispatch")
-    central = project(COORDINATOR, token)
-    metadata = snapshot["metadata"]
-    request = github_request(
-        f"/repos/{COORDINATOR}/actions/workflows/team-memory-coordinator.yml/dispatches", token,
-        {"ref": central["default_branch"], "inputs": {
-            "source_repository": metadata["repository"], "source_run_id": str(metadata["run_id"]),
-            "source_run_attempt": str(metadata["run_attempt"]),
-            "source_artifact_id": str(positive(os.environ["SOURCE_ARTIFACT_ID"])),
-        }},
-    )
-    with urllib.request.build_opener(NoRedirect()).open(request, timeout=30) as response:
-        require(response.status in {200, 204}, "Dispatch was not acknowledged; do not retry blindly")
-    print("Coordinator dispatch accepted; maintenance completion is reported by the coordinator run")
-
-
 def selection():
     repository = os.environ.get("SOURCE_REPOSITORY", "")
     require(repository in SOURCES, "Supply an allowlisted source_repository")
@@ -310,7 +233,6 @@ def preflight():
                 and all(isinstance(item, dict) and set(item) == {"id"} for item in push["commits"])
                 and push["head_commit"] == {"id": metadata["workflow_sha"]},
                 "Invalid identity-only push artifact")
-        validate_push(push, "refs/heads/" + current["default_branch"], metadata["workflow_sha"])
         try:
             envelope = client.prepare_push_memory(repository, current, push, {**metadata, **central})
         except client.SkippedRequest as skipped:
@@ -332,17 +254,14 @@ def preflight():
 
 def run(command):
     try:
-        {"prepare-dispatch": prepare_dispatch, "dispatch": dispatch, "select-source": select_source,
-         "validate-dispatch": validate_dispatch, "preflight": preflight}[command]()
+        {"select-source": select_source, "validate-dispatch": validate_dispatch, "preflight": preflight}[command]()
     except ValueError as error:
         raise SystemExit(f"::error::{error}") from None
     except Exception:
-        message = ("Coordinator dispatch failed or its outcome is unknown; inspect coordinator runs before retrying"
-                   if command == "dispatch" else "Java team-memory validation failed; no agent request was sent")
-        raise SystemExit(f"::error::{message}") from None
+        raise SystemExit("::error::Java team-memory validation failed; no agent request was sent") from None
 
 
 if __name__ == "__main__":
     parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("command", choices=("prepare-dispatch", "dispatch", "select-source", "validate-dispatch", "preflight"))
+    parser.add_argument("command", choices=("select-source", "validate-dispatch", "preflight"))
     run(parser.parse_args().command)