The first pass only covered the workflows that looked like they ran product code and missed preview, deploy, pkg-pr-new and publish-executor-package, which also invoke the CLI. Blacksmith runners kept reporting to the production PostHog project after the fix merged. Apply the opt-out at the top level of every workflow instead of guessing. The variables are inert where the product is not executed.
Showing the changes to .github (5 of 5 files). Show all
Unified · Split
| @@ -9,6 +9,16 @@ concurrency: · 8 unmodified lines | ||
| 9 | 9 | group: deploy-production |
| 10 | 10 | cancel-in-progress: false |
| 11 | 11 | |
| 12 | +# CI is not a user — see the note in ci.yml. Applied to every workflow rather | |
| 13 | +# than the ones that look like they run product code: the first pass guessed, | |
| 14 | +# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert | |
| 15 | +# where the product is not executed, so the blanket application is the cheap | |
| 16 | +# structural answer. | |
| 17 | +env: | |
| 18 | + DO_NOT_TRACK: "1" | |
| 19 | + EXECUTOR_DISABLE_ANALYTICS: "1" | |
| 20 | + EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1" | |
| 21 | + | |
| 12 | 22 | jobs: |
| 13 | 23 | migrate: |
| 14 | 24 | name: Migrate database |
| @@ -10,6 +10,16 @@ concurrency: · 9 unmodified lines | ||
| 10 | 10 | group: pkg-pr-new-${{ github.event.pull_request.number }} |
| 11 | 11 | cancel-in-progress: true |
| 12 | 12 | |
| 13 | +# CI is not a user — see the note in ci.yml. Applied to every workflow rather | |
| 14 | +# than the ones that look like they run product code: the first pass guessed, | |
| 15 | +# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert | |
| 16 | +# where the product is not executed, so the blanket application is the cheap | |
| 17 | +# structural answer. | |
| 18 | +env: | |
| 19 | + DO_NOT_TRACK: "1" | |
| 20 | + EXECUTOR_DISABLE_ANALYTICS: "1" | |
| 21 | + EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1" | |
| 22 | + | |
| 13 | 23 | jobs: |
| 14 | 24 | # Per-platform matrix: build the executor binary, tar it, upload to R2. |
| 15 | 25 | # The wrapper npm package is built later by the `publish` job which just |
| @@ -16,6 +16,16 @@ permissions: · 15 unmodified lines | ||
| 16 | 16 | contents: read |
| 17 | 17 | pull-requests: read |
| 18 | 18 | |
| 19 | +# CI is not a user — see the note in ci.yml. Applied to every workflow rather | |
| 20 | +# than the ones that look like they run product code: the first pass guessed, | |
| 21 | +# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert | |
| 22 | +# where the product is not executed, so the blanket application is the cheap | |
| 23 | +# structural answer. | |
| 24 | +env: | |
| 25 | + DO_NOT_TRACK: "1" | |
| 26 | + EXECUTOR_DISABLE_ANALYTICS: "1" | |
| 27 | + EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1" | |
| 28 | + | |
| 19 | 29 | jobs: |
| 20 | 30 | sweep: |
| 21 | 31 | name: Destroy previews for closed PRs |
| @@ -23,6 +23,16 @@ concurrency: · 22 unmodified lines | ||
| 23 | 23 | group: preview-${{ github.event.pull_request.number }} |
| 24 | 24 | cancel-in-progress: ${{ github.event.action != 'closed' }} |
| 25 | 25 | |
| 26 | +# CI is not a user — see the note in ci.yml. Applied to every workflow rather | |
| 27 | +# than the ones that look like they run product code: the first pass guessed, | |
| 28 | +# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert | |
| 29 | +# where the product is not executed, so the blanket application is the cheap | |
| 30 | +# structural answer. | |
| 31 | +env: | |
| 32 | + DO_NOT_TRACK: "1" | |
| 33 | + EXECUTOR_DISABLE_ANALYTICS: "1" | |
| 34 | + EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1" | |
| 35 | + | |
| 26 | 36 | jobs: |
| 27 | 37 | deploy: |
| 28 | 38 | name: Deploy preview |
| @@ -21,6 +21,16 @@ concurrency: · 20 unmodified lines | ||
| 21 | 21 | group: publish-executor-package-${{ github.ref }} |
| 22 | 22 | cancel-in-progress: false |
| 23 | 23 | |
| 24 | +# CI is not a user — see the note in ci.yml. Applied to every workflow rather | |
| 25 | +# than the ones that look like they run product code: the first pass guessed, | |
| 26 | +# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert | |
| 27 | +# where the product is not executed, so the blanket application is the cheap | |
| 28 | +# structural answer. | |
| 29 | +env: | |
| 30 | + DO_NOT_TRACK: "1" | |
| 31 | + EXECUTOR_DISABLE_ANALYTICS: "1" | |
| 32 | + EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1" | |
| 33 | + | |
| 24 | 34 | jobs: |
| 25 | 35 | publish: |
| 26 | 36 | runs-on: ubuntu-latest |