Extract shared tag-scope-splitting helper in internal/difc/violations.go

[Copilot]

The semantic clustering analysis flagged one actionable item: formatIntegrityLevel and formatSecrecyLevel each reimplement the same :-suffix parsing of a Tag with different string primitives. Items 2 and 3 of the issue were explicitly marked "no action needed" and are untouched.

Changes

• internal/difc/violations.go
  • Adds unexported splitTagScope(tag Tag) (base, scope string).
  • formatIntegrityLevel uses it in place of inline strings.Index slicing.
  • formatSecrecyLevel uses it in place of strings.HasPrefix + TrimPrefix.
• internal/difc/format_functions_test.go — table-driven TestSplitTagScope covering no-scope, scoped, colon-in-scope, empty-scope, leading-colon, and empty-tag inputs.

func splitTagScope(tag Tag) (base, scope string) {
	s := string(tag)
	if idx := strings.Index(s, ":"); idx > 0 {
		return s[:idx], s[idx+1:]
	}
	return s, ""
}

Behavior preservation

Two edge cases in the original code are load-bearing and preserved:

• A leading colon (":all") is not a scope separator — idx > 0, so the tag is returned unsplit.
• "private:" (empty scope) is distinct from bare "private": only the latter sets hasPrivate. Since both yield scope == "", formatSecrecyLevel now disambiguates via string(tag) == "private".

Existing TestFormatIntegrityLevel / TestFormatSecrecyLevel are unchanged and serve as the regression check on output strings.

• Fixes [refactor] 🔧 Semantic Function Clustering Analysis #11413

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tool targets (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the catalog (23 read-only tools only). The backend is launched with GITHUB_READ_ONLY=1 by the gh-aw framework, so write tools are never registered. This confirms gh-aw's own defense-in-depth but cannot independently exercise the gateway's DIFC/guard enforcement layer. No writes leaked.

⚠️ Parts D/E: gh CLI was unauthenticated (GH_TOKEN unset). All REST and GraphQL write attempts returned "set the GH_TOKEN environment variable". The token-scope boundary could not be validated in this run. No writes leaked.

No FAIL conditions: zero writes succeeded.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all "unknown tool"	BLOCKED	⚠️
C	CLI	list_issues (github CLI)	data returned	ALLOWED	✅
C	CLI	get_file_contents (github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B — All 7 write targets were absent from the MCP tool catalog (backend launched with GITHUB_READ_ONLY=1; write tools never registered). No write leaked, but gateway-level DIFC enforcement could not be independently exercised — "unknown tool" proves backend configuration only. This is expected per the architectural note in the test plan.

⚠️ Parts D & E — gh CLI has no GH_TOKEN in this gVisor runtime environment. All REST write and GraphQL mutation attempts returned "set the GH_TOKEN environment variable" rather than a token-scope 403. The token-scope boundary is untestable in this run. No write succeeded or was attempted.

No writes leaked. The read-only guarantee held across all surfaces probed, though the gVisor run has the same authentication gap as other runtimes — the D/E boundary cannot be confirmed without a read-scoped token.

References: §32100925678

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B — All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the 23-tool catalog. The backend runs with GITHUB_READ_ONLY=1 (gh-aw unconditionally sets this for tools.github: workflows), so write tools are never registered. This confirms the backend's own defense-in-depth but does not confirm mcpg's independent gateway-level DIFC/guard enforcement layer — the write call never reaches a write-capable backend to be blocked by the gateway itself. Recorded as INCONCLUSIVE per test methodology.

⚠️ Parts D & E — gh is not authenticated in this environment (GH_TOKEN invalid). All CLI REST and GraphQL write attempts would return 401 for auth reasons, not gateway enforcement. These rows cannot validate the token-scope boundary for this run.

No writes leaked. Result: RESULT=INCONCLUSIVE RUNTIME=docker-sbx RUNID=32100925737

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

[Copilot]

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Balanced