fix: URL-based fallback for search result number and repo extraction

[lpcox]

Problem

Search results from the MCP gateway were getting filtered with none integrity because items lacked number and base.repo.full_name fields that the guard needs for per-item integrity labeling and enrichment.

Symptoms:

• search_issues: items labeled issue:github/gh-aw-mcpg#unknown with integrity: ["none:github"]
• search_pull_requests: items labeled pr:#unknown with integrity: ["none"]

Root Cause

1. Missing number field: extract_resource_number() only checked item.number — search result items from the MCP server may not include this field directly
2. Missing repo for PRs: response_items.rs PR handler only checked base.repo.full_name / head.repo.full_name — search results don't have this structure
3. Blocked enrichment: Without a number, REST enrichment calls couldn't proceed, leaving items with empty integrity
4. No tool_args fallback: search tools didn't check owner/repo in tool_args when query string extraction failed

Changes

helpers.rs — URL-based fallback extraction

• extract_resource_number(): Falls back to parsing html_url/url for trailing number (e.g. .../issues/2093 → 2093)
• New extract_number_from_url() helper
• pr_integrity() / issue_integrity(): Enrichment now uses URL-based number fallback

response_items.rs — PR repo fallback

• PR items now fall back to extract_repo_from_item() (parses repository_url, html_url) when base/head repo info is missing

tool_rules.rs — Search scope from tool_args

• Both search_issues and search_pull_requests now check owner/repo in tool_args as fallback when query extraction fails

Tests

• 8 new tests (154 total, all passing)
• URL-based number extraction (direct, html_url, api url, preference, unknown)
• PR search with repository_url fallback (items + paths)
• Issue search URL number fallback

Validation

repo-assist workflow configured to build local container image for end-to-end testing.

[Copilot]

Pull request overview

This PR addresses missing per-item integrity labeling for GitHub search results returned by the MCP gateway by adding fallbacks to derive issue/PR numbers and repository identity when key fields are absent.

Changes:

• Add URL-based number extraction fallback (html_url / url) for issue/PR labeling and backend enrichment.
• Add repository extraction fallback for PR search results when base/head repo info is missing.
• Add tool_args (owner/repo) fallback for determining repo scope in search_issues / search_pull_requests tool labeling.
• Update repo-assist lock workflow to build and run a local gateway container image for validation.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/helpers.rs	Adds URL-based fallback to extract issue/PR numbers and use it for enrichment.
guards/github-guard/rust-guard/src/labels/response_items.rs	Adds PR repo fallback extraction for search results missing base/head repo fields.
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Adds repo-scope fallback for search tools using owner/repo from tool_args.
guards/github-guard/rust-guard/src/labels/mod.rs	Adds unit tests covering new URL/repo extraction behavior.
.github/workflows/repo-assist.lock.yml	Builds and uses a :local container image for end-to-end workflow validation.

Comments suppressed due to low confidence (1)

guards/github-guard/rust-guard/src/labels/tool_rules.rs:252

• Same issue as search_issues: this branch scopes labels to s_repo_id but leaves baseline_scope and repo_private tied to the initial tool_args-derived repo context. If repo scope is extracted from the query (or tool_args omit owner/repo), ensure_integrity_baseline may strip the scoped integrity and private repos may not receive writer integrity. Recommend setting baseline_scope = s_repo_id.clone() when available and deriving repo_private from s_owner/s_repo for the private-writer check.

            if !s_repo_id.is_empty() {
                desc = format!("search_pull_requests:{}", s_repo_id);
                secrecy =
                    apply_repo_visibility_secrecy(&s_owner, &s_repo, &s_repo_id, secrecy, ctx);
                integrity = private_writer_integrity(&s_repo_id, repo_private, ctx);

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

In this search_issues branch, integrity/secrecy are scoped to s_repo_id, but baseline_scope and repo_private are still derived from the top-level repo_id / tool_args owner+repo. If the repo scope comes from the query (or differs from tool_args), ensure_integrity_baseline can downgrade scoped integrity to none:*, and private repos may incorrectly get empty integrity. Consider setting baseline_scope = s_repo_id.clone() when present and computing repo_private using s_owner/s_repo for the private-writer decision.

This issue also appears on line 248 of the same file.

See below for a potential fix:

            // Only reuse the top-level repo_private flag when the scoped repo_id matches.
            let scoped_repo_private = if !s_repo_id.is_empty() && s_repo_id == repo_id {
                repo_private
            } else {
                false
            };
            if !s_repo_id.is_empty() {
                desc = format!("search_issues:{}", s_repo_id);
                secrecy =
                    apply_repo_visibility_secrecy(&s_owner, &s_repo, &s_repo_id, secrecy, ctx);
                integrity = private_writer_integrity(&s_repo_id, scoped_repo_private, ctx);

[Copilot]

This workflow step installs Rust via curl https://sh.rustup.rs | sh and uses an unpinned stable toolchain. That makes the build less reproducible and increases supply-chain risk for the CI environment. Prefer using a pinned toolchain version (e.g., via dtolnay/rust-toolchain/actions-rs/toolchain) and avoiding piping curl directly into a shell (or verifying the installer/signature).

Suggested change

	- name: Build local container image
	run: |
	# Install Rust toolchain for WASM guard build
	curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
	source "$HOME/.cargo/env"
	rustup target add wasm32-wasip1
	- name: Install Rust toolchain
	uses: actions-rs/toolchain@v1
	with:
	toolchain: 1.76.0
	target: wasm32-wasip1
	default: true
	profile: minimal
	- name: Build local container image
	run: |