[github-actions]

🤖 Repo Assist here — automated AI assistant.

Closes #15838

Root cause: pull_request_read(get_review_comments) returns review_threads[].comments[] with string author logins; extract_items_array only knew review_comments, so no fine-grained labels were produced and the gateway (correctly, per #14930) fell back to the coarse none:public denial.

Fix (rust-guard):

• label_author_items now recognises a review_threads envelope and labels each thread (path /review_threads/N, items_path=/review_threads).
• Each thread gets the lowest integrity among its comments (computed with user_authored_integrity, so blocked users, trusted users and collaborator elevation apply). The gateway labels one collection element at a time, so a thread containing a low-integrity comment is restricted as a whole — fail-closed is preserved.
• extract_author_login now accepts author as a plain string login.

Trade-offs: granularity is per thread, not per nested comment. Author trust for logins lacking author_association is resolved via the existing collaborator-permission elevation path. Per-comment filtering would need gateway changes.

Test Status

• cargo test: 692 passed (new test review_threads_use_lowest_comment_integrity covers trusted thread, mixed thread, blocked author, pagination metadata).
• cargo fmt applied; clippy shows only a pre-existing warning elsewhere.
• Go make agent-finished not run (Rust-only change).

Generated by Repo Assist · copilot · auto · ~47 AIC · ⊞ 7.9K · ◷
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_pull_requests/get_file_contents/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 target tools absent from the 23-tool catalog (read-only set only)	BLOCKED	⚠️
C	CLI	reads via proxied github CLI	data returned	ALLOWED	✅
D	CLI	REST writes	gh not authenticated (no GH_TOKEN) — writes never attempted	BLOCKED	⚠️
E	CLI	GraphQL mutations	gh not authenticated — mutations never attempted	BLOCKED	⚠️

Overall: INCONCLUSIVE

No write or mutation leaked in this run. Part B is ⚠️ because the backend GitHub MCP server (launched with GITHUB_READ_ONLY=1 by gh-aw's tools.github: wrapper) never registers write tools at all — only 23 read-only tools are exposed (get_commit, get_file_contents, get_label, get_latest_release, get_release_by_tag, get_tag, issue_read, list_branches, list_commits, list_issue_fields, list_issue_types, list_issues, list_pull_requests, list_releases, list_repository_collaborators, list_starred_repositories, list_tags, pull_request_read, search_code, search_commits, search_issues, search_pull_requests, search_repositories). This confirms gh-aw's framework-level defense-in-depth, not mcpg's independent DIFC/guard write-blocking layer, since no write tool call ever reaches a write-capable backend to test gateway-level refusal. Parts D/E are ⚠️ because gh is unauthenticated in this environment (no GH_TOKEN), so the token-scope boundary could not be exercised.

Full detail: /tmp/gh-aw/agent/readonly-stress-41307822575.txt.

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[Copilot]

🟡 Changes recommended

Structured-only MCP responses can incorrectly deny trusted threads, while collection filtering drops pagination metadata needed to fetch subsequent pages.

2 open issues

• Handle structured-only MCP responses · New
• Preserve pagination metadata in filtered results · New

What changed in this PR

Extends the GitHub guard to recognize nested review-thread responses from pull_request_read(get_review_comments), addressing #15838 while retaining the fail-closed behavior introduced by #14930.

Changes:

• Labels each thread using its lowest comment integrity, restricting mixed-trust threads as a whole.
• Supports plain-string author logins and reuses shared integrity ranking.
• Adds regression coverage for trusted and blocked authors and thread label paths.

File	Description
guards/​github-guard/​rust-guard/​src/​labels/​response_paths.rs	Adds thread-level provenance labeling and regression coverage.
guards/​github-guard/​rust-guard/​src/​labels/​helpers.rs	Supports string author logins and exposes integrity ranking.

_{Review effort: Max (auto)}

[lpcox]

@copilot address review feedback

[Copilot]

@copilot address review feedback

Addressed the structuredContent and pagination-envelope feedback, with regression coverage. Commit: df2d5cd.