fix(cymbal): use native roots for Temporal Cloud - #73099
Merged
Merged
Conversation
|
😎 This pull request was merged. |
hpouillot
marked this pull request as ready for review
July 23, 2026 08:57
pr-assigner-resolver-posthog
Bot
requested review from
a team,
ablaszkiewicz and
cat-ph
July 23, 2026 08:58
hpouillot
enabled auto-merge (squash)
July 23, 2026 08:59
Contributor
|
Reviews (1): Last reviewed commit: "fix(cymbal): use native roots for Tempor..." | Re-trigger Greptile |
![stamphog[bot]](https://avatars.githubusercontent.com/in/3000332?s=60&v=4){kind=small}
There was a problem hiding this comment.
Small, well-understood TLS trust-root fix aligning Rust client with existing Python worker behavior; author has STRONG familiarity and owns this code, mTLS client cert/key auth is preserved, no outstanding concerns.
- Author wrote 100% of the modified lines and has 8 merged PRs in these paths (familiarity STRONG).
- 👍 on the PR from greptile-apps[bot], hex-security-app[bot].
Gate mechanics and policy version
| Gate | Result | |
|---|---|---|
| prerequisites | ✓ | all clear |
| deny-list | ✓ | no deny categories matched |
| size | ✓ | 8L, 2F substantive — within ceiling |
| tier | ✓ | T1-agent / T1a-trivial (8L, 2F, single-area, fix) |
| stamphog 2.0.0b3 | .stamphog/policy.yml @ 24c0565 · reviewed head b463393 |
ablaszkiewicz
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Cymbal notifications fails at startup when issue-created workflow routing is enabled:
The Rust client was treating the injected
TEMPORAL_CLIENT_ROOT_CAas the server trust root. This replaces the SDK's native root store, but that certificate is not the issuer of Temporal Cloud's public server certificate. PostHog's Python Temporal workers do not pass this injected value to the client and rely on native roots.Changes
How did you test this code?
cargo fmt --all -- --checkcargo check -p cymbalcargo test -p cymbal modes::notifications::temporal --lib– 3 passedcargo clippy -p cymbal --all-targets --no-deps -- -D warningsI could not perform a live Temporal Cloud connection test locally. The deployed connection failure is specifically in server certificate verification, before workflow starts.
👉 Stay up-to-date with PostHog coding conventions for a smoother review.
Automatic notifications
Docs update
This internal TLS configuration fix does not require documentation changes.
🤖 Agent context
Autonomy: Human-driven (agent-assisted)
Implemented with OpenAI Codex in pi after diagnosing the deployed Temporal connection error. No repo-specific implementation skill was invoked. The fix keeps custom CA support in the shared Temporal client, but Cymbal intentionally uses native roots to match Python worker behavior.