* Add ifc label for get_file_contents tool
Emits an IFC SecurityLabel on the get_file_contents tool result when the
InsidersMode flag is enabled, mirroring the pattern landed for get_me in
Public repositories are labelled PublicUntrusted (anyone can author file
content via pull requests). Private repositories are labelled
PrivateTrusted with the repository owner as a placeholder reader, since
only collaborators can land changes there. Full collaborator enumeration
is intentionally deferred to a follow-up shared helper.
A new exported FetchRepoIsPrivate helper wraps Repositories.Get for
visibility lookups; it is invoked lazily and only when InsidersMode is
on, so non-insiders pay no extra round trip. Visibility lookup failures
skip the label rather than fail the user-facing call.
Refs github/copilot-mcp-core#1623, github/copilot-mcp-core#1389.
* get_file_contents: address Copilot review findings
- FetchRepoIsPrivate: tighten doc to 'returns whether a repository is
private' and close the underlying *github.Response body.
- attachIFC: skip emitting the ifc label when the repository visibility
lookup fails, instead of falling through to PublicUntrusted (which
would mislabel a private or unknown-visibility repo as public). The
failure is no longer cached so a subsequent return path can retry.
- Add a test asserting the tool still succeeds and omits result.Meta ["ifc"] when the visibility lookup returns 500.
Gökhan Arkan
0cdcd4aa73