ci: queue team-memory maintenance through Java Pack

Replace direct source maintenance with the scoped, pinned coordinator dispatcher and document independent caller and central authentication prerequisites.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: chagong

.github/workflows/team-memory-post-merge.yml

@@ -1,43 +1,46 @@
-name: Update IssueLens Team Memory
+name: Queue IssueLens Team Memory (opt-in)
 
 on:
   push:
     branches: [main]
-  workflow_dispatch:
-    inputs:
-      pull_request_number:
-        description: 'Merged pull request number to learn from'
-        required: true
-        type: string
 
 permissions: {}
 
-concurrency:
-  group: issuelens-${{ github.repository }}-team-memory-${{ github.event.after || inputs.pull_request_number || github.run_id }}
-  cancel-in-progress: false
-
 jobs:
   team-memory:
     if: >-
-      ${{ vars.ISSUELENS_TEAM_MEMORY_ENABLED == 'true' &&
-          github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
-          (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }}
+      vars.ISSUELENS_TEAM_MEMORY_ENABLED == 'true' &&
+      github.repository == 'microsoft/java-debug' &&
+      github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
+      github.event_name == 'push' &&
+      github.workflow_sha == github.sha &&
+      github.event.created == false &&
+      github.event.deleted == false &&
+      github.event.forced == false
     runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: read
-      pull-requests: read
-      id-token: write
+    timeout-minutes: 10
     steps:
-      - name: Maintain IssueLens team memory
-        uses: microsoft/IssueLens/.github/actions/issuelens@2b5317815e15179899014a02c41678620ce2d390
+      - name: Create coordinator dispatch token
+        id: dispatch-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.ISSUELENS_DISPATCH_APP_CLIENT_ID }}
+          private-key: ${{ secrets.ISSUELENS_DISPATCH_APP_PRIVATE_KEY }}
+          owner: microsoft
+          repositories: vscode-java-pack
+          permission-contents: read
+          permission-actions: write
+
+      - name: Queue team-memory request
+        uses: microsoft/IssueLens/.github/actions/queue-team-memory@a81d2d96167fc0e69ac631c2edc85f858e693289
         with:
-          request-type: team-memory
-          pull-request-number: ${{ inputs.pull_request_number }}
-          azure-client-id: ${{ secrets.AZURE_CLIENT_ID }}
-          azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }}
-          azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
-          agent-url: ${{ secrets.ISSUELENS_AGENT_URL }}
-          agent-scope: ${{ secrets.ISSUELENS_AGENT_SCOPE }}
-          output-mode: activity
-          summary-mode: status
+          dispatch-token: ${{ steps.dispatch-token.outputs.token }}
+          coordinator-repository: microsoft/vscode-java-pack
+          coordinator-workflow: team-memory-coordinator.yml
+          coordinator-ref: main
+          workflow-inputs: >-
+            {"source_repository":"${{ github.repository }}",
+             "source_run_id":"${{ github.run_id }}",
+             "source_run_attempt":"${{ github.run_attempt }}",
+             "push_before":"${{ github.event.before }}",
+             "push_after":"${{ github.sha }}"}

README.md

@@ -65,6 +65,43 @@ Once `eclipse.jdt.ls` launched, the client can send a [Command](https://microsof
 The response to this request will contain a port number on which the debug adapter is listening, and to which a client implementing the debug-adapter protocol can connect to.
 
 
+## IssueLens team-memory maintenance
+
+[The source workflow](.github/workflows/team-memory-post-merge.yml) queues eligible
+default-branch pushes through the `team-memory-coordinator.yml` workflow on `main`
+in `microsoft/vscode-java-pack`. The coordinator owns source validation, the
+shared-wiki queue, and maintenance; issue triage is unchanged.
+
+Before merging this migration with the existing
+`ISSUELENS_TEAM_MEMORY_ENABLED` variable set to `true`, configure both independent
+authentication paths. An enabled source switches immediately from direct
+maintenance to queue dispatch:
+
+- **Source dispatch:** set the repository variable `ISSUELENS_DISPATCH_APP_CLIENT_ID`
+  and secret `ISSUELENS_DISPATCH_APP_PRIVATE_KEY` for a dedicated GitHub App
+  installed only on `microsoft/vscode-java-pack`, with Contents read and Actions
+  write permissions. The pinned token action accepts the client ID through its
+  `client-id` input and narrows the token to that repository and those permissions.
+  The source `GITHUB_TOKEN` cannot dispatch across repositories. Do not reuse the
+  hosted IssueLens App key or the central source-read App credentials.
+- **Central source reads:** Java Pack must separately configure the secrets
+  `ISSUELENS_SOURCE_READ_APP_CLIENT_ID` and `ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY`
+  for its source-read App, with Actions, Contents, and Pull requests read access
+  to selected source repositories including `microsoft/java-debug`. A successful
+  coordinator run for Java Pack itself does not verify this external access.
+
+Only ordinary, non-created, non-deleted, non-forced pushes from the actual source
+repository/default branch with matching workflow and head SHAs are queued.
+The five string inputs identify the source run/attempt and the requested commit
+range. `push_after` is verified against the run; `push_before` authorizes ancestor
+reconciliation, not attested original-event provenance.
+
+For manual merged-PR maintenance, use **Run workflow** on the central coordinator
+with `source_repository: microsoft/java-debug` and `pull_request_number`; there
+is no local manual invocation path. Dispatch acceptance is not maintenance
+completion. Inspect central runs before retrying an ambiguous dispatch failure.
+
+
 License
 -------
 EPL 1.0, See [LICENSE](LICENSE.txt) file.