From d7fac8b48a7544c07930cf44b79fbd789ce28d00 Mon Sep 17 00:00:00 2001 From: Changyong Gong Date: Sat, 10 Oct 2026 14:39:19 +0800 Subject: [PATCH 1/2] ci: queue team-memory maintenance through Java Pack Replace direct source maintenance with the scoped, pinned coordinator dispatcher and document independent caller and central authentication prerequisites. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/workflows/team-memory-post-merge.yml | 63 ++++++++++---------- README.md | 37 ++++++++++++ 2 files changed, 70 insertions(+), 30 deletions(-) diff --git a/.github/workflows/team-memory-post-merge.yml b/.github/workflows/team-memory-post-merge.yml index 0bc114147..e84af7fb0 100644 --- a/.github/workflows/team-memory-post-merge.yml +++ b/.github/workflows/team-memory-post-merge.yml @@ -1,43 +1,46 @@ -name: Update IssueLens Team Memory +name: Queue IssueLens Team Memory (opt-in) on: push: branches: [main] - workflow_dispatch: - inputs: - pull_request_number: - description: 'Merged pull request number to learn from' - required: true - type: string permissions: {} -concurrency: - group: issuelens-${{ github.repository }}-team-memory-${{ github.event.after || inputs.pull_request_number || github.run_id }} - cancel-in-progress: false - jobs: team-memory: if: >- - ${{ vars.ISSUELENS_TEAM_MEMORY_ENABLED == 'true' && - github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && - (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} + vars.ISSUELENS_TEAM_MEMORY_ENABLED == 'true' && + github.repository == 'microsoft/java-debug' && + github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && + github.event_name == 'push' && + github.workflow_sha == github.sha && + github.event.created == false && + github.event.deleted == false && + github.event.forced == false runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - pull-requests: read - id-token: write + timeout-minutes: 10 steps: - - name: Maintain IssueLens team memory - uses: microsoft/IssueLens/.github/actions/issuelens@2b5317815e15179899014a02c41678620ce2d390 + - name: Create coordinator dispatch token + id: dispatch-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + client-id: ${{ vars.ISSUELENS_DISPATCH_APP_CLIENT_ID }} + private-key: ${{ secrets.ISSUELENS_DISPATCH_APP_PRIVATE_KEY }} + owner: microsoft + repositories: vscode-java-pack + permission-contents: read + permission-actions: write + + - name: Queue team-memory request + uses: microsoft/IssueLens/.github/actions/queue-team-memory@a81d2d96167fc0e69ac631c2edc85f858e693289 with: - request-type: team-memory - pull-request-number: ${{ inputs.pull_request_number }} - azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} - azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} - azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - agent-url: ${{ secrets.ISSUELENS_AGENT_URL }} - agent-scope: ${{ secrets.ISSUELENS_AGENT_SCOPE }} - output-mode: activity - summary-mode: status + dispatch-token: ${{ steps.dispatch-token.outputs.token }} + coordinator-repository: microsoft/vscode-java-pack + coordinator-workflow: team-memory-coordinator.yml + coordinator-ref: main + workflow-inputs: >- + {"source_repository":"${{ github.repository }}", + "source_run_id":"${{ github.run_id }}", + "source_run_attempt":"${{ github.run_attempt }}", + "push_before":"${{ github.event.before }}", + "push_after":"${{ github.sha }}"} diff --git a/README.md b/README.md index 4bf15f675..d736e33a5 100644 --- a/README.md +++ b/README.md @@ -65,6 +65,43 @@ Once `eclipse.jdt.ls` launched, the client can send a [Command](https://microsof The response to this request will contain a port number on which the debug adapter is listening, and to which a client implementing the debug-adapter protocol can connect to. +## IssueLens team-memory maintenance + +[The source workflow](.github/workflows/team-memory-post-merge.yml) queues eligible +default-branch pushes through the `team-memory-coordinator.yml` workflow on `main` +in `microsoft/vscode-java-pack`. The coordinator owns source validation, the +shared-wiki queue, and maintenance; issue triage is unchanged. + +Before merging this migration with the existing +`ISSUELENS_TEAM_MEMORY_ENABLED` variable set to `true`, configure both independent +authentication paths. An enabled source switches immediately from direct +maintenance to queue dispatch: + +- **Source dispatch:** set the repository variable `ISSUELENS_DISPATCH_APP_CLIENT_ID` + and secret `ISSUELENS_DISPATCH_APP_PRIVATE_KEY` for a dedicated GitHub App + installed only on `microsoft/vscode-java-pack`, with Contents read and Actions + write permissions. The pinned token action accepts the client ID through its + `client-id` input and narrows the token to that repository and those permissions. + The source `GITHUB_TOKEN` cannot dispatch across repositories. Do not reuse the + hosted IssueLens App key or the central source-read App credentials. +- **Central source reads:** Java Pack must separately configure the secrets + `ISSUELENS_SOURCE_READ_APP_CLIENT_ID` and `ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY` + for its source-read App, with Actions, Contents, and Pull requests read access + to selected source repositories including `microsoft/java-debug`. A successful + coordinator run for Java Pack itself does not verify this external access. + +Only ordinary, non-created, non-deleted, non-forced pushes from the actual source +repository/default branch with matching workflow and head SHAs are queued. +The five string inputs identify the source run/attempt and the requested commit +range. `push_after` is verified against the run; `push_before` authorizes ancestor +reconciliation, not attested original-event provenance. + +For manual merged-PR maintenance, use **Run workflow** on the central coordinator +with `source_repository: microsoft/java-debug` and `pull_request_number`; there +is no local manual invocation path. Dispatch acceptance is not maintenance +completion. Inspect central runs before retrying an ambiguous dispatch failure. + + License ------- EPL 1.0, See [LICENSE](LICENSE.txt) file. From 8a96c21a90a9cebda38f145386dfe590fe604f4e Mon Sep 17 00:00:00 2001 From: Changyong Gong Date: Sat, 10 Oct 2026 15:02:02 +0800 Subject: [PATCH 2/2] docs: remove public IssueLens migration documentation Keep the internal onboarding migration workflow-only and retain setup prerequisites in the pull request description. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- README.md | 37 ------------------------------------- 1 file changed, 37 deletions(-) diff --git a/README.md b/README.md index d736e33a5..4bf15f675 100644 --- a/README.md +++ b/README.md @@ -65,43 +65,6 @@ Once `eclipse.jdt.ls` launched, the client can send a [Command](https://microsof The response to this request will contain a port number on which the debug adapter is listening, and to which a client implementing the debug-adapter protocol can connect to. -## IssueLens team-memory maintenance - -[The source workflow](.github/workflows/team-memory-post-merge.yml) queues eligible -default-branch pushes through the `team-memory-coordinator.yml` workflow on `main` -in `microsoft/vscode-java-pack`. The coordinator owns source validation, the -shared-wiki queue, and maintenance; issue triage is unchanged. - -Before merging this migration with the existing -`ISSUELENS_TEAM_MEMORY_ENABLED` variable set to `true`, configure both independent -authentication paths. An enabled source switches immediately from direct -maintenance to queue dispatch: - -- **Source dispatch:** set the repository variable `ISSUELENS_DISPATCH_APP_CLIENT_ID` - and secret `ISSUELENS_DISPATCH_APP_PRIVATE_KEY` for a dedicated GitHub App - installed only on `microsoft/vscode-java-pack`, with Contents read and Actions - write permissions. The pinned token action accepts the client ID through its - `client-id` input and narrows the token to that repository and those permissions. - The source `GITHUB_TOKEN` cannot dispatch across repositories. Do not reuse the - hosted IssueLens App key or the central source-read App credentials. -- **Central source reads:** Java Pack must separately configure the secrets - `ISSUELENS_SOURCE_READ_APP_CLIENT_ID` and `ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY` - for its source-read App, with Actions, Contents, and Pull requests read access - to selected source repositories including `microsoft/java-debug`. A successful - coordinator run for Java Pack itself does not verify this external access. - -Only ordinary, non-created, non-deleted, non-forced pushes from the actual source -repository/default branch with matching workflow and head SHAs are queued. -The five string inputs identify the source run/attempt and the requested commit -range. `push_after` is verified against the run; `push_before` authorizes ancestor -reconciliation, not attested original-event provenance. - -For manual merged-PR maintenance, use **Run workflow** on the central coordinator -with `source_repository: microsoft/java-debug` and `pull_request_number`; there -is no local manual invocation path. Dispatch acceptance is not maintenance -completion. Inspect central runs before retrying an ambiguous dispatch failure. - - License ------- EPL 1.0, See [LICENSE](LICENSE.txt) file.