trunk-merge/pr-121512/9e73b1f4-3173-43cb-9ed9-86450bb37a2b

.depot/actions/paths-filter/__tests__/shared-image-policy.test.ts

@@ -89,7 +89,7 @@ describe('shared-image policy and legacy projection', () => {
     const inlineRules = yaml.load(inline!) as Record<string, Paths | null>
     const policy = productionPolicy()
     const projected = yaml.load(projectLegacyFilters(policy, inline!)) as Record<string, Paths>
-    expect(Object.keys(projected)).toEqual(Object.keys(inlineRules))
+    expect(Object.keys(projected)).toEqual(Object.keys({...inlineRules, ...policy.filters}))
     for (const [name, rule] of Object.entries(inlineRules)) {
       expect({[name]: projected[name]}).toEqual({[name]: rule === null ? policy.filters[name] : rule})
     }
@@ -131,6 +131,5 @@ describe('shared-image policy and legacy projection', () => {
     const result = filter.match(files)
     expect(result.dataWarehouseMetadata).toEqual([files[0]])
     expect(result.dataWarehouse).toEqual(files)
-    expect(current.images['posthog-cloud'].channels).toEqual({})
   })
 })

.github/actions/paths-filter/__tests__/shared-image-policy.test.ts

@@ -89,7 +89,7 @@ describe('shared-image policy and legacy projection', () => {
     const inlineRules = yaml.load(inline!) as Record<string, Paths | null>
     const policy = productionPolicy()
     const projected = yaml.load(projectLegacyFilters(policy, inline!)) as Record<string, Paths>
-    expect(Object.keys(projected)).toEqual(Object.keys(inlineRules))
+    expect(Object.keys(projected)).toEqual(Object.keys({...inlineRules, ...policy.filters}))
     for (const [name, rule] of Object.entries(inlineRules)) {
       expect({[name]: projected[name]}).toEqual({[name]: rule === null ? policy.filters[name] : rule})
     }
@@ -131,6 +131,5 @@ describe('shared-image policy and legacy projection', () => {
     const result = filter.match(files)
     expect(result.dataWarehouseMetadata).toEqual([files[0]])
     expect(result.dataWarehouse).toEqual(files)
-    expect(current.images['posthog-cloud'].channels).toEqual({})
   })
 })

.github/actions/shared-image-releases/__tests__/inspect.test.ts

@@ -2,10 +2,11 @@ jest.mock('../src/shared-image-command')
 
 import * as core from '@actions/core'
 import * as path from 'path'
-import {mkdtempSync, rmSync, writeFileSync} from 'fs'
+import {mkdirSync, mkdtempSync, rmSync, writeFileSync} from 'fs'
 import {tmpdir} from 'os'
 import {command} from '../src/shared-image-command'
 import {run} from '../src/inspect'
+import {POLICY_PATH} from '../src/shared-image-releases'
 import * as publisher from '../src/shared-image-publisher'
 
 jest.mock('@actions/core', () => ({getInput: jest.fn(), setOutput: jest.fn(), setFailed: jest.fn()}))
@@ -42,15 +43,25 @@ describe('inspect action inputs and outputs', () => {
   })
 
   test('an empty configured channel set emits false and the resolved empty map', async () => {
-    jest.mocked(core.getInput).mockImplementation(name => {
-      if (name === 'working-directory') return path.join(__dirname, '../../../..')
-      if (name === 'shared-image-policy') return ''
-      return inputs[name] || ''
-    })
-    await run()
-    expect(core.setFailed).not.toHaveBeenCalled()
-    expect(core.setOutput).toHaveBeenCalledWith('channels', 'false')
-    expect(core.setOutput).toHaveBeenCalledWith('bindings', '{"posthog-cloud":{}}')
+    const scratch = mkdtempSync(path.join(tmpdir(), 'shared-image-empty-'))
+    try {
+      const policyFile = path.join(scratch, POLICY_PATH)
+      mkdirSync(path.dirname(policyFile), {recursive: true})
+      writeFileSync(policyFile, JSON.stringify({
+        version: 1, filters: {}, images: {'posthog-cloud': {channels: {}}}
+      }))
+      jest.mocked(core.getInput).mockImplementation(name => {
+        if (name === 'working-directory') return scratch
+        if (name === 'shared-image-policy') return ''
+        return inputs[name] || ''
+      })
+      await run()
+      expect(core.setFailed).not.toHaveBeenCalled()
+      expect(core.setOutput).toHaveBeenCalledWith('channels', 'false')
+      expect(core.setOutput).toHaveBeenCalledWith('bindings', '{"posthog-cloud":{}}')
+    } finally {
+      rmSync(scratch, {recursive: true, force: true})
+    }
   })
 
   test.each([

.github/actions/shared-image-releases/__tests__/shared-image-releases.test.ts

@@ -1,14 +1,24 @@
 import {readFileSync} from 'fs'
 import * as path from 'path'
 import * as yaml from 'js-yaml'
-import {Paths, bindChannels, loadPolicy, policyDigest, serializePolicy} from '../src/shared-image'
+import {Paths, POLICY_PATH, bindChannels, loadPolicy, policyDigest, serializePolicy} from '../src/shared-image'
 
 const destination = {repository: 'posthog-temporal-workers/data-warehouse-metadata'}
 const source = 'posthog-cloud'
 const fixture = readFileSync(path.join(__dirname, '../../paths-filter/__tests__/fixtures/shared-image-policy.yaml'), 'utf8')
 const literal = JSON.parse(readFileSync(path.join(__dirname, 'fixtures/shared-image-fingerprints.json'), 'utf8')) as
   {paths: Paths; bytes: string; sha256: string}[]
 describe('shared-image publication bindings and fingerprints', () => {
+  test('binds every channel of the committed policy', () => {
+    const policy = loadPolicy(readFileSync(path.join(__dirname, '../../../..', POLICY_PATH), 'utf8'))
+    const channels = policy.images['posthog-cloud'].channels
+    const bindings = bindChannels(policy, 'posthog-cloud')['posthog-cloud']
+    expect(Object.keys(bindings).sort()).toEqual(Object.keys(channels).sort())
+    for (const [name, channel] of Object.entries(channels)) {
+      expect(bindings[name]).toEqual({repository: channel.repository})
+    }
+  })
+
   test.each([
     ['unknown build', fixture.replace('posthog-cloud:', 'unknown-image:'), 'images.unknown-image: unknown build input'],
     ['prototype build', fixture.replace('posthog-cloud:', '__proto__:'), 'images.__proto__: unknown build input'],

.github/shared-image-releases.yaml

@@ -18,7 +18,34 @@ filters:
         - pyproject.toml
         - bin/temporal-django-worker
         - 'posthog/clickhouse/migrations/**'
+    experimentsRecalculationActivity:
+        - 'products/experiments/backend/**'
+        - 'products/experiments/stats/**'
+        - 'posthog/hogql*/**'
+        - 'posthog/clickhouse/**'
+        - 'posthog/temporal/common/**'
+        - 'posthog/management/commands/start_temporal_worker.py'
+        - 'posthog/settings/temporal.py'
+        - posthog/schema.py
+        - 'posthog/models/**'
+        - 'posthog/migrations/**'
+        - 'products/*/backend/migrations/**'
+        - posthog/exceptions.py
+        - 'products/feature_flags/backend/**'
+        - 'products/cohorts/backend/**'
+        - 'products/analytics_platform/backend/lazy_computation/**'
+        - 'products/ai_observability/backend/facade/**'
+        - 'common/hogvm/**'
+        - pyproject.toml
+        - uv.lock
+        - bin/temporal-django-worker
+        - manage.py
+        - Dockerfile
 
 images:
     posthog-cloud:
-        channels: {}
+        channels:
+            experiments-recalculation-activity:
+                repository: posthog-temporal-workers/experiments-recalculation-activity
+                filter: experimentsRecalculationActivity
+                bootstrapPolicyDigest: a06fc277bfb801b6da6406ac2a8d0ed82ac09c13e1ac37234c8a4e01b44b1313

frontend/src/scenes/organization/ConfirmOrganization/confirmOrganizationLogic.test.ts

@@ -19,22 +19,28 @@ describe('confirmOrganizationLogic', () => {
     })
 
     describe('query params', () => {
-        it('prefills the form from the URL', async () => {
-            router.actions.push('/organization/confirm-creation', {
-                email: 'spike@spike.com',
-                first_name: 'Spike',
-                organization_name: 'Spikes Inc',
-            })
+        it.each([
+            ['Spike', 'Spikes Inc'],
+            ['3130', '2600'],
+        ])('prefills the form from the URL with the name %p', async (firstName, organizationName) => {
+            // A raw URL, not a params object: kea-router passes object values through untouched, so
+            // only a real query string parses a name of only digits into a number, which used to crash
+            router.actions.push(
+                `/organization/confirm-creation?email=spike@spike.com&first_name=${encodeURIComponent(firstName)}&organization_name=${encodeURIComponent(organizationName)}`
+            )
 
             await expectLogic(logic)
                 .toDispatchActions(['setEmail', 'setConfirmOrganizationValues'])
                 .toMatchValues({
                     confirmOrganization: expect.objectContaining({
-                        first_name: 'Spike',
-                        organization_name: 'Spikes Inc',
+                        first_name: firstName,
+                        organization_name: organizationName,
                     }),
                     email: 'spike@spike.com',
                 })
+
+            expect(logic.values.confirmOrganizationValidationErrors.first_name).toBeUndefined()
+            expect(logic.values.confirmOrganizationValidationErrors.organization_name).toBeUndefined()
         })
 
         it('keeps user input when a later location change re-fires the handler', async () => {

frontend/src/scenes/organization/ConfirmOrganization/confirmOrganizationLogic.ts

@@ -211,7 +211,7 @@ export const confirmOrganizationLogic = kea<confirmOrganizationLogicType>([
     })),
 
     urlToAction(({ actions, values }) => ({
-        '/organization/confirm-creation': (_, { email, organization_name, first_name }) => {
+        '/organization/confirm-creation': (_, __, ___, { search }) => {
             // Prefill from the URL once. Later location changes on this same page (for example
             // opening the docs side panel) re-fire this handler with empty params, which would
             // otherwise wipe what the user has typed.
@@ -220,15 +220,22 @@ export const confirmOrganizationLogic = kea<confirmOrganizationLogicType>([
             }
             actions.setHasPrefilled()
 
+            // Read the raw query string, because kea-router parses a value that looks like a number
+            // into one. A name of only digits must stay text for the validators to trim it.
+            const params = new URLSearchParams(search)
+            const email = params.get('email')
+            const organizationName = params.get('organization_name')
+            const firstName = params.get('first_name')
+
             if (email) {
                 actions.setEmail(email)
             }
             const prefill: DeepPartial<ConfirmOrganizationFormValues> = {}
-            if (organization_name) {
-                prefill.organization_name = organization_name
+            if (organizationName) {
+                prefill.organization_name = organizationName
             }
-            if (first_name) {
-                prefill.first_name = first_name
+            if (firstName) {
+                prefill.first_name = firstName
             }
             if (Object.keys(prefill).length > 0) {
                 actions.setConfirmOrganizationValues(prefill)

products/alerts_platform/backend/facade/contracts.py

@@ -979,24 +979,68 @@ class SourceDelete(Protocol):
     def __call__(self, *, team_id: int, legacy_configuration_id: UUID) -> None: ...
 
 
+class SourceConfigTeamCheck(Protocol):
+    """Checks a `source_config` against the project it is written in, which `validate` cannot see.
+
+    For example, that its ids name rows of that project. It raises `InvalidPlatformAlertEdit`.
+    """
+
+    def __call__(self, *, team_id: int, edit: PlatformAlertConfigurationEdit) -> None: ...
+
+
+class NativeAlertRemoveDestinations(Protocol):
+    """Removes the destinations of an alert that is about to be deleted.
+
+    The alert's open incidents are closed before this runs, while the destinations their resolves go
+    to still exist. It runs in the delete's transaction, so a delete that fails keeps them.
+    """
+
+    def __call__(self, *, team_id: int, configuration_id: UUID) -> None: ...
+
+
+@frozen
+class NativeAlertLifecycle:
+    """How the platform creates and deletes alerts of a kind whose source keeps no row for them.
+
+    The configuration is the alert's only record, and its own id is the id the alert's destinations
+    are matched on.
+    """
+
+    check_interval_minutes: int
+    remove_destinations: NativeAlertRemoveDestinations
+
+
 @frozen
 class SourceConfigSpec:
     """A source kind's schema for `source_config` and its rules for a whole edit.
 
     `model` validates `source_config`. `validate` raises `InvalidPlatformAlertEdit` for a rule that
-    spans fields, such as one that reads `enabled`. `mirror` runs in the edit's transaction. Without
-    `create` or `delete`, the API cannot create or delete alerts of the kind.
+    spans fields, such as one that reads `enabled`. `check_in_team` runs when a create or an edit
+    sets `source_config`. `mirror` runs in the edit's transaction. Without
+    `create` or `delete`, the API cannot create or delete alerts of the kind, unless the kind is
+    `native`: then the platform creates and deletes them itself, and the source keeps no row.
     """
 
     model: type[BaseModel]
     validate: Callable[[PlatformAlertConfigurationEdit], None]
+    check_in_team: SourceConfigTeamCheck | None = None
     mirror: SourceEditMirror | None = None
     create: SourceCreate | None = None
     delete: SourceDelete | None = None
     # Where the source's incident destinations listen for a close, and the alert's page in the
     # source's product. A control-plane close needs both to address its resolve.
     incident_event_ids: Mapping[str, str] | None = None
     alert_url: Callable[[int, UUID], str] | None = None
+    native: NativeAlertLifecycle | None = None
+
+    def __post_init__(self) -> None:
+        # The source-row hooks write a row a native kind does not have.
+        if self.native is not None and (self.mirror or self.create or self.delete):
+            raise ValueError("A native kind keeps no source row, so it cannot register mirror, create or delete.")
+
+    @property
+    def creatable(self) -> bool:
+        return self.native is not None or self.create is not None
 
 
 SourceConfigLoader = Callable[[], SourceConfigSpec]

products/alerts_platform/backend/logic/control_plane.py

@@ -56,7 +56,7 @@ class PendingClose:
     team_id: int
     source_kind: str
     configuration_id: UUID
-    legacy_configuration_id: UUID | None
+    destination_alert_id: UUID
     rows: tuple[PlatformAlertEventRow, ...]
 
 
@@ -90,7 +90,7 @@ def end_firings(configuration: PlatformAlertConfiguration, *, reason: str, now:
         team_id=configuration.team_id,
         source_kind=configuration.source_kind,
         configuration_id=configuration.id,
-        legacy_configuration_id=configuration.legacy_configuration_id,
+        destination_alert_id=configuration.destination_alert_id,
         rows=rows,
     )
 
@@ -129,21 +129,21 @@ def _announce(pending: PendingClose, *, inline: bool) -> None:
 
 def _resolve_delivery(pending: PendingClose) -> AlertDeliveryRequest | None:
     spec = source_configs.spec(SourceKind(pending.source_kind))
-    if spec is None or spec.incident_event_ids is None or pending.legacy_configuration_id is None:
+    if spec is None or spec.incident_event_ids is None:
         return None
     grouping_keys = [row.grouping_key for row in pending.rows]
     return AlertDeliveryRequest(
         source=SourceKind(pending.source_kind),
         team_id=pending.team_id,
         configuration_id=str(pending.configuration_id),
         evaluation_key=pending.rows[0].evaluation_key,
-        # The id the source's destinations are matched on, as on every check's delivery.
-        destination_alert_id=str(pending.legacy_configuration_id),
+        # The id the alert's destinations are matched on, as on every check's delivery.
+        destination_alert_id=str(pending.destination_alert_id),
         event_ids_by_kind={},
         incident_actions=dict.fromkeys(grouping_keys, IncidentAction.RESOLVE),
         sends_messages=False,
         event_ids_by_incident_action=dict(spec.incident_event_ids),
-        source_alert_url=spec.alert_url(pending.team_id, pending.legacy_configuration_id) if spec.alert_url else None,
+        source_alert_url=spec.alert_url(pending.team_id, pending.destination_alert_id) if spec.alert_url else None,
         owned_by_platform=True,
         parts=parts_for(len(grouping_keys)),
     )

products/alerts_platform/backend/logic/platform_lifecycle.py

@@ -31,6 +31,7 @@
     PlatformAlertUpsert,
     PlatformHandback,
     PlatformOwnershipHandover,
+    SourceKind,
     source_condition,
 )
 from products.alerts_platform.backend.facade.enums import PlatformAlertOwner, PlatformAlertState
@@ -504,7 +505,7 @@
     return replace(group, kind=AlertEventKind.CHECK, notified=False, muted_notification=held)
 
 
 def record_outcomes(team_id: int, outcomes: Sequence[PlatformAlertOutcome], now: datetime) -> int:
     """Persists a batch's decisions and advances each configuration's schedule.
 
     Two statements rather than two per alert, in one transaction, so a crash between them cannot
@@ -797,6 +798,33 @@
     if reenabled:
         configuration.next_check_at = now + _REVIVE_FENCE
         update_fields.append("next_check_at")
+    _assign_edit(configuration, edit)
+    configuration.save(update_fields=update_fields)
+
+
+def create_native_configuration(
+    *,
+    team_id: int,
+    source_kind: SourceKind,
+    edit: PlatformAlertConfigurationEdit,
+    check_interval_minutes: int,
+    now: datetime,
+) -> PlatformAlertConfiguration:
+    """Creates an alert the platform owns from the start, for a kind whose source keeps no row for it."""
+    configuration = PlatformAlertConfiguration(
+        team_id=team_id,
+        source_kind=source_kind.value,
+        check_interval_minutes=check_interval_minutes,
+        next_check_at=now,
+        owner=PlatformAlertOwner.PLATFORM,
+    )
+    _assign_edit(configuration, edit)
+    # The model's own save logs the creation.
+    configuration.save()
+    return configuration
+
+
+def _assign_edit(configuration: PlatformAlertConfiguration, edit: PlatformAlertConfigurationEdit) -> None:
     configuration.name = edit.name
     configuration.enabled = edit.enabled
     configuration.source_config = edit.source_config
@@ -805,7 +833,6 @@
     configuration.evaluation_periods = edit.evaluation_periods
     configuration.datapoints_to_alarm = edit.datapoints_to_alarm
     configuration.cooldown_minutes = edit.cooldown_minutes
-    configuration.save(update_fields=update_fields)
 
 
 def end_firing_instances(configuration: PlatformAlertConfiguration, *, now: datetime) -> list[PlatformAlert]: