Merge branch 'master' into flox

.github/workflows/ci-backend.yml

@@ -91,7 +91,6 @@ jobs:
 
     backend-code-quality:
         needs: changes
-        # if: needs.changes.outputs.backend == 'true' # <- Can't add this here because it's a required check
         timeout-minutes: 30
 
         name: Python code quality checks
@@ -106,12 +105,10 @@ jobs:
                   token: ${{ secrets.GITHUB_TOKEN }}
 
             - uses: actions/checkout@v3
-              if: needs.changes.outputs.backend == 'true'
               with:
                   fetch-depth: 1
 
             - name: Set up Python
-              if: needs.changes.outputs.backend == 'true'
               uses: actions/setup-python@v5
               with:
                   python-version: 3.11.9
@@ -121,40 +118,32 @@ jobs:
 
             # uv is a fast pip alternative: https://github.com/astral-sh/uv/
             - run: pip install uv
-              if: needs.changes.outputs.backend == 'true'
 
             - name: Install SAML (python3-saml) dependencies
-              if: needs.changes.outputs.backend == 'true'
               run: |
                   sudo apt-get update
                   sudo apt-get install libxml2-dev libxmlsec1 libxmlsec1-dev libxmlsec1-openssl
 
             - name: Install Python dependencies
-              if: needs.changes.outputs.backend == 'true'
               run: |
                   uv pip install --system -r requirements.txt -r requirements-dev.txt
 
             - name: Check for syntax errors, import sort, and code style violations
-              if: needs.changes.outputs.backend == 'true'
               run: |
                   ruff check .
 
             - name: Check formatting
-              if: needs.changes.outputs.backend == 'true'
               run: |
                   ruff format --check --diff .
 
             - name: Add Problem Matcher
-              if: needs.changes.outputs.backend == 'true'
               run: echo "::add-matcher::.github/mypy-problem-matcher.json"
 
             - name: Check static typing
-              if: needs.changes.outputs.backend == 'true'
               run: |
                   mypy -p posthog | mypy-baseline filter
 
             - name: Check if "schema.py" is up to date
-              if: needs.changes.outputs.backend == 'true'
               run: |
                   npm run schema:build:python && git diff --exit-code
 
@@ -235,9 +224,8 @@ jobs:
 
     django:
         needs: changes
-        # if: needs.changes.outputs.backend == 'true' # <- Can't add this here because it's a required check
-
-        timeout-minutes: 30 # increase for tmate testing
+        # increase for tmate testing
+        timeout-minutes: 30
 
         name: Django tests – ${{ matrix.segment }} (persons-on-events ${{ matrix.person-on-events && 'on' || 'off' }}), Py ${{ matrix.python-version }}, ${{ matrix.clickhouse-server-image }} (${{matrix.group}}/${{ matrix.concurrency }})
         runs-on: ubuntu-24.04
@@ -273,8 +261,10 @@ jobs:
                       group: 3
 
         steps:
+            # The first step is the only one that should run if `needs.changes.outputs.backend == 'false'`.
+            # All the other ones should rely on `needs.changes.outputs.backend` directly or indirectly, so that they're
+            # effectively skipped if backend code is unchanged. See https://github.com/PostHog/posthog/pull/15174.
             - uses: actions/checkout@v3
-              if: needs.changes.outputs.backend == 'true'
               with:
                   fetch-depth: 1
                   repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -317,7 +307,7 @@ jobs:
                   fi
 
             - name: Fail CI if some snapshots have been updated but not committed
-              if: needs.changes.outputs.backend == 'true' && steps.changed-files.outputs.files_found == 'true' && steps.add-and-commit.outcome == 'success'
+              if: steps.changed-files.outputs.files_found == 'true' && steps.add-and-commit.outcome == 'success'
               run: |
                   echo "${{ steps.changed-files.outputs.diff }}"
                   exit 1
@@ -333,11 +323,11 @@ jobs:
     async-migrations:
         name: Async migrations tests -  ${{ matrix.clickhouse-server-image }}
         needs: changes
-        if: needs.changes.outputs.backend == 'true'
         strategy:
             fail-fast: false
             matrix:
                 clickhouse-server-image: ['clickhouse/clickhouse-server:24.8.7.41']
+        if: needs.changes.outputs.backend == 'true'
         runs-on: ubuntu-24.04
         steps:
             - name: 'Checkout repo'
@@ -391,7 +381,7 @@ jobs:
 
     calculate-running-time:
         name: Calculate running time
-        needs: [changes, django, async-migrations]
+        needs: [django, async-migrations]
         runs-on: ubuntu-24.04
         if: # Run on pull requests to PostHog/posthog + on PostHog/posthog outside of PRs - but never on forks
             needs.changes.outputs.backend == 'true' &&

.github/workflows/ci-e2e.yml

@@ -68,7 +68,6 @@ jobs:
     container:
         name: Build and cache container image
         runs-on: ubuntu-24.04
-        if: needs.changes.outputs.shouldTriggerCypress == 'true'
         timeout-minutes: 60
         needs: [changes]
         permissions:
@@ -79,9 +78,12 @@ jobs:
             build-id: ${{ steps.build.outputs.build-id }}
         steps:
             - name: Checkout
+              if: needs.changes.outputs.shouldTriggerCypress == 'true'
               uses: actions/checkout@v3
             - name: Build the Docker image with Depot
-              uses: ./.github/actions/build-n-cache-image # Build the container image in preparation for the E2E tests
+              if: needs.changes.outputs.shouldTriggerCypress == 'true'
+              # Build the container image in preparation for the E2E tests
+              uses: ./.github/actions/build-n-cache-image
               id: build
               with:
                   save: true
@@ -166,8 +168,7 @@ jobs:
                   build-id: ${{ needs.container.outputs.build-id }}
                   tags: ${{ needs.container.outputs.tag }}
 
-            - name: Write .env
-              if: needs.changes.outputs.shouldTriggerCypress == 'true'
+            - name: Write .env # This step intentionally has no if, so that GH always considers the action as having run
               run: |
                   cat <<EOT >> .env
                   SECRET_KEY=6b01eee4f945ca25045b5aab440b953461faf08693a9abbf1166dc7c6b9772da
@@ -279,7 +280,7 @@ jobs:
     calculate-running-time:
         name: Calculate running time
         runs-on: ubuntu-24.04
-        needs: [changes, cypress]
+        needs: [cypress]
         if: needs.changes.outputs.shouldTriggerCypress == 'true' &&
             github.event.pull_request.head.repo.full_name == 'PostHog/posthog'
         steps:

.github/workflows/ci-frontend.yml

@@ -52,13 +52,12 @@ jobs:
 
     frontend-code-quality:
         name: Code quality checks
-        # if: needs.changes.outputs.frontend == 'true' # <- Can't add this here because it's a required check
         needs: changes
         # kea typegen and typescript:check need some more oomph
         runs-on: ubuntu-24.04
         steps:
+            # we need at least one thing to run to make sure we include everything for required jobs
             - uses: actions/checkout@v3
-              if: needs.changes.outputs.frontend == 'true'
 
             - name: Install pnpm
               if: needs.changes.outputs.frontend == 'true'
@@ -124,7 +123,6 @@ jobs:
     jest:
         runs-on: ubuntu-24.04
         needs: changes
-        # if: needs.changes.outputs.frontend == 'true' # <- Can't add this here because it's a required check
         name: Jest test (${{ matrix.segment }} - ${{ matrix.chunk }})
 
         strategy:
@@ -135,8 +133,8 @@ jobs:
                 chunk: [1, 2, 3]
 
         steps:
+            # we need at least one thing to run to make sure we include everything for required jobs
             - uses: actions/checkout@v3
-              if: needs.changes.outputs.frontend == 'true'
 
             - name: Remove ee
               if: needs.changes.outputs.frontend == 'true' && matrix.segment == 'FOSS'

.github/workflows/ci-hog.yml

@@ -11,12 +11,10 @@ on:
         paths-ignore:
             - rust/**
             - livestream/**
-            - .github/**
     pull_request:
         paths-ignore:
             - rust/**
             - livestream/**
-            - .github/**
 
 jobs:
     # Job to decide if we should run backend ci
@@ -49,7 +47,6 @@ jobs:
 
     hog-tests:
         needs: changes
-        if: needs.changes.outputs.hog == 'true'
         timeout-minutes: 30
 
         name: Hog tests
@@ -59,15 +56,17 @@ jobs:
             # If this run wasn't initiated by the bot (meaning: snapshot update) and we've determined
             # there are backend changes, cancel previous runs
             - uses: n1hility/cancel-previous-runs@v3
-              if: github.actor != 'posthog-bot'
+              if: github.actor != 'posthog-bot' && needs.changes.outputs.hog == 'true'
               with:
                   token: ${{ secrets.GITHUB_TOKEN }}
 
             - uses: actions/checkout@v3
+              if: needs.changes.outputs.hog == 'true'
               with:
                   fetch-depth: 1
 
             - name: Set up Python
+              if: needs.changes.outputs.hog == 'true'
               uses: actions/setup-python@v5
               with:
                   python-version: 3.11.9
@@ -77,25 +76,31 @@ jobs:
 
             # uv is a fast pip alternative: https://github.com/astral-sh/uv/
             - run: pip install uv
+              if: needs.changes.outputs.hog == 'true'
 
             - name: Install SAML (python3-saml) dependencies
+              if: needs.changes.outputs.hog == 'true'
               run: |
                   sudo apt-get update
                   sudo apt-get install libxml2-dev libxmlsec1 libxmlsec1-dev libxmlsec1-openssl
 
             - name: Install Python dependencies
+              if: needs.changes.outputs.hog == 'true'
               run: |
                   uv pip install --system -r requirements.txt -r requirements-dev.txt
 
             - name: Install pnpm
+              if: needs.changes.outputs.hog == 'true'
               uses: pnpm/action-setup@v4
 
             - name: Set up Node.js
+              if: needs.changes.outputs.hog == 'true'
               uses: actions/setup-node@v4
               with:
                   node-version: 18.12.1
 
             - name: Check if ANTLR definitions are up to date
+              if: needs.changes.outputs.hog == 'true'
               run: |
                   cd ..
                   sudo apt-get install default-jre
@@ -118,21 +123,25 @@ jobs:
                   ANTLR_VERSION: '4.13.2'
 
             - name: Check if STL bytecode is up to date
+              if: needs.changes.outputs.hog == 'true'
               run: |
                   python -m hogvm.stl.compile
                   git diff --exit-code
 
             - name: Run HogVM Python tests
+              if: needs.changes.outputs.hog == 'true'
               run: |
                   pytest hogvm
 
             - name: Run HogVM TypeScript tests
+              if: needs.changes.outputs.hog == 'true'
               run: |
                   cd hogvm/typescript
                   pnpm install --frozen-lockfile
                   pnpm run test
 
             - name: Run Hog tests
+              if: needs.changes.outputs.hog == 'true'
               run: |
                   cd hogvm/typescript
                   pnpm run build 

.github/workflows/ci-plugin-server.yml

@@ -81,7 +81,6 @@ jobs:
     tests:
         name: Plugin Server Tests (${{matrix.shard}})
         needs: changes
-        # if: needs.changes.outputs.plugin-server == 'true' # <- Can't add this here because it's a required check
         runs-on: ubuntu-24.04
 
         strategy:
@@ -97,6 +96,7 @@ jobs:
 
         steps:
             - name: Code check out
+              # NOTE: We need this check on every step so that it still runs if skipped as we need it to suceed for the CI
               if: needs.changes.outputs.plugin-server == 'true'
               uses: actions/checkout@v3
 
@@ -121,14 +121,12 @@ jobs:
 
             # uv is a fast pip alternative: https://github.com/astral-sh/uv/
             - run: pip install uv
-              if: needs.changes.outputs.plugin-server == 'true'
 
             - name: Install rust
               if: needs.changes.outputs.plugin-server == 'true'
               uses: dtolnay/[email protected]
 
             - uses: actions/cache@v4
-              if: needs.changes.outputs.plugin-server == 'true'
               with:
                   path: |
                       ~/.cargo/registry
@@ -195,7 +193,6 @@ jobs:
     functional-tests:
         name: Functional tests
         needs: changes
-        # if: needs.changes.outputs.plugin-server == 'true' # <- Can't add this here because it's a required check
         runs-on: ubuntu-24.04
 
         env:
@@ -233,7 +230,6 @@ jobs:
 
             # uv is a fast pip alternative: https://github.com/astral-sh/uv/
             - run: pip install uv
-              if: needs.changes.outputs.plugin-server == 'true'
 
             - name: Install SAML (python3-saml) dependencies
               if: needs.changes.outputs.plugin-server == 'true'

.github/workflows/codeql.yml

@@ -16,12 +16,10 @@ on:
         branches: ['master']
         paths-ignore:
             - 'rust/**'
-            - '.github/**'
     pull_request:
         branches: ['master']
         paths-ignore:
             - 'rust/**'
-            - '.github/**'
     schedule:
         - cron: '27 1 * * 0'
 

.github/workflows/container-images-ci.yml

@@ -5,7 +5,6 @@ on:
         paths-ignore:
             - 'rust/**'
             - 'livestream/**'
-            - '.github/**'
 
 concurrency:
     group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}