Merge branch 'main' into fix/704

Author: igennova

.claude/skills/merging-prs/SKILL.md

@@ -0,0 +1,105 @@
+---
+name: merging-prs
+description: Merge a PR into main through the Trunk merge queue and babysit it until it lands. Enqueue with a "/trunk merge" comment, then poll the "Trunk Merge Queue" check run and the PR state until it is MERGED or FAILED, reporting the Trunk bot's failure reason if the PR is kicked out. Use when asked to merge a PR, "merge when ready", "land it", "ship it", or to babysit/watch a PR through the queue. Never use `gh pr merge` in this repo -- the queue is the only path into main.
+allowed-tools: Bash(gh pr view:*), Bash(gh pr checks:*), Bash(gh pr comment:*), Bash(gh pr ready:*), Bash(gh api:*), Bash(sleep:*)
+---
+
+# Merge a PR through the Trunk merge queue
+
+Merges into `main` go **exclusively** through the [Trunk](https://trunk.io) merge
+queue. `gh pr merge` and the GitHub merge button are blocked by branch ruleset.
+To merge, you enqueue the PR with a comment, then watch it until Trunk lands it.
+
+When a developer says "merge this PR", "merge it when it's ready", "land it",
+"ship it", or "babysit this PR", do the full loop below — enqueue **and** watch
+to completion, reporting the outcome. See also [docs/merge-queue.md](../../../docs/merge-queue.md).
+
+`<n>` below is the PR number. Resolve the repo slug once if you need it:
+`REPO=$(gh repo view --json nameWithOwner -q .nameWithOwner)`.
+
+## 1. Preflight
+
+```bash
+gh pr view <n> --json state,isDraft,mergeable,reviewDecision,statusCheckRollup
+```
+
+- **Not open** (already merged/closed) → report and stop.
+- **Draft** → it can't be merged. Ask the developer to confirm, then
+  `gh pr ready <n>` before continuing. Don't un-draft silently.
+- **Failing required checks** (`statusCheckRollup`) → the queue will just reject
+  it. Report which checks are red and stop; fix them first. **Pending** checks
+  are fine — the queue waits for them.
+- **Merge conflicts** (`mergeable == "CONFLICTING"`) → report and stop; rebase first.
+
+## 2. Enqueue
+
+```bash
+gh pr comment <n> --body "/trunk merge"
+```
+
+Within ~2 minutes, confirm Trunk picked it up — a check run whose name starts
+with `Trunk Merge Queue` should appear on the head commit:
+
+```bash
+SHA=$(gh pr view <n> --json headRefOid -q .headRefOid)
+gh api repos/$REPO/commits/$SHA/check-runs \
+  --jq '.check_runs[] | select(.name | startswith("Trunk Merge Queue")) | {name, status, conclusion, details_url}'
+```
+
+If nothing appears after a couple of minutes, the developer may lack write
+access or GitHub-comment commands may be disabled — report that and suggest the
+`trunk-merge-queue-submit` label as a fallback.
+
+## 3. Poll until it lands
+
+Loop about every 60 seconds, up to ~45–60 minutes total. Each iteration:
+
+```bash
+gh pr view <n> --json state,mergedAt          # MERGED  -> success, stop
+SHA=$(gh pr view <n> --json headRefOid -q .headRefOid)
+gh api repos/$REPO/commits/$SHA/check-runs \
+  --jq '.check_runs[] | select(.name | startswith("Trunk Merge Queue")) | {status, conclusion, details_url}'
+sleep 60
+```
+
+- `state == "MERGED"` → done. Report success with the merge commit.
+- Check run `status` moves `queued` → `in_progress` → `completed`. Report each
+  transition so the developer can follow along.
+- Watch the **check run + PR state**, not `gh pr checks --watch`: the queue runs
+  CI on Trunk's own draft/`trunk-merge/**` branch, so this PR's own checks don't
+  reflect the queue's testing.
+- Stop at the timeout with a status summary rather than looping forever.
+
+## 4. Handle failure
+
+If the check run completes with `conclusion == "failure"` (or the PR drops out
+of the queue), Trunk kicks the PR and its bot comments with the failing
+workflow. Read the newest comments and report the reason:
+
+```bash
+gh pr view <n> --comments | tail -n 40
+```
+
+- If the failure is clearly caused by this PR **and** the fix is obvious, fix it,
+  push, wait for the PR's own checks to go green, and re-enqueue **once** with
+  `/trunk merge`.
+- Otherwise stop and report the failure and the workflow link. Don't repeatedly
+  re-enqueue a red PR.
+
+## 5. Cancel
+
+If the developer asks to stop the merge:
+
+```bash
+gh pr comment <n> --body "/trunk cancel"
+```
+
+Confirm the check run reports cancelled.
+
+## Hard rules
+
+- **Never** run `gh pr merge` — it's blocked and it's not how this repo merges.
+- **Never** force-push a branch while it is in the queue — it removes the PR
+  from the queue.
+- Re-enqueue a failed PR **at most once** automatically; beyond that, hand back
+  to the developer.

.github/workflows/agent-release.yml

@@ -68,3 +68,29 @@ jobs:
         run: pnpm publish --access public --no-git-checks
         env:
           NPM_CONFIG_PROVENANCE: true
+
+  rebuild-sandbox-images:
+    name: Rebuild tasks sandbox base images
+    needs: release
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Mint posthog/posthog workflow dispatch token
+        id: dispatch-token
+        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        with:
+          app-id: ${{ secrets.GH_APP_POSTHOG_WORKFLOW_TRIGGER_APP_ID }}
+          private-key: ${{ secrets.GH_APP_POSTHOG_WORKFLOW_TRIGGER_PRIVATE_KEY }}
+          owner: PostHog
+          repositories: posthog
+
+      - name: Dispatch posthog/posthog sandbox image rebuild
+        env:
+          GH_TOKEN: ${{ steps.dispatch-token.outputs.token }}
+        run: |
+          echo "Dispatching sandbox base image rebuild for $GITHUB_REF_NAME"
+          gh workflow run cd-sandbox-base-image.yml \
+            --repo PostHog/posthog \
+            --ref master

.github/workflows/code-release.yml

@@ -196,6 +196,16 @@ jobs:
             echo "OK: $bin"
           done
 
+          # The native codex CLI must ship as a sibling of codex-acp, or the
+          # app-server harness silently falls back to codex-acp in production.
+          for f in codex rg; do
+            if [[ ! -f "$RESOURCES/app.asar.unpacked/.vite/build/codex-acp/$f" ]]; then
+              echo "FAIL: codex-acp/$f missing in bundled binaries"
+              exit 1
+            fi
+            echo "OK: codex-acp/$f"
+          done
+
       - name: Install Playwright
         run: pnpm --filter code exec playwright install
 

.github/workflows/code-tag.yml

@@ -27,6 +27,8 @@ jobs:
     permissions:
       contents: write
       actions: write
+      pull-requests: write
+      issues: write
     runs-on: ubuntu-latest
     steps:
       - name: Get app token
@@ -42,6 +44,44 @@ jobs:
           fetch-depth: 0
           token: ${{ steps.app-token.outputs.token }}
 
+      - name: Check labeler is a member of team-posthog-code
+        id: labeler
+        if: github.event_name == 'pull_request'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          COMMENT_TOKEN: ${{ github.token }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          TEAM_SLUG: team-posthog-code
+        run: |
+          skip() {
+            echo "$1 Skipping auto-release; the next scheduled release will pick this up."
+            echo "authorized=false" >> "$GITHUB_OUTPUT"
+            GH_TOKEN="$COMMENT_TOKEN" gh pr comment "$PR_NUMBER" --repo "$REPOSITORY" \
+              --body "$1 Auto-release is limited to Team PostHog Code members, so this will ship with the next scheduled release instead." || true
+          }
+
+          LABELER=$(gh api "repos/${REPOSITORY}/issues/${PR_NUMBER}/events" --paginate \
+            --jq '.[] | select(.event == "labeled" and (.label.name | ascii_downcase) == "create release") | "\(.id) \(.actor.login)"' \
+            | sort -n | tail -1 | cut -d" " -f2)
+
+          if [ -z "$LABELER" ]; then
+            skip "Could not determine who added the 'Create release' label."
+            exit 0
+          fi
+
+          if ! MEMBERS=$(gh api "orgs/${REPOSITORY%%/*}/teams/${TEAM_SLUG}/members" --paginate --jq '.[].login'); then
+            skip "Could not verify ${TEAM_SLUG} membership (GitHub API error)."
+            exit 0
+          fi
+
+          if echo "$MEMBERS" | grep -qixF "$LABELER"; then
+            echo "'Create release' was added by ${LABELER}, a member of ${TEAM_SLUG}."
+            echo "authorized=true" >> "$GITHUB_OUTPUT"
+          else
+            skip "'Create release' was added by @${LABELER}, who is not on ${TEAM_SLUG}."
+          fi
+
       - name: Check quiet period
         id: quiet
         if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && github.event.inputs.quiet_retries != '0')
@@ -75,7 +115,7 @@ jobs:
           echo "proceed=false" >> "$GITHUB_OUTPUT"
 
       - name: Compute version and create tag
-        if: steps.quiet.outputs.proceed != 'false'
+        if: steps.quiet.outputs.proceed != 'false' && steps.labeler.outputs.authorized != 'false'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPOSITORY: ${{ github.repository }}

.github/workflows/pr-approval-agent.yml

@@ -67,6 +67,10 @@ jobs:
                   ANTHROPIC_API_KEY: ${{ secrets.STAMPHOG_ANTHROPIC_API_KEY }}
                   POSTHOG_API_KEY: ${{ secrets.POSTHOG_API_TOKEN }}
                   GH_TOKEN: ${{ steps.app-token.outputs.token }}
+                  # Set both to route through the ai-gateway (gateway.py overrides
+                  # ANTHROPIC_* at runtime). Unset means direct Anthropic.
+                  AI_GATEWAY_URL: ${{ secrets.STAMPHOG_AI_GATEWAY_URL }}
+                  AI_GATEWAY_API_KEY: ${{ secrets.STAMPHOG_AI_GATEWAY_API_KEY }}
               run: |
                   uv run tools/pr-approval-agent/review_pr.py \
                     ${{ github.event.pull_request.number }} \