rust-guard: delegate parse_integrity to MinIntegrity::from_policy_str + add response_items tests#7422
Merged
Merged
Conversation
…ponse_items tests - Replace 4-arm match in parse_integrity with delegation to MinIntegrity::from_policy_str, gaining case-insensitivity and whitespace trimming at zero extra cost - Add parse_integrity_accepts_mixed_case test - Add #[cfg(test)] module to response_items.rs with tests for unknown tool, error response skip, and private repo labeling Closes #7417
Copilot
AI
changed the title
[WIP] Fix parse_integrity duplication with MinIntegrity::from_policy_str
rust-guard: delegate Jun 12, 2026
parse_integrity to MinIntegrity::from_policy_str + add response_items tests
Contributor
There was a problem hiding this comment.
Pull request overview
This PR reduces duplication in Rust guard policy parsing by delegating parse_integrity to the canonical MinIntegrity::from_policy_str implementation, and adds initial unit tests for the security-sensitive item-based response-labeling path.
Changes:
- Refactor
parse_integrityto callMinIntegrity::from_policy_str(inheriting trim + case-insensitive parsing). - Add a new
parse_integrity_accepts_mixed_casetest to document the newly accepted inputs. - Add baseline
label_response_itemsunit tests for unknown tools,isError=trueresponses, and private repo labeling insearch_repositories.
Show a summary per file
| File | Description |
|---|---|
| guards/github-guard/rust-guard/src/lib.rs | Simplifies integrity parsing by delegating to MinIntegrity::from_policy_str and adds a test for mixed-case/whitespace inputs. |
| guards/github-guard/rust-guard/src/labels/response_items.rs | Adds initial unit tests covering key response-item labeling behaviors (unknown tool, error response skip, private repo secrecy labeling). |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 1
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
parse_integrityinlib.rsduplicated a 4-arm match already implemented (case-insensitively, with whitespace trimming) inMinIntegrity::from_policy_str.labels/response_items.rshad zero test coverage despite being on the security-sensitive response-labeling path.Changes
lib.rs— eliminate duplication inparse_integritymatchwith a single delegation toMinIntegrity::from_policy_str, gaining case-insensitivity and whitespace trimming for free:parse_integrity_accepts_mixed_casetest covering"None","APPROVED", and" merged "to document the newly inherited behaviour.labels/response_items.rs— add baseline test coverageAdd a
#[cfg(test)]module with three tests:unknown_tool_returns_empty—_ => {}catch-all returns an empty vec (not a panic)error_response_is_skipped—isError=trueearly-return guard is respected regardless of tool name (security boundary)search_repositories_private_repo_gets_private_label— private repos in search results receive aprivate:secrecy label