[Piccirello]

Problem

• Cloud task sandboxes run Node 24.22.0, one release behind the Node 24.22.1 patch release (dpkg-query -W nodejs in posthog-sandbox-base:master and posthog-sandbox-notebook:master, checked 2026-10-22).
• A Node release reaches no sandbox by itself. The images install nodejs from nodesource with no version, and the layer cache keys on the RUN text.
• The half-hourly drift check rebuilds an image only when its repo inputs change, and a Node release changes no repo file.
• Modal caches the inline slim image by its definition, so SLIM_BASE, CANVAS_BUILD and STAMPHOG_REVIEW keep the Node release of their first build.

Changes

• A new nodesource Node 24 release now rebuilds the registry sandbox images within one scheduled drift run, with no PR and no version in the repo.
• The changes job reads the newest nodejs package that nodesource serves for both amd64 and arm64, and adds it to the inputs digest. A new release then fails the drift check against the :master labels.
• The base and notebook builds pass that version as NODEJS_VERSION. The build-arg changes the cache key of the Node layer, so the build installs the new release.
• The pi, autoresearch and vm images build FROM the base, so they rebuild with it.
• A local build without the arg installs the newest package, as before.
• The Modal slim image gets a first layer that changes every ISO week. The first SLIM_BASE, CANVAS_BUILD or STAMPHOG_REVIEW create of each week pays a Modal image build, and gets the newest apt packages, Node included.
• When the nodesource index does not answer, the changes job fails and no image builds. The image build needs nodesource too, so this adds no new way to block a build.

Note

The workflow file is an input to the digest, so the merge itself rebuilds every sandbox image once.

How did you test this code?

• Ran the Describe the image HEAD should produce step on a devbox. It resolved 24.22.1-1nodesource1. With the nodesource host unreachable, it failed with the new error.
• A BuildKit build with the same NODEJS_VERSION reused the cached RUN layer, and a different value rebuilt it.
• In ubuntu:24.04, the install line gave v24.22.0 with NODEJS_VERSION=24.22.0-1nodesource1, and v24.22.1 with no arg.
• _build_slim_template_image() returns an image definition for dates in two different ISO weeks.
• Not run: the workflow on GitHub, full builds of the base and notebook images, and a Modal-side build of the slim image.

Test rationale: No new test. A unit test of the week string would restate the f-string, and the workflow step has no test harness.

Release status

• No feature flag controls this change

Docs update

None.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Agent: Claude Code, Opus 5.5 (claude-opus-5-5)

• Skills invoked: /authoring-ci-workflows, /gating-production-deploys, /writing-code-comments, /writing-pr-descriptions.
• The first version of this PR pinned nodejs=24.22.1-1nodesource1. The author asked for an approach that needs no bump for each Node release, so this version resolves the newest package at build time instead.
• Rejected for the slim image: a nodesource lookup at sandbox create, which adds a network call to that path, and moving the image into the registry pipeline.
• This makes the Renovate rule in chore(tasks): let renovate bump the sandbox nodejs package #122387 unnecessary.
• Public artifact: the diff and this body draw on no customer or private material.

[trunk-io]

😎 Merged successfully - details.

[github-actions]

🤖 CI report

⚠️ Trunk lane — backend Python lane

This PR is assigned to the backend Python lane. It runs backend Python tests and may merge in parallel with PRs in other lanes.

✅ Duplication (Python) — clean

New Python code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

✅ Duplication (TypeScript) — clean

New TypeScript code duplication introduced by this branch. Fails at 70+ tokens in app code, or 150+ tokens when both copies live in test files. Advisory while the gate proves itself: extract a shared helper instead of copying.

⚠️ Backend coverage — 50.0% of changed backend lines covered — 1 uncovered

🧪 Backend test coverage

Patch coverage — changed backend lines (products + core): ██████████░░░░░░░░░░ 50.0% (1 / 2)

File	Patch	Uncovered changed lines
products/tasks/backend/logic/services/modal_sandbox.py	50.0%	624

🤖 Agents: add a test only if an uncovered line exposes a realistic regression that existing tests miss. Otherwise explain why no new test is needed under "How did you test this code?". Gap list: the patch-coverage artifact on this run (gh run download 581277011724851 -n patch-coverage), or the coverage-data block at the end of this comment.

Per-product line coverage (touched products)

Product	Coverage	Lines
platform_features	██░░░░░░░░░░░░░░░░░░ 12.1%	7 / 58
demo	███████████░░░░░░░░░ 56.4%	1,542 / 2,736
data_tools	████████████░░░░░░░░ 61.2%	90 / 147
warehouse_sources_queue	█████████████░░░░░░░ 65.2%	2,157 / 3,306
batch_exports	████████████████░░░░ 81.6%	22,872 / 28,041
apm	█████████████████░░░ 84.1%	1,306 / 1,553
engineering_analytics	█████████████████░░░ 85.0%	11,463 / 13,482
aeo	█████████████████░░░ 85.3%	945 / 1,108
commands	█████████████████░░░ 85.5%	1,618 / 1,893
mcp_analytics	█████████████████░░░ 86.1%	5,699 / 6,617
ml_inference	█████████████████░░░ 86.3%	524 / 607
posthog_ai	██████████████████░░ 87.9%	4,295 / 4,885
dashboards	██████████████████░░ 88.2%	7,330 / 8,315
warehouse_suggestions	██████████████████░░ 88.5%	2,939 / 3,322
notebooks	██████████████████░░ 88.5%	15,312 / 17,306
mcp_registry	██████████████████░░ 89.0%	1,596 / 1,794
webmcp	██████████████████░░ 89.6%	240 / 268
cohorts	██████████████████░░ 89.6%	8,568 / 9,559
product_tours	██████████████████░░ 89.7%	1,355 / 1,510
signals	██████████████████░░ 90.1%	82,299 / 91,326
visual_review	██████████████████░░ 90.6%	9,858 / 10,875
tasks	██████████████████░░ 90.7%	80,326 / 88,528
data_warehouse	██████████████████░░ 91.0%	15,067 / 16,565
canvas	██████████████████░░ 91.1%	7,998 / 8,776
today	██████████████████░░ 91.2%	3,798 / 4,163
data_modeling	██████████████████░░ 91.4%	10,119 / 11,077
autoresearch	██████████████████░░ 91.4%	11,606 / 12,693
cdp	██████████████████░░ 91.5%	10,251 / 11,206
slack_app	██████████████████░░ 91.6%	20,324 / 22,186
business_knowledge	██████████████████░░ 91.6%	10,017 / 10,934
metrics	██████████████████░░ 91.6%	10,425 / 11,375
wizard	██████████████████░░ 91.7%	6,870 / 7,490
managed_warehouse	██████████████████░░ 91.8%	11,957 / 13,024
streamlit_apps	██████████████████░░ 91.9%	3,139 / 3,415
error_tracking	██████████████████░░ 92.0%	18,507 / 20,127
ai_training	██████████████████░░ 92.1%	441 / 479
conversations	██████████████████░░ 92.2%	30,218 / 32,778
review_hog	██████████████████░░ 92.2%	17,726 / 19,221
stamphog	███████████████████░ 92.5%	8,776 / 9,483
early_access_features	███████████████████░ 92.6%	1,339 / 1,446
managed_migrations	███████████████████░ 92.6%	1,630 / 1,760
alerts_platform	███████████████████░ 92.8%	7,385 / 7,962
notifications	███████████████████░ 93.0%	1,199 / 1,289
web_analytics	███████████████████░ 93.2%	25,649 / 27,506
alerts	███████████████████░ 93.3%	9,455 / 10,131
surveys	███████████████████░ 93.4%	6,918 / 7,406
cross_project_dashboards	███████████████████░ 93.4%	880 / 942
approvals	███████████████████░ 93.4%	4,576 / 4,898
exports	███████████████████░ 93.6%	4,143 / 4,426
billing_alerts	███████████████████░ 93.7%	2,093 / 2,233
context_layer	███████████████████░ 93.8%	3,946 / 4,208
messaging	███████████████████░ 93.8%	4,705 / 5,015
mcp_store	███████████████████░ 93.9%	9,086 / 9,678
marketing_analytics	███████████████████░ 93.9%	21,191 / 22,562
customer_analytics	███████████████████░ 94.1%	27,892 / 29,651
ai_observability	███████████████████░ 94.2%	28,055 / 29,791
workflows	███████████████████░ 94.2%	22,742 / 24,146
logs	███████████████████░ 94.4%	19,278 / 20,431
legal_documents	███████████████████░ 94.4%	2,313 / 2,451
replay_vision	███████████████████░ 94.5%	31,998 / 33,861
actions	███████████████████░ 94.7%	1,004 / 1,060
reminders	███████████████████░ 94.8%	760 / 802
growth	███████████████████░ 94.9%	11,347 / 11,959
ai_gateway	███████████████████░ 94.9%	582 / 613
endpoints	███████████████████░ 95.1%	9,656 / 10,158
annotations	███████████████████░ 95.1%	1,095 / 1,151
skills	███████████████████░ 95.2%	7,336 / 7,707
experiments	███████████████████░ 95.4%	38,972 / 40,849
access_control	███████████████████░ 95.5%	8,080 / 8,460
data_catalog	███████████████████░ 95.6%	4,582 / 4,791
product_analytics	███████████████████░ 95.8%	29,841 / 31,164
feature_flags	███████████████████░ 95.8%	27,922 / 29,136
revenue_analytics	███████████████████░ 95.9%	1,877 / 1,958
data_quality	███████████████████░ 96.0%	8,523 / 8,878
subscriptions	███████████████████░ 96.2%	12,910 / 13,425
tracing	███████████████████░ 96.4%	4,360 / 4,524
warehouse_sources	███████████████████░ 96.5%	474,312 / 491,598
security	███████████████████░ 96.7%	1,549 / 1,602
account_audits	███████████████████░ 96.7%	770 / 796
pulse	███████████████████░ 97.1%	2,023 / 2,083
analytics_platform	████████████████████ 98.0%	2,798 / 2,855
groups	████████████████████ 98.2%	1,823 / 1,856
field_notes	████████████████████ 99.4%	172 / 173
uptime_monitoring	████████████████████ 100.0%	28 / 28

Report-only. Patch coverage = changed backend lines covered vs origin/master. Sorted lowest first.
Known gaps: lines covered only by Temporal tests show as uncovered; core line numbers may drift if master changed the same file.

[parameterai]

Risk: No findings

The change makes registry sandbox images rebuild when nodesource ships a new Node release: the CI changes job resolves the newest nodejs package served for both amd64 and arm64, mixes it into the inputs digest, and passes it as a NODEJS_VERSION build-arg; the Modal slim image gains a weekly-changing layer so its apt packages refresh. The main risk I traced is a remote-controlled version string reaching workflow outputs and docker build-args, and it is contained by a strict digit-only format check before any use.

_{Sentinel reviewed 23633ee · Review settings}

[trunk-io]

   

View Full Report ↗︎ ⋅ Docs

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-10-23 16:55 UTC	Run
prod-us	✅ Deployed	2026-10-23 18:09 UTC	Run
prod-eu	✅ Deployed	2026-10-23 18:17 UTC	Run