[rust-guard] Remove dead is_bot + eliminate format! allocation in check_file_secrecy

[Copilot]

Two small cleanups in the Rust WASM guard: remove a dead exported function and eliminate per-iteration heap allocations in a hot path.

Changes

• Remove is_bot (helpers.rs, mod.rs): Zero call sites, #[allow(dead_code)]-annotated, not reachable from outside a cdylib. Removed the function and its pub use re-export. Updated README.md to reflect the actual user classification helpers.

• Eliminate format! in check_file_secrecy (tool_rules.rs): Replace per-iteration format!("/{}", pattern) allocation with split('/').any(|seg| seg == *pattern). Cuts up to 9 heap allocations per call through WASM's linear-memory allocator.

// Before
if path_lower.ends_with(pattern) || path_lower.contains(&format!("/{}", pattern)) {

// After — no allocation, semantically equivalent for all patterns in SENSITIVE_FILE_PATTERNS
if path_lower.ends_with(pattern) || path_lower.split('/').any(|seg| seg == *pattern) {

SENSITIVE_FILE_PATTERNS contains only file extensions (.env, .pem, etc.) and SSH key names (id_rsa, etc.), so the segment-equality check is a precise match with no risk of false negatives.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build3145033519/b514/launcher.test /tmp/go-build3145033519/b514/launcher.test -test.testlogfile=/tmp/go-build3145033519/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -qui�� .cfg olang.org/protob-ifaceassert x_amd64/vet . ions =0 x_amd64/vet om/s�� .cfg 886553/b286/ x_amd64/vet --gdwarf-5 .io/otel/exporte-qE p=/opt/hostedtoo(create|run) x_amd64/vet (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build3145033519/b496/config.test /tmp/go-build3145033519/b496/config.test -test.testlogfile=/tmp/go-build3145033519/b496/testlog.txt -test.paniconexit0 -test.timeout=10m0s /tmp/go-build3145033519/b315/vet.cfg 1.80.0/status/stgo1.25.8 -I x_amd64/vet --gdwarf-5 nal/descopts -o x_amd64/vet -I _.a -I x_amd64/vet --gdwarf-5 telabs/wazero/in-atomic -o x_amd64/vet (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build3145033519/b514/launcher.test /tmp/go-build3145033519/b514/launcher.test -test.testlogfile=/tmp/go-build3145033519/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -qui�� .cfg olang.org/protob-ifaceassert x_amd64/vet . ions =0 x_amd64/vet om/s�� .cfg 886553/b286/ x_amd64/vet --gdwarf-5 .io/otel/exporte-qE p=/opt/hostedtoo(create|run) x_amd64/vet (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build3145033519/b514/launcher.test /tmp/go-build3145033519/b514/launcher.test -test.testlogfile=/tmp/go-build3145033519/b514/testlog.txt -test.paniconexit0 -test.timeout=10m0s -qui�� .cfg olang.org/protob-ifaceassert x_amd64/vet . ions =0 x_amd64/vet om/s�� .cfg 886553/b286/ x_amd64/vet --gdwarf-5 .io/otel/exporte-qE p=/opt/hostedtoo(create|run) x_amd64/vet (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build3145033519/b523/mcp.test /tmp/go-build3145033519/b523/mcp.test -test.testlogfile=/tmp/go-build3145033519/b523/testlog.txt -test.paniconexit0 -test.timeout=10m0s .cfg�� om/spf13/pflag@v1.0.9/bool.go om/spf13/pflag@v1.0.9/bool_func.go x_amd64/vet --gdwarf-5 g/grpc/grpclog -o x_amd64/vet .cfg�� 886553/b442/_pkg_.a -trimpath x_amd64/vet -p contextprotocol/docker-cli-plugin-metadata -lang=go1.25 x_amd64/vet (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

This PR makes two small cleanups in the github-guard Rust WASM labeling logic: removing a dead user-classification helper and optimizing a hot-path sensitive-file check to avoid per-iteration allocations.

Changes:

• Removed the unused is_bot helper and its pub use re-export, and updated module docs accordingly.
• Updated check_file_secrecy to avoid format! allocations while matching sensitive file patterns.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Adjusts sensitive-file path matching logic in check_file_secrecy to avoid heap allocations.
guards/github-guard/rust-guard/src/labels/README.md	Updates docs to reflect current user-classification helpers (removes is_bot).
guards/github-guard/rust-guard/src/labels/mod.rs	Removes is_bot from the public re-export list.
guards/github-guard/rust-guard/src/labels/helpers.rs	Deletes the dead is_bot helper implementation.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 2

[Copilot]

The new split('/').any(|seg| seg == *pattern) check is stricter than the previous contains(&format!("/{}", pattern)) behavior and will stop classifying paths where a segment starts with a sensitive name (e.g. .env.local, .envrc, id_rsa.old) as sensitive. Since check_file_secrecy is intended to force sensitive files to private:<owner>/<repo> regardless of repo visibility, this can create false negatives and weaken secrecy labeling. To preserve the prior matching semantics without allocations, consider using a segment-boundary prefix check (e.g. split('/').any(|seg| seg.starts_with(*pattern))) and add a test case covering a variant like .env.local.

Suggested change

	if path_lower.ends_with(pattern) || path_lower.split('/').any(|seg| seg == *pattern) {
	if path_lower.ends_with(pattern)
	|| path_lower.split('/').any(|seg| seg.starts_with(*pattern))
	{

[lpcox]

@copilot apply changes based on the comments in this thread

[Copilot]

@copilot apply changes based on the comments in this thread

Done in ad4fdba:

1. Changed seg == *pattern to seg.starts_with(*pattern) in check_file_secrecy — preserves the original behaviour for variants like .env.local, .envrc, id_rsa.old.
2. Removed the is_bot "Bot Detection" section (including the code block) from guards/github-guard/docs/IMPLEMENTATION.md.