Repository navigation
Separate feature-gated moderation tools from the default guard inventory - #15564
Merged
Merged
Conversation
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Copilot
AI
changed the title
[WIP] Remove or migrate stale upstream operations in guard coverage
Separate feature-gated moderation tools from the default guard inventory
Oct 26, 2026
lpcox
marked this pull request as ready for review
October 26, 2026 13:37
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
Runtime enforcement remains unchanged, and the remaining audit-workflow feedback is non-blocking.
1 open issue
What changed in this PR
Separates six active, feature-gated moderation tools from the GitHub guard’s default write inventory while preserving their existing protection.
Changes:
- Adds a documented
FEATURE_GATED_WRITE_OPERATIONSbucket for hide/unhide tools. - Includes the new bucket in write classification.
- Updates regression checks for membership, default-bucket exclusion, sortedness, and uniqueness.
| File | Description |
|---|---|
guards/github-guard/rust-guard/src/tools.rs |
Separates feature-gated moderation tools and updates classification and inventory tests. |
Review effort: Max
| /// These are active tools, not deprecated aliases: issue comments require `issues_granular`, | ||
| /// and PR reviews/comments require `pull_requests_granular`. Keep write and DIFC coverage. | ||
| /// See https://github.com/github/github-mcp-server/blob/v2.0.3/pkg/github/comment_minimize.go | ||
| const FEATURE_GATED_WRITE_OPERATIONS: &[&str] = &[ |
Collaborator
|
@copilot address review feedback |
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Contributor
Author
Updated the audit workflow and regenerated its lock file to include feature-gated write coverage and source-based stale checks. Verified compilation and CodeQL. Commit: |
Collaborator
|
@copilot merge main and resolve conflicts |
…e-fix-6-stale-operations # Conflicts: # .github/workflows/github-mcp-guard-coverage-checker.lock.yml Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Contributor
Author
Merged |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The coverage audit flagged six hide/unhide operations as stale because they are absent from the upstream README catalog. Upstream v2.0.3 still implements them behind
issues_granularandpull_requests_granular; removing coverage or marking them deprecated would be incorrect.FEATURE_GATED_WRITE_OPERATIONS, documenting their gates and upstream source.