Queue Maven team memory through Java Pack coordinator

[Changyong Gong (chagong)]

Summary

Replace Maven's direct IssueLens team-memory invocation with a minimal dispatch-only caller for the merged Java Pack coordinator. Only .github/workflows/team-memory-post-merge.yml changes. Per user request, all documentation edits introduced by this migration have been removed, restoring the existing runtime/wiki policy exactly to its pre-migration content. Issue triage and extension behavior/workflows remain untouched.

• Preserve the existing source ISSUELENS_TEAM_MEMORY_ENABLED == 'true' opt-in and fixed source workflow path. Admit only actual microsoft/vscode-maven default-branch pushes with matching workflow/head SHAs and created, deleted, and forced all false.
• Mint a dedicated App installation token using actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 (v3.2.0), restricted to microsoft/vscode-java-pack with Contents read and Actions write. The caller's GITHUB_TOKEN receives no permissions.
• Reuse microsoft/IssueLens/.github/actions/queue-team-memory@a81d2d96167fc0e69ac631c2edc85f858e693289, explicitly targeting microsoft/vscode-java-pack, team-memory-coordinator.yml, and main, independently of the source ref. Send exactly five string inputs: source_repository, source_run_id, source_run_attempt, push_before, and push_after.
• Remove local manual maintenance and source concurrency: manual merged-PR maintenance uses the central coordinator's Run workflow with source repository and PR number. No source checkout, artifacts, Azure login, helper copies, direct agent calls, or fallback invocation remain.

The standalone action validates target metadata and attempts one bounded POST with no automatic retry. Acceptance confirms dispatch only, not queue admission or completed maintenance. The requested push_before authorizes ancestor reconciliation; it is not attested original-event provenance.

Rollout prerequisites — configure before merging with the source opt-in enabled

Keep these internal setup prerequisites in this PR description, not repository documentation. Read-only Maven configuration-name inspection during PR preparation found the existing ISSUELENS_TEAM_MEMORY_ENABLED variable, but neither new caller credential name:

• Maven variable ISSUELENS_DISPATCH_APP_CLIENT_ID and secret ISSUELENS_DISPATCH_APP_PRIVATE_KEY, for a dedicated dispatch App installed only on Java Pack with Contents read + Actions write. These are proposed caller setup names, not upstream-required names. Do not reuse the hosted IssueLens App key or central source-read credentials.
• Java Pack secrets ISSUELENS_SOURCE_READ_APP_CLIENT_ID and ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY, for the separate source-read App installed on selected source repositories including Maven with Actions/Contents/Pull requests read. The coordinating investigation at preparation time confirmed both were missing, with no inherited organization secrets. Maven is already in the central source allowlist.

A successful Java Pack own-repository run skips external authentication and does not establish external-source readiness. Merging while the source opt-in is already true switches eligible pushes to queue-only dispatch; missing credentials fail without falling back to direct invocation. No live variables, secrets, credentials, or permissions were changed. The token could not read the repository Actions-policy endpoints (HTTP 403), so allowlisted-action policy compatibility was not inspected.

Validation

• Initial workflow validation: actionlint v1.7.12 passed for the changed source workflow (official release archive checksum verified).
• Initial offline PyYAML assertions passed: push-only trigger; 14 gate scenarios including fork/manual/PR/wrong-ref/wrong-SHA/created/deleted/forced/disabled rejection; target main independence; exact five-string payload; both pinned action input schemas; explicit repository/permission scope; no direct invocation, checkout, artifacts, retry, or triage/extension changes.
• The rendered request passed the actual pinned standalone dispatcher's configuration() validation with a placeholder token and network access blocked. No dispatch, workflow rerun, App token minting, Azure login, or hosted invocation was used as a test.
• Documentation-removal revision: Git blob comparison confirms .github/issuelens/team-memory.md exactly matches its pre-migration content. The workflow is byte-for-byte unchanged from the previously validated migration commit; fresh offline YAML assertions confirm preserved source gates, scoped permissions, target/ref, and five-string payload.
• git diff --check passed. Self-review confirms the complete PR diff contains only .github/workflows/team-memory-post-merge.yml; the normal follow-up commit changes documentation only. No builds/unit suites were run because extension code and dependencies are unchanged.

Prepared from freshly fetched main at eee9eb0b49b8b5bdd4a479646d700340a2b37cbd.

Current head: da6f6858c22d6e82ab6ebe78feb95ee4215ceabf (normal follow-up; no amend or force push).