fix(conversations): keep non-image attachments on slack and teams

[veryayskiy]

Problem

Support tickets ingested from Slack and Teams dropped any attachment that wasn't an image (PDFs, Word docs, .ts files, etc.). Email and Zendesk import already kept those as download links, so customers could attach files on one channel and have them silently vanish on another.

Changes

• Remove the image/*-only gate in Slack (extract_slack_files) and Teams bot attachments (extract_teams_bot_attachments); re-host all downloadable files to UploadedMedia
• Extend build_content_with_images with an optional files param so non-images render as markdown/rich-content link nodes (same pattern as email)
• Move filename sanitization into shared sanitize_attachment_filename and apply it on Slack/Teams (strips markdown-injection chars like [/])
• Cap attachments at 20 per message (parity with email)
• Store slack_files / teams_files in comment item_context alongside existing *_images fields

How did you test this code?

• products/conversations/backend/api/tests/test_attachments_service.py — link rendering in build_content_with_images, filename sanitizer
• products/conversations/backend/api/tests/test_slack_image_sync.py — non-image PDF kept, markdown-injection filename stripped
• products/conversations/backend/api/tests/test_teams_image_sync.py — non-image PDF kept, adaptive cards still skipped

[greptile-apps]

_{Reviews (1): Last reviewed commit: "fix(conversations): keep non-image attac..." | Re-trigger Greptile}

[trunk-io]

     

View Full Report ↗︎ ⋅ Docs

[github-actions]

🤖 CI report

⚠️ Backend coverage — 98.0% of changed backend lines covered — 2 uncovered

🧪 Backend test coverage

Patch coverage — changed backend lines (products + core): ████████████████████ 98.0% (153 / 155)

File	Patch	Uncovered changed lines
products/conversations/backend/teams.py	88.9%	578
products/conversations/backend/services/attachments.py	95.0%	36

🤖 Agents: add a test covering the lines above, or note why under "How did you test this code?". Machine-readable gap list: the patch-coverage artifact on this run (gh run download 29409022561 -n patch-coverage), or the coverage-data block at the end of this comment.

Per-product line coverage (touched products)

Product	Coverage	Lines
platform_features	██░░░░░░░░░░░░░░░░░░ 12.1%	7 / 58
batch_exports	████████░░░░░░░░░░░░ 39.7%	8,414 / 21,220
demo	███████████░░░░░░░░░ 56.2%	1,497 / 2,663
warehouse_sources_queue	████████████░░░░░░░░ 59.2%	148 / 250
tasks	█████████████░░░░░░░ 67.4%	25,425 / 37,703
data_tools	██████████████░░░░░░ 70.0%	63 / 90
ai_gateway	███████████████░░░░░ 75.0%	9 / 12
signals	████████████████░░░░ 79.1%	19,070 / 24,106
data_modeling	████████████████░░░░ 80.0%	4,834 / 6,045
cdp	████████████████░░░░ 80.7%	3,118 / 3,864
wizard	████████████████░░░░ 82.5%	772 / 936
notebooks	█████████████████░░░ 83.8%	6,086 / 7,259
agent_platform	█████████████████░░░ 84.2%	3,112 / 3,695
cohorts	█████████████████░░░ 86.0%	3,989 / 4,639
actions	█████████████████░░░ 86.6%	717 / 828
product_tours	█████████████████░░░ 87.5%	1,266 / 1,447
exports	██████████████████░░ 88.3%	6,861 / 7,769
visual_review	██████████████████░░ 88.5%	5,565 / 6,287
business_knowledge	██████████████████░░ 88.5%	4,400 / 4,969
conversations	██████████████████░░ 88.9%	16,126 / 18,130
dashboards	██████████████████░░ 89.1%	5,648 / 6,337
mcp_analytics	██████████████████░░ 89.1%	2,502 / 2,807
error_tracking	██████████████████░░ 89.6%	9,749 / 10,883
engineering_analytics	██████████████████░░ 89.8%	4,861 / 5,414
streamlit_apps	██████████████████░░ 90.4%	2,499 / 2,764
slack_app	██████████████████░░ 90.6%	9,511 / 10,503
links	██████████████████░░ 90.6%	183 / 202
marketing_analytics	██████████████████░░ 90.8%	11,514 / 12,684
alerts	██████████████████░░ 90.9%	3,416 / 3,760
product_analytics	██████████████████░░ 91.1%	5,527 / 6,068
managed_migrations	██████████████████░░ 91.9%	908 / 988
workflows	██████████████████░░ 92.0%	4,795 / 5,210
data_warehouse	██████████████████░░ 92.1%	17,872 / 19,415
mcp_store	██████████████████░░ 92.1%	3,665 / 3,981
notifications	███████████████████░ 92.7%	1,026 / 1,107
web_analytics	███████████████████░ 92.7%	13,607 / 14,674
ai_observability	███████████████████░ 92.8%	14,771 / 15,923
surveys	███████████████████░ 92.9%	5,660 / 6,094
posthog_ai	███████████████████░ 93.2%	1,312 / 1,408
tracing	███████████████████░ 93.2%	2,423 / 2,599
approvals	███████████████████░ 93.3%	3,395 / 3,640
reminders	███████████████████░ 93.4%	468 / 501
early_access_features	███████████████████░ 93.8%	848 / 904
legal_documents	███████████████████░ 94.1%	1,568 / 1,667
endpoints	███████████████████░ 94.1%	8,606 / 9,143
skills	███████████████████░ 94.4%	2,827 / 2,995
revenue_analytics	███████████████████░ 94.5%	3,598 / 3,809
messaging	███████████████████░ 94.5%	2,530 / 2,677
review_hog	███████████████████░ 94.6%	6,475 / 6,848
logs	███████████████████░ 95.3%	9,525 / 9,991
growth	███████████████████░ 95.5%	2,734 / 2,864
experiments	███████████████████░ 95.6%	24,138 / 25,244
replay_vision	███████████████████░ 95.7%	13,300 / 13,896
feature_flags	███████████████████░ 96.1%	14,750 / 15,354
warehouse_sources	███████████████████░ 96.1%	217,524 / 226,240
annotations	███████████████████░ 96.2%	732 / 761
user_interviews	███████████████████░ 96.4%	2,242 / 2,325
access_control	███████████████████░ 96.8%	849 / 877
data_catalog	███████████████████░ 97.2%	1,642 / 1,689
customer_analytics	███████████████████░ 97.3%	7,442 / 7,648
analytics_platform	████████████████████ 98.0%	2,102 / 2,145
metrics	████████████████████ 98.3%	2,363 / 2,405
live_debugger	████████████████████ 99.2%	613 / 618
field_notes	████████████████████ 99.4%	158 / 159

Report-only. Patch coverage = changed backend lines covered vs origin/master. Sorted lowest first.
Known gaps: lines covered only by Temporal tests show as uncovered; core line numbers may drift if master changed the same file.

ℹ️ ClickHouse migration SQL — 1 migration(s)

ClickHouse migration SQL per cloud environment

• unset
  • all

    CREATE OR REPLACE VIEW custom_metrics_test
        AS SELECT
            'ClickHouseCustomMetric_Test' AS name,
            map('instance', hostname()) AS labels,
            1 AS value,
            'Test to check that the metric endpoint is working' AS help,
            'gauge' AS type

    CREATE OR REPLACE VIEW custom_metrics
        AS SELECT * REPLACE (toFloat64(value) as value)
        FROM custom_metrics_test

• US, EU, DEV
  • events, shufflehog

    CREATE OR REPLACE VIEW custom_metrics_test
        AS SELECT
            'ClickHouseCustomMetric_Test' AS name,
            map('instance', hostname()) AS labels,
            1 AS value,
            'Test to check that the metric endpoint is working' AS help,
            'gauge' AS type

    CREATE OR REPLACE VIEW custom_metrics
        AS SELECT * REPLACE (toFloat64(value) as value)
        FROM custom_metrics_test

[stamphog]

Extends an existing, already-hardened attachment-hosting path (used for email) to Slack/Teams, with filename sanitization and image-validation preserved and unchanged serving-side XSS defenses (non-safe content types are still forced to opaque download); well tested for the injection/traversal edge cases, and author has strong ownership and familiarity in this area.

• Author wrote 100% of the modified lines and has 160 merged PRs in these paths (familiarity STRONG).
• 👍 on the PR from greptile-apps[bot], hex-security-app[bot].

Gate mechanics and policy version

Gate		Result
prerequisites	✓	all clear
deny-list	✓	no deny categories matched
size	✓	250L, 6F substantive, 393L/10F incl. docs/generated/snapshots — within ceiling
tier	✓	T1-agent / T1d-complex (393L, 10F, single-area, fix)
stamphog 2.0.0b3		.stamphog/policy.yml @ 824a995 · reviewed head d026243

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-07-15 11:33 UTC	Run
prod-us	✅ Deployed	2026-07-15 11:54 UTC	Run
prod-eu	✅ Deployed	2026-07-15 11:53 UTC	Run