Skip to content

Commit 03b7366

Browse files
joshsnyjoshsny
authored
feat(array): sandbox environments (#42497)
1 parent aefbfb3 commit 03b7366

File tree

5 files changed

+489
-2
lines changed

5 files changed

+489
-2
lines changed

‎products/tasks/backend/constants.py‎

Lines changed: 190 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,193 @@
1+
DEFAULT_TRUSTED_DOMAINS = [
2+
# PostHog Services
3+
"posthog.com",
4+
"us.posthog.com",
5+
"eu.posthog.com",
6+
# Version Control
7+
"github.com",
8+
"www.github.com",
9+
"api.github.com",
10+
"raw.githubusercontent.com",
11+
"objects.githubusercontent.com",
12+
"codeload.github.com",
13+
"avatars.githubusercontent.com",
14+
"camo.githubusercontent.com",
15+
"gist.github.com",
16+
"gitlab.com",
17+
"www.gitlab.com",
18+
"registry.gitlab.com",
19+
"bitbucket.org",
20+
"www.bitbucket.org",
21+
"api.bitbucket.org",
22+
# Container Registries
23+
"registry-1.docker.io",
24+
"auth.docker.io",
25+
"index.docker.io",
26+
"hub.docker.com",
27+
"www.docker.com",
28+
"production.cloudflare.docker.com",
29+
"download.docker.com",
30+
"*.gcr.io",
31+
"ghcr.io",
32+
"mcr.microsoft.com",
33+
"*.data.mcr.microsoft.com",
34+
# Cloud Platforms
35+
"cloud.google.com",
36+
"accounts.google.com",
37+
"gcloud.google.com",
38+
"*.googleapis.com",
39+
"storage.googleapis.com",
40+
"compute.googleapis.com",
41+
"container.googleapis.com",
42+
"azure.com",
43+
"portal.azure.com",
44+
"microsoft.com",
45+
"www.microsoft.com",
46+
"*.microsoftonline.com",
47+
"packages.microsoft.com",
48+
"dotnet.microsoft.com",
49+
"dot.net",
50+
"visualstudio.com",
51+
"dev.azure.com",
52+
"oracle.com",
53+
"www.oracle.com",
54+
"java.com",
55+
"www.java.com",
56+
"java.net",
57+
"www.java.net",
58+
"download.oracle.com",
59+
"yum.oracle.com",
60+
# Package Managers - JavaScript/Node
61+
"registry.npmjs.org",
62+
"www.npmjs.com",
63+
"www.npmjs.org",
64+
"npmjs.com",
65+
"npmjs.org",
66+
"yarnpkg.com",
67+
"registry.yarnpkg.com",
68+
# Package Managers - Python
69+
"pypi.org",
70+
"www.pypi.org",
71+
"files.pythonhosted.org",
72+
"pythonhosted.org",
73+
"test.pypi.org",
74+
"pypi.python.org",
75+
"pypa.io",
76+
"www.pypa.io",
77+
# Package Managers - Ruby
78+
"rubygems.org",
79+
"www.rubygems.org",
80+
"api.rubygems.org",
81+
"index.rubygems.org",
82+
"ruby-lang.org",
83+
"www.ruby-lang.org",
84+
"rubyforge.org",
85+
"www.rubyforge.org",
86+
"rubyonrails.org",
87+
"www.rubyonrails.org",
88+
"rvm.io",
89+
"get.rvm.io",
90+
# Package Managers - Rust
91+
"crates.io",
92+
"www.crates.io",
93+
"static.crates.io",
94+
"rustup.rs",
95+
"static.rust-lang.org",
96+
"www.rust-lang.org",
97+
# Package Managers - Go
98+
"proxy.golang.org",
99+
"sum.golang.org",
100+
"index.golang.org",
101+
"golang.org",
102+
"www.golang.org",
103+
"goproxy.io",
104+
"pkg.go.dev",
105+
# Package Managers - JVM
106+
"maven.org",
107+
"repo.maven.org",
108+
"central.maven.org",
109+
"repo1.maven.org",
110+
"jcenter.bintray.com",
111+
"gradle.org",
112+
"www.gradle.org",
113+
"services.gradle.org",
114+
"spring.io",
115+
"repo.spring.io",
116+
# Package Managers - Other Languages
117+
"packagist.org",
118+
"www.packagist.org",
119+
"repo.packagist.org",
120+
"nuget.org",
121+
"www.nuget.org",
122+
"api.nuget.org",
123+
"pub.dev",
124+
"api.pub.dev",
125+
"hex.pm",
126+
"www.hex.pm",
127+
"cpan.org",
128+
"www.cpan.org",
129+
"metacpan.org",
130+
"www.metacpan.org",
131+
"api.metacpan.org",
132+
"cocoapods.org",
133+
"www.cocoapods.org",
134+
"cdn.cocoapods.org",
135+
"haskell.org",
136+
"www.haskell.org",
137+
"hackage.haskell.org",
138+
"swift.org",
139+
"www.swift.org",
140+
# Linux Distributions
141+
"archive.ubuntu.com",
142+
"security.ubuntu.com",
143+
"ubuntu.com",
144+
"www.ubuntu.com",
145+
"*.ubuntu.com",
146+
"ppa.launchpad.net",
147+
"launchpad.net",
148+
"www.launchpad.net",
149+
# Development Tools & Platforms
150+
"dl.k8s.io",
151+
"pkgs.k8s.io",
152+
"k8s.io",
153+
"www.k8s.io",
154+
"releases.hashicorp.com",
155+
"apt.releases.hashicorp.com",
156+
"rpm.releases.hashicorp.com",
157+
"archive.releases.hashicorp.com",
158+
"hashicorp.com",
159+
"www.hashicorp.com",
160+
"repo.anaconda.com",
161+
"conda.anaconda.org",
162+
"anaconda.org",
163+
"www.anaconda.com",
164+
"anaconda.com",
165+
"continuum.io",
166+
"apache.org",
167+
"www.apache.org",
168+
"archive.apache.org",
169+
"downloads.apache.org",
170+
"eclipse.org",
171+
"www.eclipse.org",
172+
"download.eclipse.org",
173+
"nodejs.org",
174+
"www.nodejs.org",
175+
# Cloud Services & Monitoring
176+
"statsig.com",
177+
"www.statsig.com",
178+
"api.statsig.com",
179+
"*.sentry.io",
180+
# Content Delivery & Mirrors
181+
"*.sourceforge.net",
182+
"packagecloud.io",
183+
"*.packagecloud.io",
184+
# Schema & Configuration
185+
"json-schema.org",
186+
"www.json-schema.org",
187+
"json.schemastore.org",
188+
"www.schemastore.org",
189+
]
190+
1191
SETUP_REPOSITORY_PROMPT = """
2192
Your goal is to setup the repository in the current environment.
3193

‎products/tasks/backend/migrations/0020_sandbox_environment.py‎

Lines changed: 95 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,95 @@
1+
# Generated by Django 4.2.26 on 2025-12-02 16:12
2+
3+
import django.db.models.deletion
4+
import django.contrib.postgres.fields
5+
from django.conf import settings
6+
from django.db import migrations, models
7+
8+
import posthog.models.utils
9+
import posthog.helpers.encrypted_fields
10+
11+
12+
class Migration(migrations.Migration):
13+
dependencies = [
14+
migrations.swappable_dependency(settings.AUTH_USER_MODEL),
15+
("posthog", "0925_team_business_model"),
16+
("tasks", "0019_remove_taskrun_log_storage_path"),
17+
]
18+
19+
operations = [
20+
migrations.CreateModel(
21+
name="SandboxEnvironment",
22+
fields=[
23+
(
24+
"id",
25+
models.UUIDField(
26+
default=posthog.models.utils.uuid7, editable=False, primary_key=True, serialize=False
27+
),
28+
),
29+
("name", models.CharField(max_length=255)),
30+
(
31+
"network_access_level",
32+
models.CharField(
33+
choices=[("trusted", "Trusted"), ("full", "Full"), ("custom", "Custom")],
34+
default="full",
35+
max_length=20,
36+
),
37+
),
38+
(
39+
"allowed_domains",
40+
django.contrib.postgres.fields.ArrayField(
41+
base_field=models.CharField(max_length=255),
42+
blank=True,
43+
default=list,
44+
help_text="List of allowed domains for custom network access",
45+
size=None,
46+
),
47+
),
48+
(
49+
"include_default_domains",
50+
models.BooleanField(
51+
default=False, help_text="Whether to include default trusted domains (GitHub, npm, PyPI)"
52+
),
53+
),
54+
(
55+
"repositories",
56+
django.contrib.postgres.fields.ArrayField(
57+
base_field=models.CharField(max_length=255),
58+
blank=True,
59+
default=list,
60+
help_text="List of repositories this environment applies to (format: org/repo)",
61+
size=None,
62+
),
63+
),
64+
(
65+
"environment_variables",
66+
posthog.helpers.encrypted_fields.EncryptedJSONStringField(
67+
blank=True,
68+
default=dict,
69+
help_text="Encrypted environment variables for sandbox execution",
70+
null=True,
71+
),
72+
),
73+
(
74+
"private",
75+
models.BooleanField(
76+
default=True,
77+
help_text="If true, only the creator can see this environment. Otherwise visible to whole team.",
78+
),
79+
),
80+
("created_at", models.DateTimeField(auto_now_add=True)),
81+
("updated_at", models.DateTimeField(auto_now=True)),
82+
(
83+
"created_by",
84+
models.ForeignKey(
85+
blank=True, null=True, on_delete=django.db.models.deletion.SET_NULL, to=settings.AUTH_USER_MODEL
86+
),
87+
),
88+
("team", models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, to="posthog.team")),
89+
],
90+
options={
91+
"db_table": "posthog_sandbox_environment",
92+
"indexes": [models.Index(fields=["team", "created_by"], name="posthog_san_team_id_817c0d_idx")],
93+
},
94+
),
95+
]

‎products/tasks/backend/migrations/max_migration.txt‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
0019_remove_taskrun_log_storage_path
1+
0020_sandbox_environment

0 commit comments

Comments
 (0)