Merge branch 'main' into feat/246-registry-ddb-s3

Author: isadeks

agent/src/pipeline.py

@@ -5,7 +5,6 @@
 import asyncio
 import hashlib
 import os
-import subprocess
 import sys
 import time
 from typing import TYPE_CHECKING
@@ -822,19 +821,17 @@ def _on_trace_truncated(max_bytes: int, first_dropped: int) -> None:
                     system_prompt_overrides=system_prompt_overrides,
                 )
 
-            # Configure git and gh auth before setup_repo() uses them
-            subprocess.run(
-                ["git", "config", "--global", "user.name", "bgagent"],
-                check=True,
-                capture_output=True,
-                timeout=60,
-            )
-            subprocess.run(
-                ["git", "config", "--global", "user.email", "bgagent@noreply.github.com"],
-                check=True,
-                capture_output=True,
-                timeout=60,
-            )
+            # Configure git identity and gh auth before setup_repo() uses them.
+            # Use GIT_AUTHOR_*/GIT_COMMITTER_* env vars rather than
+            # `git config --global`: git honors these for every commit (inherited
+            # by Claude Code and the safety-net commit in post_hooks) WITHOUT
+            # writing to any on-disk config. `--global` would clobber the real
+            # ~/.gitconfig — harmless in the ephemeral container, but destructive
+            # when this pipeline runs on a developer workstation (#622).
+            os.environ["GIT_AUTHOR_NAME"] = "bgagent"
+            os.environ["GIT_AUTHOR_EMAIL"] = "bgagent@noreply.github.com"
+            os.environ["GIT_COMMITTER_NAME"] = "bgagent"
+            os.environ["GIT_COMMITTER_EMAIL"] = "bgagent@noreply.github.com"
             os.environ["GITHUB_TOKEN"] = config.github_token
             os.environ["GH_TOKEN"] = config.github_token
 

agent/tests/test_pipeline.py

@@ -1,5 +1,6 @@
 """Unit tests for pipeline.py — cedar_policies injection and pure helpers."""
 
+import os
 from unittest.mock import MagicMock, patch
 
 import pytest
@@ -142,6 +143,78 @@ async def fake_run_agent(_prompt, _system_prompt, config, cwd=None, trajectory=N
         assert captured_config is not None
         assert captured_config.cedar_policies == []
 
+    @patch("runner.run_agent")
+    @patch("pipeline.build_system_prompt")
+    @patch("pipeline.discover_project_config")
+    @patch("repo.setup_repo")
+    @patch("pipeline.task_span")
+    @patch("pipeline.task_state")
+    def test_git_identity_uses_env_vars_not_global_config(
+        self,
+        _mock_task_state,
+        mock_task_span,
+        mock_setup_repo,
+        _mock_discover,
+        _mock_build_prompt,
+        mock_run_agent,
+        monkeypatch,
+    ):
+        """Git identity is set via GIT_AUTHOR/COMMITTER env vars, never
+        `git config --global`, so a developer's ~/.gitconfig is never
+        clobbered when the pipeline runs on a workstation (#622)."""
+        monkeypatch.setenv("GITHUB_TOKEN", "ghp_test")
+        monkeypatch.setenv("AWS_REGION", "us-east-1")
+        # Ensure a clean slate so the assertion proves the pipeline set them.
+        for var in (
+            "GIT_AUTHOR_NAME",
+            "GIT_AUTHOR_EMAIL",
+            "GIT_COMMITTER_NAME",
+            "GIT_COMMITTER_EMAIL",
+        ):
+            monkeypatch.delenv(var, raising=False)
+
+        mock_setup_repo.return_value = RepoSetup(
+            repo_dir="/workspace/repo",
+            branch="bgagent/test/branch",
+            build_before=True,
+        )
+
+        async def fake_run_agent(_prompt, _system_prompt, config, cwd=None, trajectory=None):
+            return AgentResult(status="success", turns=1, cost_usd=0.01, num_turns=1)
+
+        mock_run_agent.side_effect = fake_run_agent
+
+        mock_span = MagicMock()
+        mock_span.__enter__ = MagicMock(return_value=mock_span)
+        mock_span.__exit__ = MagicMock(return_value=False)
+        mock_task_span.return_value = mock_span
+
+        with (
+            patch("pipeline.ensure_committed", return_value=False),
+            patch("pipeline.verify_build", return_value=True),
+            patch("pipeline.verify_lint", return_value=True),
+            patch(
+                "pipeline.ensure_pr",
+                return_value="https://github.com/org/repo/pull/1",
+            ),
+            patch("pipeline.get_disk_usage", return_value=0),
+            patch("pipeline.print_metrics"),
+        ):
+            from pipeline import run_task
+
+            run_task(
+                repo_url="owner/repo",
+                task_description="fix bug",
+                github_token="ghp_test",
+                aws_region="us-east-1",
+                task_id="test-id",
+            )
+
+        assert os.environ["GIT_AUTHOR_NAME"] == "bgagent"
+        assert os.environ["GIT_AUTHOR_EMAIL"] == "bgagent@noreply.github.com"
+        assert os.environ["GIT_COMMITTER_NAME"] == "bgagent"
+        assert os.environ["GIT_COMMITTER_EMAIL"] == "bgagent@noreply.github.com"
+
 
 class TestRepoLessPipeline:
     """#248 Phase 3: a repo-less workflow runs the agent with no clone/build/PR."""

cdk/src/constructs/jira-integration.ts

@@ -25,6 +25,7 @@ import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import { Runtime, Architecture } from 'aws-cdk-lib/aws-lambda';
 import * as lambda from 'aws-cdk-lib/aws-lambda-nodejs';
+import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { NagSuppressions } from 'cdk-nag';
 import { Construct } from 'constructs';
@@ -35,8 +36,17 @@ import { JiraWorkspaceRegistryTable } from './jira-workspace-registry-table';
 /** Default task-record retention used for TTL computation (days). */
 const DEFAULT_TASK_RETENTION_DAYS = 90;
 
-/** Webhook-processor Lambda timeout (seconds). */
-const WEBHOOK_PROCESSOR_TIMEOUT_SECONDS = 30;
+/**
+ * Webhook-processor Lambda timeout (seconds). The processor is invoked
+ * asynchronously (not behind the API Gateway 30s deadline), so it can run
+ * longer than the receiver. #577 added serial authenticated download +
+ * Bedrock screening of up to 10 Jira attachments; the per-attachment fetch
+ * timeout alone (10s) can sum past 60s across a full batch, and a mid-loop
+ * kill would orphan objects and force an idempotent retry. 300s covers the
+ * worst-case serial batch with headroom. (A future optimization could
+ * parallelize the download/screen loop and lower this again.)
+ */
+const WEBHOOK_PROCESSOR_TIMEOUT_SECONDS = 300;
 
 /**
  * Marker key embedded in the auto-generated stack-wide webhook-secret
@@ -87,6 +97,14 @@ export interface JiraIntegrationProps {
   /** Bedrock Guardrail version for input screening. */
   readonly guardrailVersion?: string;
 
+  /**
+   * S3 bucket for task attachment storage. Required for the webhook processor
+   * to fetch, screen, and store Jira `media` file attachments at task-admission
+   * time (issue #577). When omitted, issues carrying supported file attachments
+   * are rejected with a Jira comment rather than silently dropping them.
+   */
+  readonly attachmentsBucket?: s3.IBucket;
+
   /** Task retention in days for TTL computation. */
   readonly taskRetentionDays?: number;
 
@@ -206,6 +224,9 @@ export class JiraIntegration extends Construct {
       createTaskEnv.GUARDRAIL_ID = props.guardrailId;
       createTaskEnv.GUARDRAIL_VERSION = props.guardrailVersion;
     }
+    if (props.attachmentsBucket) {
+      createTaskEnv.ATTACHMENTS_BUCKET_NAME = props.attachmentsBucket.bucketName;
+    }
 
     // --- Cognito Authorizer (for /jira/link) ---
     const cognitoAuthorizer = new apigw.CognitoUserPoolsAuthorizer(this, 'JiraCognitoAuthorizer', {
@@ -280,6 +301,13 @@ export class JiraIntegration extends Construct {
         ],
       }));
     }
+    // The processor downloads Jira `media` attachments, screens them, and
+    // writes the cleaned bytes to the attachments bucket before creating the
+    // task (#577). ReadWrite mirrors the confirm-uploads path (Put + Get for
+    // multipart/versioned writes).
+    if (props.attachmentsBucket) {
+      props.attachmentsBucket.grantReadWrite(webhookProcessorFn);
+    }
 
     // --- Webhook receiver (verifies HMAC, dedups, invokes processor) ---
     const webhookFn = new lambda.NodejsFunction(this, 'WebhookFn', {

cdk/src/constructs/task-api.ts

@@ -340,6 +340,18 @@ export class TaskApi extends Construct {
                         textTransformations: [{ priority: 0, type: 'NONE' }],
                       },
                     },
+                    {
+                      // Jira issue payloads include the full issue field set.
+                      // Attachment metadata can push them over 8 KB. The
+                      // receiver HMAC-verifies the raw body and the priority-4
+                      // rule below still rate-limits this route.
+                      byteMatchStatement: {
+                        fieldToMatch: { uriPath: {} },
+                        positionalConstraint: 'EXACTLY',
+                        searchString: '/v1/jira/webhook',
+                        textTransformations: [{ priority: 0, type: 'NONE' }],
+                      },
+                    },
                     {
                       // GitHub deployment_status webhook (preview-deploy
                       // screenshot pipeline). The full payload (workflow run
@@ -390,6 +402,18 @@ export class TaskApi extends Construct {
                         },
                       },
                     },
+                    {
+                      notStatement: {
+                        statement: {
+                          byteMatchStatement: {
+                            fieldToMatch: { uriPath: {} },
+                            positionalConstraint: 'EXACTLY',
+                            searchString: '/v1/jira/webhook',
+                            textTransformations: [{ priority: 0, type: 'NONE' }],
+                          },
+                        },
+                      },
+                    },
                     {
                       notStatement: {
                         statement: {