feat(canvas): add secure application build pipeline

.depot/workflows/ci-backend.yml

@@ -1645,6 +1645,10 @@ jobs:
               shell: bash
               run: |
                   UV_PROJECT_ENVIRONMENT=$pythonLocation uv sync --frozen --dev
+            - name: Install canvas builder dependencies
+              if: ${{ needs.changes.outputs.backend == 'true' && matrix.segment == 'Core' }}
+              shell: bash
+              run: npm ci --ignore-scripts --omit=dev --prefix common/canvas-builder
             - name: Install the working version of hogql-parser
               if: ${{ needs.changes.outputs.backend == 'true' && steps.hogql-parser-diff.outputs.changed == 'true' }}
               shell: bash

.dockerignore

@@ -4,6 +4,7 @@
 !.kearc
 !bin
 !common/alerting
+!common/canvas-builder
 !common/hogvm
 !common/esbuilder
 !common/migration_utils

.github/workflows/ci-backend.yml

@@ -2539,6 +2539,11 @@ jobs:
               run: |
                   UV_PROJECT_ENVIRONMENT=$pythonLocation uv sync --frozen --dev
 
+            - name: Install canvas builder dependencies
+              if: ${{ needs.changes.outputs.backend == 'true' && matrix.segment == 'Core' }}
+              shell: bash
+              run: npm ci --ignore-scripts --omit=dev --prefix common/canvas-builder
+
             - name: Install the working version of hogql-parser
               if: ${{ needs.changes.outputs.backend == 'true' && steps.hogql-parser-diff.outputs.changed == 'true' }}
               shell: bash

.semgrep/rules/security/idor-team-scoped-models.yaml

@@ -83,6 +83,9 @@ rules:
                               |BatchImport
                               |BriefConfig
                               |ButtonTile
+                              |CanvasApplication
+                              |CanvasBuild
+                              |CanvasSourceVersion
                               |ChangeRequest
                               |ClusteringConfig
                               |ClusteringJob
@@ -403,6 +406,9 @@ rules:
                         |BatchImport
                         |BriefConfig
                         |ButtonTile
+                        |CanvasApplication
+                        |CanvasBuild
+                        |CanvasSourceVersion
                         |ChangeRequest
                         |ClusteringConfig
                         |ClusteringJob

Dockerfile

@@ -74,7 +74,7 @@
 #   curl -LsSf "https://github.com/PostHog/posthog/releases/download/posthog-cli%2Fv<X.Y.Z>/posthog-cli-installer.sh" | sha256sum
 ARG POSTHOG_CLI_VERSION=0.7.22
 ARG POSTHOG_CLI_INSTALLER_SHA256=9bfeafcfb6f3acd2d15e3fad267b3c22b26d6aa0a28497e3f1a214f143f66219
 RUN --mount=type=secret,id=posthog_upload_sourcemaps_cli_api_key \
     if ( \
         [ -f /run/secrets/posthog_upload_sourcemaps_cli_api_key ] && \
         apt-get update && \
@@ -112,18 +112,20 @@
 COPY turbo.json package.json pnpm-lock.yaml pnpm-workspace.yaml tsconfig.json ./
 COPY bin/turbo bin/turbo
 COPY patches/ patches/
+COPY common/canvas-builder/ common/canvas-builder/
 COPY common/esbuilder/ common/esbuilder/
 COPY common/plugin_transpiler/ common/plugin_transpiler/
 RUN --mount=type=cache,id=pnpm,target=/tmp/pnpm-store-v24 \
     corepack enable && \
     NODE_OPTIONS="--max-old-space-size=4096" CI=1 pnpm --filter=@posthog/plugin-transpiler... install --frozen-lockfile --store-dir /tmp/pnpm-store-v24 && \
-    NODE_OPTIONS="--max-old-space-size=4096" bin/turbo --filter=@posthog/plugin-transpiler build
+    NODE_OPTIONS="--max-old-space-size=4096" bin/turbo --filter=@posthog/plugin-transpiler build && \
+    cd common/canvas-builder && npm ci --ignore-scripts --omit=dev
 
 # The transpiler bundle externalizes @babel/standalone (its only external runtime require — a
 # self-contained 24MB package with no deps). Materialize it as real files inside the transpiler's
 # own node_modules, replacing the pnpm symlink that pointed into the root node_modules. The final
 # image then carries just this package instead of the entire ~469MB root /code/node_modules.
 RUN cd /code/common/plugin_transpiler && \
     BABEL_REAL=$(node -e "process.stdout.write(require('path').dirname(require.resolve('@babel/standalone/package.json')))") && \
     rm -rf node_modules/@babel/standalone && \
     mkdir -p node_modules/@babel && \
@@ -147,7 +149,7 @@
 ENV UV_PROJECT_ENVIRONMENT=/python-runtime
 
 # Install build dependencies
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     "build-essential" \
     "git" \
@@ -223,7 +225,7 @@
 SHELL ["/bin/bash", "-e", "-o", "pipefail", "-c"]
 
 # Fetch the GeoLite2-City database that will be used for IP geolocation within Django.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     "ca-certificates" \
     "curl" \
@@ -252,7 +254,7 @@
 ARG UNIT_GIT_REF=28404105810f53c570523c3e70006ad0ca210e58
 
 # Build Unit from the upstream 1.35.0 release ref to ensure the Django 5 ASGI fix is present even when Docker tags lag.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends \
     "build-essential" \
     "git" \
@@ -293,7 +295,7 @@
 # Runtime-only shared libs: lxml/xmlsec are compiled --no-binary in the build stage (which keeps
 # its own -dev headers), so the final image needs the runtime .so, not the -dev headers/static libs.
 # libxmlsec1-openssl provides the OpenSSL crypto backend that libxmlsec1-dev used to pull in.
 RUN apt-get update && \
     apt-get install -y --no-install-recommends --allow-downgrades \
     "gettext-base" \
     "libpq5" \
@@ -397,6 +399,7 @@
 COPY --from=node-scripts-build --chown=posthog:posthog /code/common/plugin_transpiler/dist /code/common/plugin_transpiler/dist
 COPY --from=node-scripts-build --chown=posthog:posthog /code/common/plugin_transpiler/node_modules /code/common/plugin_transpiler/node_modules
 COPY --from=node-scripts-build --chown=posthog:posthog /code/common/plugin_transpiler/package.json /code/common/plugin_transpiler/package.json
+COPY --from=node-scripts-build --chown=posthog:posthog /code/common/canvas-builder /code/common/canvas-builder
 
 # Add in custom bin files and Django deps.
 COPY --chown=posthog:posthog ./bin ./bin/
@@ -422,7 +425,7 @@
 # Validate the Playwright client library (used to drive the remote browserless service over CDP —
 # no browser binary ships in this image).
 RUN /python-runtime/bin/python -c "import playwright; print('Playwright package imported successfully')"
 RUN /python-runtime/bin/python -c "from playwright.sync_api import sync_playwright; print('Playwright sync API available')"
 
 # Setup ENV.
 ENV NODE_ENV=production
@@ -434,5 +437,5 @@
 EXPOSE 8001
 COPY unit.json.tpl /docker-entrypoint.d/unit.json.tpl
 # nosemgrep: dockerfile.security.last-user-is-root.last-user-is-root
 USER root
 CMD ["./bin/docker"]