From 05d0d1ccad9171a808a8a40f93b264f2a4d44299 Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Thu, 16 Jul 2026 13:23:25 +0000
Subject: [PATCH] fix(rust-guard): set baseline_scope=GITHUB for search_users +
 add tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

search_users was missing baseline_scope = Cow::Borrowed(scope_names::GITHUB),
unlike the parallel search_orgs arm. This meant the tool's project:github
integrity label was resolved against the calling repo's scope (or an empty
scope) via ensure_integrity_baseline — returning a conservative repo-scoped
or none-floor label rather than the intended project:github integrity.

Fix: add the same baseline_scope override that search_orgs, security advisory,
and github_support_docs_search arms already use.

Also adds three new tests:
- test_apply_tool_labels_unstar_repository_public_secrecy_github_integrity
- test_apply_tool_labels_search_users_public_secrecy_github_integrity
- test_apply_tool_labels_search_users_with_repo_context

These tests were suggested in issue #9446 and verify that both tools yield
empty secrecy and project:github integrity regardless of calling repo context.

Resolves part of #9446.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../github-guard/rust-guard/src/labels/mod.rs | 84 +++++++++++++++++++
 .../rust-guard/src/labels/tool_rules.rs       |  1 +
 2 files changed, 85 insertions(+)

diff --git a/guards/github-guard/rust-guard/src/labels/mod.rs b/guards/github-guard/rust-guard/src/labels/mod.rs
index ed8e288d0..8a4508680 100644
--- a/guards/github-guard/rust-guard/src/labels/mod.rs
+++ b/guards/github-guard/rust-guard/src/labels/mod.rs
@@ -5793,6 +5793,90 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_apply_tool_labels_unstar_repository_public_secrecy_github_integrity() {
+        let ctx = default_ctx();
+        let tool_args = json!({
+            "owner": "github",
+            "repo": "copilot"
+        });
+
+        let (secrecy, integrity, _desc) = apply_tool_labels(
+            "unstar_repository",
+            &tool_args,
+            "github/copilot",
+            vec![],
+            vec![],
+            String::new(),
+            &ctx,
+        );
+
+        assert!(
+            secrecy.is_empty(),
+            "unstar_repository should have empty (public) secrecy — starring is a public action"
+        );
+        assert_eq!(
+            integrity,
+            project_github_label(&ctx),
+            "unstar_repository should have project:github integrity"
+        );
+    }
+
+    #[test]
+    fn test_apply_tool_labels_search_users_public_secrecy_github_integrity() {
+        let ctx = default_ctx();
+        let tool_args = json!({ "query": "octocat" });
+
+        let (secrecy, integrity, _desc) = apply_tool_labels(
+            "search_users",
+            &tool_args,
+            "",
+            vec![],
+            vec![],
+            String::new(),
+            &ctx,
+        );
+
+        assert!(
+            secrecy.is_empty(),
+            "search_users must have empty (public) secrecy — public user profiles"
+        );
+        assert_eq!(
+            integrity,
+            project_github_label(&ctx),
+            "search_users must have project:github integrity — GitHub-controlled user data"
+        );
+    }
+
+    #[test]
+    fn test_apply_tool_labels_search_users_with_repo_context() {
+        let ctx = default_ctx();
+        let tool_args = json!({ "query": "octocat" });
+
+        // Even with a repo_id, search_users is not repo-scoped: the baseline_scope is
+        // overridden to GITHUB so the integrity is always project:github regardless of
+        // the calling repo context.
+        let (secrecy, integrity, _desc) = apply_tool_labels(
+            "search_users",
+            &tool_args,
+            "github/copilot",
+            vec![],
+            vec![],
+            String::new(),
+            &ctx,
+        );
+
+        assert!(
+            secrecy.is_empty(),
+            "search_users must have empty (public) secrecy — public user profiles"
+        );
+        assert_eq!(
+            integrity,
+            project_github_label(&ctx),
+            "search_users with repo context must still have project:github integrity"
+        );
+    }
+
     #[test]
     fn test_apply_tool_labels_enable_toolset_public_secrecy_writer_integrity() {
         let ctx = default_ctx();
diff --git a/guards/github-guard/rust-guard/src/labels/tool_rules.rs b/guards/github-guard/rust-guard/src/labels/tool_rules.rs
index 104c695e9..4c09c9f39 100644
--- a/guards/github-guard/rust-guard/src/labels/tool_rules.rs
+++ b/guards/github-guard/rust-guard/src/labels/tool_rules.rs
@@ -502,6 +502,7 @@ pub fn apply_tool_labels(
             // S = public (empty)
             // I = project:github - GitHub's data
             secrecy = vec![];
+            baseline_scope = Cow::Borrowed(scope_names::GITHUB);
             integrity = project_github_label(ctx);
         }