feat(web): add PostHog analytics with typed env + refresh README - #37
feat(web): add PostHog analytics with typed env + refresh README#37PunGrumpy wants to merge 3 commits into
Conversation
Initializes posthog-js in production via a client provider and proxies ingestion through /ingest rewrites so requests survive tracking blockers. Scoped dashboard lives in the existing PostHog CLI project. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
React Doctor found 1 new issue in 1 file · 1 error · score 40 / 100 (Critical) · 0 fixed · vs Errors
Reviewed by React Doctor for commit |
Replaces raw process.env access with a validated schema in lib/env.ts: NEXT_PUBLIC_POSTHOG_KEY must be a phc_ token (defaults to the public project token), NEXT_PUBLIC_DATABUDDY_CLIENT_ID is optional and Databuddy now only mounts when it is set. next.config.ts imports the schema so invalid env fails the build instead of surfacing at runtime. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| "motion": "^12.42.2", | ||
| "next": "16.2.11", | ||
| "next-themes": "^0.4.6", | ||
| "posthog-js": "^1.414.0", |
There was a problem hiding this comment.
React Doctor · socket/low-supply-chain-score (error)
posthog-js@1.414.0 (lowest version "^1.414.0" allows) scored 36/100 on Socket's supply chain axis (minimum 50). This points to risky install-time behavior — install scripts, obfuscated or native code, network/filesystem/shell access, or typosquatting. Other axes — vulnerability 100, maintenance 100, quality 80, license 100.
Fix → Confirm this is the package you meant to install, and prefer a more established, audited alternative; update "posthog-js": "^1.414.0" in package.json. Full report: https://socket.dev/npm/package/posthog-js/overview/1.414.0. If you've reviewed and accepted this package, raise supplyChain.minScore (currently 50) or set supplyChain.severity: "warning".
PunGrumpy
changed the title
1 participant
Problem
The docker-doctor site had no presence in PostHog — its only analytics is Databuddy, which has no programmatic query surface, so launch traffic after the X announcement couldn't be tracked or dashboarded alongside the rest of the workspace's data. On top of that:
process.envwith no validation — Databuddy silently mounted with anundefinedclient ID when the env var was missing.Result
Analytics —
posthog-jsinitializes in production via a client provider and reports through/ingestrewrites so requests survive tracking blockers. A pinned Docker Doctor Launch dashboard (daily visitors, referrers, channels, top pages — all scoped to$host = docker-doctor.vercel.app) is already in PostHog and starts populating on deploy.Typed env —
@t3-oss/env-nextjs+zodschema inlib/env.ts:NEXT_PUBLIC_POSTHOG_KEYmust be aphc_token (defaults to the public project token),NEXT_PUBLIC_DATABUDDY_CLIENT_IDis optional and Databuddy now mounts only when it's set.next.config.tsimports the schema, so invalid env fails the build instead of surfacing at runtime.README — real scan output captured from an actual run under Quick start, rule count corrected to 25, CI section shows genuine pipeline usage (
--jsonreport artifact,--scoregating), and the API section is a working example verified to produce the same 68/100 score as the CLI. Changeset included since the npm README ships with@docker-doctor/cli.Verified: full
turbo run build+ 101 tests + typecheck green via the pre-commit hook.🤖 Generated with Claude Code