feat(tools/jira): add write subcommands (comment, transition, label, assign, field, attach)

[oscerd]

Summary

• Extends the read-only JIRA bridge with six write subcommands: comment, transition, label, assign, field, and attach
• Write operations require JIRA_API_TOKEN and follow the same write-path discipline as the GitHub bridge (mutations gated on explicit user confirmation in the calling skill)
• Adds a pytest test harness with a mock HTTP server (24 tests, auto-skipped when groovy is not on PATH)

Test plan

• Tests collected and pass locally (uv run pytest — 24 tests, skipped when groovy not on PATH)
• Placeholder check passes (tools/dev/check-placeholders.sh — OK)
• CI pre-commit hooks pass
• Manual verification with a live JIRA instance (optional, requires groovy + API token)

Closes #301

[andreahlert]

Scope is tight and the mock harness is a solid first layer — really like where this is going. Requesting changes on three things that imho will bite the first time a skill calls this against issues.apache.org/jira:

1. cmd_field only sends string values — most non-trivial JIRA fields (priority, version, user, single-select) need objects/arrays and will 400. See inline.
2. README auth description is Cloud-flavored but cmd_assign uses DC {name}. Needs to either say "DC only" or actually handle Cloud.
3. ASF JIRA PATs use Authorization: Bearer, not Basic. Today PAT users have to fake Basic via base64(user:pat).

The rest below are nits / follow-ups — flagging them while I'm here, not blocking on them.

Cross-cutting:

• No retry/backoff anywhere. ASF JIRA does rate-limit; a small 429/5xx → 3 retries w/ backoff loop would save pain in long skill flows.
• Pre-existing, but since the README is being touched here: @Grab('org.apache.groovy:groovy-json:4.0.21') requires Groovy 4 (3.x uses org.codehaus.groovy), yet README.md:66 still says "Groovy 3.x or newer". Easy fix in passing.

[oscerd]

@andreahlert Thanks for the thorough review — addressed all three blocking items and most nits in 2dcfadc.

Retry/backoff: Agreed this will matter in long skill flows. It applies equally to the read path, so imho better as a cross-cutting follow-up than scoped to this PR.

Groovy version: Fixed — README now says "Groovy 4.x" and explains the org.apache.groovy group ID.

[andreahlert]

Thanks for addressing this. LGTM.

[potiuk]

Thanks for the iteration — implementation is clean and the prior-feedback
round (Bearer scheme, atomic update API, UTF-8 file reads) shows good
attention to detail. Strict key regex (^[A-Z][A-Z0-9_]*-\d+$) closes the
URL-injection path, and the 28 pytest tests cover the right happy + error +
auth surfaces.

Blocking — wire the test suite into CI

The new tools/jira/ is a proper uv project with tests, but neither the
workflow matrix nor the prek hooks pick it up — so the 28 tests land as
dead weight in CI and a future regression would never block a PR. Two small
additions, both mechanical, mirror the pattern the other tools use:

1. Add jira to the pytest matrix in .github/workflows/tests.yml:

        project:
          - name: oauth-draft
            path: tools/gmail/oauth-draft
          - name: generate-cve-json
            path: tools/vulnogram/generate-cve-json
          - name: skill-and-tool-validator
            path: tools/skill-and-tool-validator
          - name: privacy-llm-checker
            path: tools/privacy-llm/checker
          - name: privacy-llm-redactor
            path: tools/privacy-llm/redactor
          - name: vulnogram-oauth-api
            path: tools/vulnogram/oauth-api
          - name: sandbox-lint
            path: tools/sandbox-lint
          - name: agent-isolation
            path: tools/agent-isolation
          - name: jira
            path: tools/jira

2. Add prek hooks for jira in .pre-commit-config.yaml, mirroring the
sibling pattern (the skill-and-tool-validator block is the closest analogue
— four hooks: ruff-check, ruff-format, mypy, pytest). Each hook's
files: regex should match ^tools/jira/(src|tests|pyproject\.toml|bridge\.groovy).

Once both land, pytest (jira) shows up as a matrix entry under the
tests-ok umbrella and prek runs the lint pass locally and in CI.

Happy to apply this as a maintainer-side fixup if you'd rather not chase it
— just say the word. Otherwise, push the two edits when you have a moment
and I'll re-review.

---

This review was drafted by an AI-assisted tool and confirmed by an Apache Steward
maintainer. After you've addressed the points above and pushed an update, an
Apache Steward maintainer will take the next look at your PR.

More on how Apache Steward handles maintainer review:
CONTRIBUTING.md.

[oscerd]

@potiuk Done in 5aa58e6:

1. Added jira to the pytest matrix in .github/workflows/tests.yml
2. Added four prek hooks (ruff-check, ruff-format, mypy, pytest) in .pre-commit-config.yaml — files: pattern includes bridge.groovy so tests re-run when the bridge itself changes
3. Added ruff and mypy to dev dependencies in pyproject.toml with mypy config mirroring sandbox-lint

All four checks pass locally (ruff check, ruff format, mypy, pytest collect — 28 tests).

[potiuk]

LGTM — the CI wire-in addresses the prior REQUEST_CHANGES exactly:

• .github/workflows/tests.yml — jira / tools/jira matrix entry slots in
  alongside the other tool packages; the tests-ok umbrella now gates the
  jira suite alongside the rest.
• .pre-commit-config.yaml — four hooks under a repo: local block
  (ruff check, ruff format --check, mypy, pytest), each with a
  files: regex matching ^tools/jira/(src|tests|pyproject\.toml|bridge\.groovy)
  exactly as proposed.
• pyproject.toml — ruff and mypy added to the dev dep group; uv.lock
  reflects.

Verified locally on the rebased branch: ruff check clean, ruff format --check clean, mypy reports no issues, pytest skips the Groovy-dependent
cases (groovy not installed locally) but the test suite's skip semantics
are correct and CI ships groovy. The 28 test assertions still match the
prior round.

The substantive review from earlier still stands: clean Groovy
implementation of six write subcommands; strict key regex (^[A-Z][A-Z0-9_]*-\d+$)
closes URL injection; atomic JIRA update API for labels; DC-only scope
called out; Bearer auth supported.

Thanks for the quick turnaround on the CI wiring.

---

This review was drafted by an AI-assisted tool and confirmed by an Apache Steward
maintainer. The maintainer approving this PR has read the findings and signed off.
If something feels off, please reply on the PR and a maintainer will follow up.

More on how Apache Steward handles maintainer review:
CONTRIBUTING.md.