ci-dist-telemetry-scan.yaml

name: 'CI: Dist Telemetry Scan'

on:
  pull_request:
    branches-ignore: [wip/*, draft/*, temp/*]

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  changes:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    outputs:
      should-run: ${{ steps.changes.outputs.should-run }}
    steps:
      - uses: actions/checkout@v7
      - id: changes
        uses: ./.github/actions/changes-filter

  scan:
    needs: changes
    if: ${{ needs.changes.outputs.should-run == 'true' }}
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v7

      - name: Install pnpm
        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10

      - name: Use Node.js
        uses: actions/setup-node@v6
        with:
          node-version-file: '.nvmrc'
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      - name: Build project
        run: pnpm build
        env:
          DISTRIBUTION: localhost

      - name: Scan dist for GTM telemetry references
        run: |
          set -euo pipefail
          echo '🔍 Scanning for Google Tag Manager references...'
          if rg --no-ignore -n \
            -g '*.html' \
            -g '*.js' \
            -e 'Google Tag Manager' \
            -e '(?i)\bgtm\.js\b' \
            -e '(?i)googletagmanager\.com/gtm\.js\\?id=' \
            -e '(?i)googletagmanager\.com/ns\.html\\?id=' \
            dist; then
            echo '❌ ERROR: Google Tag Manager references found in dist assets!'
            echo 'GTM must be properly tree-shaken from OSS builds.'
            exit 1
          fi
          echo '✅ No GTM references found'

      - name: Scan dist for Mixpanel telemetry references
        run: |
          set -euo pipefail
          echo '🔍 Scanning for Mixpanel references...'
          if rg --no-ignore -n \
            -g '*.html' \
            -g '*.js' \
            -e '(?i)mixpanel\.init' \
            -e '(?i)mixpanel\.identify' \
            -e 'MixpanelTelemetryProvider' \
            -e 'mp\.comfy\.org' \
            -e 'mixpanel-browser' \
            -e '(?i)mixpanel\.track\(' \
            dist; then
            echo '❌ ERROR: Mixpanel references found in dist assets!'
            echo 'Mixpanel must be properly tree-shaken from OSS builds.'
            echo ''
            echo 'To fix this:'
            echo '1. Use the TelemetryProvider pattern (see src/platform/telemetry/)'
            echo '2. Call telemetry via useTelemetry() hook'
            echo '3. Use conditional dynamic imports behind isCloud checks'
            exit 1
          fi
          echo '✅ No Mixpanel references found'

      - name: Scan dist for PostHog telemetry references
        run: |
          set -euo pipefail
          echo '🔍 Scanning for PostHog references...'
          if rg --no-ignore -n \
            -g '*.html' \
            -g '*.js' \
            -e '(?i)posthog\.init' \
            -e '(?i)posthog\.capture' \
            -e 'PostHogTelemetryProvider' \
            -e 'ph\.comfy\.org' \
            -e 'posthog-js' \
            dist; then
            echo '❌ ERROR: PostHog references found in dist assets!'
            echo 'PostHog must be properly tree-shaken from OSS builds.'
            exit 1
          fi
          echo '✅ No PostHog references found'

      - name: Scan dist for Datadog RUM references
        run: |
          set -euo pipefail
          echo '🔍 Scanning for Datadog RUM references...'
          if rg --no-ignore -n \
            -g '*.html' \
            -g '*.js' \
            -e '@datadog/browser-rum' \
            -e '041a9897-5516-4b1f-a245-1a9aa6895488' \
            -e 'pub7704486e5b64eb4ff6f62891cda45559' \
            -e 'comfy-cloud-frontend' \
            dist; then
            echo '❌ ERROR: Datadog RUM references found in dist assets!'
            echo 'Datadog RUM must be properly tree-shaken from OSS builds.'
            exit 1
          fi
          echo '✅ No Datadog RUM references found'

      - name: Scan dist for Customer.io telemetry references
        run: |
          set -euo pipefail
          echo '🔍 Scanning for Customer.io references...'
          if rg --no-ignore -n \
            -g '*.html' \
            -g '*.js' \
            -e 'CustomerIoTelemetryProvider' \
            -e '@customerio/cdp-analytics-browser' \
            -e 'customerio-gist-web' \
            -e '(?i)cdp\.customer\.io' \
            -e 'Comfy\.CustomerIo' \
            dist; then
            echo '❌ ERROR: Customer.io references found in dist assets!'
            echo 'Customer.io must be properly tree-shaken from OSS builds.'
            echo ''
            echo 'To fix this:'
            echo '1. Use the TelemetryProvider pattern (see src/platform/telemetry/)'
            echo '2. Call telemetry via useTelemetry() hook'
            echo '3. Use conditional dynamic imports behind isCloud checks'
            exit 1
          fi
          echo '✅ No Customer.io references found'

      - name: Scan dist for Syft telemetry references
        run: |
          set -euo pipefail
          echo '🔍 Scanning for Syft references...'
          if rg --no-ignore -n \
            -g '*.html' \
            -g '*.js' \
            -e '(?i)syft' \
            -e '(?i)sy-d\.io' \
            dist; then
            echo '❌ ERROR: Syft references found in dist assets!'
            echo 'Syft must be properly tree-shaken from OSS builds.'
            echo ''
            echo 'To fix this:'
            echo '1. Use the TelemetryProvider pattern (see src/platform/telemetry/)'
            echo '2. Call telemetry via useTelemetry() hook'
            echo '3. Use conditional dynamic imports behind isCloud checks'
            exit 1
          fi
          echo '✅ No Syft references found'

      - name: Scan dist for Cloudflare Turnstile sitekey references
        run: |
          set -euo pipefail
          echo '🔍 Scanning for Cloudflare Turnstile sitekeys...'
          if rg --no-ignore -n \
            -g '*.html' \
            -g '*.js' \
            -e '0x4AAAAAADnYZPVOpFCL_zeo' \
            -e '0x4AAAAAADnYY4_Q0qxHZ5a7' \
            -e '1x00000000000000000000AA' \
            dist; then
            echo '❌ ERROR: Cloudflare Turnstile sitekey found in dist assets!'
            echo 'The per-env Turnstile sitekeys are cloud-only and must be tree-shaken from OSS builds.'
            echo ''
            echo 'To fix this:'
            echo '1. Gate sitekey selection on the __DISTRIBUTION__ build define, not the runtime isCloud const'
            echo '2. See getTurnstileSiteKey() in src/config/turnstile.ts'
            exit 1
          fi
          echo '✅ No Turnstile sitekey references found'