rust-guard: downscope pub→pub(crate) for labels/helpers internals; add deploy key test

[Copilot]

~38 functions in helpers.rs were declared pub but never used outside labels/. The mod.rs re-export block silenced the resulting dead-export warnings with #[allow(unused_imports)], hiding real signal and bloating the public API surface.

helpers.rs — visibility reduction

Changed 37 functions from pub fn → pub(crate) fn. Functions that lib.rs actually calls remain pub:

// before
pub fn none_integrity(scope: &str, ctx: &PolicyContext) -> Vec<String> { … }
pub fn pr_integrity(…) -> Vec<String> { … }
pub fn secret_label() -> Vec<String> { … }

// after
pub(crate) fn none_integrity(scope: &str, ctx: &PolicyContext) -> Vec<String> { … }
pub(crate) fn pr_integrity(…) -> Vec<String> { … }
pub(crate) fn secret_label() -> Vec<String> { … }

mod.rs — re-export cleanup

• Removed #[allow(unused_imports)]
• Trimmed the pub use helpers::{…} block to the 14 items lib.rs actually imports
• Moved the remaining test-only symbols into a #[cfg(test)] pub(crate) use helpers::{…} block

// before — 29 items, suppressed warning
#[allow(unused_imports)]
pub use helpers:{ blocked_integrity, commit_integrity, …, none_integrity, pr_integrity, … };

// after — only what lib.rs uses
pub use helpers::{
    blocked_integrity, ensure_integrity_baseline, extract_repo_info, …,
    MinIntegrity, PolicyContext, PolicyScopeEntry, ScopeKind,
};
#[cfg(test)]
pub(crate) use helpers::{ commit_integrity, merged_integrity, pr_integrity, … };

tool_rules.rs — deploy key test coverage

Added apply_tool_labels_deploy_key_management_is_access_sensitive_with_writer_integrity to assert that add_deploy_key/delete_deploy_key carry access-sensitive (policy-private-scope) secrecy and writer-level integrity — the same pattern used by the existing user-key-management test added alongside it.

[Copilot]

Pull request overview

This PR reduces the public API surface of the Rust GitHub guard label helpers by tightening helper visibility and cleaning up label-module re-exports, and it adds a focused regression test to ensure deploy-key management tools are labeled as access-sensitive with writer-level integrity.

Changes:

• Downscopes many labels/helpers.rs functions from pub to pub(crate) to avoid exposing crate-internal helpers.
• Cleans up labels/mod.rs re-exports by removing unused/suppressed exports and separating test-only re-exports behind #[cfg(test)].
• Adds a new tool_rules.rs unit test covering deploy key management labeling (add_deploy_key / delete_deploy_key).

Show a summary per file

File	Description
guards/github-guard/rust-guard/src/labels/tool_rules.rs	Adds deploy-key labeling test asserting policy-private secrecy + writer integrity.
guards/github-guard/rust-guard/src/labels/mod.rs	Trims public re-exports and moves test-only helper re-exports behind cfg(test).
guards/github-guard/rust-guard/src/labels/helpers.rs	Reduces visibility of helper functions to pub(crate) where they’re not meant to be public API.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Low