[Repo Assist] fix(rust-guard): set baseline_scope=GITHUB for search_users + add label tests

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

Fixes a missing baseline_scope assignment in the search_users arm of apply_tool_labels in tool_rules.rs, and adds three new tests covering search_users and unstar_repository label semantics.

Partially addresses #9446.

Root Cause

The search_users arm set integrity = project_github_label(ctx) but did not set baseline_scope = Cow::Borrowed(scope_names::GITHUB). This is inconsistent with the parallel arms for search_orgs, list_global_security_advisories, and github_support_docs_search, which all set both.

Without the baseline_scope override, ensure_integrity_baseline was called with whatever repo_id the gateway passed in. For calls with a non-empty repo_id (e.g. "github/copilot"), max_integrity resolved the project:github-scoped labels against the repo scope — producing ["none:github/copilot"] instead of the intended ["none:github", "unapproved:github", "approved:github"]. For an empty repo_id, the result was ["none"].

Fix

One-line addition matching the search_orgs arm:

baseline_scope = Cow::Borrowed(scope_names::GITHUB);

New Tests

Three new tests in labels/mod.rs:

Test	What it verifies
test_apply_tool_labels_unstar_repository_public_secrecy_github_integrity	unstar_repository → empty secrecy + project:github integrity
test_apply_tool_labels_search_users_public_secrecy_github_integrity	search_users (empty repo_id) → empty secrecy + project:github integrity
test_apply_tool_labels_search_users_with_repo_context	search_users (with repo_id) → same labels regardless of calling context

Trade-offs

• No behaviour change for callers that always pass an empty repo_id — the result was already ["none"] matching the github-scope none floor.
• Behaviour fix for callers that pass a non-empty repo_id — search_users results now correctly carry project:github integrity instead of a conservative repo-scoped none label.

Test Status

✅ All 588 Rust unit tests pass (cargo test in guards/github-guard/rust-guard/).

⚠️ Go build and tests could not be verified — proxy.golang.org is firewalled in this environment. Only Rust files were modified; no Go changes were made.

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Repo Assist · 310.6 AIC · ⊞ 10.8K · ◷
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

Pull request overview

Fixes GitHub-scoped integrity labeling for search_users and adds regression coverage.

Changes:

• Sets the search_users integrity baseline scope to GitHub.
• Adds tests for search_users with empty and repository contexts.
• Adds coverage for unstar_repository labels.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Corrects the search_users baseline scope.
guards/github-guard/rust-guard/src/labels/mod.rs	Adds label-semantics regression tests.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Medium