Add ifc label for search_repositories tool#2459
Open
gokhanarkan wants to merge 1 commit into
Open
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
Adds IFC (_meta.ifc) annotation to the search_repositories MCP tool output when InsidersMode is enabled, aligning search_repositories with the existing IFC-labeling pattern used across other ingress tools.
Changes:
- Added
ifc.LabelSearchRepositories()returning a constantPublicUntrusted()label for repository search results. - Updated
SearchRepositoriesto attach_meta.ifcon successful responses whendeps.GetFlags(ctx).InsidersModeis true. - Added unit test coverage verifying IFC metadata is omitted when insiders mode is off and present (public/untrusted) when on.
Show a summary per file
| File | Description |
|---|---|
| pkg/ifc/ifc.go | Adds LabelSearchRepositories() helper documenting/encapsulating the label decision for search_repositories. |
| pkg/github/search.go | Attaches _meta.ifc to search_repositories successful results behind InsidersMode. |
| pkg/github/search_test.go | Adds Test_SearchRepositories_IFC_InsidersMode covering both insiders on/off behavior. |
Copilot's findings
- Files reviewed: 3/3 changed files
- Comments generated: 0
6181edd to
5271c51
Compare
Emits an IFC SecurityLabel on the search_repositories tool result when the InsidersMode flag is enabled, mirroring the pattern landed for get_me, list_issues, get_file_contents, search_issues, and issue_read. Per the spec in github/copilot-mcp-core#1623, the label is PublicUntrusted() regardless of whether matched repositories are private. Repository search is treated as a discovery surface: matched repositories are by definition already accessible to the caller, so the joined readers are universal. Integrity is untrusted because repository names, descriptions, and topics are user-authored. Implementation note: SearchRepositories has its own handler distinct from the shared searchHandler used by SearchIssues, so the IFC attach is wired inline at the success return rather than via the postProcess hook added in #2456. Refs github/copilot-mcp-core#1623, github/copilot-mcp-core#1389. Note: chained on #2457 (gokhanarkan/fides-issue-read), which is in turn chained on #2456. GitHub will retarget the base to main once those merge.
86d20eb to
ea5755f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Emits an IFC
SecurityLabelon thesearch_repositoriestool result when theInsidersModeflag is enabled, mirroring the pattern landed forget_me(#2432),list_issues(#2453),get_file_contents(#2454),search_issues(#2456), andissue_read(#2457).Refs github/copilot-mcp-core#1623, github/copilot-mcp-core#1389. The last ingress tool from #1623's table.
What this PR does
Per #1623,
search_repositoriesemitsPublicUntrusted()regardless of whether matched repositories are private. Repository search is treated as a discovery surface: matched repositories are by definition already accessible to the caller, so the joined readers are universal. Integrity isuntrustedbecause repository names, descriptions, and topics are user-authored.Question for @JoannaaKL
This follows the spec literally. Strictly, surfacing a private repo's name/description into a
["public"]-labelled result lets the agent then exfiltrate the name to a public destination unhindered. If you'd rather mirrorsearch_issuesand join per-repo (visibility from the search payload'sRepository.Private, collaborators viaFetchRepoCollaboratorsfor private matches), the upgrade path is a small follow-up —ifc.LabelSearchIssuesalready does the join math. Going with the spec literal here for iteration speed; happy to switch.Implementation note
SearchRepositorieshas its own handler distinct from the sharedsearchHandlerused bySearchIssues(different result type —*github.RepositoriesSearchResultvs*github.IssuesSearchResult). The IFC attach is wired inline at the success return rather than via thesearchOptionpostProcess hook added in #2456. Six lines underInsidersMode, no infra refactor.Tests
Test_SearchRepositories_IFC_InsidersModein pkg/github/search_test.go with 2 subtests:result.Meta == nil.integrity=untrusted,confidentiality=["public"].(No per-repo or visibility-failure branch to cover — the label is constant.)
Validation
go test -race ./...— green.gofmt -sclean;go vet ./...clean../script/lintitself fails locally with a pre-existing golangci-lint Go-version mismatch unrelated to this change.)