[test-improver] Improve tests for internal/config (remote schema $ref byte budget)

[github-actions]

Summary

Improved test coverage for internal/config/validate_against_custom_schema_test.go, which tests the custom JSON-Schema validation path in internal/config/validation_schema.go and validation_server.go.

File analyzed

internal/config/validate_against_custom_schema_test.go (already testify-based; 97.2% package coverage before this change).

Improvement

Added TestValidateAgainstCustomSchema_RemoteRefByteBudgetIsEnforced, covering the previously-untested reserveBytes aggregate byte-budget error path in schemaURLLoader.Load (validation_schema.go). The existing test suite only covered the document-count budget (maxRemoteRefDocuments) for remote $ref chains, but not the aggregate byte-size budget (maxRemoteRefTotalBytes) enforced by reserveBytes.

The new test serves two remote $ref documents that are each individually under fetchSchema's per-fetch size limit, but together exceed the aggregate maxRemoteRefTotalBytes budget, verifying:

• The loader rejects the request once the cumulative byte budget is exhausted.
• The error message reports the exhausted byte budget ("too large").
• No unbounded fetching occurs (exactly 3 requests: root + 2 chained documents).

Coverage

• Before: reserveBytes 83.3%, package total 97.2%
• After: reserveBytes 100%, package total 97.4%

Test output

=== RUN   TestValidateAgainstCustomSchema_RemoteRefByteBudgetIsEnforced
--- PASS: TestValidateAgainstCustomSchema_RemoteRefByteBudgetIsEnforced (0.07s)
PASS
ok  	github.com/github/gh-aw-mcpg/internal/config	0.079s

Full package suite (go test -count=3 ./internal/config/) passes, gofmt -l reports no issues, and go vet ./internal/config/ is clean.

Generated by Test Improver · auto · 167.2 AIC · ⊞ 8.4K · ◷

[Copilot]

Pull request overview

Adds coverage for aggregate remote $ref byte-budget enforcement.

Changes:

• Tests cumulative schema size rejection.
• Verifies the expected error and request count.

Show a summary per file

File	Description
internal/config/validate_against_custom_schema_test.go	Adds remote-reference byte-budget coverage.

Review details

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc kernel-level isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool [-32602]	BLOCKED	⚠️
C	CLI	reads (list issues, get file)	data returned	ALLOWED	✅
D	CLI	REST writes	unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations	unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Part B gap: All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) are absent from the backend MCP catalog — the backend returns unknown tool [-32602] for every write call. This confirms the GITHUB_READ_ONLY=1 backend defense-in-depth guarantee holds, but does not independently exercise mcpg's own DIFC/guard enforcement layer (the write call never reaches a write-capable backend). Per methodology, this is INCONCLUSIVE, not PASS.

⚠️ Parts D & E gap: gh CLI is not authenticated in this environment (gh auth status → not logged in). All REST and GraphQL write attempts would 401 unconditionally regardless of gateway enforcement. These rows cannot confirm the token-scope boundary in this run and are marked INCONCLUSIVE.

No writes leaked through. No FAIL conditions observed.

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	list_issues	3 issues returned	ALLOWED	✅
A	MCP	list_pull_requests	3 PRs returned	ALLOWED	✅
A	MCP	get_file_contents(README.md)	file content returned	ALLOWED	✅
A	MCP	list_commits	3 commits returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all 7 tools absent from catalog	BLOCKED	⚠️
C	CLI	list_issues (github CLI bridge)	data returned	ALLOWED	✅
C	CLI	get_file_contents (github CLI bridge)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	unauthenticated	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	unauthenticated	BLOCKED	⚠️

Overall: INCONCLUSIVE

⚠️ Gaps noted:

• Part B: All 7 write tool targets were absent from the MCP tool catalog (backend runs with GITHUB_READ_ONLY=1). This confirms the defense-in-depth guarantee but does not independently confirm gateway-level DIFC/guard enforcement — write calls never reached a write-capable backend. Gateway enforcement is covered by internal/guard and internal/difc unit tests.
• Parts D/E: gh is not authenticated in this environment (GH_TOKEN not set). The token-scope boundary (read-only REST/GraphQL) could not be tested this run.

No writes leaked. All reads succeeded.

References: §32261095813

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (issues/PRs/file/commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	tool not found	BLOCKED	⚠️
C	CLI	reads (issues/file)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	401 Bad credentials	BLOCKED	⚠️
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	401 Bad credentials	BLOCKED	⚠️

Overall: INCONCLUSIVE

Notes:

• Part A: All 4 MCP read operations returned data. ✅
• Part B: All 7 write tools (add_issue_comment, star_repository, issue_write, create_branch, create_or_update_file, create_pull_request) were absent from the tool catalog — backend runs with GITHUB_READ_ONLY=1, so write tools are never registered. No writes leaked, but gateway-level DIFC enforcement was not independently exercised. INCONCLUSIVE per methodology.
• Part C: Both CLI read operations returned data via the MCP proxy. ✅
• Part D/E: gh CLI is not authenticated in this environment (token invalid, 401 on all calls). All 6 REST write attempts and 3 GraphQL mutations returned 401 Bad credentials. Refusals prove token invalidity, NOT gateway enforcement. INCONCLUSIVE per methodology.
• No writes leaked in any part. Security guarantee holds; methodology gap is that gateway's own DIFC layer was not independently probed for either MCP writes (tools absent) or CLI writes (token unauthenticated).

References: §32261095238

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime