Merge branch 'main' into pr/agent-build-robustness

Author: isadeks

.github/workflows/deploy.yml

@@ -153,7 +153,7 @@ jobs:
           github-token: ${{ github.token }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -228,7 +228,7 @@ jobs:
           github-token: ${{ github.token }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ vars.AWS_REGION }}

.github/workflows/docs.yml

@@ -199,7 +199,7 @@ jobs:
           persist-credentials: false
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6.2.1
+        uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           # Fall back to us-east-1 if the repo variable is unset, so the action

.github/workflows/integ.yml

@@ -41,7 +41,7 @@ jobs:
           echo "last_month=$first_day..$last_day" >> "$GITHUB_ENV"
 
       - name: Report on issues
-        uses: github/issue-metrics@44173f9e0a3b2144a777a10a340e4c09a25ac9f8 # v4.2.8
+        uses: github/issue-metrics@df8c49d20958f9345281fa2124858bd0ad227e1f # v5.0.0
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SEARCH_QUERY: repo:aws-samples/sample-autonomous-cloud-coding-agents is:issue created:${{ env.last_month }} -reason:"not planned"
@@ -54,7 +54,7 @@ jobs:
           content-filepath: ./issue_metrics.md
 
       - name: Report on PRs
-        uses: github/issue-metrics@44173f9e0a3b2144a777a10a340e4c09a25ac9f8 # v4.2.8
+        uses: github/issue-metrics@df8c49d20958f9345281fa2124858bd0ad227e1f # v5.0.0
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SEARCH_QUERY: repo:aws-samples/sample-autonomous-cloud-coding-agents is:pr created:${{ env.last_month }} -is:draft

.github/workflows/monthly-repo-metrics.yml

@@ -4,7 +4,7 @@ ARG GH_VERSION=2.93.0
 FROM --platform=$TARGETPLATFORM jdxcode/mise:latest AS mise
 
 # Build gh with a patched Go toolchain; upstream packages can lag Go CVE fixes.
-FROM --platform=$TARGETPLATFORM golang:1.26.3-bookworm AS gh-builder
+FROM --platform=$TARGETPLATFORM golang:1.26.4-bookworm AS gh-builder
 ARG GH_VERSION
 RUN GOPROXY=direct GOBIN=/out go install "github.com/cli/cli/v2/cmd/gh@v${GH_VERSION}"
 

agent/Dockerfile

@@ -148,7 +148,7 @@ export class JiraIntegration extends Construct {
    */
   public readonly workspaceRegistryTable: dynamodb.Table;
 
-  /** Webhook dedup table — `{issueKey}#{webhookEvent}#{timestamp}` keys with 8h TTL. */
+  /** Webhook dedup table — issue timestamps or stable comment IDs, with an 8h TTL. */
   public readonly webhookDedupTable: dynamodb.Table;
 
   /** Jira webhook signing secret (placeholder — populated by `bgagent jira setup`). */
@@ -168,7 +168,8 @@ export class JiraIntegration extends Construct {
     this.workspaceRegistryTable = workspaceRegistry.table;
 
     // Dedup table: Jira webhook retries collapse to a single processor invoke
-    // within the 8h TTL window. Keyed on `{issueKey}#{webhookEvent}#{timestamp}`.
+    // within the 8h TTL window. Issue events use the event timestamp; comment
+    // events use the stable Jira comment ID.
     this.webhookDedupTable = new dynamodb.Table(this, 'WebhookDedupTable', {
       partitionKey: { name: 'dedup_key', type: dynamodb.AttributeType.STRING },
       billingMode: dynamodb.BillingMode.PAY_PER_REQUEST,

cdk/src/constructs/jira-integration.ts

@@ -0,0 +1,26 @@
+/**
+ *  MIT No Attribution
+ *
+ *  Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
+ *
+ *  Permission is hereby granted, free of charge, to any person obtaining a copy of
+ *  the Software without restriction, including without limitation the rights to
+ *  use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+ *  the Software, and to permit persons to whom the Software is furnished to do so.
+ *
+ *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ *  SOFTWARE.
+ */
+
+/**
+ * GSI name for resolving Jira-origin tasks by tenant and issue key.
+ *
+ * Kept dependency-free because both CDK constructs and bundled Lambda handlers
+ * use this deployment/runtime contract.
+ */
+export const JIRA_ISSUE_INDEX_NAME = 'JiraIssueIndex';

cdk/src/constructs/task-table-indexes.ts

@@ -20,6 +20,9 @@
 import { RemovalPolicy } from 'aws-cdk-lib';
 import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import { Construct } from 'constructs';
+import { JIRA_ISSUE_INDEX_NAME } from './task-table-indexes';
+
+export { JIRA_ISSUE_INDEX_NAME } from './task-table-indexes';
 
 /**
  * Properties for TaskTable construct.
@@ -47,13 +50,15 @@ export interface TaskTableProps {
 /**
  * DynamoDB table for persisting task state across the agent lifecycle.
  *
- * Schema: task_id (PK) with three GSIs for querying by user+status,
- * by status (queue processing), and by idempotency key (dedup).
+ * Schema: task_id (PK) with GSIs for querying by user+status, by status
+ * (queue processing), by idempotency key (dedup), and by Jira issue.
  *
  * GSIs:
  * - UserStatusIndex (PK: user_id, SK: status_created_at) — "my tasks" queries
  * - StatusIndex (PK: status, SK: created_at) — queue processing, monitoring
  * - IdempotencyIndex (PK: idempotency_key) — sparse index for dedup
+ * - JiraIssueIndex (PK: jira_issue_identity, SK: created_at) — sparse index
+ *   for resolving a Jira issue to its newest PR-producing task
  */
 export class TaskTable extends Construct {
   /**
@@ -74,6 +79,12 @@ export class TaskTable extends Construct {
    */
   public static readonly IDEMPOTENCY_INDEX = 'IdempotencyIndex';
 
+  /**
+   * GSI for resolving a tenant-scoped Jira issue to its newest ABCA task.
+   * PK: jira_issue_identity (`{cloudId}#{issueKey}`), SK: created_at.
+   */
+  public static readonly JIRA_ISSUE_INDEX = JIRA_ISSUE_INDEX_NAME;
+
   /**
    * The underlying DynamoDB table. Use this to grant access or read the table name.
    */
@@ -118,5 +129,16 @@ export class TaskTable extends Construct {
       partitionKey: { name: 'idempotency_key', type: dynamodb.AttributeType.STRING },
       projectionType: dynamodb.ProjectionType.KEYS_ONLY,
     });
+
+    // Sparse: only Jira-origin tasks with issue metadata carry the top-level
+    // jira_issue_identity attribute. Keep the projection limited to fields the
+    // comment-trigger resolver needs.
+    this.table.addGlobalSecondaryIndex({
+      indexName: TaskTable.JIRA_ISSUE_INDEX,
+      partitionKey: { name: 'jira_issue_identity', type: dynamodb.AttributeType.STRING },
+      sortKey: { name: 'created_at', type: dynamodb.AttributeType.STRING },
+      projectionType: dynamodb.ProjectionType.INCLUDE,
+      nonKeyAttributes: ['pr_url', 'pr_number', 'status', 'repo', 'user_id', 'channel_metadata'],
+    });
   }
 }