[Repo Assist] refactor(rust-guard): use policy_integrity constants and add security-tool label tests#6466
Conversation
…-tool tests Replace magic string literals in helpers.rs with policy_integrity::NONE and policy_integrity::APPROVED constants from constants.rs, making the defaults consistent with all other uses of these constants. Add three new unit tests in tool_rules.rs covering the security-sensitive apply_tool_labels arms (secret scanning, code scanning + Dependabot, job logs) that must unconditionally produce private: secrecy regardless of repo visibility. These arms had zero test coverage despite being security-critical. Closes #6458 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR updates the Rust guard’s labeling logic to improve consistency and add regression coverage for security-sensitive tool labeling, addressing #6458.
Changes:
- Refactors
helpers.rsto usepolicy_integrityconstants (NONE,APPROVED) instead of string literals for default integrity levels. - Adds unit tests in
tool_rules.rsto ensure certain security-related tools always receive private secrecy labels and writer-level integrity.
Show a summary per file
| File | Description |
|---|---|
| guards/github-guard/rust-guard/src/labels/tool_rules.rs | Adds new unit tests covering security-sensitive apply_tool_labels match arms (secret scanning, code scanning/Dependabot, job logs). |
| guards/github-guard/rust-guard/src/labels/helpers.rs | Replaces magic default integrity strings with policy_integrity constants for consistency. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 3
| assert!( | ||
| secrecy.iter().any(|s| s.starts_with("private:")), | ||
| "{tool}: expected private secrecy label, got {secrecy:?}", | ||
| ); | ||
| assert!( | ||
| integrity.iter().any(|s| s.starts_with("approved:")), | ||
| "{tool}: expected writer-level (approved) integrity, got {integrity:?}", | ||
| ); |
| assert!( | ||
| secrecy.iter().any(|s| s.starts_with("private:")), | ||
| "{tool}: expected private secrecy label, got {secrecy:?}", | ||
| ); | ||
| assert!( | ||
| integrity.iter().any(|s| s.starts_with("approved:")), | ||
| "{tool}: expected writer-level (approved) integrity, got {integrity:?}", | ||
| ); |
| assert!( | ||
| secrecy.iter().any(|s| s.starts_with("private:")), | ||
| "get_job_logs: expected private secrecy label (CI logs may contain tokens), got {secrecy:?}", | ||
| ); | ||
| assert!( | ||
| integrity.iter().any(|s| s.starts_with("approved:")), | ||
| "get_job_logs: expected writer-level (approved) integrity, got {integrity:?}", | ||
| ); |
|
@copilot address review feedback |
…ecks against helpers
Done. All three tests now assert equality against |
|
@copilot resolve the merge conflicts in this pull request |
Merge conflicts resolved. The two conflicting files were |
🤖 This is an automated pull request from Repo Assist, an AI assistant.
Closes #6458
Summary
Two improvements to the Rust guard as described in issue #6458:
1. Replace magic string literals with
policy_integrityconstants (helpers.rs)Two private helpers —
effective_disapproval_integrityandeffective_endorser_min_integrity— used raw"none"and"approved"literals as fallback values. Every other part of the codebase usespolicy_integrity::NONEandpolicy_integrity::APPROVEDfromconstants.rs. This fix brings those two outliers in line.2. Add unit tests for security-sensitive
apply_tool_labelsarms (tool_rules.rs)Added three tests covering the arms that must unconditionally apply
private:secrecy regardless of repository visibility:apply_tool_labels_secret_scanning_is_always_private— coverslist_secret_scanning_alerts,get_secret_scanning_alertapply_tool_labels_code_scanning_and_dependabot_are_always_private— coverslist_code_scanning_alerts,get_code_scanning_alert,list_dependabot_alerts,get_dependabot_alertapply_tool_labels_get_job_logs_is_always_private— coversget_job_logsThese are the highest-risk arms in
apply_tool_labels: a refactor accidentally usingapply_repo_visibility_secrecyinstead would silently expose secret-scanning alerts, Dependabot findings, and CI logs on public repos — with no test to catch it.Test Status
✅ Rust tests: All 435 tests pass (
cargo testinguards/github-guard/rust-guard/), including the 3 new tests.guards/.Warning
Firewall blocked 1 domain
The following domain was blocked by the firewall during workflow execution:
proxy.golang.orgSee Network Configuration for more information.