Allow integrity audit access to public Actions logs and artifacts by Copilot · Pull Request #10626 · github/gh-aw-mcpg

Copilot · 2026-08-03T15:20:28Z

The integrity audit workflow could list run metadata but was blocked from the evidence needed for DIFC analysis (get_job_logs, download_workflow_run_artifact) because those reads were always labeled private. This made the audit incomplete even for public repositories.

Guard labeling behavior
- Updated Rust guard tool labeling so:
  - get_job_logs secrecy now inherits repository visibility.
  - actions_get (including download_workflow_run_artifact) secrecy now inherits repository visibility.
- Private repositories remain private-scoped; public repositories are no longer unnecessarily tainted for these reads.
Rule-set cleanup
- Removed get_job_logs from the “always private security-sensitive” bucket in tool_rules.rs.
- Kept integrity labeling unchanged (writer_integrity) for these operations.
Targeted test updates
- Updated existing expectations for public-repo log/artifact reads to secrecy = [].
- Added explicit private-repo coverage for get_job_logs to ensure private secrecy labels are preserved.

// Before (public + private): always private
"get_job_logs" => {
    secrecy = policy_private_scope_label(&owner, &repo, repo_id, ctx);
}

// After: visibility-aware
"get_job_logs" => {
    secrecy = apply_repo_visibility_secrecy(&owner, &repo, repo_id, secrecy, ctx);
}

Fixes [integrity-audit] Integrity Filtering Audit — Artifact/Log access blocked by DIFC secrecy policy (audit incomplete) #10603

Copilot

Pull request overview

Updates DIFC labeling so public-repository Actions logs and artifacts inherit public secrecy.

Changes:

Makes get_job_logs and actions_get visibility-aware.
Updates public-repository expectations and adds private log coverage.

Show a summary per file

File	Description
`tool_rules.rs`	Updates labeling rules and focused tests.
`mod.rs`	Updates public Actions secrecy expectations.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 2/2 changed files
Comments generated: 4
Review effort level: Balanced

+        // === Actions log and artifact reads (repo-scoped) ===
+        // S = S(repo) — inherits from repository visibility
+        // I = writer



    #[test]
-    fn apply_tool_labels_actions_get_artifact_download_is_always_private() {
+    fn apply_tool_labels_actions_get_artifact_download_inherits_repo_visibility() {


+            Vec::<String>::new(),
+            "actions_get download_workflow_run_artifact should inherit public repo visibility",


lpcox · 2026-08-03T16:35:21Z

@copilot address review feedback

…act test, update docs

Copilot · 2026-08-03T16:42:35Z

@copilot address review feedback

Addressed all four review findings in commit Address review feedback: fix test visibility seeds, add private artifact test, update docs:

get_job_logs public test – added cache_repo_visibility_for_tests(repo_id, false) to exercise the Some(false) branch rather than the unknown-visibility fallback.
download_workflow_run_artifact public test – same: seeded visibility as false.
New download_workflow_run_artifact private test – apply_tool_labels_actions_get_artifact_download_private_repo_stays_private with cache_repo_visibility_for_tests(repo_id, true) asserting private:<owner>/<repo> secrecy.
actions_get non-artifact public test – seeded visibility as false and added an explicit secrecy assertion ([]).
SECRECY_TAG_SPEC.md – updated all four locations (intro callout, resource label table, resource label notes, response label table, and retired-tag paragraph) to reflect that job logs and artifact downloads are now visibility-aware rather than always private.

lpcox · 2026-08-03T17:43:00Z

@copilot fix this failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/30833377553/job/91754178731?pr=10626

…it-fix-access-issues

Copilot · 2026-08-03T17:52:43Z

@copilot fix this failing ci check https://github.com/github/gh-aw-mcpg/actions/runs/30833377553/job/91754178731?pr=10626

Fixed in 9b2d3a88 by updating the MCP connection error-path test to accept the SDK's early-exit broken pipe variant as well as EOF. Validation passed locally with go test -race ./internal/mcp -run TestNewConnection_ErrorPaths -count=1 -v, make test-race, and make agent-finished; the new CI runs for 9b2d3a88 are now passing.

github-actions · 2026-08-03T17:54:06Z

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused via `unknown tool [-32602]`	BLOCKED	✅
C	CLI	reads (via MCP CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused (gh unauthenticated)	BLOCKED	✅

Overall: PASS

References: §30838305641

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-08-03T17:54:12Z

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	gateway: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (exit 4)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (exit 4)	BLOCKED	✅

Overall: PASS

Run: §30838305720
Note: Part B writes blocked via gateway tool allowlist (write tools absent from exposed set). Part D/E writes blocked by unauthenticated gh CLI (GH_TOKEN not set).

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

github-actions · 2026-08-03T17:57:00Z

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/PRs/commits, get_file_contents)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`Error [-32602]: unknown tool` (gateway-stripped)	BLOCKED	✅
C	CLI	reads (list_issues, get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	blocked — gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	blocked — gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Part B enforcement: All 7 write tools returned Error [-32602]: unknown tool — gateway enforces read-only by omitting write tools from its advertised tool list. MCP session reached the gateway; the gateway itself stripped the tools.

Parts D/E: gh CLI has no GH_TOKEN; all REST/GraphQL write attempts rejected at auth layer. No writes leaked.

Run: §30838308115

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

Initial plan

f61ffc3

Copilot AI assigned Copilot and lpcox Aug 3, 2026

Copilot started work on behalf of lpcox August 3, 2026 15:21 View session

Copilot AI linked an issue Aug 3, 2026 that may be closed by this pull request

[integrity-audit] Integrity Filtering Audit — Artifact/Log access blocked by DIFC secrecy policy (audit incomplete) #10603

Closed

Relax actions log/artifact secrecy for public repos

75c7568

Copilot AI changed the title ~~[WIP] Fix access issues for integrity filtering audit~~ Allow integrity audit access to public Actions logs and artifacts Aug 3, 2026

Copilot finished work on behalf of lpcox August 3, 2026 15:29

Copilot AI requested a review from lpcox August 3, 2026 15:29

lpcox marked this pull request as ready for review August 3, 2026 16:03

Copilot AI review requested due to automatic review settings August 3, 2026 16:03

Copilot started reviewing on behalf of lpcox August 3, 2026 16:04 View session

Copilot AI reviewed Aug 3, 2026

View reviewed changes

This comment has been minimized.

Sign in to view

github-actions Bot added the readonly-stress-pass-gvisor label Aug 3, 2026

This comment has been minimized.

Sign in to view

github-actions Bot added the readonly-stress-pass-default label Aug 3, 2026

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox August 3, 2026 16:35 View session

Address review feedback: fix test visibility seeds, add private artif…

38c3bcf

…act test, update docs

Copilot finished work on behalf of lpcox August 3, 2026 16:43

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox August 3, 2026 17:43 View session

Copilot AI added 2 commits August 3, 2026 17:45

Merge remote-tracking branch 'origin/main' into copilot/integrity-aud…

7bc7dd4

…it-fix-access-issues

Fix race test handshake error assertion

9b2d3a8

Copilot finished work on behalf of lpcox August 3, 2026 17:53

lpcox merged commit 117e549 into main Aug 3, 2026
38 checks passed

lpcox deleted the copilot/integrity-audit-fix-access-issues branch August 3, 2026 18:02

Copilot AI mentioned this pull request Aug 5, 2026

Bump Claude, Copilot, Zizmor, and MCP Gateway defaults github/gh-aw#50696

Merged

Navigation Menu

Uh oh!

Allow integrity audit access to public Actions logs and artifacts - #10626

Allow integrity audit access to public Actions logs and artifacts#10626
lpcox merged 5 commits into
mainfrom
copilot/integrity-audit-fix-access-issues

Copilot AI commented Aug 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Aug 3, 2026

Uh oh!

Copilot AI commented Aug 3, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Aug 3, 2026

Uh oh!

Copilot AI commented Aug 3, 2026

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

github-actions Bot commented Aug 3, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		Vec::<String>::new(),
		"actions_get download_workflow_run_artifact should inherit public repo visibility",

Uh oh!

Conversation

Copilot AI commented Aug 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Aug 3, 2026

Uh oh!

Copilot AI commented Aug 3, 2026

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Aug 3, 2026

Uh oh!

Copilot AI commented Aug 3, 2026

Uh oh!

github-actions Bot commented Aug 3, 2026

🔒 mcpg Read-Only Stress — gVisor

Uh oh!

github-actions Bot commented Aug 3, 2026

🔒 mcpg Read-Only Stress — default AWF

Uh oh!

github-actions Bot commented Aug 3, 2026

🔒 mcpg Read-Only Stress — docker-sbx

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Aug 3, 2026 •

edited

Loading