[getappz]

Summary

• Item ci: require an approving review for non-self-authored PRs #241 (vent, medium severity): sandboxed dispatch jobs hit git push failures over SSH remotes (Bad owner or permissions on /etc/ssh/ssh_config.d/20-systemd-ssh-proxy.conf) and gh run view --log/gh pr checks failures (read-only file system on ~/.cache/gh) — both trace back to the bwrap sandbox's --unshare-user read-only root.
• Rather than reworking the sandbox's uid-mapping (security-sensitive, unverifiable without live sandbox access), documented the known workaround in AGENTS.md's Git section, matching this repo's existing convention for dispatch-environment quirks (see the neighboring "Cargo target-dir isolation" section).
• Workaround: push via HTTPS using gh's stored credentials (git -c credential.helper='!gh auth git-credential' push https://...), and redirect XDG_CACHE_HOME to a writable dir before gh cache-writing subcommands.

Test plan

• Docs-only change; no build/test required.
• Verified this worktree's own push succeeds (its origin remote is already HTTPS).

Summary by CodeRabbit

• Documentation
  • Added guidance for resolving sandboxed dispatch failures when SSH ownership checks fail.
  • Documented using HTTPS with GitHub CLI credentials and configuring a writable cache directory for GitHub CLI commands.

[getappz]

Tracking this PR for automated review (flared:51bb8de6c33b).

[coderabbitai]

Warning

Review limit reached

Next included review available in 21 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 3 included reviews currently available. Your 41 included PR review attempts over the past 7 days set your current allowance at 3 reviews per hour.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: 4d5b6892-32c0-4afc-8aa0-5d9b1a9f8cd1

📥 Commits

Reviewing files that changed from the base of the PR and between a41af4b and f6711d8.

📒 Files selected for processing (1)

• AGENTS.md

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Essentials

Run ID: e25e5cff-739f-4020-a587-f7865381ea77

📥 Commits

Reviewing files that changed from the base of the PR and between e9748a8 and a41af4b.

📒 Files selected for processing (1)

• AGENTS.md

Included review availability: 1 review is currently available. Your included PR review attempts over the past 7 days set your current allowance at 4 reviews per hour.

---

📝 Walkthrough

Walkthrough

AGENTS.md adds troubleshooting guidance for sandboxed SSH push failures and GitHub CLI cache-write failures.

Changes

Sandboxed dispatch guidance

Layer / File(s)	Summary
Troubleshooting instructions AGENTS.md	Documents an HTTPS git push workaround that uses GitHub CLI credentials when SSH ownership checks fail. Adds XDG_CACHE_HOME redirection commands for gh run view --log and gh pr checks when the root filesystem is read-only.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to a41af

This change adds troubleshooting documentation only; no concrete user or production impact is indicated, so it is mergeable with normal documentation checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the documentation change and its SSH push and GitHub CLI cache workaround.
Description check	✅ Passed	The description includes the change summary, rationale, workaround details, and test plan. It does not include the template's separate Notes for reviewers section, but it provides the relevant risk an…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch task/241-vent-git-push-over-ssh-remote-git-github

Warning

Git: CodeRabbit could not clone the repository, so clone-backed analysis was skipped and this review may be incomplete. Verify repository clone access, such as SSH credentials, before requesting another full review. If clone access is intentionally unavailable, use path_filters to narrow the review scope.

---

_{Comment @coderabbitai help to get the list of available commands.}