[rust-guard] Deduplicate granular repo-write tool labeling and avoid repeated path scans in file secrecy checks by Copilot · Pull Request #3967 · github/gh-aw-mcpg

Copilot · 2026-04-16T18:25:50Z

tool_rules.rs had four adjacent match arms (21 tools total) implementing the same repo-scoped write labeling, and check_file_secrecy repeatedly re-scanned the same path string. This PR consolidates the duplicated labeling logic and reduces file-path traversal overhead in the secrecy check path.

Tool labeling: consolidate duplicate granular write arms
- Merged granular issue updates, sub-issue management, granular PR updates, and PR review tools into one match arm.
- Kept labeling semantics unchanged (S = S(repo), I = writer) while removing duplicated arm bodies.
File secrecy: split once, reuse segments
- check_file_secrecy now computes path segments once and reuses them for:
  - segment-level sensitive pattern checks
  - filename extraction
- Replaces repeated split('/') / rsplit('/') traversals with a single split pass.
Coverage update
- Added focused test coverage for granular PR update tools (update_pull_request_*) to lock in repo-scoped secrecy + writer-integrity behavior.

let path_lower = path.to_lowercase();
let segments: Vec<&str> = path_lower.split('/').collect();

for pattern in SENSITIVE_FILE_PATTERNS {
    if path_lower.ends_with(pattern) || segments.iter().any(|seg| seg.starts_with(*pattern)) {
        return policy_private_scope_label(owner, repo, repo_id, ctx);
    }
}

let filename = segments.last().copied().unwrap_or(path_lower.as_str());

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

example.com
- Triggering command: /tmp/go-build2652146382/b514/launcher.test /tmp/go-build2652146382/b514/launcher.test -test.testlogfile=/tmp/go-build2652146382/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true g_.a -I x_amd64/vet --gdwarf-5 metadata -o IKHi8OnZxBbc -E .cfg 0887644/b299/ 64/pkg/tool/linux_amd64/vet -I . -imultiarch 64/pkg/tool/linu-buildtags (dns block)
- Triggering command: /tmp/go-build1987576926/b514/launcher.test /tmp/go-build1987576926/b514/launcher.test -test.testlogfile=/tmp/go-build1987576926/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -gua�� -guard/target/debug/deps/rustcZYhlM6/symbols.o -guard/target/debug/deps/github_guard-57d41235e07a5585.0r6f2y9pmz8tylr32cgwnziux.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.0y8i0suihruczucboywd9kbz6.0d7kehr.rcgu.o -guard/target/degit -guard/target/deconfig -guard/target/deextensions.objectformat -guard/target/debug/deps/github_guard-57d41235e07a5585.1yg4dgf4ofc88gtczrpthgg1u.0d7kehr.rcgu.o -gua�� -guard/target/debug/deps/github_guard-57d41235e07a5585.2slqyghiy5vmlrtxer9j2lnp9.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.2z8afzdm9zucrirrh7hnf4z1l.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.34w8f3apoo4qlefxtp7qruodt.0d7kehr.rcgu.o -guard/target/de/tmp/go-build1987576926/b499/rules.test -guard/target/de-test.testlogfile=/tmp/go-build1987576926/b499/testlog.txt -guard/target/de-test.paniconexit0 -guard/target/de-test.timeout=10m0s (dns block)
invalid-host-that-does-not-exist-12345.com
- Triggering command: /tmp/go-build2652146382/b496/config.test /tmp/go-build2652146382/b496/config.test -test.testlogfile=/tmp/go-build2652146382/b496/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true rotocol/go-sdk@vgo1.25.8 -I x_amd64/vet --gdwarf-5 --64 -o x_amd64/vet -I g_.a 0887644/b299/ x_amd64/vet --gdwarf-5 v3 -o x_amd64/vet (dns block)
- Triggering command: /tmp/go-build1987576926/b496/config.test /tmp/go-build1987576926/b496/config.test -test.testlogfile=/tmp/go-build1987576926/b496/testlog.txt -test.paniconexit0 -test.timeout=10m0s /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o /home/REDACTED/work/gh-aw-mcpg/gh-aw-mcpg/guards/github-guard/rust-guard/target/debug/deps/github_guard-57d41235e07a5585 lib/�� lib/rustlib/x86_/home/REDACTED/work/gh-aw-mcpg/gh-aw-mcpg/guards/github-guard/rust-guard/target/de/opt/hostedtoolcache/go/1.25.8/x64/pkg/tool/linux_amd64/vet lib/rustlib/x86_/home/REDACTED/work/gh-aw-mcpg/gh-aw-mcpg/guards/github-guard/rust-guard/target/de/tmp/go-build4284444941/b490/vet.cfg lib/rustlib/x86_/home/REDACTED/work/gh-aw-mcpg/gh-aw-mcpg/guards/github-guard/rust-guard/target/de--check-cfg lib/rustlib/x86_/home/REDACTED/.rustup/toolchains/stable-x86_64-REDACTED-linux-gnu/lib/rustlib/x86_64-REDACTED-linux-gnu/bin/rust-lld lib/rustlib/x86_-flavor lib/rustlib/x86_gnu lib/rustlib/x86_-plugin (dns block)
nonexistent.local
- Triggering command: /tmp/go-build2652146382/b514/launcher.test /tmp/go-build2652146382/b514/launcher.test -test.testlogfile=/tmp/go-build2652146382/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true g_.a -I x_amd64/vet --gdwarf-5 metadata -o IKHi8OnZxBbc -E .cfg 0887644/b299/ 64/pkg/tool/linux_amd64/vet -I . -imultiarch 64/pkg/tool/linu-buildtags (dns block)
- Triggering command: /tmp/go-build1987576926/b514/launcher.test /tmp/go-build1987576926/b514/launcher.test -test.testlogfile=/tmp/go-build1987576926/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -gua�� -guard/target/debug/deps/rustcZYhlM6/symbols.o -guard/target/debug/deps/github_guard-57d41235e07a5585.0r6f2y9pmz8tylr32cgwnziux.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.0y8i0suihruczucboywd9kbz6.0d7kehr.rcgu.o -guard/target/degit -guard/target/deconfig -guard/target/deextensions.objectformat -guard/target/debug/deps/github_guard-57d41235e07a5585.1yg4dgf4ofc88gtczrpthgg1u.0d7kehr.rcgu.o -gua�� -guard/target/debug/deps/github_guard-57d41235e07a5585.2slqyghiy5vmlrtxer9j2lnp9.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.2z8afzdm9zucrirrh7hnf4z1l.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.34w8f3apoo4qlefxtp7qruodt.0d7kehr.rcgu.o -guard/target/de/tmp/go-build1987576926/b499/rules.test -guard/target/de-test.testlogfile=/tmp/go-build1987576926/b499/testlog.txt -guard/target/de-test.paniconexit0 -guard/target/de-test.timeout=10m0s (dns block)
slow.example.com
- Triggering command: /tmp/go-build2652146382/b514/launcher.test /tmp/go-build2652146382/b514/launcher.test -test.testlogfile=/tmp/go-build2652146382/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true g_.a -I x_amd64/vet --gdwarf-5 metadata -o IKHi8OnZxBbc -E .cfg 0887644/b299/ 64/pkg/tool/linux_amd64/vet -I . -imultiarch 64/pkg/tool/linu-buildtags (dns block)
- Triggering command: /tmp/go-build1987576926/b514/launcher.test /tmp/go-build1987576926/b514/launcher.test -test.testlogfile=/tmp/go-build1987576926/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -gua�� -guard/target/debug/deps/rustcZYhlM6/symbols.o -guard/target/debug/deps/github_guard-57d41235e07a5585.0r6f2y9pmz8tylr32cgwnziux.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.0y8i0suihruczucboywd9kbz6.0d7kehr.rcgu.o -guard/target/degit -guard/target/deconfig -guard/target/deextensions.objectformat -guard/target/debug/deps/github_guard-57d41235e07a5585.1yg4dgf4ofc88gtczrpthgg1u.0d7kehr.rcgu.o -gua�� -guard/target/debug/deps/github_guard-57d41235e07a5585.2slqyghiy5vmlrtxer9j2lnp9.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.2z8afzdm9zucrirrh7hnf4z1l.0d7kehr.rcgu.o -guard/target/debug/deps/github_guard-57d41235e07a5585.34w8f3apoo4qlefxtp7qruodt.0d7kehr.rcgu.o -guard/target/de/tmp/go-build1987576926/b499/rules.test -guard/target/de-test.testlogfile=/tmp/go-build1987576926/b499/testlog.txt -guard/target/de-test.paniconexit0 -guard/target/de-test.timeout=10m0s (dns block)
this-host-does-not-exist-12345.com
- Triggering command: /tmp/go-build2652146382/b523/mcp.test /tmp/go-build2652146382/b523/mcp.test -test.testlogfile=/tmp/go-build2652146382/b523/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true NHV5Q4M0b -I x_amd64/vet 0887644/b299/ .io/otel/sdk/tra--version -o x_amd64/vet .cfg�� aw-mcpg/internal/server/auth.go aw-mcpg/internal/server/circuit_-ifaceassert x_amd64/vet --gdwarf-5 --64 -o x_amd64/vet (dns block)
- Triggering command: /tmp/go-build1987576926/b523/mcp.test /tmp/go-build1987576926/b523/mcp.test -test.testlogfile=/tmp/go-build1987576926/b523/testlog.txt -test.paniconexit0 -test.timeout=10m0s /usr�� (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

… segments Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/2477f609-0fec-4df5-a908-631451c0f984 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot

Pull request overview

This PR refactors GitHub Guard (Rust) labeling rules to remove duplicated repo-scoped write labeling logic and optimizes check_file_secrecy by splitting the path once and reusing the segments, while adding tests to lock in labeling behavior for granular PR update tools.

Changes:

Consolidate multiple identical match arms for granular repo-scoped write tools into a single shared arm (same secrecy/integrity semantics).
Optimize check_file_secrecy by reusing pre-split, lowercased path segments instead of repeatedly splitting/traversing the path.
Add unit test coverage for granular PR update tools to ensure repo-scoped secrecy + writer-integrity behavior.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Deduplicates granular repo write labeling match arms and reduces repeated path scanning in `check_file_secrecy`.
guards/github-guard/rust-guard/src/labels/mod.rs	Adds unit test for granular `update_pull_request_*` tools’ integrity/secrecy labeling.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 1

Copilot · 2026-04-16T18:48:15Z

+            assert_eq!(secrecy, vec![] as Vec<String>, "{tool} secrecy mismatch");
+            assert_eq!(integrity, writer_integrity(repo_id, &ctx), "{tool} should have writer integrity");
+        }


The failure messages use the literal string "{tool} ..."; assert_eq! won’t interpolate {tool} unless you pass it as a format argument. Consider using a formatted message (e.g., include tool as an argument) so failures clearly identify which tool name mismatched.

Address review feedback: replace implicit named captures ({tool}) with explicit format arguments ({}, tool) in assert_eq! failure messages for granular PR update and PR review tool tests. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ch-arms

Initial plan

a7eba3e

Copilot AI assigned Copilot and lpcox Apr 16, 2026

Copilot started work on behalf of lpcox April 16, 2026 18:25 View session

Copilot AI linked an issue Apr 16, 2026 that may be closed by this pull request

[rust-guard] Rust Guard: Consolidate duplicate granular-write match arms and fix redundant path splitting #3935

Closed

fix(rust-guard): deduplicate granular write rules and reuse file path…

7019605

… segments Agent-Logs-Url: https://github.com/github/gh-aw-mcpg/sessions/2477f609-0fec-4df5-a908-631451c0f984 Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Consolidate duplicate granular-write match arms and fix path splitting~~ [rust-guard] Deduplicate granular repo-write tool labeling and avoid repeated path scans in file secrecy checks Apr 16, 2026

Copilot finished work on behalf of lpcox April 16, 2026 18:36

Copilot AI requested a review from lpcox April 16, 2026 18:36

lpcox marked this pull request as ready for review April 16, 2026 18:45

Copilot AI review requested due to automatic review settings April 16, 2026 18:45

Copilot started reviewing on behalf of lpcox April 16, 2026 18:45 View session

Copilot AI reviewed Apr 16, 2026

View reviewed changes

lpcox and others added 2 commits April 16, 2026 12:14

Merge branch 'main' into copilot/rust-guard-consolidate-duplicate-mat…

096a0a6

…ch-arms

lpcox merged commit 1b1af3a into main Apr 16, 2026
16 checks passed

lpcox deleted the copilot/rust-guard-consolidate-duplicate-match-arms branch April 16, 2026 19:26

This was referenced Apr 16, 2026

Smoke Test: Copilot - 24529686597 #3979

Closed

Smoke Test: Copilot - 24529765688 #3981

Closed

Guards and Integrity: tracking issue #1711

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[rust-guard] Deduplicate granular repo-write tool labeling and avoid repeated path scans in file secrecy checks#3967

[rust-guard] Deduplicate granular repo-write tool labeling and avoid repeated path scans in file secrecy checks#3967
lpcox merged 4 commits intomainfrom
copilot/rust-guard-consolidate-duplicate-match-arms

Copilot AI commented Apr 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Apr 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

I tried to connect to the following addresses, but was blocked by firewall rules:

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

Copilot AI Apr 16, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Apr 16, 2026 •

edited

Loading