Jenkins job for validation summary clickhouse table by sammacbeth · Pull Request #54 · duckduckgo/pixel-schema

sammacbeth · 2026-02-02T10:41:11Z

Adds a Jenkins job that imports pixel data from Clickhouse, runs validation to generate rows for a validation summary table. This can be used for dashboards to measure pixel traffic and validation status, as well as identify issues with specific pixels.

Note

Medium Risk
Adds new scheduled CI automation that reads from and writes to ClickHouse and introduces new aggregation tables, so misconfiguration or query issues could impact dashboards/data volume. Core validation logic changes are small, but the new pipeline/scripts broaden operational surface area.

Overview
Adds a new scheduled Jenkinsfile.dashboard pipeline that (optionally per-platform) checks out pixel definition repos, runs a new scripts/detailedValidation.sh workflow for a given date (defaulting to yesterday), and marks individual platform stages as UNSTABLE on failure.

Introduces a ClickHouse-backed detailed validation ingestion path: fetch_pixels_for_day.mjs exports daily pixel traffic to CSV, validate_live_pixel.mjs can emit per-row JSONL results (and optionally skip legacy result file writes via DISABLE_RESULT_SAVING), and detailedValidation.sh inserts those rows into a new pixels.validation_results_2 table defined in validation_table.sql.

Adds validation_table_aggregations.mjs to compute daily agent-level and prefix-level rollups into pixels.daily_validation_results and pixels.daily_valid_prefix_results, and enhances Asana per-owner reports to link pixel names directly to the Grafana pixel dashboard (with agent inferred from the repo path). Also updates LivePixelsValidator.validatePixel to persist prefix/match info on the returned validation state for downstream consumers.

^{Written by Cursor Bugbot for commit 9b5056b. This will update automatically on new commits. Configure here.}

cursor · 2026-02-02T10:49:00Z

+                    currentBuild.description = "Import: ${env.DATE_TO_USE}"
+                }
+                dir('pixel-schema') {
+                    checkout([$class: 'GitSCM', branches: [[name: "sam/dashboard"]],


Jenkins job checks out developer feature branch

High Severity

The pixel-schema repository checkout uses branch sam/dashboard which appears to be a personal feature branch rather than an official branch. All other repos in this Jenkinsfile correctly use main or develop. This means the production Jenkins job would be pulling from an unstable development branch instead of the main codebase.

_{Please tell me if this was useful or not with a 👍 or 👎.}

Will fix this just before merging so as not to break the current job.

cursor · 2026-02-02T10:49:00Z

+)
+ENGINE = ReplicatedReplacingMergeTree()
+PARTITION BY (date)
+ORDER BY (agent, prefix, params)


ClickHouse table ORDER BY causes data deduplication

Medium Severity

The ReplicatedReplacingMergeTree table has ORDER BY (agent, prefix, params) but stores distinct pixel, pixel_id, and version values in separate columns. Since these columns aren't in the ORDER BY, rows with different pixels that share the same agent, prefix, and params will be deduplicated during ClickHouse merges, causing silent data loss including loss of freq aggregations.

_{Please tell me if this was useful or not with a 👍 or 👎.}

cursor · 2026-02-02T10:49:00Z

+                    userRemoteConfigs: [[url: 'https://github.com/duckduckgo/duckduckgo-privacy-extension.git']]])
+                }
+                dir('pixel-schema') {
+                    sh "/bin/bash scripts/detailedValidation.sh ../duckduckgo-privacy-extension/pixel-definitions/ ${env.DATE_TO_USE}"


Command injection via unvalidated DATE parameter

High Severity

The DATE parameter is used directly in shell commands without validation. A malicious value like 2024-01-01; malicious_command would be interpreted by the shell, executing arbitrary commands on the Jenkins agent. The parameter description suggests YYYY-MM-DD format but doesn't enforce it, allowing command injection via ${env.DATE_TO_USE} in sh steps.

_{Please tell me if this was useful or not with a 👍 or 👎.}

Additional Locations (2)

Jenkinsfiles/Jenkinsfile.dashboard#L85-L86

Jenkinsfiles/Jenkinsfile.dashboard#L124-L125

cursor · 2026-02-03T14:40:22Z

        }
        const [prefix, pixelMatch] = matchPixel(pixel, this.#compiledPixels);
+        this.#currentPixelState.prefix = prefix;
+        this.#currentPixelState.pixelMatch = pixelMatch || '';


Unused property assignment for pixelMatch

Low Severity

this.#currentPixelState.pixelMatch is assigned but never read anywhere in the codebase. While result.prefix is used in validate_live_pixel.mjs, result.pixelMatch is not accessed by any consumer.

cursor · 2026-02-03T16:32:00Z

+
+    SELECT date, agent, version, pixel_id, pixel, params_fixed AS params, COUNT(*) AS freq
+    FROM metrics.pixels
+    WHERE date = '${day}' AND 


SQL injection risk in date parameter interpolation

Medium Severity

The day parameter from user input is directly interpolated into the SQL query string at WHERE date = '${day}' without sanitization or parameterization. While the Jenkins job is internal and the Clickhouse client appears read-only (ddg-ro-ch), a user with Jenkins access could provide a malicious DATE parameter to manipulate the query (e.g., 2024-01-01' OR '1'='1).

Additional Locations (1)

live_validation_scripts/fetch_pixels_for_day.mjs#L46-L47

ladamski · 2026-02-11T04:21:44Z

@@ -0,0 +1,19 @@
+CREATE DATABASE IF NOT EXISTS pixels ON CLUSTER 'ch-prod-cluster';
+
+CREATE TABLE IF NOT EXISTS pixels.validation_results_2 ON CLUSTER 'ch-prod-cluster' (


Any reason for the _2 in pixels.validation_results_2?

ladamski · 2026-02-11T04:22:08Z

@@ -0,0 +1,19 @@
+CREATE DATABASE IF NOT EXISTS pixels ON CLUSTER 'ch-prod-cluster';


File name should probably be validation_table_results.sql

ladamski · 2026-02-11T04:38:22Z

+    owners Array(String),
+    errors Array(String)
+)
+ENGINE = ReplicatedReplacingMergeTree()


ReplicatedReplacingMergeTree() generally needs a merge key to "replace" effectively, otherwise it relies on insert order, so I think you may have a duplicate data issue here. For example:

SELECT countDistinct(*) FROM pixels.validation_results_2 1095553439

vs.

SELECT countDistinct(*) FROM pixels.validation_results_2 FINAL 899781731

Also the cursorbot comment below re "ORDER BY" is worth digging into IMO.

ladamski · 2026-02-11T05:16:16Z

+    pixel_id String,
+    pixel String,
+    prefix String,
+    params Array(String),


Array(String) vs String can have a large performance penalty, see https://app.asana.com/1/137249556945/task/1211328177475138

cursor · 2026-02-11T09:15:38Z

+        SUM(CASE WHEN status = 1 THEN freq ELSE 0 END) AS old_app_version,
+        SUM(CASE WHEN status = 0 THEN freq ELSE 0 END) AS undocumented,
+        COUNT(DISTINCT params) AS parameter_permutations
+    FROM pixels.validation_results


Table name mismatch between insert and aggregation queries

High Severity

The detailedValidation.sh script inserts data into pixels.validation_results_2, but the aggregation queries in validation_table_aggregations.mjs read FROM pixels.validation_results (without the _2 suffix). The aggregation step won't find any of the just-inserted data, so pixels.daily_validation_results and pixels.daily_valid_prefix_results will get empty or stale rows.

_{Please tell me if this was useful or not with a 👍 or 👎.}

Additional Locations (2)

scripts/detailedValidation.sh#L28-L29

live_validation_scripts/validation_table_aggregations.mjs#L41-L42

cursor · 2026-02-11T09:15:38Z

+    GROUP BY date, agent, prefix`;
+
+    spawnSync('ddg-rw-ch', ['-h', 'clickhouse', '--query', query]);
+    spawnSync('ddg-rw-ch', ['-h', 'clickhouse', '--query', query2]);


Silent failure when ClickHouse aggregation queries error

Medium Severity

The spawnSync return values for both ClickHouse queries are never checked. If either query fails (e.g., connection error, syntax error, missing table), the script exits successfully with no indication of failure. The error output and non-zero exit status from spawnSync are silently discarded.

_{Please tell me if this was useful or not with a 👍 or 👎.}

cursor · 2026-02-11T09:15:38Z

+    GROUP BY date, agent, prefix`;
+
+    spawnSync('ddg-rw-ch', ['-h', 'clickhouse', '--query', query]);
+    spawnSync('ddg-rw-ch', ['-h', 'clickhouse', '--query', query2]);


spawnSync errors silently ignored in aggregation script

Medium Severity

The return values of both spawnSync calls are discarded. spawnSync does not throw on non-zero exit codes — it returns an object with a status field. If either ClickHouse query fails, the script exits successfully with no error indication, leaving the aggregation tables silently empty or stale.

cursor · 2026-02-11T09:34:05Z

+            SELECT DISTINCT pixel_id FROM metrics.pixels_validation_pixel_ids
+        ) AND
+        NOT is_test AND
+        version_major >= ${major}


Computed version_minor unused in query WHERE clause

Medium Severity

The SQL CTE computes version_minor and the JavaScript destructures minor and patch from the resolved version, but the WHERE clause only filters on version_major >= ${major}. This means versions with the correct major but a lower minor version (e.g., 7.1.0 when minimum is 7.150.0) will be incorrectly included in the results.

_{Please tell me if this was useful or not with a 👍 or 👎.}

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

cursor · 2026-02-11T11:19:29Z

@@ -0,0 +1,139 @@
+pipeline {
+    agent { label 'ubuntu-latest' }
+    triggers { cron('H 1 * * 0') }


Weekly cron only processes a single day's data

Medium Severity

The cron trigger H 1 * * 0 runs weekly (Sundays), but the default date is only "yesterday" (one day). This means six out of seven days are never processed automatically. For a dashboard measuring daily validation status, this likely needs to be a daily schedule (H 1 * * *) or the job needs to iterate over the past week's dates.

sammacbeth added 13 commits January 29, 2026 06:12

Add detailed validation data for monitoring

49ad374

Fix extension checkout

cdfae25

Use fnm to locate node executables

7eb94ad

Set up macOS and iOS import

e308abd

Setup remaining platforms

db70298

Pre-round some known unbounded parameters

bad84b2

More robust error handling

fc98a98

Attempt to fix unbounded null issues

28cbccc

Jenkinsfile improvements

de51f0c

Query typo

f82bb49

Run import job daily

691b52a

Fix lint

7879900

Docs

414f38f

sammacbeth requested a review from ladamski February 2, 2026 10:41

cursor Bot reviewed Feb 2, 2026

View reviewed changes

sammacbeth force-pushed the sam/dashboard branch from cab33c6 to cb05cab Compare February 3, 2026 14:33

cursor Bot reviewed Feb 3, 2026

View reviewed changes

Link to pixel dashboard in Asana reports

43aa502

sammacbeth force-pushed the sam/dashboard branch from cb05cab to 43aa502 Compare February 3, 2026 16:24

cursor Bot reviewed Feb 3, 2026

View reviewed changes

Lint

2a392c9

ladamski requested changes Feb 11, 2026

View reviewed changes

sammacbeth added 2 commits February 11, 2026 03:13

Fix subprocess issue and add version filtering

b838e2e

Do aggregation as part of main validation job

9d4afda

cursor Bot reviewed Feb 11, 2026

View reviewed changes

sammacbeth added 2 commits February 11, 2026 04:19

Only filter on major version

747482f

Continue on failure for import steps

8d530ed

sammacbeth force-pushed the sam/dashboard branch from 9723797 to 8d530ed Compare February 11, 2026 09:25

cursor Bot reviewed Feb 11, 2026

View reviewed changes

Lint fix

9b5056b

cursor Bot reviewed Feb 11, 2026

View reviewed changes

		@@ -0,0 +1,19 @@
		CREATE DATABASE IF NOT EXISTS pixels ON CLUSTER 'ch-prod-cluster';

		CREATE TABLE IF NOT EXISTS pixels.validation_results_2 ON CLUSTER 'ch-prod-cluster' (

Uh oh!

Conversation

sammacbeth commented Feb 2, 2026 • edited by cursor Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot Feb 2, 2026

Choose a reason for hiding this comment

Jenkins job checks out developer feature branch

Uh oh!

sammacbeth Feb 2, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot Feb 2, 2026

Choose a reason for hiding this comment

ClickHouse table ORDER BY causes data deduplication

Uh oh!

cursor Bot Feb 2, 2026

Choose a reason for hiding this comment

Command injection via unvalidated DATE parameter

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cursor Bot Feb 3, 2026

Choose a reason for hiding this comment

Unused property assignment for pixelMatch

Uh oh!

cursor Bot Feb 3, 2026

Choose a reason for hiding this comment

SQL injection risk in date parameter interpolation

Uh oh!

ladamski Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

ladamski Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

ladamski Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ladamski Feb 11, 2026

Choose a reason for hiding this comment

Uh oh!

cursor Bot Feb 11, 2026

Choose a reason for hiding this comment

Table name mismatch between insert and aggregation queries

Uh oh!

cursor Bot Feb 11, 2026

Choose a reason for hiding this comment

Silent failure when ClickHouse aggregation queries error

Uh oh!

cursor Bot Feb 11, 2026

Choose a reason for hiding this comment

spawnSync errors silently ignored in aggregation script

Uh oh!

cursor Bot Feb 11, 2026

Choose a reason for hiding this comment

Computed version_minor unused in query WHERE clause

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Feb 11, 2026

Choose a reason for hiding this comment

Weekly cron only processes a single day's data

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sammacbeth commented Feb 2, 2026 •

edited by cursor Bot

Loading

Computed `version_minor` unused in query WHERE clause