[Repo Assist] refactor(rust-guard): merge identical security-alert match arms and add actions_get tests

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Closes #6524

Summary

Two improvements to guards/github-guard/rust-guard/src/labels/tool_rules.rs, as described in #6524:

1. Merge three identical security-sensitive match arms

Three consecutive match arms (list_secret_scanning_alerts/get_secret_scanning_alert, list_code_scanning_alerts/get_code_scanning_alert/list_dependabot_alerts/get_dependabot_alert, and get_job_logs) all had identical two-line bodies calling policy_private_scope_label + writer_integrity. They're merged into one unified arm with a consolidated comment explaining the rationale for all seven tool names.

Effect: ~14 lines removed; a single canonical location to add future security-sensitive tools.

2. Add tests for actions_get security branch

The actions_get arm has a security-critical if/else: download_workflow_run_artifact is always forced to private secrecy, while other methods inherit repo-visibility secrecy. This had zero test coverage. Two new tests pin both branches:

• apply_tool_labels_actions_get_artifact_download_is_always_private
• apply_tool_labels_actions_get_non_artifact_inherits_repo_visibility

Test Status

✅ All 440 Rust tests pass (cargo test in guards/github-guard/rust-guard/).

The Go build infrastructure was unavailable in this environment (Go toolchain download blocked), but no Go files were modified — only tool_rules.rs.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Repo Assist · sonnet46 2.5M · ◷

Add this agentic workflows to your repo

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55