aws-samples / aws-samples/sample-autonomous-cloud-coding-agents

feat(github): add user linking for GitHub issue-trigger attribution

Offen
#584 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
adapters cli enhancement security
Vorherrschende Sprache
TypeScript
Sterne
143
Forks
46
Ø Merge
3 T. 10 Std.
Gemergte PRs (30 T.)
24

Beschreibung

## Component

CDK GitHub adapter, CLI, identity mapping

## Describe the feature

GitHub issue-triggered tasks need explicit user attribution like Linear and Jira. A GitHub issue author or labeler should map to a Cognito platform user so ABCA can enforce per-user concurrency, cost attribution, and auditability.

## Use case

Without a user mapping, all GitHub issue-triggered tasks would need either a shared fallback user or would be unattributed. That is weaker than Linear/Jira and makes cost/concurrency controls harder to reason about.

## Proposed solution

Add a GitHub user mapping flow modeled after Linear/Jira invite/link:

- Add a GitHub user mapping table keyed by GitHub login or node id.
- Add an admin command such as `bgagent github invite-user ` that resolves the GitHub identity and emits a one-time link code.
- Add `bgagent github link ` for a Cognito-authenticated teammate to confirm and bind the GitHub identity to their platform user.
- Add a Cognito-authenticated `POST /v1/github/link` route if the existing link API pattern requires it.
- Have the GitHub issue processor attribute tasks to the mapped GitHub sender or issue author, using a clear precedence documented in tests.
- If no mapping exists, reject task creation with a clear GitHub issue comment rather than running under a silent fallback identity.

## Acceptance criteria

- Admins can generate a one-time GitHub identity link code.
- Teammates can redeem the code and see the GitHub identity before confirming.
- GitHub issue-triggered tasks run under the linked platform user.
- Unmapped GitHub users receive a clear issue comment and no task is created.
- Existing Linear/Jira identity mappings are unaffected.

## Tests

- CLI tests cover invite and link flows.
- Handler tests cover dry-run/confirmation behavior and expired/invalid codes.
- GitHub issue processor tests cover mapped and unmapped users.
- Docs explain teammate onboarding for GitHub Issues.

## Out of scope

- Per-user GitHub OAuth tokens.
- Replacing the existing GitHub App/PAT credential path.
- Organization-wide fallback users.
- GitHub Enterprise Server identity mapping.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Beginne damit, die bestehenden Linear/Jira-Einladungs- und Link-Flows nachzuverfolgen, und prüfe anschließend den GitHub-Issue-Prozessor sowie die im Issue genannten CLI- und Handler-Testbereiche. Als abgeschlossen gilt die Arbeit, wenn Admins Einmalcodes erstellen können, Teammitglieder ihre Identitäten bestätigen können, zugeordnete Benutzer eine Attribution erhalten, nicht zugeordnete Benutzer einen eindeutigen Kommentar ohne Aufgabenerstellung erhalten und bestehende Zuordnungen unverändert bleiben.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
aws, github, typescript
Bereich
api, authentication, authorization, backend-api-design, cli, documentation
Issue-Typ
Feature
Schwierigkeit
5/5
Geschätzter Aufwand
Über eine Woche
Aktivitätsstatus
Ruhig
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
35/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.