Skip to content

[test] Add tests for proxy.seedEnclaveAssignedRepositorySecrecy - #11994

Merged
lpcox merged 3 commits into
mainfrom
test-coverage-seedEnclaveAssignedRepositorySecrecy-3910390e706c94fb
Aug 28, 2026
Merged

[test] Add tests for proxy.seedEnclaveAssignedRepositorySecrecy#11994
lpcox merged 3 commits into
mainfrom
test-coverage-seedEnclaveAssignedRepositorySecrecy-3910390e706c94fb

Conversation

@github-actions

Copy link
Copy Markdown
Contributor

Test Coverage Improvement: seedEnclaveAssignedRepositorySecrecy

Function Analyzed

  • Package: internal/proxy
  • Function: Server.seedEnclaveAssignedRepositorySecrecy
  • Previous Coverage: 75.0%
  • New Coverage: 100.0%
  • Complexity: Medium (branching on policy lookup result + sensitivity value, with a mutation side-effect on shared agent registry state)

Why This Function?

The overall test suite currently passes (integration tests fail only due to the awmg binary not being pre-built in this environment, not code issues). Scanning go tool cover -func output for non-test, non-trivial functions with partial coverage, seedEnclaveAssignedRepositorySecrecy stood up as a good target with 75% coverage:

  • It has three distinct outcomes (repo not in policy, public-sensitivity repo, confidential/private-sensitivity repo) but was only exercised indirectly through end-to-end enclave request tests, leaving the "no sensitivity entry" and "public sensitivity" early-return branches untested in isolation.
  • It mutates shared DIFC agent-label state (AgentRegistry.GetOrCreate(...).AddSecrecyTag(...)), which is security-relevant (it controls secrecy propagation for cross-repo enclave access) and worth pinning down with direct unit tests rather than relying only on indirect coverage from handler-level tests.

Tests Added

  • ✅ Confidential-sensitivity repo: correctly adds a private:<repo> secrecy tag to the agent's labels
  • ✅ Public-sensitivity repo: no tag added, and — since the function returns before calling GetOrCreate — no agent labels are created at all
  • ✅ Repo absent from the policy's repository list: same early-return behavior as public sensitivity (no tag, no agent labels created)
  • ✅ Multi-call accumulation: calling the function multiple times for the same agent across different confidential repos accumulates all expected secrecy tags without duplication issues

Tests use table-driven subtests (TestSeedEnclaveAssignedRepositorySecrecy) plus a dedicated accumulation test, following existing conventions in internal/proxy/enclave_test.go and using difc.NewAgentRegistry() / enclavegithub.ParsePolicy() directly to keep the tests focused and independent of HTTP handler plumbing.

Coverage Report

Before: 75.0% coverage (seedEnclaveAssignedRepositorySecrecy)
After:  100.0% coverage (seedEnclaveAssignedRepositorySecrecy)
Improvement: +25.0%

Test Execution

=== RUN   TestSeedEnclaveAssignedRepositorySecrecy
=== RUN   TestSeedEnclaveAssignedRepositorySecrecy/confidential_repo_adds_private_secrecy_tag
=== RUN   TestSeedEnclaveAssignedRepositorySecrecy/public_repo_does_not_add_a_secrecy_tag
=== RUN   TestSeedEnclaveAssignedRepositorySecrecy/repo_not_present_in_policy_does_not_add_a_secrecy_tag
--- PASS: TestSeedEnclaveAssignedRepositorySecrecy (0.00s)
    --- PASS: TestSeedEnclaveAssignedRepositorySecrecy/confidential_repo_adds_private_secrecy_tag (0.00s)
    --- PASS: TestSeedEnclaveAssignedRepositorySecrecy/public_repo_does_not_add_a_secrecy_tag (0.00s)
    --- PASS: TestSeedEnclaveAssignedRepositorySecrecy/repo_not_present_in_policy_does_not_add_a_secrecy_tag (0.00s)
=== RUN   TestSeedEnclaveAssignedRepositorySecrecy_AccumulatesAcrossCalls
--- PASS: TestSeedEnclaveAssignedRepositorySecrecy_AccumulatesAcrossCalls (0.00s)
PASS
ok  	github.com/github/gh-aw-mcpg/internal/proxy	0.013s

gofmt -l, go vet ./internal/proxy/..., and go build ./... all pass cleanly on the changed file.


Generated by Test Coverage Improver
Next run will target the next most complex under-tested function

Generated by Test Coverage Improver · auto · 71 AIC · ⊞ 10.6K ·

Adds table-driven tests covering all branches of
Server.seedEnclaveAssignedRepositorySecrecy: confidential repo sensitivity
(adds private secrecy tag), public sensitivity (no tag added, no agent
labels created), and repos absent from policy (no tag added, no agent
labels created). Also adds a test verifying secrecy tags accumulate
correctly across multiple calls for the same agent across different repos.

Coverage for this function improves from 75.0% to 100.0%.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@lpcox
lpcox marked this pull request as ready for review August 28, 2026 02:57
Copilot AI balanced review requested due to automatic review settings August 28, 2026 02:57

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds focused unit coverage for enclave repository secrecy seeding.

Changes:

  • Tests confidential, public, and absent policy entries.
  • Tests secrecy-tag accumulation across repeated calls.
Show a summary per file
File Description
internal/proxy/enclave_test.go Adds direct secrecy-seeding tests.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

  • Files reviewed: 1/1 changed files
  • Comments generated: 1
  • Review effort level: Balanced

Comment thread internal/proxy/enclave_test.go Outdated
@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@lpcox

lpcox commented Aug 28, 2026

Copy link
Copy Markdown
Collaborator

Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
@github-actions

This comment has been minimized.

@github-actions

This comment has been minimized.

Copilot AI commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

@copilot fix failing lint ci check https://github.com/github/gh-aw-mcpg/actions/runs/33137934452/job/98742067254?pr=11994

Fixed the gofmt lint failure by correcting indentation in internal/proxy/enclave_test.go. Commit 643d6ff; targeted tests and make agent-finished now pass.

@github-actions

This comment has been minimized.

Copilot AI requested a review from lpcox August 28, 2026 03:13
@github-actions

Copy link
Copy Markdown
Contributor Author

🔒 mcpg Read-Only Stress — gvisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part Surface Op Result Expected Status
A MCP reads (issues/PRs/file/commits) data returned ALLOWED
B MCP writes (reaction/star/issue/comment/branch/file/PR) all tools absent from catalog BLOCKED ⚠️
C CLI reads (list_issues, get_file_contents) data returned ALLOWED
D CLI REST writes (reaction/star/issue/comment/file) gh unauthenticated BLOCKED ⚠️
E CLI GraphQL mutations (addReaction/addStar/createIssue) gh unauthenticated BLOCKED ⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools were absent from the MCP catalog (unknown tool [-32602]). The backend was launched with GITHUB_READ_ONLY=1 (gh-aw framework guarantee), so write tools were never registered. No write leaked, but gateway-level DIFC/guard enforcement could not be independently confirmed via this surface.

⚠️ Parts D & E: gh is not authenticated (GH_TOKEN not set). All REST and GraphQL write attempts returned unauthenticated errors — cannot distinguish gateway blocking from missing credentials. Token-scope boundary not validated in this run.

No writes leaked. No security regression detected.

References: §33138114864

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

@github-actions

Copy link
Copy Markdown
Contributor Author

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part Surface Op Result Expected Status
A MCP reads (issues/PRs/file/commits) data returned ALLOWED
B MCP writes (reaction/star/issue/comment/branch/file/PR) tools absent from catalog BLOCKED ⚠️
C CLI reads (list issues, get file) data returned ALLOWED
D CLI REST writes (reaction/star/issue/comment/file) gh unauthenticated BLOCKED ⚠️
E CLI GraphQL mutations (addReaction/addStar/createIssue) gh unauthenticated BLOCKED ⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools absent from MCP catalog. Backend runs GITHUB_READ_ONLY=1 (gh-aw unconditionally sets this for tools.github: workflows), so write tools are never registered. Confirms backend defense-in-depth, but does not independently confirm mcpg's own DIFC/guard enforcement. Recorded as INCONCLUSIVE per test plan.

⚠️ Parts D & E: gh CLI not authenticated (gh auth status → "not logged into any GitHub hosts"). All REST/GraphQL write probes are INCONCLUSIVE — 401s would not confirm gateway blocking.

No writes succeeded. All reads passed.

References: §33138114844

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

@github-actions

Copy link
Copy Markdown
Contributor Author

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part Surface Op Result Expected Status
A MCP reads (list_issues/PRs, get_file_contents, list_commits) data returned ALLOWED
B MCP writes (reaction/star/issue/comment/branch/file/PR) all 7 tools absent from catalog BLOCKED ⚠️
C CLI reads (list_issues, get_file_contents) data returned ALLOWED
D CLI REST writes (reaction/star/issue/comment/file) 401 Bad credentials BLOCKED ⚠️
E CLI GraphQL mutations (addReaction/addStar/createIssue) 401 Bad credentials BLOCKED ⚠️

Overall: INCONCLUSIVE — No writes leaked. No FAIL conditions observed.

Gaps (all ⚠️ INCONCLUSIVE):

  • Part B: All 7 write tools absent from MCP catalog — confirms GITHUB_READ_ONLY=1 framework defense (backend never registers write tools). Gateway-level DIFC enforcement could not be independently confirmed since no write-capable call ever reached the proxy layer.
  • Parts D/E: gh CLI has invalid credentials (HTTP 401 on all requests). Cannot confirm token-scope write-blocking boundary. A valid read-only token is needed to test that REST/GraphQL writes are rejected with 403 rather than 401.

MCP tool catalog (23 tools, all read-only): get_commit, get_file_contents, get_label, get_latest_release, get_release_by_tag, get_tag, issue_read, list_branches, list_commits, list_issue_fields, list_issue_types, list_issues, list_pull_requests, list_releases, list_repository_collaborators, list_starred_repositories, list_tags, pull_request_read, search_code, search_commits, search_issues, search_pull_requests, search_repositories

References: §33138114818

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

@lpcox
lpcox merged commit e7d839a into main Aug 28, 2026
37 checks passed
@lpcox
lpcox deleted the test-coverage-seedEnclaveAssignedRepositorySecrecy-3910390e706c94fb branch August 28, 2026 04:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants