trunk-merge/pr-108243/138f8145-1c3c-41cc-8ce2-e89119d6fecf

.agents/security.md

@@ -196,7 +196,7 @@ An app or admin page takes the matching list in `CSPMiddleware`.
 On PostHog Cloud, the app policy's `script-src` and `connect-src` name each PostHog host instead of `*.posthog.com`.
 A script or request that goes to another PostHog subdomain needs its host in the lists that `CSPMiddleware` passes to `narrowed_app_policy()`.
 Local runs, E2E runs and self-hosted installs keep the wildcards, so a missing host breaks only production.
-A canvas artifact takes `artifact_csp()` in `products/canvas/backend/contract.py`, and a workflow message asset takes the header its endpoint sets in `products/workflows/backend/api/hog_flow.py`.
+A canvas artifact takes `artifact_csp()` in `products/canvas/backend/contract.py`, and a workflow message asset takes the header its endpoint sets in `products/workflows/backend/presentation/views/hog_flow.py`.
 `CSPMiddleware` returns a view-set header untouched, so widening the app policy does nothing for those two.
 Say why the source is needed in a comment either way, then run `posthog/test/test_csp_middleware.py`.
 The `csp-header-outside-csp-middleware` semgrep rule blocks a `Content-Security-Policy` header set anywhere else.

.depot/workflows/ci-backend.yml

@@ -233,10 +233,21 @@ jobs:
         outputs:
             handed_off: ${{ steps.handoff.outputs.handed_off }}
         steps:
+            # Depot's ambient token can come from an installation spent for the hour. It answers 403,
+            # and the wait would decline a real hand-off. The same token posts the relay's checks.
+            - name: Mint hand-off token
+              id: handoff-token
+              if: contains(fromJSON('["pull_request", "workflow_dispatch", "api"]'), github.event_name) && github.event.pull_request.head.repo.fork != true
+              continue-on-error: true
+              uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+              with:
+                  client-id: ${{ secrets.GH_APP_POSTHOG_TESTS_APP_ID }}
+                  private-key: ${{ secrets.GH_APP_POSTHOG_TESTS_PRIVATE_KEY }}
+                  permission-checks: write
             - name: Wait for the hand-off check from GitHub Actions
               id: handoff
               env:
-                  GH_TOKEN: ${{ github.token }}
+                  GH_TOKEN: ${{ steps.handoff-token.outputs.token || github.token }}
                   REPO: ${{ github.repository }}
                   EVENT: ${{ github.event_name }}
                   IS_FORK: ${{ github.event.pull_request.head.repo.fork == true }}
@@ -297,6 +308,25 @@ jobs:
                       fi
                   fi
                   echo "handed_off=$handed_off" >> "$GITHUB_OUTPUT"
+            # Mirrors Depot's own checks for .github/scripts/ci_backend_relay.py (see MIRROR_APP_ID).
+            # A declined event also gets the gate's skipped check, as Depot posts it.
+            - name: Post the hand-off checks for the relay
+              if: github.event_name == 'pull_request' && steps.handoff-token.outputs.token != ''
+              continue-on-error: true
+              env:
+                  GH_TOKEN: ${{ steps.handoff-token.outputs.token }}
+                  REPO: ${{ github.repository }}
+                  SHA: ${{ github.event.pull_request.head.sha }}
+                  WAIT_CHECK: Backend CI on Depot / Wait for GitHub Actions to hand off backend tests (PR ${{ github.event.pull_request.number }}, event ${{ github.event.pull_request.updated_at }})
+                  GATE_CHECK: Backend CI on Depot / Django Tests Pass on Depot
+                  HANDED_OFF: ${{ steps.handoff.outputs.handed_off }}
+              run: |
+                  post() {
+                      gh api "repos/$REPO/check-runs" --method POST -f name="$1" -f head_sha="$SHA" \
+                          -f status=completed -f conclusion="$2" -f details_url="$DEPOT_JOB_URL" --silent
+                  }
+                  post "$WAIT_CHECK" success
+                  [ "$HANDED_OFF" = true ] || post "$GATE_CHECK" skipped
     # Job to decide if we should run backend ci
     # See .github/actions/paths-filter/README.md for filter semantics
     changes:
@@ -4163,6 +4193,7 @@ jobs:
                   done
 
             - name: Check dependency results
+              id: verdict
               run: |
                   # Per-test failure rollup, emitted from THIS step because GitHub only
                   # auto-expands the failed step in the log view. Best-effort via `|| true`
@@ -4264,6 +4295,30 @@ jobs:
                   check_required_result "Snapshot commit job" "${{ needs.handle-snapshots.result }}"
 
                   echo "All backend and product checks passed."
+
+            # A separate checks:write token, minted in a job that runs no pull request code.
+            - name: Mint gate check token
+              id: gate-token
+              if: ${{ always() && github.event_name == 'pull_request' }}
+              continue-on-error: true
+              uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+              with:
+                  client-id: ${{ secrets.GH_APP_POSTHOG_TESTS_APP_ID }}
+                  private-key: ${{ secrets.GH_APP_POSTHOG_TESTS_PRIVATE_KEY }}
+                  permission-checks: write
+            # Mirrors Depot's own check for .github/scripts/ci_backend_relay.py (see MIRROR_APP_ID).
+            - name: Post the gate check for the relay
+              if: ${{ always() && steps.gate-token.outputs.token != '' }}
+              continue-on-error: true
+              env:
+                  GH_TOKEN: ${{ steps.gate-token.outputs.token }}
+                  REPO: ${{ github.repository }}
+                  SHA: ${{ github.event.pull_request.head.sha }}
+                  GATE_CHECK: Backend CI on Depot / Django Tests Pass on Depot
+                  CONCLUSION: ${{ job.status == 'cancelled' && 'cancelled' || (steps.verdict.outcome == 'success' && 'success' || 'failure') }}
+              run: |
+                  gh api "repos/$REPO/check-runs" --method POST -f name="$GATE_CHECK" \
+                      -f head_sha="$SHA" -f status=completed -f conclusion="$CONCLUSION" -f details_url="$DEPOT_JOB_URL" --silent
     test-selection-verdict:
         needs: [django, turbo-tests, changes, turbo-discover]
         name: Test selection verdict

.github/CODEOWNERS

@@ -93,7 +93,8 @@ products/isolation_baseline.txt @PostHog/team-devex
 # stay out, because a mistake there is visible rather than silent.
 products/cdp/backend/api/** @PostHog/team-workflows
 products/cdp/backend/models/** @PostHog/team-workflows
-products/workflows/backend/api/** @PostHog/team-workflows
+products/workflows/backend/facade/** @PostHog/team-workflows
+products/workflows/backend/presentation/** @PostHog/team-workflows
 products/workflows/backend/models/** @PostHog/team-workflows
 products/messaging/backend/api/** @PostHog/team-workflows
 products/messaging/backend/models/** @PostHog/team-workflows