A rule build the Server refuses shows the runner a generic 503, not the Server's reason#4059

opened1d agobyNNick

GitHub writeback is off. Issues and comments you change here stay in GitCafe. Sync settings

When a Server refuses a rule build's grant, the GitHub runner sees only Ployz Cloud refused the build (HTTP 503): Your Cluster could not mint a Build Grant. Cloud gets the Server's reason ("This Server refused the rule build's grant: the approval names the signer this request does not match") but build-grant-unavailable in dashboard/src/server/public-error.ts drops it.

The person has to read Cloud's or the Server's logs to learn the push needs the rule approved again.

Found while verifying D5 (approve automatic deploy rules in the dashboard), under a rule signed by a browser session, which Servers refuse by design.

Frequency (F): 3. Only when a Server refuses a grant: a stale, ended or session-signed rule, or a mismatched builder.
Severity (S): 4. The deploy fails correctly. Only the reason is hidden, and the Deployment's own status and the Server logs still show it.
F×S = 12, so it's filed, not fixed in D5.

Possible fix: pass the Server's refusal text through as a forbidden with that text, the way the Machine's other refusals surface.