Troubleshoot the GitHub connection

preview

We're still working on this feature, but we'd love for you to try it out!

This feature is currently provided as part of a preview program pursuant to our pre-release policies.

Use this page to diagnose connection issues, understand current limitations, and review how Autopilot stores and isolates GitHub data.

Troubleshoot connection issues

Problem	Cause	Solution
Autopilot's response omits PR context even when a Change Tracking event exists	Token missing, expired, revoked, or without required scope	An org manager opens Configure > Autopilot > GitHub and replaces the token following Step 2. Verify the new token has Pull requests: Read, Contents: Read, and Metadata: Read.
"403 Forbidden" in the Autopilot's audit log when calling GitHub	Token not authorized for SAML SSO in your GitHub organization	The token owner opens the token in GitHub Settings > Fine-grained tokens and clicks Authorize for your organization's SSO.
"404 Not Found" for a specific commit lookup	Commit SHA was force-pushed away, rebased out, or the branch was deleted	Expected behavior. Autopilot notes "no PR was found for the deployment commit" and continues. No action needed unless it happens systematically.
"422" or empty array from GitHub	No PR is associated with that commit (for example, a direct push to main)	Expected behavior. Autopilot notes that no PR is linked and continues its investigation.
GitHub row shows Not connected after Save	Save action failed silently or was interrupted	Reload the page, reopen the Configure panel, and repeat Step 2. If the row stays Not connected, contact your New Relic account team.
Rate limit errors ("403 rate limit exceeded") in audit log	Very high investigation volume against the same GitHub org	Autopilot's circuit-breaker skips GitHub on failure and continues the investigation without PR context. If the errors persist, contact your New Relic account team.
No Change Tracking events show up in Autopilot investigations	Change Tracking is not enabled for the affected services, or events have no `commit_sha` field	Verify Change Tracking is configured with GitHub for the affected services and that deployment events carry a commit SHA. Without a commit SHA there is nothing to look up.
Wrong repos are being read	Token scope includes more repos than intended	Rotate the token with one that has a narrower scope. Only select repositories you want in scope.

Current limitations

Public github.com only. GitHub Enterprise Server (self-hosted) and GHE.com (data-residency tier) are not supported in this preview.
Read-only, no writes. Autopilot fetches PR metadata and commit change data (title, description, files changed, line counts). It does not store full file contents, source code, or PR review comments.
Organization-level token only. All users of Autopilot in your New Relic org share one token's read access. Per-user tokens with individual authorization are planned for a later release.
No in-product disconnect button yet. In this preview, removing the integration requires revoking the token in GitHub. See Disable the GitHub integration.
Six GitHub MCP tools. Autopilot uses pull_request_read, search_commits, search_pull_requests, list_pull_requests, get_commit, and list_commits. Broader GitHub tools (workflow runs, code search, security scanning) are not part of this preview.
Investigation-time only. Autopilot pulls GitHub context during an active investigation. There is no scheduled GitHub sync and no PR data is stored ahead of time.

Data and security

Data isolation

Each request from Autopilot to GitHub is isolated as follows:

Token per organization: Each New Relic organization stores its own GitHub token. There is no cross-org read path.
Token retrieved per request: The token is retrieved from the New Relic Secrets Service into request-scoped memory only for the duration of a single Autopilot request (seconds), then is discarded. It is not cached across requests.
Only two headers cross the boundary: The outbound request to https://api.githubcopilot.com/mcp/ carries only Authorization: Bearer <token> and Accept: application/vnd.github+json. All internal New Relic headers (system identity, user context, tracing, feature-flag decisions) are stripped before the request leaves New Relic.
No persistent GitHub data: The GitHub response is held in Autopilot's request-scoped memory for one investigation, used to synthesize the response, and released.

Token storage

The GitHub Personal Access Token is stored in the New Relic Secrets Service:

Scope: Accessible only by your New Relic organization ID and Autopilot. No other New Relic product can read this secret.
Encryption at rest: The Secrets Service encrypts the token at rest.
Regional processing: The token is stored in the Secrets Service instance in the region assigned to your New Relic organization (US, EU, or JP). Outbound calls to api.github.com originate from the same region.

Authentication and identity

The GitHub connection is authenticated by an organization-level Personal Access Token stored in New Relic. There is no separate per-user identity linking for GitHub.

For a request to succeed, all three of the following must be true:

Workspace authorized: An organization manager has connected your New Relic org to GitHub (Step 2).
Token valid: The stored PAT is present in the Secrets Service, has not been revoked in GitHub, and has not expired.
Token in scope: The token still authorizes read on Pull requests, Contents, and Metadata for the target repository.

If any of these are not true, Autopilot skips the GitHub step for that investigation and continues its analysis without PR context.

Importante

No per-user authorization in this preview. Every user in your New Relic organization who can use Autopilot inherits the same GitHub read access the token grants.