[carogalvin]

Summary

Adds a read-only list_code_quality_findings tool to the code_quality toolset. It lists a repository's code quality findings through GET /repos/{owner}/{repo}/code-quality/findings and supports the state and direction filters plus cursor pagination.

Why

Closes #3560

What changed

• Added ListCodeQualityFindings in pkg/github/code_quality.go, modelled on list_dependabot_alerts:
  • Uses WithCursorPagination (perPage, after) and NewToolWithSchemaOptions, with ValidationInputSchema: inventory.CloneSchemaWithoutDefaults(schema).
  • Is marked ReadOnlyHint: true.
  • Uses translation keys TOOL_LIST_CODE_QUALITY_FINDINGS_*.
• Inputs: owner and repo are required. state accepts open or dismissed and defaults to open. direction accepts asc or desc and defaults to desc. These are the only filters the endpoint supports.
• go-github v92 has CodeQuality.ListFindings, but the tool sends a raw client.NewRequest to match GetCodeQualityFinding and to return the REST JSON unchanged to legacy clients.
• Added ListCodeQualityFindingsInput and CodeQualityFindingsOutput (findings plus pageInfo) to pkg/github/security_outputs.go:
  • Legacy protocols get the REST findings as returned, plus pageInfo.
  • Typed-output protocols get the existing CodeQualityFindingOutput DTO.
• Registered the tool in pkg/github/tools.go, right after GetCodeQualityFinding.
• Tests:
  • Test_ListCodeQualityFindings covers the toolsnap, schema assertions, defaults, the state and direction filters, cursor passthrough, the returned next cursor, 403 and 404 responses, and missing owner or repo.
  • Added the tool to the shared typed security output and compatibility tests.
• The endpoint's Link header includes a rel="last" link with an empty before= value. pageInfo reads cursors only from rel="next" and rel="prev", so it never returns that empty cursor. A test using the real header shape covers this.
• New toolsnap list_code_quality_findings.snap, and the README is regenerated.

MCP impact

• No tool or API changes
• Tool schema or behavior changed
• New tool added
  • New tool added: list_code_quality_findings. It is in the existing code_quality toolset. There is no feature flag, and the default toolsets are unchanged.

Prompts tested (tool changes only)

I tested these against a local build over stdio, using a repository that has Code Quality enabled.

• "List open code quality findings in monalisa/smile, 5 per page": returns 5 findings, hasNextPage: true, and a nextCursor.
• "Get the next page of code quality findings in monalisa/smile" (passing after): returns the next 5 findings in the same order as the REST API, with both cursors.
• "List dismissed code quality findings in monalisa/smile": returns only dismissed findings.
• "List the oldest code quality findings in monalisa/smile" (direction: asc): returns findings in ascending order.
• "List all open code quality findings in monalisa/smile, 100 per page": the count matches the repository's open-findings total.
• "List code quality findings in octocat/Hello-World", a repo without Code Quality: returns failed to list findings for repository 'octocat/Hello-World': ... 404 Not Found.
• state: closed: schema validation rejects it.

Security / limits

• No security or limits impact
• Auth / permissions considered
  • The tool uses the same auth as get_code_quality_finding: scopes.PublicRead(scopes.Repo), which needs the repo OAuth scope for private repositories.
  • No IFC label is attached, to stay consistent with get_code_quality_finding, which also has none. The other security list tools (Dependabot, code scanning, secret scanning) attach ifc.LabelSecurityAlert(). If maintainers prefer that convention, adding the label is a one-line change.
• Data exposure, filtering, or token/size limits considered

Tool renaming

• I am renaming tools as part of this PR (e.g. a part of a consolidation effort)
  • I have added the new tool aliases in deprecated_tool_aliases.go
• I am not renaming tools as part of this PR

Note: if you're renaming tools, you must add the tool aliases. For more information on how to do so, please refer to the official docs.

Lint & tests

• Linted locally with ./script/lint: passed, 0 issues.
• Tested locally with ./script/test: passed. UPDATE_TOOLSNAPS=true go test ./... also passed; it added one new snapshot and changed no others.

Docs

• Not needed
• Updated (README / docs / examples)
  • Regenerated the README with script/generate-docs. The only change is the new tool entry.