[CI] (1776c51) react-native/react-native-saas

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 1776c51
App: react-native/react-native-saas
App directory: apps/react-native/react-native-saas
Workbench branch: wizard-ci-1776c51-react-native-react-native-saas
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-07-10T23:40:32.964Z
Duration: 349.5s

YARA Scanner

✓ 134 tool calls scanned, 0 violations detected

No violations: ✓ 134 clean scans

[wizard-ci-bot]

Now I have enough context from the diff and the key files to produce the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a React Native SaaS app using posthog-react-native. It adds SDK initialization via PostHogProvider, manual screen tracking through React Navigation callbacks, user identification on sign-in, identity reset on sign-out, and a comprehensive set of business events across auth, teams, projects, and members sagas. Error tracking is implemented via captureException.

Files changed	Lines added	Lines removed
16	+303	-14

Confidence score: 4/5 👍

• Email used as distinct_id: getDistinctIdFromEmail() returns the raw (normalized) email address as the distinct_id passed to posthog.identify(). This causes fragmented analytics data and is a PostHog anti-pattern — a stable database user ID or UUID should be used instead. [CRITICAL]
• No .env.example committed: The .env file with the real API key exists locally but is not committed. No .env.example or equivalent documentation of required env vars is included in the PR, so collaborators won't know what to set. [MEDIUM]

---

File changes

Filename	Score	Description
src/services/posthog.js	3/5	PostHog client initialization, email sanitization helpers, and error capture wrapper. Uses email as distinct_id which is problematic.
src/services/posthogTracking.js	3/5	Tracking abstraction layer with identify, screen, event, exception, and reset functions. Identify uses email-based distinct_id.
src/routes.js	5/5	Wraps app with PostHogProvider, adds manual screen tracking via NavigationContainer callbacks. Well-implemented.
package.json	5/5	Adds posthog-react-native and required peer deps (react-native-config, react-native-device-info, etc.)
android/app/build.gradle	5/5	Applies dotenv gradle plugin for react-native-config env var loading on Android builds.
src/pages/SignIn/index.js	5/5	Captures sign_in_submitted with sanitized email domain and password presence.
src/store/modules/auth/sagas.js	4/5	Identifies user on sign-in, resets on sign-out, captures success/failure events. Good saga integration pattern.
src/store/modules/teams/sagas.js	5/5	Captures team creation success/failure with enriched properties.
src/store/modules/projects/sagas.js	5/5	Captures project creation events with source context.
src/store/modules/members/sagas.js	5/5	Captures member invite and role update events with contextual properties.
src/components/TeamSwitcher/index.js	5/5	Captures team_selected event with team context properties. Adds testIDs.
src/pages/Main/index.js	5/5	Captures drawer open events. Adds testIDs.
react-native-config.d.ts	5/5	Type declarations for env config module.
jsconfig.json	4/5	Adds include paths for TypeScript/IDE support.
posthog-setup-report.md	4/5	Comprehensive setup report with event table and next steps.
src/pages/Main/styles.js	5/5	Removes unused Platform import — minor cleanup.

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	No syntax errors, all imports resolve, native gradle config is correct
Preserves existing env vars & configs	Yes	Existing app code and configs preserved; PostHog additions are additive
No syntax or type errors	Yes	All JS files are syntactically valid
Correct imports/exports	Yes	posthog-react-native, react-native-config imports are correct for React Native
Minimal, focused changes	Yes	All changes relate to PostHog integration; testID additions support autocapture
Pre-existing issues	None	No pre-existing issues observed

Issues

• No .env.example committed: The .env file with the real API key exists on disk but is (correctly) not committed. However, no .env.example or equivalent is committed either, leaving POSTHOG_PROJECT_TOKEN and POSTHOG_HOST undocumented for collaborators. [MEDIUM]

Other completed criteria

• Build configuration is valid — build.gradle correctly applies the dotenv gradle plugin
• package.json dependencies are correctly specified with appropriate version ranges
• jsconfig.json and react-native-config.d.ts properly configured

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-react-native@^4.55.0 added with required peers (react-native-device-info, react-native-localize, react-native-svg)
PostHog client initialized	Yes	new PostHog(token, config) in posthog.js; PostHogProvider wraps the navigation stack in routes.js with autocapture config
capture()	Yes	15+ meaningful posthog.capture() calls across auth, teams, projects, and members flows
identify()	No	Uses raw email address as distinct_id via getDistinctIdFromEmail(), which causes fragmented person data. Should use a stable user ID from the backend.
Error tracking	Yes	posthog.captureException() used in captureError() wrapper; called in all catch blocks across sagas
Reverse proxy	N/A	Mobile app — reverse proxy is not applicable

Issues

• Email as distinct_id: getDistinctIdFromEmail() normalizes the email and returns it as the distinct_id for posthog.identify(). PostHog best practices require a stable, unique user ID (e.g., database user ID or UUID) as the distinct_id. Using email addresses leads to fragmented analytics if a user changes their email, and is explicitly an anti-pattern. The fix: use the user's database ID from the auth response (e.g., response.data.user.id) as the distinct_id, and pass the email only as a person property via ``. [CRITICAL]

Other completed criteria

• API key loaded from environment variable via react-native-config (not hardcoded)
• Host correctly configured with fallback to https://us.i.posthog.com
• PostHogProvider correctly wraps navigation stack with autocapture config for touches
• Manual screen tracking correctly implemented via NavigationContainer onStateChange callback
• posthog.reset() called on sign-out to unlink future events
• captureAppLifecycleEvents: true enabled for automatic lifecycle tracking

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
src/pages/SignIn/index.js	sign_in_submitted	Captures sign-in form submission with email domain and password presence
src/store/modules/auth/sagas.js	sign_in_succeeded, sign_in_failed, signed_out, captureException	Full auth lifecycle with method, domain, and team context
src/components/TeamSwitcher/index.js	team_selected	Team selection with team_id, slug, and name length
src/pages/Main/index.js	team_switcher_opened, members_drawer_opened	UI interaction events with active team context
src/store/modules/teams/sagas.js	team_created, team_creation_failed, captureException	Team creation lifecycle with source and team metadata
src/store/modules/projects/sagas.js	project_created, project_creation_failed, captureException	Project creation with source, ID, and title length
src/store/modules/members/sagas.js	member_invited, member_invitation_failed, member_role_updated, member_role_update_failed, captureException	Member management with invitation channel, role counts, and team context
src/routes.js	`` (via posthog.screen())	Manual screen view tracking on navigation state changes

Issues

• Email used as fabricated distinct_id: The identifySignedInUser function uses the user's email address as the distinct_id. This is PII used as a fabricated distinct_id, which violates PostHog best practices and creates data quality issues. [CRITICAL]

Other completed criteria

• Events represent real user actions (sign-in, team switching, project creation, member invites)
• Events enable product insights — sign-in funnel, team/project creation trends, member management flows
• Events include rich contextual properties (team_slug, creation_source, auth_method, email_domain)
• Event names follow consistent snake_case convention with descriptive action names
• Email domain extraction (sanitizeEmailDomain) correctly strips PII from event properties
• Success/failure event pairs enable conversion analysis

---

Reviewed by wizard workbench PR evaluator