From 2353c28fcc6697285a14839cf9366bd9fa2c9bc0 Mon Sep 17 00:00:00 2001 From: Changyong Gong Date: Sat, 10 Oct 2026 14:39:15 +0800 Subject: [PATCH 1/2] ci: queue team memory updates through Java Pack Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/issuelens/team-memory.md | 64 ++++++++++++++++++-- .github/workflows/team-memory-post-merge.yml | 57 +++++++++-------- 2 files changed, 90 insertions(+), 31 deletions(-) diff --git a/.github/issuelens/team-memory.md b/.github/issuelens/team-memory.md index d0d9bf42..553cc66f 100644 --- a/.github/issuelens/team-memory.md +++ b/.github/issuelens/team-memory.md @@ -126,6 +126,52 @@ limitation when these cannot be established. Broader App access, a related searc result, or an existing wiki citation does not authorize private-source retrieval or disclosure. +## Workflow queue and setup + +The [source workflow](../workflows/team-memory-post-merge.yml) only dispatches +requests to the [Java Pack coordinator](https://github.com/microsoft/vscode-java-pack/blob/main/.github/workflows/team-memory-coordinator.yml) +on `main`, independently of the source branch. Preserve the source workflow path: +the coordinator verifies it when validating the source run. Only normal pushes to +this repository's default branch qualify; created, deleted, or forced pushes and +workflow/head SHA mismatches are rejected. The source performs no checkout, +artifact preparation, Azure login, agent invocation, or wiki write. + +The existing source variable `ISSUELENS_TEAM_MEMORY_ENABLED` remains the opt-in. +Merging this migration while it is `true` switches subsequent eligible pushes to +queue dispatch; configure the new caller credentials before merging. No new +opt-in is introduced, and this migration does not change live settings. + +| Source configuration | Purpose | +| --- | --- | +| Variable `ISSUELENS_DISPATCH_APP_CLIENT_ID` | Client ID of a dedicated dispatch App installed on `microsoft/vscode-java-pack`, with Contents read and Actions write. | +| Secret `ISSUELENS_DISPATCH_APP_PRIVATE_KEY` | Private key of that dedicated dispatch App. | + +These are proposed caller setup names, not existing IssueLens-required names. +The workflow requests an installation token scoped only to `vscode-java-pack` +and those two permissions. The source `GITHUB_TOKEN` cannot dispatch to another +repository. Do not reuse the hosted IssueLens App key, Azure credentials, or the +coordinator's separate source-read App credentials for dispatch. + +External maintenance also requires the Java Pack coordinator's separate secrets +`ISSUELENS_SOURCE_READ_APP_CLIENT_ID` and `ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY`. +That App needs Actions, Contents, and Pull requests read on the allowlisted source +repositories, including `microsoft/vscode-java-test`. The coordinator owns source +validation, the shared wiki queue, invocation, and final receipt validation. +A successful own-repository coordinator run does not verify external-source +authentication; both caller dispatch and central source-read setup are rollout +prerequisites. + +The dispatch action attempts one bounded POST with no automatic retry. Source +success means only that GitHub accepted the dispatch, not that maintenance +completed. Inspect the central run for the final result; after an ambiguous +dispatch failure, inspect target runs before retrying. + +For manual merged-PR maintenance, use **Run workflow** on Java Pack's +`team-memory-coordinator.yml` at `main`, set `source_repository` to +`microsoft/vscode-java-test` and `pull_request_number` to the merged source PR, +and leave the automatic run/attempt/before/after inputs empty. There is no local +manual team-memory invocation path bypassing the queue. Issue triage is unchanged. + ## Maintenance and provenance Only a separately authorized team-memory task may update knowledge. Preserve @@ -135,12 +181,18 @@ fresh snapshot, and reassess the authorized update rather than forcing an overwrite or carrying prepared edits to another wiki. Do not fall back to a different destination. -Team-memory workflow concurrency is per source repository and push, or per PR for -manual dispatch, not a cross-repository wiki lock. Other Java tooling repositories -may update the same wiki concurrently; -retain the runtime's optimistic-concurrency checks and reassess conflicts. Never -force a write, delete unrelated pages, perform destination-wide cleanup, or -replace shared navigation, assets, human content, or other repositories' citations. +Source workflow concurrency is per repository and push, not a cross-repository +wiki lock. Java Pack's coordinator serializes queued maintenance for the shared +wiki; retain the runtime's optimistic-concurrency checks and reassess conflicts +with any writers outside that queue. Never force a write, delete unrelated pages, +perform destination-wide cleanup, or replace shared navigation, assets, human +content, or other repositories' citations. + +Automatic requests contain five string fields: `source_repository`, +`source_run_id`, `source_run_attempt`, `push_before`, and `push_after`. The +coordinator verifies the source run and its `push_after` head SHA. `push_before` +requests reconciliation from an authorized ancestor; it is not attested +original-event provenance or proof of the original push boundary. For merged-PR tasks, use the verified merge/default-branch evidence and full source SHA for the authorized PR in `microsoft/vscode-java-test`, not a PR in the diff --git a/.github/workflows/team-memory-post-merge.yml b/.github/workflows/team-memory-post-merge.yml index 0bc11414..dfbc2f70 100644 --- a/.github/workflows/team-memory-post-merge.yml +++ b/.github/workflows/team-memory-post-merge.yml @@ -1,43 +1,50 @@ -name: Update IssueLens Team Memory +name: Queue IssueLens Team Memory on: push: branches: [main] - workflow_dispatch: - inputs: - pull_request_number: - description: 'Merged pull request number to learn from' - required: true - type: string permissions: {} concurrency: - group: issuelens-${{ github.repository }}-team-memory-${{ github.event.after || inputs.pull_request_number || github.run_id }} + group: issuelens-${{ github.repository }}-team-memory-${{ github.event.after || github.run_id }} cancel-in-progress: false jobs: team-memory: if: >- ${{ vars.ISSUELENS_TEAM_MEMORY_ENABLED == 'true' && + github.repository == 'microsoft/vscode-java-test' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && - (github.event_name == 'push' || github.event_name == 'workflow_dispatch') }} + github.event_name == 'push' && + github.workflow_sha == github.sha && + github.event.created == false && + github.event.deleted == false && + github.event.forced == false }} runs-on: ubuntu-latest - timeout-minutes: 30 - permissions: - contents: read - pull-requests: read - id-token: write + timeout-minutes: 10 steps: - - name: Maintain IssueLens team memory - uses: microsoft/IssueLens/.github/actions/issuelens@2b5317815e15179899014a02c41678620ce2d390 + - name: Get token for the Java Pack coordinator + id: dispatch-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 with: - request-type: team-memory - pull-request-number: ${{ inputs.pull_request_number }} - azure-client-id: ${{ secrets.AZURE_CLIENT_ID }} - azure-tenant-id: ${{ secrets.AZURE_TENANT_ID }} - azure-subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - agent-url: ${{ secrets.ISSUELENS_AGENT_URL }} - agent-scope: ${{ secrets.ISSUELENS_AGENT_SCOPE }} - output-mode: activity - summary-mode: status + client-id: ${{ vars.ISSUELENS_DISPATCH_APP_CLIENT_ID }} + private-key: ${{ secrets.ISSUELENS_DISPATCH_APP_PRIVATE_KEY }} + owner: microsoft + repositories: vscode-java-pack + permission-contents: read + permission-actions: write + + - name: Queue team-memory request + uses: microsoft/IssueLens/.github/actions/queue-team-memory@a81d2d96167fc0e69ac631c2edc85f858e693289 + with: + dispatch-token: ${{ steps.dispatch-token.outputs.token }} + coordinator-repository: microsoft/vscode-java-pack + coordinator-workflow: team-memory-coordinator.yml + coordinator-ref: main + workflow-inputs: >- + {"source_repository":"${{ github.repository }}", + "source_run_id":"${{ github.run_id }}", + "source_run_attempt":"${{ github.run_attempt }}", + "push_before":"${{ github.event.before }}", + "push_after":"${{ github.sha }}"} From e4cd5b1fe432dff13bf7c04ce276454ddb46535b Mon Sep 17 00:00:00 2001 From: Changyong Gong Date: Sat, 10 Oct 2026 15:02:24 +0800 Subject: [PATCH 2/2] chore: remove queue migration documentation changes Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --- .github/issuelens/team-memory.md | 64 +++----------------------------- 1 file changed, 6 insertions(+), 58 deletions(-) diff --git a/.github/issuelens/team-memory.md b/.github/issuelens/team-memory.md index 553cc66f..d0d9bf42 100644 --- a/.github/issuelens/team-memory.md +++ b/.github/issuelens/team-memory.md @@ -126,52 +126,6 @@ limitation when these cannot be established. Broader App access, a related searc result, or an existing wiki citation does not authorize private-source retrieval or disclosure. -## Workflow queue and setup - -The [source workflow](../workflows/team-memory-post-merge.yml) only dispatches -requests to the [Java Pack coordinator](https://github.com/microsoft/vscode-java-pack/blob/main/.github/workflows/team-memory-coordinator.yml) -on `main`, independently of the source branch. Preserve the source workflow path: -the coordinator verifies it when validating the source run. Only normal pushes to -this repository's default branch qualify; created, deleted, or forced pushes and -workflow/head SHA mismatches are rejected. The source performs no checkout, -artifact preparation, Azure login, agent invocation, or wiki write. - -The existing source variable `ISSUELENS_TEAM_MEMORY_ENABLED` remains the opt-in. -Merging this migration while it is `true` switches subsequent eligible pushes to -queue dispatch; configure the new caller credentials before merging. No new -opt-in is introduced, and this migration does not change live settings. - -| Source configuration | Purpose | -| --- | --- | -| Variable `ISSUELENS_DISPATCH_APP_CLIENT_ID` | Client ID of a dedicated dispatch App installed on `microsoft/vscode-java-pack`, with Contents read and Actions write. | -| Secret `ISSUELENS_DISPATCH_APP_PRIVATE_KEY` | Private key of that dedicated dispatch App. | - -These are proposed caller setup names, not existing IssueLens-required names. -The workflow requests an installation token scoped only to `vscode-java-pack` -and those two permissions. The source `GITHUB_TOKEN` cannot dispatch to another -repository. Do not reuse the hosted IssueLens App key, Azure credentials, or the -coordinator's separate source-read App credentials for dispatch. - -External maintenance also requires the Java Pack coordinator's separate secrets -`ISSUELENS_SOURCE_READ_APP_CLIENT_ID` and `ISSUELENS_SOURCE_READ_APP_PRIVATE_KEY`. -That App needs Actions, Contents, and Pull requests read on the allowlisted source -repositories, including `microsoft/vscode-java-test`. The coordinator owns source -validation, the shared wiki queue, invocation, and final receipt validation. -A successful own-repository coordinator run does not verify external-source -authentication; both caller dispatch and central source-read setup are rollout -prerequisites. - -The dispatch action attempts one bounded POST with no automatic retry. Source -success means only that GitHub accepted the dispatch, not that maintenance -completed. Inspect the central run for the final result; after an ambiguous -dispatch failure, inspect target runs before retrying. - -For manual merged-PR maintenance, use **Run workflow** on Java Pack's -`team-memory-coordinator.yml` at `main`, set `source_repository` to -`microsoft/vscode-java-test` and `pull_request_number` to the merged source PR, -and leave the automatic run/attempt/before/after inputs empty. There is no local -manual team-memory invocation path bypassing the queue. Issue triage is unchanged. - ## Maintenance and provenance Only a separately authorized team-memory task may update knowledge. Preserve @@ -181,18 +135,12 @@ fresh snapshot, and reassess the authorized update rather than forcing an overwrite or carrying prepared edits to another wiki. Do not fall back to a different destination. -Source workflow concurrency is per repository and push, not a cross-repository -wiki lock. Java Pack's coordinator serializes queued maintenance for the shared -wiki; retain the runtime's optimistic-concurrency checks and reassess conflicts -with any writers outside that queue. Never force a write, delete unrelated pages, -perform destination-wide cleanup, or replace shared navigation, assets, human -content, or other repositories' citations. - -Automatic requests contain five string fields: `source_repository`, -`source_run_id`, `source_run_attempt`, `push_before`, and `push_after`. The -coordinator verifies the source run and its `push_after` head SHA. `push_before` -requests reconciliation from an authorized ancestor; it is not attested -original-event provenance or proof of the original push boundary. +Team-memory workflow concurrency is per source repository and push, or per PR for +manual dispatch, not a cross-repository wiki lock. Other Java tooling repositories +may update the same wiki concurrently; +retain the runtime's optimistic-concurrency checks and reassess conflicts. Never +force a write, delete unrelated pages, perform destination-wide cleanup, or +replace shared navigation, assets, human content, or other repositories' citations. For merged-PR tasks, use the verified merge/default-branch evidence and full source SHA for the authorized PR in `microsoft/vscode-java-test`, not a PR in the