[test-improver] Improve tests for internal/util TruncateRunes

[github-actions]

File analyzed

internal/util/truncate_test.go (tests for internal/util/truncate.go)

Why this file

• Package coverage was already high (99.3%) and uses testify consistently, but TruncateRunes sat at 93.3% coverage with a documented invariant (invalid-UTF-8 normalization) that lacked broad edge-case testing.
• File was not recently modified in isolation (last touched only via a repo-wide schema bump commit).

Improvements made

• Added table-driven edge cases to TestTruncateRunes:
  • Multibyte string with more bytes than maxRunes but fewer actual runes (exercises the utf8.RuneCountInString early-return fast path).
  • Mixed ASCII + multibyte truncation mid-string.
  • maxRunes exactly one less than the rune count.
  • Single-rune ASCII string at the boundary.
• Added a new property-style test, TestTruncateRunes_TruncatedResultIsAlwaysValidUTF8, which asserts that whenever TruncateRunes actually truncates a string, the result is always valid UTF-8 — covering ASCII, multibyte (Japanese), emoji, and malformed-byte inputs, guarding the invariant documented in the function's doc comment.

Coverage

• Before: internal/util 99.3% overall; TruncateRunes 93.3%.
• After: internal/util 99.3% overall; TruncateRunes 93.3% (the remaining uncovered line is a defensive return s fallback at the end of the byte-walk loop that is unreachable given the preceding fast-path checks — kept as documented defensive code, not removed).

Test output

go test -count=3 ./internal/util/
ok  	github.com/github/gh-aw-mcpg/internal/util	0.011s
go vet ./internal/util/   # clean
gofmt -l internal/util/truncate_test.go   # no output (formatted)

All existing passing tests were preserved; only new cases and one new test function were added.

Generated by Test Improver · auto · 128.3 AIC · ⊞ 8.1K · ◷

[Copilot]

Pull request overview

Expands TruncateRunes tests with boundary, multibyte, and malformed UTF-8 cases.

Changes:

• Adds table-driven truncation edge cases.
• Adds UTF-8 validity invariant coverage.

Show a summary per file

File	Description
internal/util/truncate_test.go	Extends TruncateRunes tests and UTF-8 validation.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — default

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	unknown tool refused	BLOCKED	✅
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated	BLOCKED	✅

Notes:

• Part B: all 7 write tools refused by gateway with Error [-32602]: unknown tool "<name>"
• Parts D/E: gh has no GH_TOKEN; all REST/GraphQL writes rejected pre-flight
• No reaction, star, issue, comment, branch, file, or PR was created

Overall: PASS

References: §31141420886

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error[-32602]: unknown tool	BLOCKED	✅
C	CLI	reads	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	HTTP 401 Bad credentials	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	HTTP 401 Bad credentials	BLOCKED	✅

Overall: PASS

Note on Part B: All 7 write tool calls returned Error [-32602]: unknown tool — gateway allowlist strips write tools entirely, a gateway-enforced control.
Parts D & E blocked by HTTP 401 (gh unauthenticated in this runtime).

References: §31141420896

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime