Fix analytics-review on workflow_dispatch: pass resolved PR context to the agent (#152)

* Fix analytics-review on workflow_dispatch: pass resolved PR context to the agent

Dry-run 32015295640 (PR #146) went green end-to-end after the v0.86.2
recompile, but the agent posted nothing: the resolve pre-step's
AW_PR_NUMBER/AW_HEAD_REF land in step env only, which never reaches the
agent sandbox, and on workflow_dispatch the event payload has no PR
object. The agent concluded "no associated pull request ... nothing to
review" and noop'd.

Fix 1: the resolve step (now id: resolve_pr) also writes step outputs
and /tmp/gh-aw/context/run-context.md — the context dir is the one
channel proven to reach the agent (it read jira-ticket.md in the same
run). The prompt body names run-context.md as the source of truth for
PR identity, treats a dispatch run with a resolved PR as a normal
review, and reserves noop for runs where no PR resolves at all.
(${{ steps.* }} interpolation into the body cannot work: the prompt is
rendered in the activation job, the steps run in the agent job.)

Fix 2: the same run showed "JIRA returned HTTP 404 for ENG-909" —
ambiguous, since JIRA answers 404 for missing ticket, missing project
permission, AND bad credentials. On any non-200 the step now probes
/rest/api/3/myself and writes an auth diagnosis into the marker
(credentials rejected vs authenticated-but-cannot-see vs unreachable),
reporting HTTP codes only, never credential values. Still never fails
the job.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* JIRA step: support scoped Atlassian tokens (accessible-resources probe + auto-recovery)

Root cause of the ENG-909 404: JIRA_API_TOKEN is a scoped Atlassian API
token, and scoped tokens must target https://api.atlassian.com/ex/jira/<cloudId>
instead of https://<site>.atlassian.net. Atlassian answers 404 (not 403)
when a scoped token hits the site-host form, which mimics a missing issue.

- Replace the /rest/api/3/myself probe (not callable with granular
  read:issue scopes -> would false-report valid credentials as broken)
  with GET https://api.atlassian.com/oauth/token/accessible-resources,
  which works for both token types and returns each site's cloudId.
- Auto-recovery: when the issue fetch fails and the probe can resolve a
  cloudId (configured URL matches a site, cloudId embedded in an ex/jira
  URL, or single-site token), retry via the scoped-token endpoint - so
  either token type works with either JIRA_BASE_URL form.
- Self-diagnosing markers on hard failure: credentials rejected (401/403,
  mentions <=365-day scoped-token expiry), base URL matches none of the
  token's sites (lists reachable site URLs + cloudIds and the exact value
  to set), ticket not visible/nonexistent (tried both endpoints), or
  api.atlassian.com unreachable. HTTP codes, site URLs and cloudIds only;
  never credential values.
- Comments fetch now uses the possibly-recovered base URL.
- README: JIRA_BASE_URL form guidance per token type.
- New helper .github/scripts/jira_sites.py (cloud-id resolution + site
  summary; always exits 0).

All six failure/recovery branches exercised locally against a mock
Atlassian server using the step script extracted verbatim from the
workflow; every path exits 0 and writes the marker.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: amjithtitus09

.github/scripts/jira_sites.py

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+"""Helpers for diagnosing JIRA API access in the analytics-review workflow.
+
+Parses the JSON that `GET https://api.atlassian.com/oauth/token/accessible-resources`
+returns (the list of Atlassian sites a credential can reach) and answers two
+questions for the workflow's JIRA pre-step:
+
+    jira_sites.py cloud-id <resources.json> <configured-base-url>
+        Print the cloudId to use with the scoped-token endpoint
+        (https://api.atlassian.com/ex/jira/<cloudId>), chosen as: the site
+        whose `url` equals the configured base URL, else the cloudId already
+        embedded in an .../ex/jira/<id> base, else the only site when exactly
+        one is accessible. Prints nothing when no confident answer exists.
+
+    jira_sites.py summary <resources.json>
+        Print a one-line "url (cloudId ...)" list for diagnostics.
+
+Site URLs and cloudIds are not credentials (cloudIds appear in every browser
+request to a JIRA site); nothing secret is ever read or printed here. Exit
+code is always 0 — this feeds a diagnostics path that must never fail the job.
+"""
+
+import json
+import sys
+
+
+def load_sites(path):
+    try:
+        with open(path) as fh:
+            data = json.load(fh)
+    except Exception:
+        return []
+    return [s for s in data if isinstance(s, dict)] if isinstance(data, list) else []
+
+
+def main():
+    if len(sys.argv) < 3:
+        return
+    mode, path = sys.argv[1], sys.argv[2]
+    sites = load_sites(path)
+    if mode == "summary":
+        line = "; ".join(
+            "%s (cloudId %s)" % (s.get("url", "?"), s.get("id", "?")) for s in sites
+        )
+        print(line or "no sites accessible to this token")
+    elif mode == "cloud-id":
+        base = (sys.argv[3] if len(sys.argv) > 3 else "").rstrip("/")
+        match = [s for s in sites if str(s.get("url", "")).rstrip("/") == base]
+        if not match and "/ex/jira/" in base:
+            cid = base.split("/ex/jira/", 1)[1].split("/")[0]
+            match = [s for s in sites if s.get("id") == cid]
+        if not match and len(sites) == 1:
+            match = sites
+        if match:
+            print(match[0].get("id", ""))
+
+
+if __name__ == "__main__":
+    main()