{"record":{"id":"69550289f3dc8b1f","repo":"github/github-mcp-server","slug":"lockdown-cache-is-not-configured","errorCode":null,"errorMessage":"lockdown cache is not configured","messagePattern":"lockdown cache is not configured","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/github/issues.go","lineNumber":862,"sourceCode":"\t\t},\n\t}\n\n\tcomments, resp, err := client.Issues.ListComments(ctx, owner, repo, issueNumber, opts)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"failed to get issue comments: %w\", err)\n\t}\n\tdefer func() { _ = resp.Body.Close() }()\n\n\tif resp.StatusCode != http.StatusOK {\n\t\tbody, err := io.ReadAll(resp.Body)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"failed to read response body: %w\", err)\n\t\t}\n\t\treturn ghErrors.NewGitHubAPIStatusErrorResponse(ctx, \"failed to get issue comments\", resp, body), nil\n\t}\n\tif flags.LockdownMode {\n\t\tif cache == nil {\n\t\t\treturn nil, fmt.Errorf(\"lockdown cache is not configured\")\n\t\t}\n\t\tfilteredComments := make([]*github.IssueComment, 0, len(comments))\n\t\tfor _, comment := range comments {\n\t\t\tuser := comment.User\n\t\t\tif user == nil {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tlogin := user.GetLogin()\n\t\t\tif login == \"\" {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tisSafeContent, err := cache.IsSafeContent(ctx, login, owner, repo)\n\t\t\tif err != nil {\n\t\t\t\treturn utils.NewToolResultError(fmt.Sprintf(\"failed to check lockdown mode: %v\", err)), nil\n\t\t\t}\n\t\t\tif isSafeContent {\n\t\t\t\tfilteredComments = append(filteredComments, comment)\n\t\t\t}","sourceCodeStart":844,"sourceCodeEnd":880,"githubUrl":"https://github.com/github/github-mcp-server/blob/0ea1f775a7c73eff1bd2e25904d01136756bbfe2/pkg/github/issues.go#L844-L880","documentation":"GetIssueComments read feature flags saying lockdown mode is ON, but the resolved RepoAccessCache is nil, so it cannot filter comments by author push access and fails fast instead of leaking unvetted content. Under RequestDeps the cache is only constructed when the deps themselves were built with lockdownMode true — a nil cache here means the flag source and the dependency wiring disagree.","triggerScenarios":"flags.LockdownMode (from context/request-level flags) is true while RequestDeps.lockdownMode is false, so GetRepoAccessCache returned (nil, nil); or BaseDeps was constructed without a RepoAccessCache while the flag is enabled.","commonSituations":"Embedding the server and enabling lockdown via request context flags without passing lockdown config into NewRequestDeps; test harnesses with stub deps that enable the flag but return a nil cache; version drift where flag propagation moved to a different layer than cache construction.","solutions":["Make the lockdown setting a single source of truth: when flags can enable lockdown, construct the deps (RequestDeps/BaseDeps) with lockdown mode and cache wiring enabled","In custom embeddings, provide a cache via BaseDeps.RepoAccessCache (build one with lockdown.NewRepoAccessCache(gqlClient, restClient))","If lockdown was not intended for this deployment, disable the flag","For test doubles, return a fake non-nil cache from stubDeps.GetRepoAccessCache"],"exampleFix":"// before — flag and wiring disagree\ndeps := pkggithub.NewRequestDeps(apiHosts, version, t, false /* lockdownMode not passed */)\n// ...request arrives with LockdownMode flag = true -> \"lockdown cache is not configured\"\n\n// after — construct deps from the same config the flags read\ndeps := pkggithub.NewRequestDeps(apiHosts, version, t, cfg.LockdownMode)","handlingStrategy":"validation","validationCode":"// Assert flag/deps consistency before serving requests\nif flagsFromContext.LockdownMode {\n    if cache, err := deps.GetRepoAccessCache(ctx); err != nil || cache == nil {\n        return fmt.Errorf(\"lockdown flag set but cache unavailable: %v\", err)\n    }\n}","typeGuard":"func isLockdownConfigError(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"lockdown cache is not configured\")\n}","tryCatchPattern":null,"preventionTips":["Derive both the lockdown flag and deps construction from one config value","Add a smoke test that enables lockdown and calls one issue tool end-to-end","In embeddings, always populate BaseDeps.RepoAccessCache when lockdown is possible","Fail deployment health checks on lockdown wiring mismatches rather than failing per request"],"tags":["config","lockdown","internal","fail-fast"],"backgroundTag":null,"analyzedSha":"0ea1f775a7c73eff1bd2e25904d01136756bbfe2","analyzedAt":"2026-08-15T18:10:19.804Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}