[Repo Assist] fix: handle bare-string labels from MCP tool path in rust guard

[github-actions]

🤖 This PR was created by Repo Assist, an automated AI assistant.

Summary

Fixes #9382: approval-labels and refusal-labels are silently ignored when issues are read via MCP tools (e.g. issue_read). The REST/proxy path returns labels as objects ([{"name":"x"}]); the MCP tool path returns bare strings (["x"]). The guard only handled the object shape.

Root Cause

extract_github_label_names in guards/github-guard/rust-guard/src/labels/helpers.rs called .get("name") on every label element. This returns None for bare strings, so no labels were extracted on the MCP path — meaning approval-label promotion and refusal-label demotion were both silently skipped.

Fix

Try as_str() (bare string) first; fall back to get("name") (object shape). Both shapes are now handled without any behaviour change on the existing REST/proxy path.

Impact

This was a security-relevant gap: without this fix, a refusal label on an item read via MCP tools would be ignored and the item would not be demoted to none. The fix ensures both approval promotion and refusal demotion work correctly on all read paths.

Tests Added

3 new unit tests covering the bare-string label shape for approval and refusal paths.

Test Status

Check	Result
Rust unit tests (cargo test)	✅ 585 passed, 0 failed
Go build/tests	⚠️ Infrastructure: proxy.golang.org network-blocked (pre-existing policy, unrelated to this change)

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• proxy.golang.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "proxy.golang.org"

See Network Configuration for more information.

Generated by Repo Assist · 182.1 AIC · ⊞ 10.8K · ◷
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@851905c06e905bf362a9f6cc54f912e3df747d55

[Copilot]

Pull request overview

Fixes label-policy enforcement for MCP tool responses that return labels as bare strings.

Changes:

• Supports both string and object label formats.
• Adds approval/refusal label regression tests.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/helpers.rs	Extracts labels from both API shapes and tests MCP behavior.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Medium