guards/github-guard/rust-guard/src/labels/tool_rules.rs:452

• apply_tool_labels already calls backend::is_repo_private(&owner, &repo) to populate repo_private before the match, and apply_repo_visibility_secrecy() calls is_repo_private() again. With this change, get_job_logs now triggers a second visibility lookup (even if it hits the cache), which is a small but unnecessary per-call overhead. Consider reusing the already-computed repo_private (or refactoring apply_repo_visibility_secrecy to accept it) to avoid the duplicate backend call.

        "get_job_logs" => {
            // S = inherits from repo visibility (public repo logs are public)
            // I = approved — CI output is system-generated, not user-controlled
            secrecy = apply_repo_visibility_secrecy(&owner, &repo, repo_id, secrecy, ctx);
            integrity = writer_integrity(repo_id, ctx);

guards/github-guard/rust-guard/src/labels/tool_rules.rs:452

• SECRECY_TAG_SPEC.md currently documents get_job_logs as secret for both public and private repos, but this PR changes it to inherit repo visibility. Please update the spec (and any other docs referencing job logs secrecy) so the documentation matches the new policy.

        "get_job_logs" => {
            // S = inherits from repo visibility (public repo logs are public)
            // I = approved — CI output is system-generated, not user-controlled
            secrecy = apply_repo_visibility_secrecy(&owner, &repo, repo_id, secrecy, ctx);
            integrity = writer_integrity(repo_id, ctx);

guards/github-guard/rust-guard/src/labels/tool_rules.rs:320

• The new comment for the actions_get/actions_list arm is workflow/artifact-specific, but this match arm also covers other Actions methods (e.g., secrets/variables/caches per proxy routing). Consider broadening the wording (or splitting by method) so the comment accurately describes the full surface area handled here.

            // S(workflow/artifact) = inherits from repo visibility
            // Public repos: artifacts are public. Private repos: artifacts are private-scoped.
            // I(workflow/artifact) = approved - maintained by repo team

guards/github-guard/rust-guard/src/labels/tool_rules.rs:323

• This change removes the only method-specific secrecy logic for actions_get (download_workflow_run_artifact). There currently isn’t a unit test covering apply_tool_labels("actions_get", {method: "download_workflow_run_artifact", ...}) to prevent accidentally reintroducing secret_label() or other method-specific behavior later. Please add a focused test for this method under the labels tests.

        "actions_get" | "actions_list" => {
            // S(workflow/artifact) = inherits from repo visibility
            // Public repos: artifacts are public. Private repos: artifacts are private-scoped.
            // I(workflow/artifact) = approved - maintained by repo team
            secrecy = apply_repo_visibility_secrecy(&owner, &repo, repo_id, secrecy, ctx);
            integrity = writer_integrity(repo_id, ctx);
        }