fix(guard): add copilot-swe-agent to trusted first-party bots

[Copilot]

PRs opened by Copilot's coding agent (app/copilot-swe-agent) were not recognized as trusted first-party bots, causing them to receive none/unapproved integrity. On public repos with auto-defaulted min-integrity: approved, this blocked pull_request_read on any PR the agent authored — a chicken-and-egg problem for PR review workflows.

Changes

• guards/github-guard/rust-guard/src/labels/helpers.rs — add all three login variants to is_trusted_first_party_bot():

  || lower == "copilot-swe-agent[bot]"  // REST API bot user
  || lower == "copilot-swe-agent"        // without [bot] suffix
  || lower == "app/copilot-swe-agent"    // gh CLI app/ prefix

• guards/github-guard/rust-guard/src/labels/mod.rs — extend test_trusted_first_party_bot_detection to assert all three variants are trusted, including case-insensitive matching

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build3121127075/b334/launcher.test /tmp/go-build3121127075/b334/launcher.test -test.testlogfile=/tmp/go-build3121127075/b334/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build3121127075/b237/vet.cfg ebug/debug.s .go x_amd64/compile /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet fips140 /home/REDACTED/wor-unreachable=false x_amd64/compile 6871�� g_.a JWaf/v-LJHyKfeZzW2BDEJWaf x_amd64/vet /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /home/REDACTED/wor-atomic /home/REDACTED/wor-bool x_amd64/vet (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build3121127075/b319/config.test /tmp/go-build3121127075/b319/config.test -test.testlogfile=/tmp/go-build3121127075/b319/testlog.txt -test.paniconexit0 -test.timeout=10m0s -m64�� ternal/wasm/counts.go ternal/wasm/engine.go x_amd64/compile /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet 6871160/b009/ 64-REDACTED-linux-unreachable=false x_amd64/compile --no�� @v1.1.3/cpu/arm/arm.go /home/REDACTED/.rustup/toolchains/-dumpbase x_amd64/vet bug/deps/rustcKv/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet bug/deps/github_-unsafeptr=false bug/deps/github_-unreachable=false x_amd64/vet (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build3121127075/b334/launcher.test /tmp/go-build3121127075/b334/launcher.test -test.testlogfile=/tmp/go-build3121127075/b334/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build3121127075/b237/vet.cfg ebug/debug.s .go x_amd64/compile /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet fips140 /home/REDACTED/wor-unreachable=false x_amd64/compile 6871�� g_.a JWaf/v-LJHyKfeZzW2BDEJWaf x_amd64/vet /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /home/REDACTED/wor-atomic /home/REDACTED/wor-bool x_amd64/vet (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build3121127075/b334/launcher.test /tmp/go-build3121127075/b334/launcher.test -test.testlogfile=/tmp/go-build3121127075/b334/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build3121127075/b237/vet.cfg ebug/debug.s .go x_amd64/compile /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet fips140 /home/REDACTED/wor-unreachable=false x_amd64/compile 6871�� g_.a JWaf/v-LJHyKfeZzW2BDEJWaf x_amd64/vet /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /home/REDACTED/wor-atomic /home/REDACTED/wor-bool x_amd64/vet (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build3121127075/b343/mcp.test /tmp/go-build3121127075/b343/mcp.test -test.testlogfile=/tmp/go-build3121127075/b343/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build3121127075/b273/vet.cfg g_.a /home/REDACTED/worruntime/pprof x_amd64/vet /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet 6871160/b073/ /home/REDACTED/wor-unreachable=false x_amd64/vet 6871�� afu_mdwfy /home/REDACTED/wor-nolocalimports x_amd64/vet /home/REDACTED/wor/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet /home/REDACTED/wor-unsafeptr=false /home/REDACTED/wor-unreachable=false x_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.