Onboard Project Manager for Java to IssueLens

[Changyong Gong (chagong)]

Summary

Add seven IssueLens onboarding files for Project Manager for Java, following the approved Java-tooling consumer contract.

• Add the issue-loop and opt-in post-merge team-memory workflows, both using microsoft/IssueLens/.github/actions/issuelens@49df3d97547069f891a68248be6ed722c2aeca2f.
• Configure only labeling, duplicate_detection, assignment, and team_memory. Label updates are additive, duplicate findings require evidence-backed native High confidence (90-100), and new assignees are restricted to chagong or wenytang-ms.
• Map team memory to the shared microsoft/vscode-java-pack wiki while retaining microsoft/vscode-java-dependency as the source authorization scope. Preserve the shared flat page map, source citations, explicit maintenance authority, privacy boundaries, and atomic wiki snapshot checks.

Preserved behavior and workflow boundaries

The existing Azure Function AI Triage, bulk triage, no-response, CI workflows, .github/llms.md, and CODEOWNERS are unchanged. There are no application, dependency, README, or global configuration changes.

Insufficient or out-of-scope reports use exact needs more info, retaining the existing 14-day no-response closure behavior. The distinct need more info label is not used. No new closer or direct IssueLens closure is introduced.

The new workflows use dynamic default-branch checks, least-privilege permissions, 20-minute timeouts, repository/entity concurrency without cancellation, and one pinned composite step without checkout or issue/PR-body interpolation. Human issue comments exclude PR and bot comments. Team-memory automation is limited to merged default-branch PRs or validated manual replay with the opt-in enabled. Action logs and summaries use activity and status, not agent text.

Validation

• Published JSON Schema at the pinned IssueLens revision, including negative controls.
• Checksum-verified actionlint 1.7.12 on both new workflows.
• 377 configuration/policy/format assertions, including 101 actual YAML trigger/gate cases and 16 concurrency cases evaluated with the official Actions expressions library.
• 27 selected pinned upstream action tests with HTTP/Azure calls mocked: invalid identifiers, PR-as-issue, provenance/default-branch checks, privacy, and result validation.
• Fifteen immutable source links, live label names, ASCII/LF formatting, whitespace, and the exact seven-addition diff.
• Parent actual pinned-loader/schema/caller integration on the final blobs: passed. The four configured domains load, unconfigured criticality/notification-content/planning behavior is preserved, and the shared-wiki mapping resolves through source-only reads.

No full application build was run for this configuration-only change.

Operational prerequisites configured separately

The coordinating parent confirmed setup and readback of the five standard Actions secrets (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID, ISSUELENS_AGENT_URL, ISSUELENS_AGENT_SCOPE), ISSUELENS_TEAM_MEMORY_ENABLED=true, and the exact main and pull_request federation subjects on the existing issuelens-gha managed identity. Existing roles/trust and unrelated secrets were preserved.

The parent also added the previously missing documentation label; API readback confirmed its exact name and ededed color. No existing labels were modified or issues relabeled.

These prerequisite and offline checks do not establish live OIDC authentication, agent execution, destination App permissions, or shared-wiki read/write readiness. No workflow was manually dispatched, agent invoked/deployed, App changed, wiki written, or PR merged during onboarding.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🔵 Needs a closer look

The overlapping issues.opened trigger must be resolved before approval.

Pull request overview

This PR onboards IssueLens for Project Manager for Java with scoped issue triage and opt-in shared team-memory automation.

Changes:

• Adds pinned issue-loop and post-merge workflows.
• Configures labeling, duplicate detection, assignment, and team memory.
• Documents policy, privacy, provenance, and shared-wiki safeguards.

File summaries

File	Summary
.github/workflows/issuelens-run.yml	Moderate (1 vote): overlapping issues.opened handling with triage-agent.yml may race or duplicate writes; gate one path or remove the overlap.
.github/workflows/team-memory-post-merge.yml	Adds the opt-in post-merge team-memory workflow.
.github/issuelens/team-memory.md	Two nits (1 vote each): clarify the Contents: write permission scope and correct the current-user authority wording.
.github/issuelens/labels.md	Defines additive labeling behavior.
.github/issuelens/duplicates.md	Defines evidence-backed duplicate detection.
.github/issuelens/assignment.md	Restricts new assignees.
.github/issuelens.yml	Configures the four IssueLens domains and shared-wiki mapping.

Review details

Suppressed comments (3)

.github/issuelens/team-memory.md:21

• Contents: write is not only a wiki permission: the destination App needs it for maintenance, and GitHub treats it as repository-content write access. Saying this does not grant source-code writes understates the App's blast radius and could mislead operators; distinguish the underlying App permission from the IssueLens writer's fixed wiki-only tool surface.

Destination GitHub App installation and Contents access (read for retrieval,
write for separately authorized maintenance) are separate from source-user
authorization and the source workflow's `contents: read` permission. These do not
grant issue, label, assignment, pull-request, source-code, or settings writes in
either repository.

.github/issuelens/team-memory.md:157

• The phrase “requires separately explicit current-user authority” is grammatically incorrect; please use “requires separate, explicit current-user authority” so this maintenance requirement is clear.

maintenance, including bootstrap, requires separately explicit current-user

.github/workflows/issuelens-run.yml:5

• This adds an issues.opened trigger alongside .github/workflows/triage-agent.yml, which already processes the same event and sends a DirectUpdate request with issues: write. Every new issue will therefore be handled by both triage systems, allowing their label/assignment/comment writes to race or produce duplicate, inconsistent results. Please gate one path or remove the overlapping trigger before enabling IssueLens.

  issues:
    types: [opened, reopened]

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Changyong Gong (chagong)]

Addressed the policy wording findings from the review summary in 0c460c4:

• Clarified that GitHub App Contents: write is a broader repository-content capability, not an intrinsically wiki-only permission. The IssueLens wiki-only tool surface and separately authorized maintenance job enforce this task's wiki-only scope; source-user authority and the source workflow's contents: read remain separate.
• Corrected the wording to "requires separate, explicit current-user authority."

The pushed commit changes only .github/issuelens/team-memory.md; the exact intended diff, remote blob and whitespace/ASCII/LF checks were verified. No workflow behavior changed.

For the overlapping automatic triage concern, the maintainer has explicitly taken ownership of disabling the legacy AI Triage workflows separately and requested that their files remain unchanged here. The overlap is real while those workflows are still enabled; this is an operational handoff, not a claim that both automatic writers are safe or that the legacy workflows have already been disabled.

[Copilot]

🔵 Needs a closer look

External identity, agent, and shared-wiki integrations were not live-validated.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Changyong Gong (chagong)]

Final review follow-up: GitHub now confirms the legacy AI Triage workflow (.github/workflows/triage-agent.yml, workflow 186396277) is disabled_manually, completing the maintainer-owned retirement of the competing automatic writer.

The updated branch still contains exactly the seven reviewed onboarding files, with the accepted policy/workflow blobs unchanged. The latest CI is green, including Windows and the E2E aggregate, and the PR is approved.

The external identity/agent/wiki integration limitation remains explicitly documented in the PR description. These checks do not claim a live agent invocation or wiki-write validation.