[github-actions]

File: internal/util/collections_test.go

Changes

• Converted TestGetStringFromMap to a table-driven test and added a nil-value case.
• Added ShallowCloneMap edge cases: nil input, writability of the clone, and that adding keys to the clone leaves the original unchanged.
• Removed TestCopyTrimmedStringIntMap_NilAndEmptyReturnNil, which duplicated the table cases.

Coverage: the internal/util package stays at 96.2% before and after. The uncovered lines are OS error paths in atomic_write.go and one line in truncate.go, so this change is about structure and assertion quality rather than coverage.

Verification: go vet and gofmt are clean, and go test -count=3 ./internal/util/ passes.

Generated by Test Improver · copilot · auto · ~27 AIC · ⊞ 8.9K · ◷

[Copilot]

🟢 Approval recommended

No active review issues are identified, and the changes are limited to reorganizing and expanding focused utility tests without modifying production behavior.

No open issues 🎉

What changed in this PR

This pull request improves the organization and edge-case coverage of utility collection tests without changing production behavior.

Changes:

• Converted TestGetStringFromMap to a table-driven test with nil-value coverage.
• Added ShallowCloneMap tests for nil inputs, writable clones, and clone isolation.
• Removed redundant CopyTrimmedStringIntMap nil and empty-input coverage.

File	Description
internal/​util/​collections_test.go	Reorganizes collection utility tests and adds focused edge-case assertions.

_{Review effort: Lite (auto)}

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues, list_pull_requests, get_file_contents, list_commits)	data returned	ALLOWED	✅
B	MCP	writes (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request)	all 'unknown tool' (-32602), absent from 23-tool catalog	BLOCKED	⚠️
C	CLI	reads (same calls via github proxy)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment)	gh not authenticated — not attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh not authenticated — not attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: all 6 write-tool targets (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the gateway's exposed tool catalog (only 23 read tools listed: list_issues, list_pull_requests, get_file_contents, list_commits, etc.). Per the test's own methodology, absence from the catalog only proves backend/toolset configuration (gh-aw's GITHUB_READ_ONLY=1), not independent mcpg gateway-level DIFC/guard enforcement — so these rows are recorded INCONCLUSIVE, not PASS.

⚠️ Parts D/E: gh auth status confirmed no GH_TOKEN was set in this job (gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable). No REST or GraphQL write attempts could be made, so the token-scope boundary was not exercised this run.

No write of any kind succeeded or leaked through either surface. No security regression found; the gaps are purely test-coverage INCONCLUSIVE results, not FAIL.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime