fix(canvas): enforce artifact security boundaries

73aeccc

Select commit

Loading

Failed to load commit list.

Uh oh!

There was an error while loading. Please reload this page.

Graphite App

Graphite / AI Reviews

Wiz (7ad640923b)

Wiz SAST Scanner

Wiz Data Scanner

Wiz IaC Scanner

Wiz Secret Scanner

Wiz Vulnerability Scanner

Mendral App

Mendral / Supply Chain Review

Veria AI

Veria AI - PR Review

Hex Security App

Hex Security

Depot Code Access

[optional, does not block merge] Backend CI / Build Django matrix

[optional, does not block merge] Backend CI / Build product test matrix

[optional, does not block merge] Backend CI / Detect snapshot mode

[optional, does not block merge] Backend CI / Determine need to run backend and migration checks

[optional, does not block merge] Backend CI / Discover product tests

[optional, does not block merge] Backend CI / Get ClickHouse versions

[optional, does not block merge] Backend CI / Repo checks (depot-ubuntu-24.04)

[optional, does not block merge] Backend CI / Select tests

[optional, does not block merge] Backend CI / Validate migrations and OpenAPI types

[optional, does not block merge] Backend CI / Validate product.yaml owners (depot-ubuntu-24.04)

[optional, does not block merge] Backend CI / [optional, does not block merge] Django Tests Pass

[optional, does not block merge] Backend CI / [optional, does not block merge] Sample run

[optional, does not block merge] Backend CI / ci-backend.yml:django:_dynamicMatrix

[optional, does not block merge] Backend CI / ci-backend.yml:turbo-tests:_dynamicMatrix

blacksmith.sh

[code]smith

Sync client libraries review for posthog-js updates on: pull_request_target

Sync client libraries review request

Frontend CI on: pull_request

Determine need to run frontend checks

Select jest tests

Frontend formatting

Frontend bundle size

Frontend typechecking

Jest test (replay-shared)

Jest test (${{ matrix.segment }} - ${{ matrix.chunk }})

Report Jest test signals

Frontend Tests Pass

Calculate running time

Desktop Agent Release Verify on: pull_request

Verify agent release build

AI on: pull_request

AI evals / ${{ matrix.group }}

AI evals / summary

shellcheck on: pull_request

shellcheck

MCP CI on: pull_request

Determine need to run MCP checks

Build Package

Unit Tests

Integration Tests (depot-ubuntu-24.04-4)

Commit snapshot changes

MCP Tests Pass

Desktop PR Build Installer on: pull_request

build-macos

comment

Agent Skills on: pull_request

Determine need to run skill checks

Check agent skills

Check current master

Release agent skills

OAuth Proxy CI on: pull_request

Determine need to run oauth-proxy checks

Build & Test

OAuth Proxy Tests Pass

Build and deploy ml-mirror-image-scrub container image on: pull_request

Determine need to run ml-mirror-image-scrub Docker build

Unit-test ml-mirror-image-scrub

Build and push ml-mirror-image-scrub image

Deploy ml-mirror-image-scrub service

Node.js CI on: pull_request

Determine need to run Node.js checks

Node.js Code quality (depot-ubuntu-24.04)

Node.js Build (depot-ubuntu-24.04)

Node.js Tests ${{ matrix.shard }}/3 (depot-ubuntu-24.04-4)

Rust ingestion consumer Node API e2e (depot-ubuntu-24.04-4)

Node.js Tests Pass

Python CI on: pull_request

Determine need to run python checks

Python code quality (depot-ubuntu-24.04)

Python code quality checks

E2E CI Playwright on: pull_request

Determine need to run E2E checks

Select affected E2E specs

Playwright E2E tests

Complete Visual Review run

Playwright tests pass

Capture run time

LLM Services CI on: pull_request

Determine need to run LLM Services checks

LLM Gateway Tests

LLM Services Tests Pass

Dagster CI on: pull_request

Validate dagster path filter coverage

Determine need to run dagster checks

Dagster tests (${{ matrix.group }}/${{ matrix.concurrency }})

Dagster Tests Pass

MCP UI Apps CI on: pull_request

Determine need to run UI Apps checks

Build and validate UI Apps

MCP UI Apps CI

Agent Proxy CI on: pull_request

Determine need to run agent-proxy checks

Agent Proxy checks

Agent Proxy CI Pass

Hog CI on: pull_request

Determine need to run Hog checks

Hog tests

Release new HogVM TypeScript version

Storybook on: pull_request

Determine need to run storybook checks

Build Storybook (depot-ubuntu-24.04)

Storybook flake verification

Story selection

Create Visual Review run

Capture story selection

Visual regression tests - ${{ matrix.browser }} (${{ matrix.shard }}/${{ matrix.shard_count }})

Complete Visual Review run

Upload test results to Trunk

Visual regression tests pass

Calculate running time

Desktop CI on: pull_request 3

build / changes

build / build

build / Desktop Build Pass

quality / changes

quality / quality

quality / Desktop Quality Pass

typecheck / changes

typecheck / typecheck

typecheck / Desktop Typecheck Pass

test / changes

test / unit-test

test / integration-test

test / e2e

test / Desktop Tests Pass

Desktop Tests Pass

Container Images CI on: pull_request

Determine need to run Docker checks

Guard against dropped image files

Build Docker image

Lint changed Dockerfiles

Backend CI on: pull_request 4

Determine need to run backend and migration checks

Detect snapshot mode

Discover product tests

Repo checks (depot-ubuntu-24.04)

Validate product.yaml owners (ubuntu-latest)

Validate migrations

Validate OpenAPI types

Get ClickHouse versions

Select tests

Build product test matrix

Cancel Backend CI after repo check failure

Cancel Backend CI after OpenAPI check failure

Build Django matrix

Capture test selection

Product tests (${{ matrix.group }}, events schema ${{ ((matrix.new-events-schema && 'json') || 'legacy') }})

Django tests – ${{ matrix.segment }}${{ ((matrix.compat && ' compat') || '') }} (persons-on-events ${{ ((matrix.person-on-events && 'on') || 'off') }}, events schema ${{ ((matrix.new-events-schema && 'json') || 'legacy') }}), Py ${{ matrix.python-version }}, ${{ matrix.clickhouse-server-image }} (${{ matrix.group }}/${{ matrix.concurrency }})

Commit snapshot changes

Test selection verdict

Django Tests Pass

Calculate running time

Report per-test traces

Backend coverage report

Semgrep on: pull_request

semgrep

E2E Hobby CI on: pull_request

Determine need to run hobby checks

Wait for Docker image build

Cleanup preview on label removal

Setup DO Hobby Instance and test

Rust CI on: pull_request

Determine need to run Rust checks

Compute affected Rust crates

Lint Rust services (depot-ubuntu-22.04-4)

Build Rust services (depot-ubuntu-22.04-4)

Test Rust (${{ matrix.packages }})

PersonHog e2e gate

Rust Tests Pass

PR Approval Agent on: pull_request

decide-delta

bot-author-skip

dismiss

review

PR housekeeping on: pull_request

lint-pr / Validate PR title against Conventional Commits

turbo / Turbo Affected (depot-ubuntu-22.04-4)

trunk-impacted-targets / Compute impacted targets

trunk-impacted-targets / Upload impacted targets to Trunk

rate-limit-monitor / poll

flags-project-board

pr-opened

resolve-bot-comments / Resolve outdated bot review comments

migrations-separation / Check migrations and service changes are not in same PR

release-plan / plan

release-plan / build-local-artifacts (${{ join(matrix.targets, ', ') }})

release-plan / build-global-artifacts

Enable Feature Flags PR Canary on: pull_request

Handle /pr-canary command

Preflight checks for canary deployment

Build feature-flags image and enable canary

Security on: pull_request

Determine need to run Semgrep checks

semgrep-general

semgrep-python

semgrep-go

semgrep-rust

semgrep-js

semgrep-products-frontend

semgrep-devex

semgrep-test-rules

semgrep-desktop

Semgrep Checks Pass

Proto CI on: pull_request

Determine need to run proto checks

Lint proto definitions (depot-ubuntu-22.04-4)

Check for breaking changes (depot-ubuntu-22.04-4)

Check Python proto stubs are up to date (depot-ubuntu-22.04-4)

Proto Checks Pass

Semgrep Package Managers on: pull_request

semgrep-package-managers

[Optional] Hogbox Preview Environment on: pull_request 1

[Optional] decide eligibility

[Optional] announce build

[Optional] build PR frontend

[Optional] tear down preview

[Optional] deploy preview

Priority Review Slack Notifications on: pull_request_review

notify-priority-review

cleanup-closed

notify-reviewed

Inkeep Agent on: pull_request_review

trigger-agent

Priority Review Slack Notifications on: pull_request

notify-priority-review

cleanup-closed

notify-reviewed

[Optional] Hogbox Preview Environment on: pull_request 1

[Optional] decide eligibility

[Optional] announce build

[Optional] build PR frontend

[Optional] tear down preview

[Optional] deploy preview

Container Images CI on: pull_request

Determine need to run Docker checks

Guard against dropped image files

Build Docker image

Lint changed Dockerfiles

AI on: pull_request

AI evals / ${{ matrix.group }}

AI evals / summary

PR Approval Agent on: pull_request

decide-delta

bot-author-skip

dismiss

review

Desktop PR Build Installer on: pull_request

build-macos

comment

E2E Hobby CI on: pull_request

Determine need to run hobby checks

Wait for Docker image build

Cleanup preview on label removal

Setup DO Hobby Instance and test

ReviewHog on: pull_request_target

Trigger ReviewHog review

Explain skipped bot label

Desktop Tag Release on: pull_request

tag

Inkeep Agent on: pull_request 1

trigger-agent

Priority Review Slack Notifications on: pull_request

notify-priority-review

cleanup-closed

notify-reviewed

Closed PR on: pull_request 1

Cleanup hobby preview deployment

Cleanup hogbox preview

Disable feature flags canary

Report age of PR

fix(canvas): enforce artifact security boundaries

Uh oh!

Select a check to view from the sidebar