[Repo Assist] fix(rust-guard): eliminate scopes.clone() in label_agent + add DIFC_MODE constant

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Addresses the two improvements raised in #4008.

Changes

1. Eliminate scopes.clone() in label_agent

PolicyContext was constructed before secrecy, token, and scope_kind were computed, forcing an unnecessary scopes.clone(). The fix reorders the computation so that scope-derived values are extracted while scopes is still owned, then scopes is moved directly into ctx.

PolicyScopeEntry contains three heap-allocated String fields (scope_owner, scope_repo, scope_label). Eliminating the Vec<PolicyScopeEntry> clone removes one heap allocation per label_agent call — a meaningful saving in the WASM bump-allocator environment.

2. Add DIFC_MODE constant

Replaces the magic string literal "filter" and its single-use let difc_mode = "filter" binding with a named constant DIFC_MODE declared alongside POLICY_SCOPE_ALL and POLICY_SCOPE_PUBLIC at the top of lib.rs. This matches the existing convention and makes the value self-documenting and searchable.

Test Status

All 308 Rust unit tests pass:

test result: ok. 308 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

Go build and tests are blocked by a pre-existing infrastructure issue (proxy.golang.org firewall block prevents Go 1.25.0 toolchain download) — not caused by this change.

Closes #4008

Warning

⚠️ Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Repo Assist · ● 4.1M · ◷

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

Pull request overview

Optimizes the Rust GitHub guard’s label_agent by removing an unnecessary clone and replaces a DIFC mode magic string with a named constant.

Changes:

• Reordered label_agent logic to compute scope-derived values before moving scopes into PolicyContext, eliminating scopes.clone().
• Introduced a DIFC_MODE constant and used it in the output instead of a local "filter" string literal.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/lib.rs	Removes scopes.clone() via reordering and adds DIFC_MODE constant to replace a magic string.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0