fix: map author_association NONE to unapproved integrity

[lpcox]

Summary

Maps GitHub author_association: NONE to unapproved integrity instead of none.

Problem

GitHub's author_association enum value NONE means "Author has no association with the repository" (docs). This is intentionally vague and does not mean the user is established or trustworthy — only that they are not FIRST_TIMER.

Previously, the guard mapped NONE to the lowest integrity level (none), identical to FIRST_TIMER ("Author has not previously committed to GitHub" — a brand-new account). This incorrectly treated users with existing GitHub activity the same as completely new accounts.

Changes

Rust guard (core logic)

• author_association_floor_from_str in helpers.rs: Added "NONE" to the unapproved match arm alongside CONTRIBUTOR and FIRST_TIME_CONTRIBUTOR
• Added dedicated test_author_association_none_maps_to_unapproved test
• Updated 10 existing tests that used "NONE" and expected none_integrity() → now expect reader_integrity()

Documentation

• INTEGRITY_TAG_SPEC.md: Updated Author Association Initialization section with rationale table, GitHub API links, and clear note that NONE does not mean established
• INTEGRITY_TAG_SPEC.md: Updated resource/response label rule tables to distinguish NONE (unapproved) from FIRST_TIMER (none)
• TESTING.md: Updated author_association mapping documentation to move NONE from the none group to unapproved

Go test fix (pre-existing)

• flags_test.go: Fixed TestRegisterFlagCompletions tests that checked flag.Annotations (not populated by RegisterFlagCompletionFunc) — now uses GetFlagCompletionFunc to verify completions

Mapping (after this change)

author_association	Integrity Level	Rationale
OWNER, MEMBER, COLLABORATOR	approved	Known repo contributors
CONTRIBUTOR, FIRST_TIME_CONTRIBUTOR, NONE	unapproved	Not brand-new to GitHub, no special repo relationship
FIRST_TIMER, unknown/missing	none	Brand-new GitHub accounts or unrecognized values

Closes #4419

[Copilot]

Pull request overview

Adjusts GitHub Guard integrity labeling to treat author_association: NONE as unapproved integrity (rather than none), aligning behavior with GitHub’s semantics and preventing established-but-new-to-repo contributors from being overly filtered.

Changes:

• Update Rust guard author-association mapping so NONE maps to unapproved (reader integrity) and add a focused regression test.
• Update Rust labeling tests to reflect the new NONE → unapproved behavior across issue/PR/commit scenarios.
• Update documentation to clarify the rationale and tables for NONE vs FIRST_TIMER, and fix a Go flag-completion test to validate completion functions via Cobra APIs.

Show a summary per file

File	Description
internal/cmd/flags_test.go	Fixes completion tests to assert via GetFlagCompletionFunc instead of flag annotations.
guards/github-guard/rust-guard/src/labels/helpers.rs	Changes author_association mapping (NONE → reader) and adds a dedicated unit test.
guards/github-guard/rust-guard/src/labels/mod.rs	Updates expectations/comments in label/integrity tests for NONE → reader integrity.
guards/github-guard/docs/INTEGRITY_TAG_SPEC.md	Updates spec mapping tables and adds rationale clarifying NONE vs FIRST_TIMER.
guards/github-guard/docs/TESTING.md	Updates testing documentation to match new mapping and explain rationale.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 5/5 changed files
• Comments generated: 1