fix(linear): wire AttachmentsBucket into LinearIntegration

Issue descriptions can carry markdown image references that
`extractImageUrlAttachments` (linear-webhook-processor.ts) turns into
URL attachments on the createTaskCore call. The shared `create-task-core`
path uploads the screened bytes to `ATTACHMENTS_BUCKET_NAME`, mirroring
the TaskApi and Slack flows — but `LinearIntegration` was the only
construct that never received the bucket reference, so any Linear
trigger with an image in the description failed at task creation with
503 "Attachment storage is not configured."

Add `attachmentsBucket` to `LinearIntegrationProps`, set the env var on
the webhook processor when present, and grant `grantPut` + `grantDelete`
to match the TaskApi pattern. Construct test locks in both the env var
and the IAM grants.

(cherry picked from commit c59c8a6)

Author: isadeks

cdk/src/constructs/linear-integration.ts

@@ -25,6 +25,7 @@ import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
 import * as iam from 'aws-cdk-lib/aws-iam';
 import { Runtime, Architecture } from 'aws-cdk-lib/aws-lambda';
 import * as lambda from 'aws-cdk-lib/aws-lambda-nodejs';
+import * as s3 from 'aws-cdk-lib/aws-s3';
 import * as secretsmanager from 'aws-cdk-lib/aws-secretsmanager';
 import { NagSuppressions } from 'cdk-nag';
 import { Construct } from 'constructs';
@@ -93,6 +94,14 @@ export interface LinearIntegrationProps {
   /** Bedrock Guardrail version for input screening. */
   readonly guardrailVersion?: string;
 
+  /**
+   * S3 bucket for attachment storage. Required to support image attachments
+   * extracted from issue descriptions (markdown `![alt](https://…)` images).
+   * When omitted, Linear-triggered tasks with image attachments fail at
+   * `createTaskCore` with "Attachment storage is not configured."
+   */
+  readonly attachmentsBucket?: s3.IBucket;
+
   /** Task retention in days for TTL computation. */
   readonly taskRetentionDays?: number;
 
@@ -192,6 +201,9 @@ export class LinearIntegration extends Construct {
       createTaskEnv.GUARDRAIL_ID = props.guardrailId;
       createTaskEnv.GUARDRAIL_VERSION = props.guardrailVersion;
     }
+    if (props.attachmentsBucket) {
+      createTaskEnv.ATTACHMENTS_BUCKET_NAME = props.attachmentsBucket.bucketName;
+    }
 
     // --- Cognito Authorizer (for /linear/link) ---
     const cognitoAuthorizer = new apigw.CognitoUserPoolsAuthorizer(this, 'LinearCognitoAuthorizer', {
@@ -291,6 +303,15 @@ export class LinearIntegration extends Construct {
         ],
       }));
     }
+    // Issue descriptions can carry markdown `![alt](https://…)` images, which
+    // `extractImageUrlAttachments` (linear-webhook-processor.ts) turns into
+    // URL attachments. `createTaskCore` then uploads the screened bytes to
+    // `ATTACHMENTS_BUCKET_NAME`, mirroring the TaskApi/Slack paths. Without
+    // grantPut + grantDelete here, that upload fails closed with 503.
+    if (props.attachmentsBucket) {
+      props.attachmentsBucket.grantPut(webhookProcessorFn);
+      props.attachmentsBucket.grantDelete(webhookProcessorFn);
+    }
 
     // --- Webhook receiver (verifies HMAC, dedups, invokes processor) ---
     const webhookFn = new lambda.NodejsFunction(this, 'WebhookFn', {

cdk/src/stacks/agent.ts

@@ -806,6 +806,9 @@ export class AgentStack extends Stack {
       // the sweep to re-release from).
       userConcurrencyTable: userConcurrencyTable.table,
       maxConcurrentTasksPerUser,
+      // Image attachments extracted from issue descriptions upload here
+      // (otherwise createTaskCore 503s "Attachment storage is not configured").
+      attachmentsBucket: attachmentsBucket.bucket,
     });
 
     // #247 Mode A: the reconciler consumes the TaskTable stream and

cdk/test/constructs/linear-integration.test.ts

@@ -22,6 +22,7 @@ import { Template, Match } from 'aws-cdk-lib/assertions';
 import * as apigw from 'aws-cdk-lib/aws-apigateway';
 import * as cognito from 'aws-cdk-lib/aws-cognito';
 import * as dynamodb from 'aws-cdk-lib/aws-dynamodb';
+import * as s3 from 'aws-cdk-lib/aws-s3';
 import { LinearIntegration } from '../../src/constructs/linear-integration';
 
 describe('LinearIntegration construct', () => {
@@ -181,3 +182,66 @@ describe('LinearIntegration construct — #331 seed-time root release throttle',
     expect(Object.keys(fns)).toHaveLength(0);
   });
 });
+
+describe('LinearIntegration construct — attachmentsBucket wiring', () => {
+  // Regression-guard: webhook processor needs ATTACHMENTS_BUCKET_NAME and S3
+  // Put/Delete on the bucket so `extractImageUrlAttachments` can reach the
+  // bucket via createTaskCore. Without this, Linear-triggered tasks with
+  // markdown image attachments fail with 503 ("Attachment storage is not
+  // configured.") — the symptom that bit `linear-vercel` 2026-05-27.
+  let template: Template;
+
+  beforeAll(() => {
+    const app = new App();
+    const stack = new Stack(app, 'TestStack');
+
+    const api = new apigw.RestApi(stack, 'TestApi');
+    const userPool = new cognito.UserPool(stack, 'TestUserPool');
+    const taskTable = new dynamodb.Table(stack, 'TaskTable', {
+      partitionKey: { name: 'task_id', type: dynamodb.AttributeType.STRING },
+    });
+    const taskEventsTable = new dynamodb.Table(stack, 'TaskEventsTable', {
+      partitionKey: { name: 'task_id', type: dynamodb.AttributeType.STRING },
+      sortKey: { name: 'event_id', type: dynamodb.AttributeType.STRING },
+    });
+    const attachmentsBucket = new s3.Bucket(stack, 'AttachmentsBucket');
+
+    new LinearIntegration(stack, 'LinearIntegration', {
+      api,
+      userPool,
+      taskTable,
+      taskEventsTable,
+      attachmentsBucket,
+    });
+
+    template = Template.fromStack(stack);
+  });
+
+  test('processor env includes ATTACHMENTS_BUCKET_NAME when bucket provided', () => {
+    template.hasResourceProperties('AWS::Lambda::Function', {
+      Environment: {
+        Variables: Match.objectLike({
+          ATTACHMENTS_BUCKET_NAME: Match.anyValue(),
+          LINEAR_PROJECT_MAPPING_TABLE_NAME: Match.anyValue(),
+        }),
+      },
+    });
+  });
+
+  test('processor role can PutObject and DeleteObject on the attachments bucket', () => {
+    template.hasResourceProperties('AWS::IAM::Policy', {
+      PolicyDocument: {
+        Statement: Match.arrayWith([
+          Match.objectLike({
+            Action: Match.arrayWith(['s3:PutObject']),
+            Effect: 'Allow',
+          }),
+          Match.objectLike({
+            Action: 's3:DeleteObject*',
+            Effect: 'Allow',
+          }),
+        ]),
+      },
+    });
+  });
+});