[CI] (3393d57) swift/hackers-ios

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 3393d57
App: swift/hackers-ios
App directory: apps/swift/hackers-ios
Workbench branch: wizard-ci-3393d57-swift-hackers-ios
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-03-17T00:41:40.351Z
Duration: 550.4s

[wizard-ci-bot]

Now I have enough context to write the full evaluation. Let me analyze all the key points:

1. API key in scheme: The value sTMFPsFhdP1Ssg in the xcscheme does NOT look like a real PostHog API key (those start with phc_ and are much longer). This appears to be a placeholder/truncated value — acceptable for a demo/CI setup.

2. Identify pattern: Uses username (the HN username string) as the distinct_id — this is a raw user-input string, not a database ID or session ID. However, for Hacker News, the username IS the unique identifier, so this is reasonable.

3. PII concern: username is passed both in identify() (correct) and as a property in capture("user_logged_in") — the username in the capture event property is a PII concern.

4. Error tracking: No error/exception tracking setup (no captureExceptions or similar).

5. Reverse proxy: N/A for iOS (native app, not browser).

---

PR Evaluation Report

Summary

This PR integrates PostHog analytics into the Hackers iOS app (a Hacker News client). It adds the posthog-ios SDK via SPM to the main Xcode project and five feature module Package.swift files, initializes PostHog in HackersApp.swift using environment variables from the Xcode scheme, implements user identification on login with reset on logout, and adds 12 analytics events across authentication, feed, comments, voting, and in-app purchase flows.

Files changed	Lines added	Lines removed
14	+163	-11

Confidence score: 5/5 🧙

• Username as identify distinct_id: The identify() call uses the raw HN username string as distinct_id. While HN usernames are unique, using a raw username string as distinct_id is not ideal — a hashed or internal user ID would be preferable. However, since this is a third-party HN client without its own user database, the username is the only available unique identifier, making this acceptable. [MEDIUM]
• PII in capture event properties: user_logged_in event includes "username" as an event property. PII like usernames should be set via person properties (e.g., in identify() or ``), not in individual capture() event properties. [MEDIUM]
• No error tracking configured: No exception/error tracking setup (e.g., no captureExceptions or error boundary configuration). [MEDIUM]

---

File changes

Filename	Score	Description
App/HackersApp.swift	5/5	Adds PostHogEnv enum reading from environment variables and initializes PostHog SDK in init() with lifecycle event capture
Features/Authentication/Package.swift	5/5	Adds posthog-ios SPM dependency to Authentication module
Features/Authentication/Sources/Authentication/LoginViewModel.swift	4/5	Adds identify on login, reset on logout, and login/logout event capture; minor PII concern in capture properties
Features/Comments/Package.swift	5/5	Adds posthog-ios SPM dependency to Comments module
Features/Comments/Sources/Comments/CommentsViewModel.swift	5/5	Captures bookmark toggle events with post_id property
Features/Feed/Package.swift	5/5	Adds posthog-ios SPM dependency to Feed module
Features/Feed/Sources/Feed/FeedViewModel.swift	5/5	Captures feed category change and search events with relevant properties
Features/Settings/Package.swift	5/5	Adds posthog-ios SPM dependency to Settings module
Features/Settings/Sources/Settings/SupportViewModel.swift	4/5	Captures purchase and restore events; minor behavioral change to if-nesting is harmless but unnecessary
Hackers.xcodeproj/project.pbxproj	5/5	Adds PBXBuildFile, XCSwiftPackageProductDependency, and XCRemoteSwiftPackageReference with correct UUIDs
Hackers.xcodeproj/xcshareddata/xcschemes/Hackers.xcscheme	4/5	Sets environment variables for API key and host in scheme
Shared/Package.swift	5/5	Adds posthog-ios SPM dependency to Shared module
Shared/Sources/Shared/ViewModels/VotingViewModel.swift	5/5	Captures post and comment upvote events with ID properties
posthog-setup-report.md	N/A	Setup report documentation

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	All Swift syntax is valid, SPM dependencies are correctly declared, pbxproj has proper entries
Preserves existing env vars & configs	Yes	Only adds new PostHog-related configuration; no existing code is removed or broken
No syntax or type errors	Yes	All Swift code follows valid syntax and type patterns
Correct imports/exports	Yes	import PostHog is correctly added in all files that use PostHogSDK.shared
Minimal, focused changes	Yes	Changes are focused on PostHog integration; the minor restructure in SupportViewModel is related to adding the capture call
Pre-existing issues	None	No pre-existing issues identified

Issues

• SupportViewModel logic restructure: The if result == .success, product.kind == .subscription compound condition was split into nested ifs. While functionally equivalent and harmless, this is a slightly unnecessary refactor to accommodate the PostHog capture call. [LOW]

Other completed criteria

• Environment variables documented via Xcode scheme environment variables in Hackers.xcscheme
• Build configuration is valid — all SPM package references use consistent version 3.47.0 with upToNextMajorVersion
• All three required pbxproj objects (PBXBuildFile, XCSwiftPackageProductDependency, XCRemoteSwiftPackageReference) are correctly created

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-ios v3.47.0 added via SPM in project.pbxproj and all feature module Package.swift files
PostHog client initialized	Yes	Initialized in HackersApp.init() via PostHogSDK.shared.setup(config) with captureApplicationLifecycleEvents = true
capture()	Yes	12 meaningful capture calls across 5 view model files
identify()	Yes	PostHogSDK.shared.identify(username, userProperties:) called on login, PostHogSDK.shared.reset() on logout
Error tracking	No	No error/exception tracking configured (no captureExceptions or similar error tracking setup)
Reverse proxy	N/A	iOS native app — reverse proxy is not applicable

Issues

• No error tracking: The PR does not set up PostHog error/exception tracking. PostHog iOS SDK supports exception autocapture that should be enabled in the config. [MEDIUM]
• PII in capture properties: The user_logged_in event captures "username" as an event property. Username is PII and should only be set via person properties (already done correctly in the identify() call). Remove "username" from the capture() properties dictionary. [MEDIUM]

Other completed criteria

• API key loaded from environment variable via PostHogEnv enum using ProcessInfo.processInfo.environment — follows the exact framework-specific pattern
• Host correctly configured to https://us.i.posthog.com
• SDK version 3.47.0 is used across all Package.swift files consistently
• pbxproj correctly adds all three required SPM objects (PBXBuildFile, XCRemoteSwiftPackageReference, XCSwiftPackageProductDependency)
• PostHogSDK.shared.reset() correctly called on logout

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
LoginViewModel.swift	user_logged_in, login_failed, user_logged_out	Authentication flow tracking: login success with username (PII concern), login failure, and logout with identity reset
FeedViewModel.swift	feed_category_changed, search_performed	Feed navigation and search usage with category name, query length, and result count properties
CommentsViewModel.swift	post_bookmarked, post_unbookmarked	Bookmark toggle tracking with post_id
VotingViewModel.swift	post_upvoted, comment_upvoted	Voting engagement tracking with post_id and comment_id
SupportViewModel.swift	purchase_completed, purchase_failed, purchases_restored	In-app purchase funnel tracking with product_id and product_kind

Issues

• PII in user_logged_in event: The "username" property in the capture("user_logged_in") call is PII. It's already correctly set via identify() — remove it from the capture properties to avoid storing PII on individual events. [MEDIUM]
• login_failed event lacks properties: The login_failed event has no properties. Adding context like "username_provided": true/false (without the actual username) would make this event more useful for analysis. [LOW]

Other completed criteria

• Events represent real user actions in a Hacker News client (login, voting, bookmarking, searching, purchasing)
• Events enable product insights — can build login funnel, engagement trends, search usage analysis, and purchase conversion funnels
• Most events include relevant properties (post_id, category, query_length, result_count, product_id, product_kind)
• Event names are descriptive and use consistent snake_case convention

---

Reviewed by wizard workbench PR evaluator