Add Rust guard coverage for GitHub-controlled/advisory label policies

[Copilot]

The Rust guard had no direct unit coverage for three security-sensitive apply_tool_labels policy arms: private user metadata, public GitHub-controlled metadata, and repository security advisories. This also trims an internal backend helper that was exposed more broadly than its call sites require.

• Tool label policy coverage

  • Add focused tool_rules.rs tests for:
    • get_copilot_space, list_copilot_spaces → private:user secrecy + project:github integrity
    • search_orgs, list_global_security_advisories, get_global_security_advisory, github_support_docs_search → empty secrecy + project:github integrity
    • list_repository_security_advisories, list_org_repository_security_advisories → private repo/owner scope secrecy + writer integrity
  • Keep coverage local to the match arms that enforce these label decisions, so regressions in those branches fail directly.

• API surface reduction

  • Downscope is_repo_private_with_callback from pub to pub(crate).
  • Preserves test access within the crate while removing an unnecessary external-facing symbol.

• Representative pattern

  for tool in &["get_copilot_space", "list_copilot_spaces"] {
      let (secrecy, integrity, _) =
          apply_tool_labels(tool, &json!({}), "", vec![], vec![], String::new(), &ctx);
  
      assert_eq!(secrecy, private_user_label());
      assert_eq!(integrity, project_github_label(&ctx));
  }

• Fixes [rust-guard] Rust Guard: Add test coverage for Copilot/org/advisory tool label policies + downscope is_repo_private_with_callback #9981

[Copilot]

Pull request overview

Adds focused Rust guard regression coverage for security-sensitive label policies and narrows an internal backend helper’s visibility.

Changes:

• Tests Copilot Spaces, public GitHub metadata, and repository advisory labels.
• Changes is_repo_private_with_callback visibility to pub(crate).

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Adds focused policy-label tests.
guards/github-guard/rust-guard/src/labels/backend.rs	Restricts helper visibility to the crate.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool for all 7 — gateway strips write tools	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents via gateway bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated — no GH_TOKEN	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated — no GH_TOKEN	BLOCKED	✅

Notes:

• Part B: Gateway enforces read-only by omitting write tools from the MCP tool list entirely (Error [-32602]: unknown tool). All 7 write tools absent.
• Parts D & E: gh has no GH_TOKEN in gVisor runtime; REST and GraphQL writes fail at auth layer.

Overall: PASS

Run: §30093109251

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_PRs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error[-32602]: unknown tool (gateway filter — write tools absent from allowed set)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	rejected (gh unauthenticated — GH_TOKEN not set)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	rejected (gh unauthenticated — GH_TOKEN not set)	BLOCKED	✅

Overall: PASS

Gateway enforcement detail (Part B): The mcpg tools file exposes only read tools. All 7 write tool calls returned Error[-32602]: unknown tool — the gateway strips write tools from the MCP tool registry before they reach the backend, so no write can be expressed at the MCP layer.

References: §30093109313

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	refused by gateway (write tools absent from manifest)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused — gh unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused — gh unauthenticated	BLOCKED	✅

Overall: PASS

Part B note: Gateway enforces read-only by serving a manifest of only 22 read-only tools. All 7 write tools return MCP error -32602: unknown tool — the gateway controls the manifest, so this is gateway-level enforcement.
Parts D/E note: gh CLI has no GH_TOKEN in this environment; all REST/GraphQL write attempts are rejected at auth.

References: §30093109245

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime