Add regression coverage for GitHub guard write operations

[Copilot]

Eight release, issue, comment, and repository mutations require explicit write classification to prevent DIFC guard bypasses.

• Coverage
  • Assert create_release, edit_release, delete_release, and `upload_release_asset are writes.
  • Assert delete_issue, update_issue_comment, delete_issue_comment, and delete_repository are writes.
• Classification integrity
  • Require explicit WRITE_OPERATIONS membership.
  • Prevent accidental reclassification as read-write operations.

• Fixes [guard-coverage] Guard coverage gap: 8 operations from github-mcp-server / GitHub CLI not fully covered #11370

[Copilot]

Pull request overview

Adds regression coverage ensuring eight GitHub mutations remain explicitly classified as write-only operations.

Changes:

• Verifies explicit WRITE_OPERATIONS membership.
• Prevents accidental read-write reclassification.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/tools.rs	Adds write-classification regression tests.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tools absent from catalog	BLOCKED	⚠️
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the MCP tool catalog (23 read-only tools only). The backend runs with GITHUB_READ_ONLY=1 set unconditionally by the gh-aw framework, so write tools are never registered. This confirms the framework's own defense-in-depth guarantee but does not independently confirm the gateway's DIFC/guard enforcement layer — that requires a write-capable backend outside gh-aw's tools.github: wrapper (tracked as follow-up).

⚠️ Parts D & E: gh CLI is not authenticated in this gVisor runtime environment. 401 responses cannot be distinguished from gateway blocking vs. unauthenticated requests. Token-scope boundary cannot be validated for this run.

No writes leaked. No Part B, D, or E writes succeeded.

References: §31988931905

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues	3 issues returned	ALLOWED	✅
A2	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A3	MCP	get_file_contents (README.md)	file content returned	ALLOWED	✅
A4	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all write tools absent from catalog	BLOCKED	⚠️
C1	CLI	list_issues via github CLI	issues returned	ALLOWED	✅
C2	CLI	get_file_contents via github CLI	README.md returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B: The github CLI catalog exposes only 23 read-only tools (get_*, list_*, search_*, issue_read, pull_request_read). All write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the catalog — the backend runs with GITHUB_READ_ONLY=1. This confirms the gh-aw framework defense-in-depth guarantee but cannot independently confirm mcpg's own DIFC/guard enforcement layer (structural gap; tracked as follow-up).

⚠️ Parts D/E: gh CLI is not authenticated (no GH_TOKEN set). All 6 REST and 3 GraphQL write attempts were rejected with "GH_TOKEN not set" — no writes succeeded, but this is authentication failure, not gateway enforcement. Cannot confirm the token-scope boundary for this run.

No writes leaked. No FAIL.

References: §31988931916

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	data returned	ALLOWED	✅
A	MCP	get_file_contents (README.md)	file content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	add_issue_comment	tool absent from catalog	BLOCKED	⚠️
B	MCP	star_repository	tool absent from catalog	BLOCKED	⚠️
B	MCP	issue_write	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_branch	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_or_update_file	tool absent from catalog	BLOCKED	⚠️
B	MCP	create_pull_request	tool absent from catalog	BLOCKED	⚠️
C	CLI	list_issues (github CLI)	data returned	ALLOWED	✅
C	CLI	get_file_contents (github CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	Bad credentials	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	Bad credentials	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps noted:

• Part B: All 23 exposed MCP tools are read-only. Write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the tool catalog because the backend runs with GITHUB_READ_ONLY=1. This is defense-in-depth but does not independently confirm gateway-level DIFC/guard enforcement — the write call never reaches the gateway's blocking layer.
• Parts D/E: gh token (GH_TOKEN) is invalid in this environment (Bad credentials). All CLI write attempts returned 401, which proves the token is non-functional but does not confirm the token-scope boundary. Cannot distinguish "blocked by read-only token" from "blocked by bad credentials."

No writes leaked. The run is INCONCLUSIVE (not FAIL) per methodology.

References: §31988932124

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime