Fix upstream error status codes being converted to 500 in forward proxy

[Copilot]

UpstreamRequestError::IntoResponse had a catch-all wildcard _ => 500 that swallowed ResponseError(status, _) and RateLimited(_), causing Relay to return 500 to callers even when the upstream returned a meaningful error like a GitHub 403 (e.g. IP allow-list restriction). The actual error was completely masked.

Changes

• relay-server/src/services/upstream.rs: Add explicit arms before the wildcard in UpstreamRequestError::IntoResponse:
  • ResponseError(status, _) → forward the upstream status code
  • RateLimited(_) → 429
  • Wildcard _ now only covers true internal failures (NoCredentials, ChannelClosed, AuthDenied)

// Before
_ => StatusCode::INTERNAL_SERVER_ERROR.into_response(),

// After
Self::RateLimited(_) => StatusCode::TOO_MANY_REQUESTS.into_response(),
Self::ResponseError(status, _) => status.into_response(),
_ => StatusCode::INTERNAL_SERVER_ERROR.into_response(),

• tests/integration/test_forwarding.py: Add test_forwarding_error_status_codes parametrized over 403, 404, 429, 500, 503 to assert Relay does not convert upstream error responses to 500.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• chromium.googlesource.com
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED -o crypto/engine/libcrypto-lib-eng_pkey.o /tmp/cc5hatzm.s lib/rustlib/x86_providers/common/include stable-x86_64-un-I derive.487c4a665cmp derive.487c4a665crypto/engine/libcrypto-lib-eng_dyn.d.tmp derive.487c4a665crypto/engine/libcrypto-lib-eng_dyn.d pto/ec/libcrypto-o f232�� derive.487c4a665/tmp/ccKbcDby.s -I rking/target/debug/deps/rustcsLeFEz/symbols.o b_cipher.d.tmp; \ else \ mv crypto/engine/libcrypto-lib-tb_cipher.d.tmp crypto/engine/libcrypt rking/target/deb-I rking/target/deb. rking/target/deb-I (dns block)
  • Triggering command: /usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin REDACTED -DSHA1_ASM lib/�� ug/deps/libheck--I lib/rustlib/x86_providers/common/include o \ rm -f crypto//usr/libexec/gcc/x86_64-linux-gnu/13/cc1 derive.487c4a665-quiet derive.487c4a665-I ONT5 -DOPENSSL_C. f232�� derive.487c4a665include -fdata-sections rking/target/debproviders/common/include rking/target/deb/bin/sh rking/target/deb-c rking/target/debif cmp crypto/engine/libcrypto-lib-eng_pkey.d.tmp crypto/engine/libcrypto-lib-en-DAES_ASM ne/libcrypto-li (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.