[rust-guard] Remove static-string allocations in guard outputs and add response path labeling coverage

[Copilot]

This PR addresses two gaps in the Rust guard: avoid per-call heap allocation for output fields that are always static literals, and add direct unit coverage for high-impact label_response_paths branches (search_repositories, list_pull_requests, query-scoped search_issues, and unknown-tool fallback).

• Static output fields: String → &'static str (allocation removal)

  • Updated LabelResourceOutput::operation and LabelAgentOutput::difc_mode to &'static str.
  • Removed redundant .to_string() at construction sites in label_resource and label_agent.

• Response path labeling tests (new coverage in response_paths.rs)

  • Added tests to verify:
    • private vs public secrecy behavior for search_repositories
    • merged-integrity assignment for merged PRs in list_pull_requests
    • repo-scope extraction from repo: query qualifier for search_issues
    • None result for unknown tools

• Representative change

  #[derive(Debug, Serialize)]
  struct LabelAgentOutput {
      agent: AgentLabels,
      difc_mode: &'static str,
      normalized_policy: NormalizedPolicy,
  }
  
  let output = LabelAgentOutput {
      agent: AgentLabels { secrecy, integrity },
      difc_mode: DIFC_MODE,
      normalized_policy,
  };

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build1015159776/b513/launcher.test /tmp/go-build1015159776/b513/launcher.test -test.testlogfile=/tmp/go-build1015159776/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1015159776/b431/vet.cfg 1.80.0/health/grpc_health_v1/health.pb.go 1.80.0/health/grpc_health_v1/health_grpc.pb.go x_amd64/vet -p base -lang=go1.25 x_amd64/vet -I g_.a 999199174/b287//-ifaceassert x_amd64/vet --gdwarf-5 ernal/middleware-atomic 9199174/b287/ x_amd64/vet (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build1015159776/b495/config.test /tmp/go-build1015159776/b495/config.test -test.testlogfile=/tmp/go-build1015159776/b495/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1015159776/b388/vet.cfg @v1.1.3/cpu/arm/go1.25.9 9199174/b151/ x_amd64/vet -p nal/impl -lang=go1.25 x_amd64/vet 9199�� g_.a -I x_amd64/vet --gdwarf-5 64 -o x_amd64/vet (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build1015159776/b513/launcher.test /tmp/go-build1015159776/b513/launcher.test -test.testlogfile=/tmp/go-build1015159776/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1015159776/b431/vet.cfg 1.80.0/health/grpc_health_v1/health.pb.go 1.80.0/health/grpc_health_v1/health_grpc.pb.go x_amd64/vet -p base -lang=go1.25 x_amd64/vet -I g_.a 999199174/b287//-ifaceassert x_amd64/vet --gdwarf-5 ernal/middleware-atomic 9199174/b287/ x_amd64/vet (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build1015159776/b513/launcher.test /tmp/go-build1015159776/b513/launcher.test -test.testlogfile=/tmp/go-build1015159776/b513/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build1015159776/b431/vet.cfg 1.80.0/health/grpc_health_v1/health.pb.go 1.80.0/health/grpc_health_v1/health_grpc.pb.go x_amd64/vet -p base -lang=go1.25 x_amd64/vet -I g_.a 999199174/b287//-ifaceassert x_amd64/vet --gdwarf-5 ernal/middleware-atomic 9199174/b287/ x_amd64/vet (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build1015159776/b522/mcp.test /tmp/go-build1015159776/b522/mcp.test -test.testlogfile=/tmp/go-build1015159776/b522/testlog.txt -test.paniconexit0 -test.timeout=10m0s -I .cfg om/spf13/cobra@v1.10.2/args.go x_amd64/vet --gdwarf-5 g/grpc/resolver -o x_amd64/vet .cfg�� 9199174/b394/_pkg_.a -importpath x_amd64/vet -ldflags="-O2" "bash g/grpc/internal//usr/bin/runc -I x_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR improves the Rust GitHub guard by eliminating per-call heap allocations for output fields that are always static literals, and by adding targeted unit tests for high-impact label_response_paths branches to increase confidence in response labeling behavior.

Changes:

• Change LabelResourceOutput.operation and LabelAgentOutput.difc_mode from String to &'static str, and remove now-unneeded .to_string() calls.
• Add unit tests covering label_response_paths behavior for search_repositories, list_pull_requests, query-scoped search_issues, and unknown-tool fallback.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/lib.rs	Removes unnecessary heap allocations by switching static output fields to &'static str and simplifying construction sites.
guards/github-guard/rust-guard/src/labels/response_paths.rs	Adds direct unit coverage for key response-path labeling branches and fallback behavior.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0