Clean stale GitHub guard coverage cache entries

[Copilot]

The guard already models the reported CLI write operations under canonical synthetic identifiers, but persisted coverage state retained obsolete gh … command spellings. This caused recurring false-positive coverage findings.

• Cache normalization
  • Direct the coverage workflow to remove stale CLI placeholders from known_gaps and last_all_gaps.
  • Preserve canonical guard identifiers when they represent actual gaps.

gh repo sync       → sync_fork
gh issue transfer  → transfer_issue
gh cache delete    → delete_actions_cache

• Workflow artifact
  • Regenerated github-mcp-guard-coverage-checker.lock.yml for the updated prompt.

• Fixes [guard-coverage] Guard coverage gap: 11 operations from github-mcp-server / GitHub CLI not fully covered #12204

[Copilot]

🟢 Approval recommended

The normalization mappings match the guard’s canonical CLI operation identifiers, with no unresolved issues found.

Pull request overview

Updates the guard coverage workflow to prevent obsolete GitHub CLI names from recurring as false-positive gaps.

Changes:

• Removes ten stale CLI spellings while preserving canonical identifiers for real gaps.
• Regenerates the compiled workflow artifact.

File summaries

File	Description
.github/workflows/github-mcp-guard-coverage-checker.md	Adds cache normalization instructions.
.github/workflows/github-mcp-guard-coverage-checker.lock.yml	Regenerates the workflow with updated tooling.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	401 Bad credentials	ALLOWED	⚠️
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	401 / no catalog	BLOCKED	⚠️
C	CLI	reads	gh not authenticated	ALLOWED	⚠️
D	CLI	REST writes	gh not authenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations	gh not authenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ All rows INCONCLUSIVE: the docker-sbx environment's GH_TOKEN was invalid (401 Bad credentials) so no MCP tool call or gh command could authenticate. The read-only guarantee could not be confirmed or denied for this runtime. This is an infrastructure/prerequisites gap (no valid token configured for the microVM), not a security failure.

Prerequisites needed to run this variant end-to-end: valid GH_TOKEN/GITHUB_TOKEN inside the KVM microVM, DOCKER_PAT/DOCKER_USERNAME secrets, and a KVM-capable self-hosted runner. See workflow instructions.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A1	MCP	list_issues	data returned	ALLOWED	✅
A2	MCP	list_pull_requests	data returned	ALLOWED	✅
A3	MCP	get_file_contents	data returned	ALLOWED	✅
A4	MCP	list_commits	data returned	ALLOWED	✅
B1	MCP	add_issue_comment (reaction)	tool absent from catalog	BLOCKED	⚠️
B2	MCP	star_repository	tool absent from catalog	BLOCKED	⚠️
B3	MCP	issue_write/create_issue	tool absent from catalog	BLOCKED	⚠️
B4	MCP	add_issue_comment (body)	tool absent from catalog	BLOCKED	⚠️
B5	MCP	create_branch	tool absent from catalog	BLOCKED	⚠️
B6	MCP	create_or_update_file	tool absent from catalog	BLOCKED	⚠️
B7	MCP	create_pull_request	tool absent from catalog	BLOCKED	⚠️
C1	CLI	list_issues	data returned	ALLOWED	✅
C2	CLI	get_file_contents	data returned	ALLOWED	✅
D1-D6	CLI REST	writes	gh unauthenticated	BLOCKED	⚠️
E1-E3	CLI GraphQL	mutations	gh unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ INCONCLUSIVE gaps:

• Part B: All 7 write-tool targets were absent from the MCP tool catalog (backend runs with GITHUB_READ_ONLY=1 via getGitHubReadOnly() in gh-aw, so write tools are never registered). The catalog exposed only 23 read-only tools. This confirms the backend defense-in-depth layer but cannot independently confirm mcpg's own DIFC/guard enforcement on write tool calls. No write leaked.
• Parts D & E: gh CLI is not authenticated in this sandbox (GH_TOKEN not set). REST and GraphQL write boundary tests could not be executed; all 9 rows are inconclusive, not confirmed blocked. No write leaked.

No writes succeeded. Zero FAILs.

References: §33409341415

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime