[lpcox]

Summary

GitHub Actions logs can contain comments, build output, and workflow inputs without repository-writer endorsement. Hosting those bytes on GitHub does not establish approved integrity.

• Give get_job_logs baseline none integrity for public and private repositories while preserving repository-visibility secrecy labels.
• Exclude job-log responses from the approved singleton server-metadata fallback, including plain-text MCP wrappers and empty-search-shaped output.
• Route the individual-job log endpoint explicitly through get_job_logs rather than generic file-content fallback. Job, run, and run-attempt log endpoints now use the same integrity rules.
• Add synthetic Rust and real-WASM regression coverage for public/private labels, direct outsider text versus the same text wrapped in logs, MCP/structured response shapes, coarse array fallback, and REST JSON/text/redirect enforcement.
• Update the directly related labeling documentation. Repository metadata behavior is unchanged.

Verification

• Reproduced the previous approved-integrity behavior and the missing individual-job route behavior with regression tests before applying each fix.
• Built the WASM guard and passed the targeted real-guard, routing, and REST enforcement tests.
• cargo fmt --manifest-path guards/github-guard/rust-guard/Cargo.toml -- --check
• make agent-finished — passed after the routing follow-up: formatting, build, lint (0 issues), Go tests, and all 688 Rust guard tests.

All fixtures are synthetic and use local test servers.

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_pull_requests/get_file_contents/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (issue_write/star_repository/create_branch/add_issue_comment/create_or_update_file/create_pull_request)	all absent from 23-tool catalog (unknown tool), no leak	BLOCKED	⚠️
C	CLI	reads (github proxy list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh not authenticated (no GH_TOKEN)	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE
(⚠️ Part B: all targeted write tools were absent from the exposed 23-tool catalog — consistent with gh-aw's unconditional GITHUB_READ_ONLY=1 backend config, which structurally prevents reaching mcpg's own DIFC write-enforcement layer on this surface. ⚠️ Parts D/E: gh CLI had no GH_TOKEN in this job, so the GitHub-API-token-scope boundary could not be independently exercised. No write of any kind leaked in any part.)

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[Copilot]

🟡 Changes recommended

The missing job-log route falls back to get_file_contents with merged integrity, allowing opaque logs or redirects to bypass the approved minimum in normal proxy mode.

1 open issue

• Route job logs with explicit integrity protection · New

What changed in this PR

This PR assigns GitHub Actions job logs baseline none integrity, preventing arbitrary workflow output from receiving repository-writer endorsement. Repository-visibility secrecy labels and repository metadata behavior remain unchanged.

Changes:

• Give job logs baseline integrity and exclude them from the approved server-metadata fallback.
• Add Rust and real-WASM regression coverage for response shapes, filtering, and REST enforcement.
• Update labeling documentation to describe log integrity and visibility-based secrecy.

File	Description
internal/​proxy/​job_logs_guard_test.go	Adds real-WASM labeling and REST enforcement tests.
guards/​github-guard/​rust-guard/​src/​lib.rs	Excludes logs from approved metadata fallback and adds regressions.
guards/​github-guard/​rust-guard/​src/​labels/​tool_rules.rs	Assigns baseline integrity while preserving visibility-based secrecy.
guards/​github-guard/​rust-guard/​src/​labels/​mod.rs	Updates job-log integrity expectations.
guards/​github-guard/​README.md	Documents log integrity and secrecy behavior.
guards/​github-guard/​docs/​LABELING.md	Clarifies visibility-based log secrecy and baseline integrity.
guards/​github-guard/​docs/​INTEGRITY_TAG_SPEC.md	Updates resource and response integrity rules for logs.
guards/​github-guard/​docs/​IMPLEMENTATION.md	Describes log secrecy and fallback handling.
guards/​github-guard/​docs/​IMPLEMENTATION_SUMMARY.md	Aligns summary tables with job-log labeling.

_{Review effort: Max (auto)}

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

The review feedback is addressed in b8cb720: the individual-job log endpoint now routes through get_job_logs, with route and real-WASM enforcement coverage.