Centralize Rust guard issue_read skip logic and mutation constants (#14903)

Both response labelers duplicated the `issue_read` skip condition,
including its `get_comments` exception. Granular mutation tools also
repeated raw names across operation lists and labeling rules.

- **Shared skip rule:** Extract `skip_issue_read_per_item_labeling` and
introduce `GET` / `GET_COMMENTS` constants. Preserve per-item labeling
for `get`, `get_comments`, and an empty method.
- **Mutation constants:** Centralize granular issue mutation names and
`unlock_pull_request`, then reuse them in operation lists and DIFC
rules.
- **Regression coverage:** Cover skip-rule edge cases and canonical
constant values.

Both response labelers now use:
```rust
if skip_issue_read_per_item_labeling(tool_name, method) {
    // Use resource-level labels.
}
```

No labeling or tool-classification behavior change is intended.

<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes #14878

Author: lpcox

guards/github-guard/rust-guard/src/labels/constants.rs

@@ -37,9 +37,10 @@ pub mod policy_integrity {
 #[cfg(test)]
 mod tests {
     use super::{
-        desc_default, desc_prefix, field_names, policy_integrity, tool_names, ORG_FIELD_ALIASES,
-        SENSITIVE_PATH_PREFIXES, UI_GET_ACCESS_SENSITIVE_METHODS, UI_GET_GITHUB_APPROVED_METHODS,
-        UI_GET_REPO_SCOPED_METHODS, UNKNOWN_LABEL_FALLBACK, URL_FALLBACK_FIELDS,
+        desc_default, desc_prefix, field_names, method_values, policy_integrity, tool_names,
+        ORG_FIELD_ALIASES, SENSITIVE_PATH_PREFIXES, UI_GET_ACCESS_SENSITIVE_METHODS,
+        UI_GET_GITHUB_APPROVED_METHODS, UI_GET_REPO_SCOPED_METHODS, UNKNOWN_LABEL_FALLBACK,
+        URL_FALLBACK_FIELDS,
     };
 
     /// Ensures ORDER_LOW_TO_HIGH_PIPED stays in sync with ORDER_HIGH_TO_LOW.
@@ -108,6 +109,27 @@ mod tests {
         );
     }
 
+    #[test]
+    fn method_and_issue_mutation_constants_match_canonical_values() {
+        assert_eq!(method_values::GET, "get");
+        assert_eq!(method_values::GET_COMMENTS, "get_comments");
+        assert_eq!(tool_names::CLOSE_ISSUE, "close_issue");
+        assert_eq!(tool_names::REOPEN_ISSUE, "reopen_issue");
+        assert_eq!(tool_names::LOCK_ISSUE, "lock_issue");
+        assert_eq!(tool_names::UNLOCK_ISSUE, "unlock_issue");
+        assert_eq!(tool_names::UNLOCK_PULL_REQUEST, "unlock_pull_request");
+        assert_eq!(tool_names::TRANSFER_ISSUE, "transfer_issue");
+        assert_eq!(tool_names::UNPIN_ISSUE, "unpin_issue");
+        assert_eq!(tool_names::UPDATE_ISSUE_ASSIGNEES, "update_issue_assignees");
+        assert_eq!(tool_names::UPDATE_ISSUE_BODY, "update_issue_body");
+        assert_eq!(tool_names::UPDATE_ISSUE_COMMENT, "update_issue_comment");
+        assert_eq!(tool_names::UPDATE_ISSUE_LABELS, "update_issue_labels");
+        assert_eq!(tool_names::UPDATE_ISSUE_MILESTONE, "update_issue_milestone");
+        assert_eq!(tool_names::UPDATE_ISSUE_STATE, "update_issue_state");
+        assert_eq!(tool_names::UPDATE_ISSUE_TITLE, "update_issue_title");
+        assert_eq!(tool_names::UPDATE_ISSUE_TYPE, "update_issue_type");
+    }
+
     #[test]
     fn dispatch_constants_match_canonical_values() {
         assert_eq!(tool_names::ACTIONS_GET, "actions_get");
@@ -288,6 +310,12 @@ pub mod field_names {
     pub const TYPE: &str = "type";
 }
 
+/// Canonical method values for read-style dispatch tools.
+pub mod method_values {
+    pub const GET: &str = "get";
+    pub const GET_COMMENTS: &str = "get_comments";
+}
+
 /// Fallback identifier used in labels when a response item lacks an expected field.
 pub const UNKNOWN_LABEL_FALLBACK: &str = "unknown";
 
@@ -370,6 +398,21 @@ pub mod tool_names {
     pub const GET_PULL_REQUEST: &str = "get_pull_request";
     pub const ISSUE_READ: &str = "issue_read";
     pub const GET_ISSUE: &str = "get_issue";
+    pub const CLOSE_ISSUE: &str = "close_issue";
+    pub const REOPEN_ISSUE: &str = "reopen_issue";
+    pub const LOCK_ISSUE: &str = "lock_issue";
+    pub const UNLOCK_ISSUE: &str = "unlock_issue";
+    pub const UNLOCK_PULL_REQUEST: &str = "unlock_pull_request";
+    pub const TRANSFER_ISSUE: &str = "transfer_issue";
+    pub const UNPIN_ISSUE: &str = "unpin_issue";
+    pub const UPDATE_ISSUE_ASSIGNEES: &str = "update_issue_assignees";
+    pub const UPDATE_ISSUE_BODY: &str = "update_issue_body";
+    pub const UPDATE_ISSUE_COMMENT: &str = "update_issue_comment";
+    pub const UPDATE_ISSUE_LABELS: &str = "update_issue_labels";
+    pub const UPDATE_ISSUE_MILESTONE: &str = "update_issue_milestone";
+    pub const UPDATE_ISSUE_STATE: &str = "update_issue_state";
+    pub const UPDATE_ISSUE_TITLE: &str = "update_issue_title";
+    pub const UPDATE_ISSUE_TYPE: &str = "update_issue_type";
     pub const LIST_PULL_REQUESTS: &str = "list_pull_requests";
     pub const LIST_PULL_REQUESTS_FF_FIELDS_PARAM: &str = "list_pull_requests_ff_fields_param";
     pub const GET_FILE_CONTENTS: &str = "get_file_contents";

guards/github-guard/rust-guard/src/labels/helpers.rs

@@ -10,7 +10,7 @@ use serde_json::Value;
 
 use super::backend::GithubMcpCallback;
 use super::constants::{
-    field_names, label_constants, scope_names, tool_names, UNKNOWN_LABEL_FALLBACK,
+    field_names, label_constants, method_values, scope_names, tool_names, UNKNOWN_LABEL_FALLBACK,
     URL_FALLBACK_FIELDS,
 };
 
@@ -1165,7 +1165,15 @@ pub(crate) fn is_non_get_read_sub_method(
     read_tool_name: &str,
     method: &str,
 ) -> bool {
-    tool_name == read_tool_name && !method.is_empty() && method != "get"
+    tool_name == read_tool_name && !method.is_empty() && method != method_values::GET
+}
+
+/// `issue_read` sub-methods whose responses are not issue objects, so per-item
+/// labeling is skipped (`get_comments` is handled by the item path).
+#[inline]
+pub(crate) fn skip_issue_read_per_item_labeling(tool_name: &str, method: &str) -> bool {
+    is_non_get_read_sub_method(tool_name, tool_names::ISSUE_READ, method)
+        && method != method_values::GET_COMMENTS
 }
 
 /// Extract a string field from a JSON value
@@ -4669,7 +4677,26 @@ mod tests {
 
 #[cfg(test)]
 mod is_non_get_read_sub_method_tests {
-    use super::is_non_get_read_sub_method;
+    use super::{
+        is_non_get_read_sub_method, method_values, skip_issue_read_per_item_labeling, tool_names,
+    };
+
+    #[test]
+    fn issue_read_per_item_labeling_skip_condition() {
+        for (tool_name, method, expected) in [
+            (tool_names::ISSUE_READ, method_values::GET, false),
+            (tool_names::ISSUE_READ, method_values::GET_COMMENTS, false),
+            (tool_names::ISSUE_READ, "get_labels", true),
+            (tool_names::ISSUE_READ, "", false),
+            (tool_names::LIST_ISSUES, "get_labels", false),
+        ] {
+            assert_eq!(
+                skip_issue_read_per_item_labeling(tool_name, method),
+                expected,
+                "tool={tool_name}, method={method}"
+            );
+        }
+    }
 
     #[test]
     fn matches_non_get_sub_methods() {
@@ -4690,7 +4717,7 @@ mod is_non_get_read_sub_method_tests {
         assert!(!is_non_get_read_sub_method(
             "pull_request_read",
             "pull_request_read",
-            "get"
+            method_values::GET
         ));
         assert!(!is_non_get_read_sub_method(
             "pull_request_read",
@@ -4704,12 +4731,12 @@ mod is_non_get_read_sub_method_tests {
         assert!(!is_non_get_read_sub_method(
             "issue_read",
             "pull_request_read",
-            "get_comments"
+            method_values::GET_COMMENTS
         ));
         assert!(!is_non_get_read_sub_method(
             "list_issues",
             "issue_read",
-            "get_comments"
+            method_values::GET_COMMENTS
         ));
     }
 }

guards/github-guard/rust-guard/src/labels/mod.rs

@@ -4004,7 +4004,7 @@ mod tests {
             "owner": "github",
             "repo": "gh-aw-mcpg",
             "issue_number": 2278,
-            "method": "get_comments"
+            "method": constants::method_values::GET_COMMENTS
         });
         let response = json!([
             {

guards/github-guard/rust-guard/src/labels/response_items.rs

@@ -273,15 +273,13 @@ pub fn label_response_items(
         | tool_names::GET_ISSUE
         | tool_names::ISSUE_READ => {
             // For issue_read sub-methods that return non-issue objects (e.g.
-            // get_comments, get_sub_issues, get_labels), skip per-item labeling.
+            // get_sub_issues, get_labels), skip per-item labeling.
             // Resource-level labels from tool_rules provide correct issue-scoped integrity.
             let method = tool_args
                 .get(field_names::METHOD)
                 .and_then(|v| v.as_str())
                 .unwrap_or("");
-            if is_non_get_read_sub_method(tool_name, tool_names::ISSUE_READ, method)
-                && method != "get_comments"
-            {
+            if skip_issue_read_per_item_labeling(tool_name, method) {
                 // Fall through — use resource-level labels from tool_rules
             } else {
                 let items = extract_items_slice(&actual_response, "issues");

guards/github-guard/rust-guard/src/labels/response_paths.rs

@@ -306,15 +306,13 @@ pub fn label_response_paths(
         | tool_names::SEARCH_ISSUES_FF_FIELDS_PARAM
         | tool_names::ISSUE_READ
         | tool_names::GET_ISSUE => {
-            // Skip per-item labeling for issue_read sub-methods (get_comments,
-            // get_sub_issues, get_labels). Resource-level labels from tool_rules apply.
+            // Skip per-item labeling for issue_read sub-methods (get_sub_issues,
+            // get_labels). Resource-level labels from tool_rules apply.
             let method = tool_args
                 .get(field_names::METHOD)
                 .and_then(|v| v.as_str())
                 .unwrap_or("");
-            if is_non_get_read_sub_method(tool_name, tool_names::ISSUE_READ, method)
-                && method != "get_comments"
-            {
+            if skip_issue_read_per_item_labeling(tool_name, method) {
                 // Fall through — use resource-level labels
             } else if let Some(repo_item_ctx) = resolve_repo_item_context(
                 tool_name,

guards/github-guard/rust-guard/src/labels/tool_rules.rs

@@ -315,8 +315,8 @@ pub fn apply_tool_labels(
         "issue_dependency_write"
         | "issue_dependency_write_ff_issue_dependencies"
         | "pin_issue"
-        | "transfer_issue"
-        | "unpin_issue" => {
+        | tool_names::TRANSFER_ISSUE
+        | tool_names::UNPIN_ISSUE => {
             if !owner.is_empty() && !repo.is_empty() {
                 if let Some(issue_num) =
                     extract_number_as_string(tool_args, field_names::ISSUE_NUMBER)
@@ -750,17 +750,17 @@ pub fn apply_tool_labels(
         | tool_names::CREATE_DISCUSSION // gh discussion create — creates a discussion in a repository
         | tool_names::EDIT_DISCUSSION // gh discussion edit   — edits title/body/labels of a discussion
         // Granular issue mutation
-        | "close_issue"
-        | "reopen_issue"
-        | "lock_issue"
-        | "unlock_issue"
-        | "update_issue_assignees"
-        | "update_issue_body"
-        | "update_issue_labels"
-        | "update_issue_milestone"
-        | "update_issue_state"
-        | "update_issue_title"
-        | "update_issue_type"
+        | tool_names::CLOSE_ISSUE
+        | tool_names::REOPEN_ISSUE
+        | tool_names::LOCK_ISSUE
+        | tool_names::UNLOCK_ISSUE
+        | tool_names::UPDATE_ISSUE_ASSIGNEES
+        | tool_names::UPDATE_ISSUE_BODY
+        | tool_names::UPDATE_ISSUE_LABELS
+        | tool_names::UPDATE_ISSUE_MILESTONE
+        | tool_names::UPDATE_ISSUE_STATE
+        | tool_names::UPDATE_ISSUE_TITLE
+        | tool_names::UPDATE_ISSUE_TYPE
         | "set_issue_fields"
         // Sub-issues
         | "add_sub_issue"
@@ -779,7 +779,7 @@ pub fn apply_tool_labels(
         | "mark_pull_request_as_draft"
         | "mark_pull_request_as_ready_for_review"
         | "lock_pull_request"
-        | "unlock_pull_request"
+        | tool_names::UNLOCK_PULL_REQUEST
         | "update_pull_request_body"
         | "update_pull_request_draft_state"
         | "update_pull_request_state"
@@ -820,7 +820,7 @@ pub fn apply_tool_labels(
         | "revert_pull_request"
         // Pre-emptive: issue deletion, issue comments, repository deletion, releases
         | tool_names::DELETE_ISSUE
-        | "update_issue_comment"
+        | tool_names::UPDATE_ISSUE_COMMENT
         | "delete_issue_comment"
         | tool_names::DELETE_REPOSITORY
         | tool_names::CREATE_RELEASE

guards/github-guard/rust-guard/src/lib.rs

@@ -1157,7 +1157,7 @@ mod tests {
                 "owner": "org",
                 "repo": "repo",
                 "issue_number": "7",
-                "method": "get_comments"
+                "method": labels::constants::method_values::GET_COMMENTS
             }),
             tool_result: json!([
                 {"id": 1, "body": "first"},