Onboard Java Debug Server to IssueLens

[Changyong Gong (chagong)]

Summary

• Add the pinned shared IssueLens issue-loop and opt-in post-merge team-memory callers for microsoft/java-debug (the Java Debug Server, not the VS Code debugger extension).
• Add canonical version-1 configuration for labeling, duplicate detection, assignment, and team memory, with the validated shared wiki destination microsoft/vscode-java-pack and source identity microsoft/java-debug.
• Ground the policies in server DAP handlers, JDTLS debug delegates, and JDI/JDWP/JVM boundaries. Preserve labels and assignees, use only live labels and the approved assignment candidates, and require native High duplicate confidence plus technical corroboration.
• Limit the change to seven new files. Preserve existing Azure Function triage, batch triage, CI, CODEOWNERS, and legacy repository context. No no-response automation exists in this baseline, and none is added.

Validation

• Published pinned schema and action contract at 49df3d97547069f891a68248be6ed722c2aeca2f; configuration and parsed callers match the approved immutable Java Pack reference.
• actionlint 1.7.12, acquired with official checksum and API digest verification.
• 672 actual-YAML trigger/job-gate fixtures and 15 concurrency assertions using the official GitHub Actions expression evaluator, including bots/PR comments, dynamic default branches, opt-in, and manual/run fallbacks.
• Exact live label vocabulary, ten duplicate candidate repositories, shared 17-page namespace, 17 immutable source links, four local links, ASCII/LF/whitespace, and seven-file-only scope.
• Parent actual pinned loader/schema/caller integration passed against the final accepted blobs: four configured domains, three unrelated domain behaviors preserved, and shared-wiki resolution with 21 source-only reads.
• The final two version-neutral Gradle task-service wording corrections preserve all page names/citations; the other six reviewed blobs are unchanged.
• No Java build was run for this configuration-only change.

Operational scope and readiness

The coordinating parent confirmed the five standard repository Actions secrets (AZURE_CLIENT_ID, AZURE_TENANT_ID, AZURE_SUBSCRIPTION_ID, ISSUELENS_AGENT_URL, ISSUELENS_AGENT_SCOPE), ISSUELENS_TEAM_MEMORY_ENABLED=true, and exact main/pull_request trust under the existing issuelens-gha managed identity. Unrelated secrets, existing trust, and roles were preserved.

No agent deployment/invocation, workflow dispatch, GitHub App change, or wiki write was performed. Live OIDC authentication, agent execution, destination App access, and wiki maintenance were not exercised. Static validation and configured settings do not establish live IssueLens execution readiness.

[Copilot]

🟡 Changes recommended

The new workflows pass empty issue/PR numbers to the IssueLens action for event-triggered runs by using only inputs.* instead of the event payload numbers.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds IssueLens onboarding for microsoft/java-debug by introducing the two canonical GitHub Actions callers (issue-loop + post-merge team-memory) plus repository-scoped v1 IssueLens policy/config files that constrain labeling, duplicate detection, assignment, and shared-wiki team memory behavior.

Changes:

• Add IssueLens issue-loop workflow for issues / issue_comment (plus manual dispatch).
• Add IssueLens post-merge team-memory workflow for merged PRs (plus manual dispatch), gated by ISSUELENS_TEAM_MEMORY_ENABLED.
• Add v1 .github/issuelens.yml plus hosted policy documents for labeling, duplicates, assignment, and team-memory (shared wiki target microsoft/vscode-java-pack).

File summaries

File	Description
.github/workflows/team-memory-post-merge.yml	Adds post-merge IssueLens team-memory caller workflow.
.github/workflows/issuelens-run.yml	Adds IssueLens issue-loop caller workflow for issue triage.
.github/issuelens.yml	Registers IssueLens v1 configuration and policy entry points (incl. wiki target).
.github/issuelens/team-memory.md	Defines shared-wiki team-memory policy and maintenance boundaries for java-debug.
.github/issuelens/labels.md	Defines constrained labeling policy (additive-only, live-label-only).
.github/issuelens/duplicates.md	Defines bounded, read-only duplicate detection policy and thresholds.
.github/issuelens/assignment.md	Defines constrained assignee-candidate policy and additive assignment rules.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The issues/issue_comment workflow exposes OIDC and secrets on user-triggered events without a trust/association gate, creating a security and abuse risk.

Get a fresh assessment by requesting another Copilot review.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

It introduces new workflows that obtain OIDC tokens and use repository secrets on public issue/comment triggers, warranting final human review of the operational/security posture before enabling.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite