fix(guard): classify discussion_comment_write; add list_repository_collaborators DIFC rules

[Copilot]

The upstream github-mcp-server added discussion_comment_write without a corresponding entry in the guard, allowing agents to create/edit Discussion comments without triggering DIFC write-path checks. list_repository_collaborators also lacked an explicit label rule despite returning access-sensitive data.

tools.rs

• Add discussion_comment_write to WRITE_OPERATIONS — closes the guard coverage gap

tool_rules.rs — two new match arms

• discussion_comment_write: S=S(repo), I=writer — mirrors issue_write / add_issue_comment since it produces repo-scoped, agent-authored content
• list_repository_collaborators: S=S(repo), I=reader — uses reader-level integrity (one level below writer) because the response reveals who holds write/admin access, making it access-sensitive relative to other repo metadata reads

[Copilot]

Pull request overview

This PR closes DIFC guard coverage gaps for new/previously-unlabeled GitHub MCP tools by (1) classifying a new discussion comment mutation tool as write-capable and (2) adding explicit DIFC label rules for collaborator listing and discussion comment writes.

Changes:

• Add discussion_comment_write to WRITE_OPERATIONS and test that it’s treated as a write (not read-write).
• Add apply_tool_labels match arms for discussion_comment_write and list_repository_collaborators.
• Add unit tests for both new apply_tool_labels rules.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/tools.rs	Classifies discussion_comment_write as a write operation and adds a classification test.
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Adds explicit DIFC secrecy/integrity rules and tests for discussion_comment_write and list_repository_collaborators.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 3

[lpcox]

@copilot fix this failed ci check https://github.com/github/gh-aw-mcpg/actions/runs/25967718884/job/76334061789?pr=5818

[Copilot]

@copilot fix this failed ci check https://github.com/github/gh-aw-mcpg/actions/runs/25967718884/job/76334061789?pr=5818

Fixed in 648096a. I reproduced the rust-guard-test failure, corrected the policy_private_scope_label usage/signature mismatch, aligned the collaborator integrity test expectation, and verified with cargo test labels::tool_rules and make agent-finished.