What happened
The review agent for PR #5 on rhdh-parasol/plugin-empty failed at the pre-flight connectivity check in workflow run 33521605477. The error was: pre-flight connectivity check: GitHub API unreachable from sandbox (HTTP 403 - proxy allowlist issue): Get "https://api.github.com/rate_limit": Forbidden. The sandbox was running OpenShell v0.0.83 on an Azure eastus runner. All prior steps (checkout, workspace prep, token minting, GCP setup, agent env setup) succeeded — only the sandbox network connectivity failed.
What could go better
The review agent was completely unable to function because the sandbox proxy blocked outbound HTTPS to api.github.com. This is a hard prerequisite for any agent that needs to interact with GitHub (posting comments, fetching PR diffs, etc.). Without it, the entire review pipeline is a no-op.
Confidence: High that this is a real infrastructure issue, not a transient blip. The error message is specific (proxy allowlist issue, not a timeout or DNS failure), and the pre-flight check is designed to catch exactly this class of problem. Moderate confidence on root cause — it could be (a) a missing entry in the OpenShell gateway proxy allowlist, (b) a regression in OpenShell v0.0.83, or (c) a region-specific network policy issue on Azure eastus. Investigation is needed to determine which.
No existing open issues were found covering this in fullsend-ai/fullsend, fullsend-ai/agents, or rhdh-parasol/plugin-empty.
Proposed change
Investigate and fix the OpenShell gateway proxy allowlist to ensure api.github.com (and likely *.github.com) is permitted for HTTPS CONNECT from within sandboxes. The error message in the harness already points to the right area: "Check the OpenShell gateway network policy and proxy allowlist configuration." Specific steps:
- Check the OpenShell gateway proxy allowlist configuration for the sandbox environment to verify whether
api.github.com is included.
- If missing, add it. If present, investigate whether OpenShell v0.0.83 introduced a regression in proxy handling or whether the Azure eastus region has a different network policy.
- Verify the fix by re-running a review agent on a test PR.
Validation criteria
The next 3 review agent runs on rhdh-parasol/plugin-empty (or any repo using the same sandbox infrastructure) should pass the pre-flight connectivity check without HTTP 403 errors. The pre-flight step should report successful GitHub API connectivity.
Generated by retro agent from rhdh-parasol/plugin-empty#5
What happened
The review agent for PR #5 on
rhdh-parasol/plugin-emptyfailed at the pre-flight connectivity check in workflow run 33521605477. The error was:pre-flight connectivity check: GitHub API unreachable from sandbox (HTTP 403 - proxy allowlist issue): Get "https://api.github.com/rate_limit": Forbidden. The sandbox was running OpenShell v0.0.83 on an Azure eastus runner. All prior steps (checkout, workspace prep, token minting, GCP setup, agent env setup) succeeded — only the sandbox network connectivity failed.What could go better
The review agent was completely unable to function because the sandbox proxy blocked outbound HTTPS to
api.github.com. This is a hard prerequisite for any agent that needs to interact with GitHub (posting comments, fetching PR diffs, etc.). Without it, the entire review pipeline is a no-op.Confidence: High that this is a real infrastructure issue, not a transient blip. The error message is specific (
proxy allowlist issue, not a timeout or DNS failure), and the pre-flight check is designed to catch exactly this class of problem. Moderate confidence on root cause — it could be (a) a missing entry in the OpenShell gateway proxy allowlist, (b) a regression in OpenShell v0.0.83, or (c) a region-specific network policy issue on Azure eastus. Investigation is needed to determine which.No existing open issues were found covering this in
fullsend-ai/fullsend,fullsend-ai/agents, orrhdh-parasol/plugin-empty.Proposed change
Investigate and fix the OpenShell gateway proxy allowlist to ensure
api.github.com(and likely*.github.com) is permitted for HTTPS CONNECT from within sandboxes. The error message in the harness already points to the right area: "Check the OpenShell gateway network policy and proxy allowlist configuration." Specific steps:api.github.comis included.Validation criteria
The next 3 review agent runs on
rhdh-parasol/plugin-empty(or any repo using the same sandbox infrastructure) should pass the pre-flight connectivity check without HTTP 403 errors. The pre-flight step should report successful GitHub API connectivity.Generated by retro agent from rhdh-parasol/plugin-empty#5