trunk-merge/pr-119223/232f83c1-5d1e-4bf0-8adc-8e3736e63f44

.github/scripts/post-ci-sections.test.mjs

@@ -3,6 +3,7 @@ import { describe, it } from 'node:test'
 
 import { buildDocsPreviewSection } from './post-docs-preview-section.mjs'
 import { buildHobbySection } from './post-hobby-section.mjs'
+import { buildHogboxPreviewSection } from './post-hogbox-preview-section.mjs'
 import { buildTrunkLaneSection, parseCrossLane, postTrunkLaneSection } from './post-trunk-lane-section.mjs'
 
 const commonHobby = {
@@ -153,6 +154,36 @@ describe('CI report section builders', () => {
         assert.match(section.body, /actions\/runs\/42/)
     })
 
+    for (const testCase of [
+        {
+            name: 'claims the PR frontend only when it was swapped in',
+            frontendSwapped: true,
+            expected: /\*\*and\*\* frontend/,
+        },
+        {
+            name: 'says the frontend is unchanged when it was not swapped in',
+            frontendSwapped: false,
+            expected: /frontend unchanged by this PR/,
+        },
+    ]) {
+        it(testCase.name, () => {
+            const section = buildHogboxPreviewSection({
+                state: 'ready',
+                sha: '1234567890abcdef',
+                runUrl: 'https://github.com/PostHog/posthog/actions/runs/42',
+                url: 'https://preview.example.com',
+                boxId: 'box-1',
+                penId: 'None',
+                consoleHost: 'console.example.com',
+                frontendSwapped: testCase.frontendSwapped,
+            })
+            assert.equal(section.status, 'ok')
+            assert.match(section.summary, /https:\/\/preview\.example\.com/)
+            assert.match(section.body, testCase.expected)
+            assert.doesNotMatch(section.body, /console\/fleet\/pens/)
+        })
+    }
+
     it('moves a hobby preview through setup, ready, and failed states', () => {
         const initial = buildHobbySection({ state: 'initial', ...commonHobby })
         const ready = buildHobbySection({

.github/scripts/post-hogbox-preview-section.mjs

@@ -0,0 +1,105 @@
+#!/usr/bin/env node
+import { pathToFileURL } from 'node:url'
+
+import { postSection, updateSectionIfPresent } from '../../frontend/bin/ci-report/update-ci-report.mjs'
+
+const LEGACY_PREFIXES = ['<!-- hogbox-preview-comment -->']
+
+export function buildHogboxPreviewSection({
+    state,
+    sha = '',
+    runUrl,
+    url,
+    boxId,
+    penId,
+    consoleHost,
+    frontendSwapped,
+    readySeconds,
+}) {
+    const commit = sha.slice(0, 7)
+
+    if (state === 'building') {
+        return {
+            status: 'info',
+            summary: 'building',
+            body: [
+                "Spinning up PostHog for this PR on a hogland hogbox. This section updates in place when it's ready (usually a few minutes).",
+                '',
+                `<sub>commit \`${commit}\` &middot; <a href="${runUrl}">build log</a></sub>`,
+            ].join('\n'),
+        }
+    }
+
+    if (state === 'failed') {
+        return {
+            status: 'fail',
+            summary: 'build failed',
+            body: [
+                `The preview didn't come up for commit \`${commit}\`. See the **[build log](${runUrl})** for the failing step. It'll retry on the next push.`,
+                '',
+                '<sub>Previews are optional and never block merging. A failure here is often a hogland or tailnet hiccup rather than anything in your PR, so the check stays green and this section is the status.</sub>',
+            ].join('\n'),
+        }
+    }
+
+    if (state === 'torn-down') {
+        return {
+            status: 'info',
+            summary: 'torn down',
+            body: 'The preview for this PR was torn down because the `hogbox-preview` label was removed. Add the label again to bring it back.',
+        }
+    }
+
+    if (state !== 'ready') {
+        throw new Error(`Unknown hogbox preview section state: ${state}`)
+    }
+
+    // A backend-only preview serves the :master SPA, so only claim the PR's frontend when it was swapped in.
+    const running = frontendSwapped
+        ? "this PR's backend **and** frontend, on the PostHog `:master` base"
+        : "this PR's backend on the PostHog `:master` base (frontend unchanged by this PR)"
+    // The CLI parser can surface a missing pen id as the literal string 'None'.
+    const adminUrl =
+        consoleHost && penId && penId !== 'None' ? `https://${consoleHost}/console/fleet/pens/${penId}` : null
+    const readyIn = readySeconds ? ` &middot; ready in ${readySeconds}s (push → usable)` : ''
+
+    return {
+        status: 'ok',
+        summary: `ready, <a href="${url}">open the preview</a>`,
+        body: [
+            `### [▶ Open the preview](${url})`,
+            '',
+            '| | |',
+            '|--|--|',
+            '| 🔑 **Login** | `test@posthog.com` / `12345678` (demo data) |',
+            `| 🧩 **Running** | ${running} |`,
+            '| 🔗 **Link** | **stable across rebuilds**: a re-push swaps the box underneath, the URL stays |',
+            '| 🔒 **Access** | tailnet only (PostHog VPN) |',
+            ...(adminUrl ? [`| 🛠️ **Admin** | [inspect & debug state in hogland](${adminUrl}) |`] : []),
+            '| 💤 **Idle** | sleeps after ~30 min idle (snapshot to S3, zero node cost) and wakes on your next visit in ~30s, behind a brief "waking up" screen |',
+            '',
+            `<sub>commit \`${commit}\` &middot; box \`${boxId}\`${readyIn} &middot; <a href="${runUrl}">build log</a> &middot; rebuilds on every push, torn down on close</sub>`,
+        ].join('\n'),
+    }
+}
+
+async function main() {
+    const [state] = process.argv.slice(2)
+    const section = buildHogboxPreviewSection({
+        state,
+        sha: process.env.SHA,
+        runUrl: `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`,
+        url: process.env.URL,
+        boxId: process.env.BOX,
+        penId: process.env.PEN,
+        consoleHost: process.env.CONSOLE_HOST,
+        frontendSwapped: process.env.SWAP === 'true',
+        readySeconds: process.env.READY_SECONDS,
+    })
+    const post = state === 'torn-down' ? updateSectionIfPresent : postSection
+    await post({ id: 'hogbox-preview', ...section }, { legacyPrefixes: LEGACY_PREFIXES })
+}
+
+if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    await main()
+}

.github/scripts/trunk-impacted-targets.js

@@ -182,6 +182,9 @@ const DESKTOP = 'desktop'
 // from services/mcp sources. The same pair STANDALONE_TREES gives cli/ itself.
 const CLI_ARTIFACTS = 'cli-artifacts'
 
+// The hogbox preview-environment workflows, which read the hogbox tooling.
+const HOGBOX_PREVIEW = 'hogbox-preview'
+
 // Bot, report, sync, and canary workflows plus the scripts they run. None of
 // them is a required check, so a break costs a bot action rather than a merge
 // gate, and one shared lane keeps a script and the workflow that runs it
@@ -319,6 +322,10 @@ const TRIPWIRE_RULES = [
     // the rust lanes on top of deploy: those PR checks parse it, even though
     // only the image builds act on what it maps.
     ['.github/rust-images.yml', [RUST, DEPLOY]],
+    // The hogbox preview environment gates no check, and its deploys read the
+    // hogbox tooling, which owns a lane already.
+    ['.github/workflows/hogbox-preview-env.yml', HOGBOX_PREVIEW],
+    ['.github/workflows/hogbox-preview-cleanup.yml', HOGBOX_PREVIEW],
     // CI scripts held to the workflows that run them: the backend test-timing
     // pair and the IDOR coverage check run only in ci-backend and its timing
     // workflow, while report_test_timings is read by the backend, frontend,
@@ -1728,6 +1735,11 @@ function addHobbyLane(targets) {
     return true
 }
 
+function addHogboxPreviewLane(targets) {
+    targets.add('tools:hogbox-preview')
+    return true
+}
+
 function addCliArtifactLanes(targets) {
     targets.add('cli')
     targets.add('svc:mcp')
@@ -1857,6 +1869,7 @@ const DOMAIN_LANES = new Map([
     [FULLSTACK, addFullstackLanes],
     [DEPLOY, addDeployLane],
     [HOBBY, addHobbyLane],
+    [HOGBOX_PREVIEW, addHogboxPreviewLane],
     [CLI_ARTIFACTS, addCliArtifactLanes],
     [DESKTOP, addDesktopLanes],
     [REPO_AUTOMATION, laneOf('repo-automation')],
@@ -2979,6 +2992,7 @@ module.exports = {
     DESKTOP,
     FULLSTACK,
     HOBBY,
+    HOGBOX_PREVIEW,
     JAVASCRIPT,
     NATIVE_BINDING_CONSUMER_LANES,
     NODE,

.github/scripts/trunk-impacted-targets.test.js

@@ -827,6 +827,12 @@ test('the cli workflow and the reusable release plan share the cli lane', () =>
     }
 })
 
+test('the hogbox preview workflows keep the hogbox tooling lane', () => {
+    for (const file of ['.github/workflows/hogbox-preview-env.yml', '.github/workflows/hogbox-preview-cleanup.yml']) {
+        assert.deepEqual(computeTargets([file], CONTEXT), ['tools:hogbox-preview'], file)
+    }
+})
+
 test('the mcp ui-apps workflow claims the product-surface readers', () => {
     assert.deepEqual(
         computeTargets(['.github/workflows/ci-mcp-ui-apps.yml'], CONTEXT),
@@ -1330,6 +1336,7 @@ test('every target the rules can emit appears in the enumerated universe', () =>
         '.github/workflows/ci-hobby.yml',
         '.github/workflows/ci-oauth-proxy.yml',
         '.github/workflows/ci-agent-skills.yml',
+        '.github/workflows/hogbox-preview-env.yml',
         '.github/workflows/ci-cli.yml',
         'bin/hobby-ci.py',
         'Dockerfile.llm-analytics',

.github/workflows/hogbox-preview-cleanup.yml

@@ -0,0 +1,81 @@
+name: Hogbox Preview Cleanup
+
+# Daily backstop sweep: destroy hogbox previews (box + pen) whose PR has closed
+# but whose fast-path teardown didn't fire or failed — that fast path is
+# pr-closed.yml (on close) and the label-removal job in hogbox-preview-env.yml.
+#
+# Why its own file and not a job in pr-cleanup.yml (where hobby's stale-sweep
+# lives): pr-cleanup.yml is a *reusable* workflow — pr-closed.yml calls it with
+# only `deployments: write`. A job that mints a hogland OIDC token needs
+# `id-token: write`, which exceeds that capped call and fails the caller's run at
+# startup. So the hogbox sweep lives here, on its own triggers, where it can hold
+# the permission it needs.
+
+on:
+    schedule:
+        # Daily at 03:15 UTC (staggered just after pr-cleanup.yml's 03:00 sweep).
+        - cron: '15 3 * * *'
+    workflow_dispatch:
+        inputs:
+            dry_run:
+                description: 'Dry run (list closed-PR previews, destroy nothing)'
+                type: boolean
+                default: true
+
+permissions:
+    contents: read
+    id-token: write # OIDC for the tailnet join + hogplane token
+
+env:
+    HOG_HOST: https://hogland-dev.hedgehog-kitefin.ts.net
+    HOG_OIDC_AUDIENCE: hogland.dev.posthog.dev
+
+jobs:
+    cleanup-hogbox-preview:
+        name: Reap stale hogbox previews
+        if: github.repository == 'PostHog/posthog'
+        runs-on: ubuntu-24.04
+        timeout-minutes: 15
+        steps:
+            # Pin to the default branch: the sweep runs the tool with the hogland
+            # token, and a workflow_dispatch from a non-master ref would otherwise
+            # run that ref's tool code in credential scope — same rule as every
+            # other credentialed job in this family.
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+              with:
+                  ref: ${{ github.event.repository.default_branch }}
+            - name: Connect to Tailscale (tag:hogland-ci)
+              uses: tailscale/github-action@306e68a486fd2350f2bfc3b19fcd143891a4a2d8 # v4.1.2
+              with:
+                  oauth-client-id: ${{ vars.TS_HOGLAND_CI_CLIENT_ID }}
+                  audience: ${{ vars.TS_HOGLAND_CI_AUDIENCE }}
+                  tags: tag:hogland-ci
+            - name: Mint hogland OIDC token
+              # Retry + empty-token guard, matching the other mint sites: `curl |
+              # jq` takes jq's exit (which succeeds on empty input), so without the
+              # guard a transient OIDC outage would pass an empty token and the
+              # sweep would no-op silently instead of reaping stale previews.
+              run: |
+                  token=""
+                  for attempt in 1 2 3; do
+                    token=$(curl -sf -H "Authorization: bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+                      "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=${HOG_OIDC_AUDIENCE}" | jq -r '.value') || token=""
+                    [ -n "$token" ] && [ "$token" != "null" ] && break
+                    echo "::warning::OIDC mint attempt ${attempt} failed; retrying"
+                    [ "$attempt" -lt 3 ] && sleep 5
+                  done
+                  [ -n "$token" ] && [ "$token" != "null" ] || { echo "::error::OIDC mint failed after 3 attempts"; exit 1; }
+                  echo "::add-mask::$token"
+                  echo "HOG_TOKEN=$token" >> "$GITHUB_ENV"
+            # uv (repo convention): --no-project skips the monorepo sync, --with
+            # pins the first-party SDK (exempted from the 7-day soak in [tool.uv]).
+            - uses: ./.github/actions/setup-uv
+              with:
+                  enable-cache: false
+            - name: Reap previews for closed PRs
+              working-directory: tools/hogbox-preview
+              env:
+                  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+                  GITHUB_REPOSITORY: ${{ github.repository }}
+                  DRY_RUN: ${{ inputs.dry_run || 'false' }}
+              run: uv run --no-project --with posthog-hogland==0.3.0 --python 3.12 python -m hogbox_preview --host "$HOG_HOST" cleanup-stale