[pull] main from Comfy-Org:main #15

Workflow file for this run

.github/workflows/ci-dist-telemetry-scan.yaml at e544b2a

	name: 'CI: Dist Telemetry Scan'

	on:
	pull_request:
	branches-ignore: [wip/, draft/, temp/*]

	concurrency:
	group: ${{ github.workflow }}-${{ github.ref }}
	cancel-in-progress: true

	permissions:
	contents: read

	jobs:
	changes:
	runs-on: ubuntu-latest
	permissions:
	contents: read
	outputs:
	should-run: ${{ steps.changes.outputs.should-run }}
	steps:
	- uses: actions/checkout@v7
	- id: changes
	uses: ./.github/actions/changes-filter

	scan:
	needs: changes
	if: ${{ needs.changes.outputs.should-run == 'true' }}
	runs-on: ubuntu-latest

	steps:
	- uses: actions/checkout@v7

	- name: Install pnpm
	uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9

	- name: Use Node.js
	uses: actions/setup-node@v6
	with:
	node-version-file: '.nvmrc'
	cache: 'pnpm'

	- name: Install dependencies
	run: pnpm install --frozen-lockfile

	- name: Build project
	run: pnpm build
	env:
	DISTRIBUTION: localhost

	- name: Scan dist for GTM telemetry references
	run: \|
	set -euo pipefail
	echo '🔍 Scanning for Google Tag Manager references...'
	if rg --no-ignore -n \
	-g '*.html' \
	-g '*.js' \
	-e 'Google Tag Manager' \
	-e '(?i)\bgtm\.js\b' \
	-e '(?i)googletagmanager\.com/gtm\.js\\?id=' \
	-e '(?i)googletagmanager\.com/ns\.html\\?id=' \
	dist; then
	echo '❌ ERROR: Google Tag Manager references found in dist assets!'
	echo 'GTM must be properly tree-shaken from OSS builds.'
	exit 1
	fi
	echo '✅ No GTM references found'

	- name: Scan dist for Mixpanel telemetry references
	run: \|
	set -euo pipefail
	echo '🔍 Scanning for Mixpanel references...'
	if rg --no-ignore -n \
	-g '*.html' \
	-g '*.js' \
	-e '(?i)mixpanel\.init' \
	-e '(?i)mixpanel\.identify' \
	-e 'MixpanelTelemetryProvider' \
	-e 'mp\.comfy\.org' \
	-e 'mixpanel-browser' \
	-e '(?i)mixpanel\.track\(' \
	dist; then
	echo '❌ ERROR: Mixpanel references found in dist assets!'
	echo 'Mixpanel must be properly tree-shaken from OSS builds.'
	echo ''
	echo 'To fix this:'
	echo '1. Use the TelemetryProvider pattern (see src/platform/telemetry/)'
	echo '2. Call telemetry via useTelemetry() hook'
	echo '3. Use conditional dynamic imports behind isCloud checks'
	exit 1
	fi
	echo '✅ No Mixpanel references found'

	- name: Scan dist for PostHog telemetry references
	run: \|
	set -euo pipefail
	echo '🔍 Scanning for PostHog references...'
	if rg --no-ignore -n \
	-g '*.html' \
	-g '*.js' \
	-e '(?i)posthog\.init' \
	-e '(?i)posthog\.capture' \
	-e 'PostHogTelemetryProvider' \
	-e 'ph\.comfy\.org' \
	-e 'posthog-js' \
	dist; then
	echo '❌ ERROR: PostHog references found in dist assets!'
	echo 'PostHog must be properly tree-shaken from OSS builds.'
	exit 1
	fi
	echo '✅ No PostHog references found'

	- name: Scan dist for Datadog RUM references
	run: \|
	set -euo pipefail
	echo '🔍 Scanning for Datadog RUM references...'
	if rg --no-ignore -n \
	-g '*.html' \
	-g '*.js' \
	-e '@datadog/browser-rum' \
	-e '041a9897-5516-4b1f-a245-1a9aa6895488' \
	-e 'pub7704486e5b64eb4ff6f62891cda45559' \
	-e 'comfy-cloud-frontend' \
	dist; then
	echo '❌ ERROR: Datadog RUM references found in dist assets!'
	echo 'Datadog RUM must be properly tree-shaken from OSS builds.'
	exit 1
	fi
	echo '✅ No Datadog RUM references found'

	- name: Scan dist for Customer.io telemetry references
	run: \|
	set -euo pipefail
	echo '🔍 Scanning for Customer.io references...'
	if rg --no-ignore -n \
	-g '*.html' \
	-g '*.js' \
	-e 'CustomerIoTelemetryProvider' \
	-e '@customerio/cdp-analytics-browser' \
	-e 'customerio-gist-web' \
	-e '(?i)cdp\.customer\.io' \
	-e 'Comfy\.CustomerIo' \
	dist; then
	echo '❌ ERROR: Customer.io references found in dist assets!'
	echo 'Customer.io must be properly tree-shaken from OSS builds.'
	echo ''
	echo 'To fix this:'
	echo '1. Use the TelemetryProvider pattern (see src/platform/telemetry/)'
	echo '2. Call telemetry via useTelemetry() hook'
	echo '3. Use conditional dynamic imports behind isCloud checks'
	exit 1
	fi
	echo '✅ No Customer.io references found'

	- name: Scan dist for Syft telemetry references
	run: \|
	set -euo pipefail
	echo '🔍 Scanning for Syft references...'
	if rg --no-ignore -n \
	-g '*.html' \
	-g '*.js' \
	-e '(?i)syft' \
	-e '(?i)sy-d\.io' \
	dist; then
	echo '❌ ERROR: Syft references found in dist assets!'
	echo 'Syft must be properly tree-shaken from OSS builds.'
	echo ''
	echo 'To fix this:'
	echo '1. Use the TelemetryProvider pattern (see src/platform/telemetry/)'
	echo '2. Call telemetry via useTelemetry() hook'
	echo '3. Use conditional dynamic imports behind isCloud checks'
	exit 1
	fi
	echo '✅ No Syft references found'

	- name: Scan dist for Cloudflare Turnstile sitekey references
	run: \|
	set -euo pipefail
	echo '🔍 Scanning for Cloudflare Turnstile sitekeys...'
	if rg --no-ignore -n \
	-g '*.html' \
	-g '*.js' \
	-e '0x4AAAAAADnYZPVOpFCL_zeo' \
	-e '0x4AAAAAADnYY4_Q0qxHZ5a7' \
	-e '1x00000000000000000000AA' \
	dist; then
	echo '❌ ERROR: Cloudflare Turnstile sitekey found in dist assets!'
	echo 'The per-env Turnstile sitekeys are cloud-only and must be tree-shaken from OSS builds.'
	echo ''
	echo 'To fix this:'
	echo '1. Gate sitekey selection on the __DISTRIBUTION__ build define, not the runtime isCloud const'
	echo '2. See getTurnstileSiteKey() in src/config/turnstile.ts'
	exit 1
	fi
	echo '✅ No Turnstile sitekey references found'

Navigation Menu

[pull] main from Comfy-Org:main #15

Workflow file

[pull] main from Comfy-Org:main #15

Uh oh!

Workflow file for this run