[Repo Assist] fix(rust-guard): cover feature-flagged issue_dependency_write and find_duplicate tool variants - #13089
Draft
github-actions[bot] wants to merge 1 commit into
Conversation
…nd find_duplicate_ff_duplicate_detection Closes #13077 Guard coverage checker flagged two current upstream feature-flagged tool names missing from classification: - issue_dependency_write_ff_issue_dependencies is now classified as a READ_WRITE_OPERATIONS bucket entry (tools.rs) alongside the legacy issue_dependency_write name. - find_duplicate_ff_duplicate_detection now shares the same DIFC labeling arm as find_duplicate in tool_rules.rs (repo-scoped secrecy, private writer integrity). The existing tool_rules.rs match arm for issue_dependency_write_ff_issue_dependencies (added previously) is unaffected; only the tools.rs classification bucket needed the entry. Did not remove the two stale-entry suggestions from the issue (create_pull_request_with_copilot, issue_dependency_write) since their presence in upstream github-mcp-server could not be verified against a live tool inventory in this environment; leaving them in place is the safer default until a maintainer confirms removal. Co-authored-by: Copilot <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🤖 This PR was created by Repo Assist, an automated AI assistant.
Closes #13077
Root cause
The GitHub Guard Coverage Checker flagged that two current upstream feature-flagged tool names introduced by
github-mcp-serverare not classified by the rust-guard, even though their legacy/base names already are:issue_dependency_write_ff_issue_dependencies— a feature-flagged variant ofissue_dependency_write. It already had a DIFC labeling match arm intool_rules.rs, but was missing from theREAD_WRITE_OPERATIONSclassification bucket intools.rs, so the guard did not recognize it as a read/write operation at all.find_duplicate_ff_duplicate_detection— a feature-flagged variant offind_duplicate. It had no DIFC labeling match arm intool_rules.rs, so it fell through to the default (less specific) handler instead of inheriting the repo-scoped secrecy/writer-integrity labels applied tofind_duplicate.Fix
tools.rs: addedissue_dependency_write_ff_issue_dependenciestoREAD_WRITE_OPERATIONS(kept alphabetically sorted, required forbinary_searchcorrectness).labels/tool_rules.rs: extended the existingfind_duplicatematch arm to also matchfind_duplicate_ff_duplicate_detection, applying identical repo-scoped secrecy and private-writer integrity labels.Trade-offs / scope
The issue also suggested removing two stale entries (
create_pull_request_with_copilotfromWRITE_OPERATIONS, andissue_dependency_writefromREAD_WRITE_OPERATIONS) as possibly no longer present upstream. I did not make these removals in this PR — I could not verify their current upstream status against a livegithub-mcp-servertool inventory in this sandboxed environment, and removing guard coverage for a tool that turns out to still exist upstream would be a security regression (a write operation the guard forgot to check). Leaving them in place is the safer default; a maintainer with access to the live upstream inventory can safely remove them in a follow-up if confirmed stale.Test Status
cargo build --release: ✅ passcargo test(rust-guard): ✅ 668 passed, 0 failedcargo clippy --release --all-targets -- -D warnings: ✅ cleancargo fmt --checkon the two touched files: ✅ no diff (pre-existing unrelated formatting drift exists elsewhere inlabels/backend.rsandlabels/mod.rs, not touched by this change)Add this agentic workflow to your repo
To install this agentic workflow, run