fix: add write-sink guard policies for non-GitHub MCP servers on auto-lockdown#21342

Merged

lpcox merged 6 commits intomainfrom

copilot/fix-write-sink-guard-policies

Mar 17, 2026

Commits on Mar 17, 2026

Initial plan
Copilot
committed
fix: add write-sink guard policies for non-GitHub MCP servers when auto-lockdown is used

Copilot
and
lpcox
committed
Merge branch 'main' into copilot/fix-write-sink-guard-policies
pelikhan
authored
test: add TestAllNonGitHubMCPServersGetWriteSinkWhenGitHubHasAllowOnly for explicit allow-only guard policies

Copilot
and
lpcox
committed
fix: update docstring and log messages for deriveWriteSinkGuardPolicyFromWorkflow auto-lockdown case

Copilot
and
lpcox
committed
fix: replace whitespace-sensitive unexpectedInServer checks with regex patterns

Copilot
and
lpcox
committed