Skip to content

Formal spec alignment for GitHub MCP access-control conformance docs and predicate mapping #47633

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
pelikhan merged 3 commits into from
Jul 24, 2026
+7 −18
Merged

Formal spec alignment for GitHub MCP access-control conformance docs and predicate mapping #47633

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ba4657d
Initial plan
Copilot Jul 23, 2026
0d9f0c6
Align formal access-control spec usage and predicate label
Copilot Jul 23, 2026
a3ab164
Merge branch 'main' into copilot/formal-spec-github-mcp-access-contro…
pelikhan Jul 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion pkg/workflow/github_mcp_access_control_formal_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ func TestFormal_WildcardMatch(t *testing.T) {
}

func TestFormal_OmittedReposAllowAll(t *testing.T) {
// P1_RepoMatch: omitted repos field means "no restriction" — all accessible repos are allowed (spec §4.4.1).
// P2_RepoMatch: omitted repos field means "no restriction" — all accessible repos are allowed (spec §4.4.1).
assert.True(t, formalEvaluateAccess(formalToolConfig{}, formalAccessRequest{Repository: "github/gh-aw"}).allow)
assert.True(t, formalEvaluateAccess(formalToolConfig{}, formalAccessRequest{Repository: "microsoft/vscode"}).allow)

Expand Down
23 changes: 6 additions & 17 deletions specs/github-mcp-access-control-compliance/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -123,28 +123,17 @@ and no error is returned.
4. Update `expected` fields to match the required outcome.
5. Register the new fixture in the table above and link it from §11.4 of the specification.

## Running Compliance Tests
## Usage

Compliance tests that consume these fixtures are located in (or will be added to):

```
pkg/workflow/tools_validation_test.go — §11.1.1 configuration validation
pkg/workflow/tools_validation_test.go — §11.1.8 blocked-user tests
```

To run all related tests:

```bash
go test -v -run "TestValidateGitHubGuardPolicy" ./pkg/workflow/
```

To run the formal conformance test suite (predicate-mapped tests):
1. Copy or verify the test file at `pkg/workflow/github_mcp_access_control_formal_test.go`.
2. No stub interfaces are needed — all types and helpers are self-contained in the file.
3. Run predicate-mapped tests:

```bash
go test -v -run "TestFormal_(ExactMatch|WildcardMatch|OmittedRepos|RoleFilter|PrivateRepo|BlockedUser|ToolName|IntegrityLevel|UnknownContent|InvalidMinIntegrity|CombinedFilters|ErrorCode|NoSpurious)" ./pkg/workflow/
go test -v -run "TestFormal_" ./pkg/workflow/
```

To run the YAML fixture runner (drives every scenario from the fixture files above through the formal evaluator):
4. Run only the fixture runner:

```bash
go test -v -run "TestFormal_FixtureRunner" ./pkg/workflow/
Expand Down
Loading