From df154fa55052e06ee1421c0082de0374c4001053 Mon Sep 17 00:00:00 2001 From: Changyong Gong Date: Sat, 10 Oct 2026 14:42:20 +0800 Subject: [PATCH 1/2] Queue Maven team memory through Java Pack coordinator Replace direct maintenance with a scoped dispatch-only caller and document caller and central source-read rollout prerequisites. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/issuelens/team-memory.md | 59 ++++++++++++++++--- .github/workflows/team-memory-post-merge.yml | 61 ++++++++++---------- 2 files changed, 84 insertions(+), 36 deletions(-) diff --git a/.github/issuelens/team-memory.md b/.github/issuelens/team-memory.md index 69a8e5dd..ccb300d2 100644 --- a/.github/issuelens/team-memory.md +++ b/.github/issuelens/team-memory.md @@ -19,8 +19,8 @@ with the operation-scoped permissions needed for source reads and the requested wiki operation. The same installation may cover both repositories, but access to one does not establish access to the other. Destination Contents access (read for retrieval, write for separately authorized maintenance) is separate from -source-user authorization and the source workflow token's `contents: read`, -`pull-requests: read`, and `id-token: write` permissions. +source-user authorization and the coordinator's operation-scoped source-read +and `id-token: write` permissions. The App's `Contents: write` is a **broad repository-content write capability**, not intrinsically wiki-only. The IssueLens wiki tool surface and this job's @@ -36,6 +36,50 @@ shared wiki. Unknown visibility or authorization is a limitation, not permission Broader App access, related search results, or existing wiki citations do not authorize private-source retrieval or disclosure. +## Queued post-merge setup + +The [source workflow](../workflows/team-memory-post-merge.yml) only dispatches to +`microsoft/vscode-java-pack`'s `team-memory-coordinator.yml` on target ref `main`, +independent of the source ref. Keep this source workflow path: central preflight +validates it. Eligible runs are non-created, non-deleted, non-forced pushes to +Maven's default branch in the actual `microsoft/vscode-maven` repository, with +matching workflow/head SHAs. The existing source variable +`ISSUELENS_TEAM_MEMORY_ENABLED` must equal `true`; central variables do not +enable a source. + +Before merging while that opt-in is `true`, configure the new caller variable +`ISSUELENS_DISPATCH_APP_CLIENT_ID` and secret +`ISSUELENS_DISPATCH_APP_PRIVATE_KEY` for a dedicated dispatch App installed only +on `microsoft/vscode-java-pack`, with Contents read and Actions write. The pinned +`actions/create-github-app-token` v3 action mints a token restricted to that +repository and those permissions. Maven's `GITHUB_TOKEN` cannot dispatch across +repositories; this job grants it no permissions. Do not reuse the hosted +IssueLens App key or central source-read App credentials for dispatch. + +Separately, Java Pack needs `ISSUELENS_SOURCE_READ_APP_CLIENT_ID` and +`ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY` secrets for its source-read App, installed +on the selected source repositories including `microsoft/vscode-maven`, with +Actions, Contents, and Pull requests read. Both caller and central credential +sets are rollout prerequisites. A successful own-repository coordinator run +skips external-source authentication and does not prove this setup is ready. +Merging with the source opt-in already `true` switches eligible pushes to +queue-only dispatch; missing credentials fail without a direct-invocation +fallback. This migration does not change live variables, secrets, or issue +triage. + +The standalone dispatcher sends only five string inputs: `source_repository`, +`source_run_id`, `source_run_attempt`, `push_before`, and `push_after`. Central +validation verifies the source run/head and authorizes ancestor reconciliation; +`push_before` is not attested original-event provenance. The coordinator owns +the shared queue, source/range validation, agent invocation, and final wiki +receipts. Dispatch acceptance does not confirm queue admission or maintenance +completion. There is no automatic dispatch retry; if the POST outcome is +unknown, inspect central runs before retrying. + +For manual merged-PR maintenance, use **Run workflow** on Java Pack's coordinator +with `source_repository: microsoft/vscode-maven` and `pull_request_number`. +The source workflow has no manual trigger or local maintenance path. + ## Architecture basis Use the [JavaForge Java tooling architecture](https://github.com/chagong/JavaForge/blob/04f85410fbc80397ce4bce83795e1f77a5c7d8c7/javatooling-architecture.md) @@ -224,11 +268,12 @@ retrieval or separately authorized direct maintenance. Preserve paired `expected_wiki_repository` and full-SHA `expected_base` from a fresh, verified wiki snapshot on every update. Retain atomic Git compare-and-swap -(CAS); source workflow concurrency is per repository and issue/push/PR, not a -cross-repository wiki lock. Other Java tooling repositories can update the same -shared wiki. On a destination/base mismatch or conflict, stop the prepared write, -perform a bounded re-read, and recompute only still-authorized changes against -the verified snapshot. If authorization, destination, or provenance cannot be +(CAS); Java Pack's coordinator serializes queued post-merge maintenance across +sources, but is not a lock for writers outside that queue. Other Java tooling +repositories can update the same shared wiki. On a destination/base mismatch or +conflict, stop the prepared write, perform a bounded re-read, and recompute only +still-authorized changes against the verified snapshot. If authorization, +destination, or provenance cannot be re-established, report failure. Never force a write, drop the expected base, silently fall back to another destination, or carry stale prepared edits across snapshots. A changed or inaccessible mapping must not become a successful update. diff --git a/.github/workflows/team-memory-post-merge.yml b/.github/workflows/team-memory-post-merge.yml index 0bc11414..eef0add0 100644 --- a/.github/workflows/team-memory-post-merge.yml +++ b/.github/workflows/team-memory-post-merge.yml @@ -1,43 +1,46 @@ -name: Update IssueLens Team Memory +name: Queue IssueLens Team Memory on: push: branches: [main] - workflow_dispatch: - inputs: - pull_request_number: - description: 'Merged pull request number to learn from' - required: true - type: string permissions: {} -concurrency: - group: issuelens-${{ github.repository }}-team-memory-${{ github.event.after || inputs.pull_request_number || github.run_id }} - cancel-in-progress: false - jobs: - team-memory: + dispatch: if: >- ${{ vars.ISSUELENS_TEAM_MEMORY_ENABLED == 'true' && + github.repository == 'microsoft/vscode-maven' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && - (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} + github.event_name == 'push' && + github.workflow_sha == github.sha && + github.event.created == false && + github.event.deleted == false && + github.event.forced == false }} runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - pull-requests: read - id-token: write + timeout-minutes: 10 steps: - - name: Maintain IssueLens team memory - uses: microsoft/IssueLens/.github/actions/issuelens@2b5317815e15179899014a02c41678620ce2d390 + - name: Get coordinator dispatch token + id: dispatch-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.ISSUELENS_DISPATCH_APP_CLIENT_ID }} + private-key: ${{ secrets.ISSUELENS_DISPATCH_APP_PRIVATE_KEY }} + owner: microsoft + repositories: vscode-java-pack + permission-contents: read + permission-actions: write + + - name: Queue team-memory request + uses: microsoft/IssueLens/.github/actions/queue-team-memory@a81d2d96167fc0e69ac631c2edc85f858e693289 with: - request-type: team-memory - pull-request-number: ${{ inputs.pull_request_number }} - azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} - azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} - azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - agent-url: ${{ secrets.ISSUELENS_AGENT_URL }} - agent-scope: ${{ secrets.ISSUELENS_AGENT_SCOPE }} - output-mode: activity - summary-mode: status + dispatch-token: ${{ steps.dispatch-token.outputs.token }} + coordinator-repository: microsoft/vscode-java-pack + coordinator-workflow: team-memory-coordinator.yml + coordinator-ref: main + workflow-inputs: >- + {"source_repository":"${{ github.repository }}", + "source_run_id":"${{ github.run_id }}", + "source_run_attempt":"${{ github.run_attempt }}", + "push_before":"${{ github.event.before }}", + "push_after":"${{ github.sha }}"} From da6f6858c22d6e82ab6ebe78feb95ee4215ceabf Mon Sep 17 00:00:00 2001 From: Changyong Gong Date: Sat, 10 Oct 2026 15:01:57 +0800 Subject: [PATCH 2/2] Remove public documentation changes from queue migration Restore the pre-migration team-memory policy exactly at user request, leaving the workflow migration unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/issuelens/team-memory.md | 59 ++++---------------------------- 1 file changed, 7 insertions(+), 52 deletions(-) diff --git a/.github/issuelens/team-memory.md b/.github/issuelens/team-memory.md index ccb300d2..69a8e5dd 100644 --- a/.github/issuelens/team-memory.md +++ b/.github/issuelens/team-memory.md @@ -19,8 +19,8 @@ with the operation-scoped permissions needed for source reads and the requested wiki operation. The same installation may cover both repositories, but access to one does not establish access to the other. Destination Contents access (read for retrieval, write for separately authorized maintenance) is separate from -source-user authorization and the coordinator's operation-scoped source-read -and `id-token: write` permissions. +source-user authorization and the source workflow token's `contents: read`, +`pull-requests: read`, and `id-token: write` permissions. The App's `Contents: write` is a **broad repository-content write capability**, not intrinsically wiki-only. The IssueLens wiki tool surface and this job's @@ -36,50 +36,6 @@ shared wiki. Unknown visibility or authorization is a limitation, not permission Broader App access, related search results, or existing wiki citations do not authorize private-source retrieval or disclosure. -## Queued post-merge setup - -The [source workflow](../workflows/team-memory-post-merge.yml) only dispatches to -`microsoft/vscode-java-pack`'s `team-memory-coordinator.yml` on target ref `main`, -independent of the source ref. Keep this source workflow path: central preflight -validates it. Eligible runs are non-created, non-deleted, non-forced pushes to -Maven's default branch in the actual `microsoft/vscode-maven` repository, with -matching workflow/head SHAs. The existing source variable -`ISSUELENS_TEAM_MEMORY_ENABLED` must equal `true`; central variables do not -enable a source. - -Before merging while that opt-in is `true`, configure the new caller variable -`ISSUELENS_DISPATCH_APP_CLIENT_ID` and secret -`ISSUELENS_DISPATCH_APP_PRIVATE_KEY` for a dedicated dispatch App installed only -on `microsoft/vscode-java-pack`, with Contents read and Actions write. The pinned -`actions/create-github-app-token` v3 action mints a token restricted to that -repository and those permissions. Maven's `GITHUB_TOKEN` cannot dispatch across -repositories; this job grants it no permissions. Do not reuse the hosted -IssueLens App key or central source-read App credentials for dispatch. - -Separately, Java Pack needs `ISSUELENS_SOURCE_READ_APP_CLIENT_ID` and -`ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY` secrets for its source-read App, installed -on the selected source repositories including `microsoft/vscode-maven`, with -Actions, Contents, and Pull requests read. Both caller and central credential -sets are rollout prerequisites. A successful own-repository coordinator run -skips external-source authentication and does not prove this setup is ready. -Merging with the source opt-in already `true` switches eligible pushes to -queue-only dispatch; missing credentials fail without a direct-invocation -fallback. This migration does not change live variables, secrets, or issue -triage. - -The standalone dispatcher sends only five string inputs: `source_repository`, -`source_run_id`, `source_run_attempt`, `push_before`, and `push_after`. Central -validation verifies the source run/head and authorizes ancestor reconciliation; -`push_before` is not attested original-event provenance. The coordinator owns -the shared queue, source/range validation, agent invocation, and final wiki -receipts. Dispatch acceptance does not confirm queue admission or maintenance -completion. There is no automatic dispatch retry; if the POST outcome is -unknown, inspect central runs before retrying. - -For manual merged-PR maintenance, use **Run workflow** on Java Pack's coordinator -with `source_repository: microsoft/vscode-maven` and `pull_request_number`. -The source workflow has no manual trigger or local maintenance path. - ## Architecture basis Use the [JavaForge Java tooling architecture](https://github.com/chagong/JavaForge/blob/04f85410fbc80397ce4bce83795e1f77a5c7d8c7/javatooling-architecture.md) @@ -268,12 +224,11 @@ retrieval or separately authorized direct maintenance. Preserve paired `expected_wiki_repository` and full-SHA `expected_base` from a fresh, verified wiki snapshot on every update. Retain atomic Git compare-and-swap -(CAS); Java Pack's coordinator serializes queued post-merge maintenance across -sources, but is not a lock for writers outside that queue. Other Java tooling -repositories can update the same shared wiki. On a destination/base mismatch or -conflict, stop the prepared write, perform a bounded re-read, and recompute only -still-authorized changes against the verified snapshot. If authorization, -destination, or provenance cannot be +(CAS); source workflow concurrency is per repository and issue/push/PR, not a +cross-repository wiki lock. Other Java tooling repositories can update the same +shared wiki. On a destination/base mismatch or conflict, stop the prepared write, +perform a bounded re-read, and recompute only still-authorized changes against +the verified snapshot. If authorization, destination, or provenance cannot be re-established, report failure. Never force a write, drop the expected base, silently fall back to another destination, or carry stale prepared edits across snapshots. A changed or inaccessible mapping must not become a successful update.