Repository navigation
Conversation
Adds a signature format choice to the webhook template. HMAC-SHA256 of the body sends X-Hub-Signature-256 for receivers that check GitHub-style signatures. Merge only after the executor support below has deployed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
🤖 CI report✅ Trunk lane — non-backend laneThis PR is assigned to the non-backend lane. It does not run backend Python tests and may merge in parallel with PRs in other lanes.
|
| First copy | Second copy | Lines | Tokens |
|---|---|---|---|
posthog/hogql/database/schema/test/test_sessions_v2.py:224 |
posthog/hogql/database/schema/test/test_sessions_v3.py:332 |
44 | 246 |
posthog/hogql/database/schema/sessions_v1.py:313 |
posthog/hogql/database/schema/sessions_v2.py:385 |
34 | 169 |
posthog/hogql/database/schema/sessions_v1.py:219 |
posthog/hogql/database/schema/sessions_v2.py:230 |
15 | 106 |
products/warehouse_sources/sources/secoda/secoda.py:67 |
products/warehouse_sources/sources/twilio/twilio.py:309 |
19 | 101 |
products/warehouse_sources/sources/bigcommerce/bigcommerce.py:126 |
products/warehouse_sources/sources/tvmaze/tvmaze.py:99 |
14 | 89 |
products/signals/backend/emission/azure_application_insights_exceptions.py:5 |
products/signals/backend/emission/mux_errors.py:7 |
15 | 87 |
products/signals/backend/emission/azure_application_insights_exceptions.py:9 |
products/signals/backend/emission/newrelic_errors.py:11 |
11 | 82 |
products/warehouse_sources/sources/firehydrant/firehydrant.py:99 |
products/warehouse_sources/sources/helpin/helpin.py:244 |
13 | 71 |
⚠️ Duplication (TypeScript) — 10 new duplicated blocks (worst 264 tokens)
New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.
| First copy | Second copy | Lines | Tokens |
|---|---|---|---|
products/signals/frontend/inbox/signalSourcesLogic.ts:782 |
products/signals/frontend/inbox/signalSourcesLogic.ts:909 |
126 | 264 |
products/signals/frontend/inbox/signalSourcesLogic.ts:645 |
products/signals/frontend/inbox/signalSourcesLogic.ts:782 |
125 | 254 |
frontend/src/products.tsx:1995 |
products/signals/manifest.tsx:14 |
13 | 157 |
frontend/src/layout/panel-layout/navbar/tabs/navProductsTabLogic.ts:101 |
frontend/src/scenes/analytics/analyticsPinnedLogic.ts:73 |
35 | 113 |
frontend/src/products.tsx:315 |
products/signals/manifest.tsx:58 |
12 | 96 |
products/metrics/frontend/suggestedDashboards/QuillSuggestedDashboardsMenu.tsx:28 |
products/metrics/frontend/suggestedDashboards/SuggestedDashboardsMenu.tsx:64 |
12 | 93 |
products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts:866 |
products/workflows/frontend/Broadcasts/broadcastWizardLogic.ts:1672 |
16 | 73 |
products/conversations/frontend/components/SupportSetupCard/supportSetupCardLogic.ts:46 |
products/workflows/frontend/setupGuide/wizard/workflowsOnboardingWizardLogic.ts:181 |
16 | 72 |
products/error_tracking/frontend/scenes/ErrorTrackingIssueScene/errorTrackingIssueSceneLogic.ts:234 |
products/error_tracking/frontend/scenes/ErrorTrackingIssueScene/errorTrackingIssueSceneLogic.ts:284 |
16 | 70 |
products/error_tracking/frontend/scenes/ErrorTrackingIssueScene/errorTrackingIssueSceneLogic.ts:458 |
products/error_tracking/frontend/scenes/ErrorTrackingIssueScene/errorTrackingIssueSceneLogic.ts:630 |
15 | 70 |
![posthog[bot]](https://avatars.githubusercontent.com/in/1203049?s=60&v=4){kind=small}
Run the template's fetch through the executor and check the signature the receiver gets for each signing format, keeping the check that the queue payload never holds the secret. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Risk: No findings Follow-up delta adds two fail-closed guards to the HMAC-SHA256 webhook signing path — a 24-byte minimum secret length and a refusal to sign requests with no body — plus test and description copy updates. Both guards stop the request before it is sent and sign exactly the bytes the fetch transmits, so they harden rather than weaken the flow. Sentinel reviewed |
|
Review requests went to the owners of the changed code. These owners were not requested because their part of this change looks trivial:
If you were listed here and want to review, you can still assign yourself as a reviewer. |
posthog-security-review-bot
Bot
added
the
security-review
|
✅ Security review complete — No findings above the confidence threshold, in 5 min. Add the |
![stamphog[bot]](https://avatars.githubusercontent.com/in/3000332?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
![posthog-security-review-bot[bot]](https://avatars.githubusercontent.com/in/4551195?s=60&v=4){kind=small}
posthog-security-review-bot
Bot
removed
the
security-review
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
New commits were pushed — dismissing the stamphog approval from an earlier head. Re-add the trigger label to request a fresh review.
There was a problem hiding this comment.
Approved.
The security-sensitive changes have current-head independent review and STRONG author familiarity. No unresolved substantive concerns or other refusal grounds were found.
- Author wrote 79% of the modified lines and has 3 merged PRs in these paths (familiarity STRONG).
- PostHog Review (Standard) reviewed the current head: no findings.
- posthog[bot] reviewed the current head.
Gate mechanics and policy version
| Gate | Result | |
|---|---|---|
| prerequisites | ✓ | all clear |
| deny-list | ✓ | no deny categories matched |
| size | ✓ | 25L, 1F substantive, 94L/6F incl. docs/generated/snapshots — within ceiling |
| tier | ✓ | T1-agent / T1c-medium (94L, 6F, single-area, feat) |
| stamphog 2.8.0 | .stamphog/policy.yml @ 6307e7a · reviewed head 6307e7a |
Problem
Builds on #127117, which taught every worker the new format.
Impact
Watch Webhooks signed with HMAC-SHA256: teams with webhook steps or destinations choose the new format after deploy. Baseline since 2026-11-13.
Note
🔵 Merge risk: low · two-way door until a team builds a receiver on
X-Hub-Signature-256Rollout
Changes
X-Hub-Signature-256: sha256=<hex>and awebhook-idthat stays the same across retries.How did you test this code?
Test rationale: the webhook template test runs each format through the executor and checks the signature the request carries: unset, Standard Webhooks and HMAC-SHA256. It fails if a format signs the wrong way, or if the queued job holds the secret.
webhook-id; a wrong secret gets a 401; HMAC-SHA256 with GET sends nothing and logs why.Release status
Docs update
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Agent: Claude Code, Claude Opus 5.5 (claude-opus-5-5)
Skills:
/writing-tests,/writing-user-facing-copy,/writing-pr-descriptions,/stacking-prs,takeover,full-stop,impact,merge-risk,pr-descriptionSecurity review: not needed
More context for AI agents
signingchoice inwebhook.template.ts; a missingsigning_formatmust stay Standard Webhooks.Involvement: one design pass, two review panel rounds, two upstream review rounds, three bot review rounds.
🤖 Generated with Claude Code