What happened
The retro agent ran on konflux-ci/konflux-ci#8123, a Renovate dependency update PR. The agent attempted to call the GitHub API to retrieve PR metadata (state, labels, comments, reviews, CI status) using both the gh CLI and curl. All attempts failed because the sandbox proxy (10.200.0.1:3128) returned HTTP 403 on CONNECT tunnels to api.github.com:443. The GH_TOKEN environment variable was set, but the network path was blocked before authentication could occur.
This left the retro agent with only a shallow git clone (1 commit, no parent to diff against) and the repo's static files. It could not determine: whether a review agent ran, what it said, whether labels were applied correctly, what CI results looked like, or whether human reviewers intervened. The entire optimization-goal analysis (review quality, rework rate, token cost, time to resolution, autonomy readiness) was impossible.
What could go better
The retro agent needs read access to the GitHub API to do its job. Without it, the agent burns compute and tokens producing no actionable insights. This likely affects every retro agent invocation in this sandbox configuration, not just this PR.
Confidence: High — the proxy 403 was reproduced with both gh and curl -v, showing the block at the network layer. The failure is deterministic, not transient.
Uncertainty: It is unclear whether this is specific to the konflux-ci org's sandbox configuration or affects all retro agent sandboxes. The proxy may be intentionally restrictive for other agent types (code, fix) where outbound access is unnecessary, and the retro agent may need a different network policy.
Proposed change
Allow the retro agent's sandbox to make outbound HTTPS connections to api.github.com. This could be implemented as:
- Proxy allowlist: Add api.github.com to the proxy's allowlist for retro agent containers.
- Network policy: Configure a different network policy for the retro agent sandbox that permits GitHub API access.
- Pre-fetched context: Have the harness fetch PR metadata (state, labels, comments, reviews, check runs) before launching the sandbox and provide it as a local JSON file alongside the repo checkout. This would be the most secure approach since it eliminates the need for outbound network access entirely.
Option 3 (pre-fetched context) is the most robust — it decouples the agent from network access, makes the analysis reproducible, and avoids granting broad API access to the sandbox.
Validation criteria
- The retro agent can successfully retrieve PR metadata (title, state, labels, comments, reviews) for the originating PR.
- A retro run on a PR with review agent activity produces a summary that references specific review comments, labels, and CI results.
- No retro agent run fails with proxy or network errors when accessing the GitHub API.
Generated by retro agent from konflux-ci/konflux-ci#8123
What happened
The retro agent ran on konflux-ci/konflux-ci#8123, a Renovate dependency update PR. The agent attempted to call the GitHub API to retrieve PR metadata (state, labels, comments, reviews, CI status) using both the gh CLI and curl. All attempts failed because the sandbox proxy (10.200.0.1:3128) returned HTTP 403 on CONNECT tunnels to api.github.com:443. The GH_TOKEN environment variable was set, but the network path was blocked before authentication could occur.
This left the retro agent with only a shallow git clone (1 commit, no parent to diff against) and the repo's static files. It could not determine: whether a review agent ran, what it said, whether labels were applied correctly, what CI results looked like, or whether human reviewers intervened. The entire optimization-goal analysis (review quality, rework rate, token cost, time to resolution, autonomy readiness) was impossible.
What could go better
The retro agent needs read access to the GitHub API to do its job. Without it, the agent burns compute and tokens producing no actionable insights. This likely affects every retro agent invocation in this sandbox configuration, not just this PR.
Confidence: High — the proxy 403 was reproduced with both gh and curl -v, showing the block at the network layer. The failure is deterministic, not transient.
Uncertainty: It is unclear whether this is specific to the konflux-ci org's sandbox configuration or affects all retro agent sandboxes. The proxy may be intentionally restrictive for other agent types (code, fix) where outbound access is unnecessary, and the retro agent may need a different network policy.
Proposed change
Allow the retro agent's sandbox to make outbound HTTPS connections to api.github.com. This could be implemented as:
Option 3 (pre-fetched context) is the most robust — it decouples the agent from network access, makes the analysis reproducible, and avoids granting broad API access to the sandbox.
Validation criteria
Generated by retro agent from konflux-ci/konflux-ci#8123