fix(tasks): handle ReauthorizationRequired for GitHub repo access

[posthog]

Problem

The sandbox GitHub-token resolver (get_sandbox_github_token) raises ReauthorizationRequired when a user-authored or Slack-triggered run can't resolve a usable GitHub token and there's no team-level integration to fall back on. This is meant to be a user-actionable "re-link your GitHub account" signal.

The periodic credential-refresh path already treats it that way — it catches ReauthorizationRequired and converts it to CredentialUnavailableError, which is deliberately not captured to error tracking. But the three sandbox-provisioning activities caught it with a generic except Exception and re-raised it as GitHubAuthenticationError, whose constructor captures the cause to error tracking. So an expected re-auth state landed in the raw error stream as noise, mostly hitting the team building tasks rather than end users. A recent refactor that moved the raise into a new inner helper reshaped the stack and produced a second, distinct error-tracking issue on top of the original, and as more Slack-triggered runs flow through this path it could keep generating new fingerprints and mask genuinely broken auth.

Why: raised from an inbox report — the team building tasks was getting raw ReauthorizationRequired exceptions in error tracking from the sandbox GitHub-token path.

Changes

Catch ReauthorizationRequired explicitly in each provisioning call site — in provision_sandbox.py (initial provisioning and token injection on resume), get_sandbox_for_repository.py, and create_sandbox_from_snapshot.py — before the generic except Exception, and convert it to CredentialUnavailableError, mirroring the refresh path. The run still fails fatally with the same non-retryable outcome; it just no longer generates error-tracking issues for an expected re-auth state.

How did you test this code?

Added a regression test to test_sandbox_utils.py asserting that when the token resolver raises ReauthorizationRequired, provisioning surfaces CredentialUnavailableError (not GitHubAuthenticationError) — locking in that the signal stays out of the raw error stream. Ran the file's suite locally (13 passed). DB-backed tests in the broader tasks suite could not run in this environment (no Postgres); the new test needs no DB.

Automatic notifications

• Publish to changelog?
• Alert Sales and Marketing teams?

Docs update

🤖 Agent context

Autonomy: Fully autonomous

Investigated from the inbox report's contributing findings. Confirmed the noise mechanism: GitHubAuthenticationError.__init__ calls capture_exception(cause), and all four provisioning call sites wrapped the resolver in except Exception, so ReauthorizationRequired was captured. Chose to mirror the existing sandbox_credentials.py refresh handling (convert to CredentialUnavailableError, which sets capture=False) rather than change the raise sites in utils.py — the raise is the correct signal; only the boundary handling was wrong. Both exception types are non-retryable ProcessTaskFatalError, so the run's fatal outcome is unchanged. Invoked the /writing-tests skill before adding the regression test.

---

Created with PostHog Code from an inbox report

[trunk-io]

😎 Merged manually by @tatoalo - details.

[github-actions]

🤖 CI report

⚠️ Backend coverage — 69.0% of changed backend lines covered — 7 uncovered

🧪 Backend test coverage

Patch coverage — changed backend lines (products + core): ██████████████░░░░░░ 69.0% (16 / 23)

File	Patch	Uncovered changed lines
products/tasks/backend/temporal/process_task/activities/create_sandbox_from_snapshot.py	0.0%	5, 92–93
products/tasks/backend/temporal/process_task/activities/get_sandbox_for_repository.py	50.0%	188–189
products/tasks/backend/temporal/process_task/activities/provision_sandbox.py	66.7%	789–790

🤖 Agents: add a test covering the lines above, or note why under "How did you test this code?". Machine-readable gap list: the patch-coverage artifact on this run (gh run download 29997147650 -n patch-coverage), or the coverage-data block at the end of this comment.

Per-product line coverage (touched products)

Product	Coverage	Lines
demo	███████████░░░░░░░░░ 56.2%	1,497 / 2,663
tasks	██████████████░░░░░░ 69.2%	29,451 / 42,548
signals	████████████████░░░░ 79.2%	20,572 / 25,978
cdp	████████████████░░░░ 81.0%	3,144 / 3,881
data_modeling	█████████████████░░░ 82.8%	5,529 / 6,675
notebooks	█████████████████░░░ 85.3%	7,266 / 8,522
agent_platform	█████████████████░░░ 86.4%	3,807 / 4,405
actions	█████████████████░░░ 86.6%	717 / 828
cohorts	██████████████████░░ 87.8%	4,488 / 5,114
product_tours	██████████████████░░ 87.9%	1,303 / 1,482
exports	██████████████████░░ 88.4%	6,949 / 7,861
data_warehouse	██████████████████░░ 88.8%	11,867 / 13,358
engineering_analytics	██████████████████░░ 89.2%	5,641 / 6,323
conversations	██████████████████░░ 89.3%	16,820 / 18,834
dashboards	██████████████████░░ 89.4%	5,983 / 6,693
error_tracking	██████████████████░░ 89.7%	10,174 / 11,342
alerts	██████████████████░░ 89.9%	4,054 / 4,508
early_access_features	██████████████████░░ 90.1%	1,031 / 1,144
mcp_analytics	██████████████████░░ 90.1%	2,763 / 3,065
streamlit_apps	██████████████████░░ 90.4%	2,501 / 2,767
slack_app	██████████████████░░ 90.7%	9,028 / 9,951
marketing_analytics	██████████████████░░ 91.0%	11,792 / 12,964
stamphog	██████████████████░░ 91.1%	4,056 / 4,450
product_analytics	██████████████████░░ 91.3%	5,811 / 6,362
ai_observability	███████████████████░ 92.7%	14,995 / 16,168
surveys	███████████████████░ 93.0%	5,730 / 6,163
web_analytics	███████████████████░ 93.0%	14,178 / 15,237
posthog_ai	███████████████████░ 93.2%	1,326 / 1,422
approvals	███████████████████░ 93.3%	3,437 / 3,682
reminders	███████████████████░ 93.4%	468 / 501
workflows	███████████████████░ 93.6%	6,374 / 6,810
endpoints	███████████████████░ 94.1%	8,640 / 9,177
skills	███████████████████░ 94.5%	2,893 / 3,061
revenue_analytics	███████████████████░ 94.6%	3,651 / 3,858
review_hog	███████████████████░ 94.7%	6,814 / 7,199
logs	███████████████████░ 95.4%	9,935 / 10,416
experiments	███████████████████░ 95.7%	25,036 / 26,159
replay_vision	███████████████████░ 96.2%	14,973 / 15,572
annotations	███████████████████░ 96.2%	732 / 761
feature_flags	███████████████████░ 96.5%	17,110 / 17,734
user_interviews	███████████████████░ 96.5%	2,638 / 2,734
warehouse_sources	███████████████████░ 97.1%	328,027 / 337,701
customer_analytics	███████████████████░ 97.3%	8,380 / 8,610
data_catalog	███████████████████░ 97.5%	2,368 / 2,429
pulse	████████████████████ 98.4%	2,017 / 2,049

Report-only. Patch coverage = changed backend lines covered vs origin/master. Sorted lowest first.
Known gaps: lines covered only by Temporal tests show as uncovered; core line numbers may drift if master changed the same file.

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-07-23 10:44 UTC	Run
prod-us	✅ Deployed	2026-07-23 10:59 UTC	Run
prod-eu	✅ Deployed	2026-07-23 11:03 UTC	Run