Refactor util helper placement and improve TLS/API env discoverability by Copilot · Pull Request #10246 · github/gh-aw-mcpg

Copilot · 2026-07-28T16:37:29Z

This addresses semantic clustering findings around low-signal utility scatter and TLS discoverability. The change is intentionally structural: function behavior is preserved while file ownership and intent become clearer.

internal/util decomposition (remove catch-all)
- Deleted internal/util/util.go.
- Moved collection helpers into internal/util/collections.go:
  - SortedSetKeys
  - GetStringFromMap
- Moved formatting/conversion helpers into internal/util/format.go:
  - InterfaceToIntString
  - NormalizeStringCI
- Introduced internal/util/json.go for JSON-specific cloning:
  - DeepCloneJSON
TLS cross-reference for discoverability
- Added an explicit note in internal/httputil/tls.go (LoadGatewayTLS docs) pointing to internal/proxy.GenerateSelfSignedTLS for self-signed certificate generation.
GitHub env helper boundary clarification
- Added a package-level clarifying comment in internal/envutil/github.go explaining why GitHub-specific env resolution remains in envutil (shared env semantics across cmd/server/proxy layers, without HTTP package coupling).

// internal/util/json.go
package util

func DeepCloneJSON(v any) any {
	switch val := v.(type) {
	case map[string]any:
		clone := make(map[string]any, len(val))
		for k, v := range val {
			clone[k] = DeepCloneJSON(v)
		}
		return clone
	case []any:
		clone := make([]any, len(val))
		for i, v := range val {
			clone[i] = DeepCloneJSON(v)
		}
		return clone
	default:
		return v
	}
}

Fixes [refactor] Semantic Function Clustering Analysis — Refactoring Opportunities #10197

Copilot

Pull request overview

Reorganizes utility helpers by responsibility and clarifies TLS and GitHub environment helper boundaries.

Changes:

Splits catch-all utility helpers into collection, formatting, and JSON files.
Adds TLS generation cross-referencing.
Documents GitHub environment helper placement.

Show a summary per file

File	Description
`internal/util/util.go`	Removes the catch-all utility file.
`internal/util/collections.go`	Adds collection and map helpers.
`internal/util/format.go`	Adds numeric conversion and normalization helpers.
`internal/util/json.go`	Adds JSON deep-cloning.
`internal/httputil/tls.go`	Cross-references self-signed certificate generation.
`internal/envutil/github.go`	Explains GitHub environment helper ownership.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 6/6 changed files
Comments generated: 1
Review effort level: Medium

+// SortedSetKeys returns the keys of a string set (map[string]struct{}) as a sorted slice.
+// Returns an empty (non-nil) slice when the set is empty.
+func SortedSetKeys(set map[string]struct{}) []string {


lpcox · 2026-07-28T17:20:53Z

@copilot address review feedback

- Move TestSortedSetKeys and TestGetStringFromMap into collections_test.go - Move TestInterfaceToIntString and TestNormalizeStringCI into format_test.go - Create json_test.go with TestDeepCloneJSON - Delete util_test.go (catch-all no longer needed)

Copilot · 2026-07-28T17:25:47Z

@copilot address review feedback

Done in commit refactor: redistribute util tests to match source file structure. Each test group now lives alongside its source file: TestSortedSetKeys/TestGetStringFromMap moved to collections_test.go, TestInterfaceToIntString/TestNormalizeStringCI moved to format_test.go, TestDeepCloneJSON placed in the new json_test.go, and util_test.go deleted.

github-actions · 2026-07-28T18:11:54Z

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`unknown tool [-32602]`	BLOCKED	✅
C	CLI	reads (list issues, get file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	no token — refused	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	no token — refused	BLOCKED	✅

Overall: PASS

Part B writes refused with gateway MCP error [-32602]: unknown tool — gateway-enforced tool filtering confirmed.
Parts D & E: gh unauthenticated in this environment; all REST/GraphQL write attempts fail before reaching GitHub API.

References: §30382830779

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

github-actions · 2026-07-28T18:12:35Z

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`unknown tool [-32602]` @ gateway speed (~5–19 ms)	BLOCKED	✅
C	CLI	reads (list_issues/get_file via `github` CLI)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	`gh` unauthenticated — blocked before API	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	`gh` unauthenticated — blocked before GitHub API	BLOCKED	✅

Overall: PASS

Part B write tools absent from gateway-exposed tool list (≤19 ms vs ~1200 ms for reads), confirming gateway-level enforcement.
Part D/E: gh carries no token in this sandbox; all writes blocked at auth.

References: §30382830711

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

github-actions · 2026-07-28T18:15:46Z

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	`Error [-32602]: unknown tool` (gateway-enforced allowlist)	BLOCKED	✅
C	CLI	reads (`github list_issues`)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated — `GH_TOKEN` not set	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated — `GH_TOKEN` not set	BLOCKED	✅

Overall: PASS

Part B refusals are gateway-enforced (Error [-32602]: unknown tool) — the MCP Gateway exposes only read tools. Parts D & E were additionally blocked because gh is unauthenticated in this environment.

References: §30382831690

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

Initial plan

bafa3e8

Copilot AI assigned Copilot and lpcox Jul 28, 2026

Copilot started work on behalf of lpcox July 28, 2026 16:38 View session

Copilot AI linked an issue Jul 28, 2026 that may be closed by this pull request

[refactor] Semantic Function Clustering Analysis — Refactoring Opportunities #10197

Closed

4 tasks

Copilot AI added 2 commits July 28, 2026 16:40

refactor util helpers into focused files

6212349

docs: cross-reference TLS certificate generation helper

f6a994e

Copilot AI changed the title ~~[WIP] Refactor semantic function clustering analysis findings~~ Refactor util helper placement and improve TLS/API env discoverability Jul 28, 2026

Copilot AI requested a review from lpcox July 28, 2026 16:43

Copilot finished work on behalf of lpcox July 28, 2026 16:43

lpcox marked this pull request as ready for review July 28, 2026 17:00

Copilot AI review requested due to automatic review settings July 28, 2026 17:00

Copilot started reviewing on behalf of lpcox July 28, 2026 17:00 View session

Copilot AI reviewed Jul 28, 2026

View reviewed changes

Comment thread internal/util/collections.go

Comment on lines +8 to +10

// SortedSetKeys returns the keys of a string set (map[string]struct{}) as a sorted slice.

// Returns an empty (non-nil) slice when the set is empty.

func SortedSetKeys(set map[string]struct{}) []string {

This comment has been minimized.

Sign in to view

github-actions Bot added readonly-stress-pass-gvisor readonly-stress-pass-default labels Jul 28, 2026

This comment has been minimized.

Sign in to view

Copilot started work on behalf of lpcox July 28, 2026 17:21 View session

Copilot finished work on behalf of lpcox July 28, 2026 17:26

lpcox merged commit be46376 into main Jul 28, 2026
38 checks passed

lpcox deleted the copilot/refactor-semantic-function-clustering branch July 28, 2026 18:38

github-actions Bot mentioned this pull request Jul 28, 2026

Smoke Test: Copilot - 30388493625 #10264

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Refactor util helper placement and improve TLS/API env discoverability - #10246

Refactor util helper placement and improve TLS/API env discoverability#10246
lpcox merged 4 commits into
mainfrom
copilot/refactor-semantic-function-clustering

Copilot AI commented Jul 28, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jul 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

This comment has been minimized.

This comment has been minimized.

This comment has been minimized.

lpcox commented Jul 28, 2026

Uh oh!

Copilot AI commented Jul 28, 2026

Uh oh!

github-actions Bot commented Jul 28, 2026

🔒 mcpg Read-Only Stress — gVisor

Uh oh!

github-actions Bot commented Jul 28, 2026

🔒 mcpg Read-Only Stress — default

Uh oh!

github-actions Bot commented Jul 28, 2026

🔒 mcpg Read-Only Stress — docker-sbx

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 28, 2026 •

edited

Loading