Function transformRepoPattern

pkg/workflow/mcp_github_config.go:517–525

transformRepoPattern transforms a repos pattern to the corresponding accept pattern. Rules: - "O/*" → "private:O" (owner wildcard → strip wildcard) - "O/P*" → "private:O/P*" (prefix wildcard → keep as-is) - "O/R" → "private:O/R" (specific repo → keep as-is)

(pattern string)

//   - "O/P*" → "private:O/P*" (prefix wildcard → keep as-is)
//   - "O/R"  → "private:O/R" (specific repo → keep as-is)
func transformRepoPattern(pattern string) string {
	// Check if pattern ends with "/*" (owner wildcard)
	if owner, found := strings.CutSuffix(pattern, "/*"); found {
		// Strip the wildcard: "owner/*" → "private:owner"
		return "private:" + owner
	}
	// All other patterns (including "O/P*" prefix wildcards): add "private:" prefix
	return "private:" + pattern
}

// deriveWriteSinkGuardPolicyFromWorkflow derives a write-sink guard policy for non-GitHub MCP servers
// from the workflow's GitHub guard-policy configuration. This uses the same derivation as