rust-guard: eliminate hot-path allocations in file secrecy and baseline scope inference

[Copilot]

✨ Enhancement

This change removes two avoidable heap allocations in Rust Guard hot paths used during tool labeling. It keeps behavior unchanged while reducing per-call overhead in get_file_contents secrecy checks and baseline scope inference.

What does this improve?
Lower allocation pressure in frequently executed labeling paths.

Why is this valuable?
These paths run on nearly every label_resource / label_response dispatch, so small per-call savings compound quickly.

Implementation approach:

• check_file_secrecy now uses lazy path iteration (labels/tool_rules.rs)
  • Removed Vec<&str> collection from path_lower.split('/').collect().
  • Replaced segment checks with path_lower.split('/').any(...).
  • Replaced filename extraction via last() with path_lower.rsplit('/').next().
• infer_scope_for_baseline now returns Cow<'_, str> (lib.rs)
  • Switched return type from String to Cow<'_, str>.
  • Common branches now borrow (repo_id, scope_names::GITHUB, and empty scope).
  • Only search_* query extraction returns owned data.
• Focused test updates
  • Added branch-level assertions for Cow::Borrowed/Cow::Owned behavior in infer_scope_for_baseline.

fn infer_scope_for_baseline<'a>(
    tool_name: &str,
    tool_args: &Value,
    repo_id: &'a str,
) -> Cow<'a, str> {
    if !repo_id.is_empty() {
        return Cow::Borrowed(repo_id);
    }

    match tool_name {
        "create_repository" | "fork_repository" => Cow::Borrowed(scope_names::GITHUB),
        "search_code" | "search_issues" | "search_pull_requests" => {
            let query = tool_args.get("query").and_then(|v| v.as_str()).unwrap_or("");
            let (_, _, repo_from_query) = extract_repo_info_from_search_query(query);
            Cow::Owned(repo_from_query)
        }
        _ => Cow::Borrowed(""),
    }
}

[Copilot]

Pull request overview

This PR reduces allocations in Rust Guard labeling hot paths by using borrowed scope strings where possible and avoiding segment collection during file secrecy checks.

Changes:

• infer_scope_for_baseline now returns Cow<str> and borrows common baseline scopes.
• File secrecy path checks avoid collecting split segments into a Vec.
• Tests add assertions for borrowed vs owned baseline inference behavior.

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/lib.rs	Updates baseline scope inference to use Cow and adds branch-level tests.
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Replaces eager path segment collection with lazy path splitting.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 2/2 changed files
• Comments generated: 2