Replace ingress IFC reader list with private marker#2478
Merged
Conversation
Switches the ingress IFC labels from emitting a per-repo collaborator list to a single 'private' marker. The CLI engine now fetches readers from the GitHub endpoint on demand at egress decision time (P-F check), with pagination + caching, which removes a wire-bloat ceiling for repos with thousands of collaborators. Drops the per-call FetchRepoCollaborators from list_issues, issue_read, get_file_contents, search_issues, and search_repositories. The shared LabelSearchIssues helper collapses to a single []bool argument; the intersection logic and length-mismatch failure mode go away. This is a breaking wire-format change for _meta.ifc consumers — coordinate with the CLI cut-over. Refs github/copilot-mcp-core#1389.
Contributor
There was a problem hiding this comment.
Pull request overview
Replaces the per-result IFC collaborator (reader) list with a single opaque private marker, so private-repo labels no longer carry the full collaborator set on the wire. Callers (the CLI engine) are expected to resolve concrete readers on demand at egress decision time. This is a breaking wire-format change for _meta.ifc.
Changes:
pkg/ifc: addConfidentialityPrivate; simplifyPrivateTrusted/PrivateUntrustedto take no readers; replaceLabelSearchIssues(visibilities, readerSets) (label, ok)withLabelSearchIssues(visibilities) label; droptoConfidentiality/intersectReadershelpers.pkg/githubingress paths (issues.go,repositories.go,search.go): stop callingFetchRepoCollaboratorsand stop accepting/computingreaderSets; rely solely on visibility.- Tests updated across
ifc_test.go,issues_test.go,repositories_test.go,search_test.goto reflect the marker-only output and the newLabelSearchIssuessignature.
Show a summary per file
| File | Description |
|---|---|
| pkg/ifc/ifc.go | New private confidentiality marker; readers removed from constructors and LabelSearchIssues; helper functions deleted. |
| pkg/ifc/ifc_test.go | Tests rewritten for marker semantics and the new single-return-value signature. |
| pkg/github/search.go | attachSearchRepositoriesIFCLabel no longer fetches collaborators; signature simplified; passes only visibilities. |
| pkg/github/search_test.go | Drops collaborator mocks/fixtures; asserts private marker instead of reader lists. |
| pkg/github/repositories.go | GetFileContents IFC closure drops ifcReaders and collaborator fetching; comment updated. |
| pkg/github/repositories_test.go | Removes collaborator mock; expects [private] confidentiality for private repos. |
| pkg/github/issues.go | issue_read, search_issues post-process, and list_issues drop collaborator fetches and reader fallback to owner. |
| pkg/github/issues_test.go | Removes collaborator mocks, fixtures, and the "collaborators lookup fails" subtests; updates expectations to the private marker. |
Copilot's findings
- Files reviewed: 8/8 changed files
- Comments generated: 1
Addresses Copilot review on #2478. The helper is no longer called by the server itself; ingress emits a 'private' marker and the client engine resolves readers on demand. Kept exported per the library-consumer convention; updated the comment to reflect the new role.
JoannaaKL
reviewed
May 14, 2026
JoannaaKL
reviewed
May 14, 2026
…a scalar Per Joanna's review on #2478: - Remove FetchRepoCollaborators entirely (no callers left after the marker switch). Drops the GetReposCollaboratorsByOwnerByRepo mock route too. - Change SecurityLabel.Confidentiality from []Confidentiality to a scalar Confidentiality. Wire format is now {integrity, confidentiality} where confidentiality is a single 'public' or 'private' string. Updated all tests and the LabelSearchIssues helper accordingly.
JoannaaKL
approved these changes
May 14, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ingress IFC labels now emit a single
privatemarker instead of the full collaborator list. The CLI engine fetches readers on demand at egress decision time (with pagination + caching), removing a wire-bloat ceiling for large private repos. DropsFetchRepoCollaboratorsfrom all five ingress hot paths. Breaking wire-format change for_meta.ifc— coordinate with the CLI cut-over. Refs github/copilot-mcp-core#1389.