rust-guard: deduplicate search-query-fallback blocks and merge blocked-tool match arms

[Copilot]

Two instances of code duplication in the rust-guard labels subsystem: a 7-line "extract repo from tool args, fall back to repo: in search query" block repeated 4× across response_items.rs and response_paths.rs, and two consecutive match arms in tool_rules.rs with identical bodies.

Changes

• helpers.rs — adds pub(crate) fn extract_repo_scope_with_query_fallback(tool_args: &Value) -> (String, String, String): canonical implementation of the owner/repo extraction with query fallback

• response_items.rs / response_paths.rs — replaces 4 inline copies with a single call:

  // Before (×4):
  let (mut arg_owner, mut arg_repo, mut arg_repo_full) = extract_repo_info(tool_args);
  if arg_owner.is_empty() || arg_repo.is_empty() {
      let query = tool_args.get("query").and_then(|v| v.as_str()).unwrap_or("");
      let (q_owner, q_repo, q_repo_id) = extract_repo_info_from_search_query(query);
      if !q_repo_id.is_empty() {
          arg_owner = q_owner; arg_repo = q_repo; arg_repo_full = q_repo_id;
      }
  }
  
  // After (×4):
  let (arg_owner, arg_repo, arg_repo_full) = extract_repo_scope_with_query_fallback(tool_args);

• tool_rules.rs — merges "transfer_repository" and "archive_repository" | "unarchive_repository" | "rename_repository" into one arm; both called apply_repo_visibility_secrecy with identical arguments under the same policy rationale

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build2886625906/b514/launcher.test /tmp/go-build2886625906/b514/launcher.test -test.testlogfile=/tmp/go-build2886625906/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s 8536�� .cfg /tmp/go-build235-ifaceassert x_amd64/vet . telabs/wazero/ininfo --64 x_amd64/vet -I .cfg elemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0/internal/otlpconfig/options.go x_amd64/vet --gdwarf-5 g/protobuf/encodinfo -o x_amd64/vet (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build2886625906/b496/config.test /tmp/go-build2886625906/b496/config.test -test.testlogfile=/tmp/go-build2886625906/b496/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build2886625906/b385/vet.cfg g_.a om/go-logr/logr@-c=4 x_amd64/vet /tmp/go-build235/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet ternal/engine/wa-atomic x86_64-linux-gnu-bool x_amd64/vet -I 7xwaangNM -I x_amd64/vet --gdwarf-5 8536374/b239/ -o x_amd64/vet (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build2886625906/b514/launcher.test /tmp/go-build2886625906/b514/launcher.test -test.testlogfile=/tmp/go-build2886625906/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s 8536�� .cfg /tmp/go-build235-ifaceassert x_amd64/vet . telabs/wazero/ininfo --64 x_amd64/vet -I .cfg elemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0/internal/otlpconfig/options.go x_amd64/vet --gdwarf-5 g/protobuf/encodinfo -o x_amd64/vet (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build2886625906/b514/launcher.test /tmp/go-build2886625906/b514/launcher.test -test.testlogfile=/tmp/go-build2886625906/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s 8536�� .cfg /tmp/go-build235-ifaceassert x_amd64/vet . telabs/wazero/ininfo --64 x_amd64/vet -I .cfg elemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0/internal/otlpconfig/options.go x_amd64/vet --gdwarf-5 g/protobuf/encodinfo -o x_amd64/vet (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build2886625906/b523/mcp.test /tmp/go-build2886625906/b523/mcp.test -test.testlogfile=/tmp/go-build2886625906/b523/testlog.txt -test.paniconexit0 -test.timeout=10m0s .cfg�� 8536374/b351/_pkg_.a -I x_amd64/vet --gdwarf-5 g/grpc/internal//usr/bin/runc -o x_amd64/vet .cfg�� wwMF/PIk94C_Qa7ObsBMvwwMF pkg/mod/github.com/santhosh-teku-ifaceassert x_amd64/vet . --gdwarf2 --64 x_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Refactors the rust-guard labels subsystem to remove small but repeated repo-scope extraction logic and to consolidate identical tool-label match arms, reducing duplication while keeping labeling behavior consistent.

Changes:

• Added a shared helper (extract_repo_scope_with_query_fallback) to centralize “owner/repo from args, else repo: in query” resolution.
• Replaced four duplicated inline fallback blocks in response labeling with calls to the new helper.
• Merged multiple blocked repository-operation match arms in tool_rules.rs into a single arm with a shared implementation.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/helpers.rs	Introduces a canonical helper for extracting repo scope with search-query fallback.
guards/github-guard/rust-guard/src/labels/response_items.rs	Replaces duplicated repo-extraction + query-fallback logic with the new helper.
guards/github-guard/rust-guard/src/labels/response_paths.rs	Same deduplication as response_items.rs for the path-based labeling implementation.
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Consolidates identical blocked-repo-operation match arms into one arm.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 0