chore: fix telemetry token #236
Conversation
|
Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. Warning Rate limit exceeded@ymc9 has exceeded the limit for the number of commits or files that can be reviewed per hour. Please wait 9 minutes and 4 seconds before requesting another review. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. 📒 Files selected for processing (3)
WalkthroughRemoves the tsup onSuccess hook from the CLI build, adds a new post-build script to inject the telemetry token into built artifacts, and updates the CI workflow to run this script after building. Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
✨ Finishing Touches
🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
Status, Documentation and Community
|
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: console.log('TELEMETRY_TRACKING_TOKEN:', process.env['TELEMETRY_TRACKING_TOKEN']);Code Review Findings✅ Code Quality & Best Practices
|
There was a problem hiding this comment.
Pull Request Overview
This PR adds debug logging to display the telemetry tracking token value during the build process. The change helps with debugging telemetry configuration by outputting the token value to the console.
- Adds console logging for the TELEMETRY_TRACKING_TOKEN environment variable
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (2)
packages/cli/tsup.config.ts (2)
23-29: Use consistent paths for read/write; write should also join with __dirname.Reading uses
path.join(__dirname, ...)but writing is CWD-relative; this can write to the wrong location.- fs.writeFileSync(file, updatedContent, 'utf-8'); + fs.writeFileSync(path.join(__dirname, file), updatedContent, 'utf-8');
24-27: Replace all occurrences and avoid$expansion in replacement strings.
String.prototype.replaceonly replaces the first match and may interpret$in the replacement. UsereplaceAllwith a function.- const updatedContent = content.replace( - '<TELEMETRY_TRACKING_TOKEN>', - process.env['TELEMETRY_TRACKING_TOKEN'], - ); + const token = process.env['TELEMETRY_TRACKING_TOKEN']!; + const updatedContent = content.replaceAll('<TELEMETRY_TRACKING_TOKEN>', () => token);
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
packages/cli/tsup.config.ts(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
{packages,samples,tests}/**
📄 CodeRabbit inference engine (CLAUDE.md)
Packages are located in
packages/,samples/, andtests/
Files:
packages/cli/tsup.config.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build-test (20.x)
🔇 Additional comments (1)
packages/cli/tsup.config.ts (1)
1-4: Ensure__dirnameis defined under ESM.If the repo uses
"type": "module",__dirnameis undefined. Verify config loader; if ESM, derive it explicitly.// At top of file: import { fileURLToPath } from 'node:url'; const __dirname = path.dirname(fileURLToPath(import.meta.url));Also applies to: 23-23
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: console.log('TELEMETRY_TRACKING_TOKEN:', process.env['TELEMETRY_TRACKING_TOKEN']);Code Review Findings✅ Code Quality & Best Practices
|
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: console.log('TELEMETRY_TRACKING_TOKEN:', process.env['TELEMETRY_TRACKING_TOKEN']);Code Review Findings✅ Code Quality & Best Practices
|
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (1)
.github/workflows/build-test.yml(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
- GitHub Check: build-test (20.x)
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary:
Code Review Findings✅ Code Quality & Best Practices
🚨 CRITICAL Security Concerns
✅ Performance Considerations
✅ Potential Bugs
✅ Test Coverage
Architecture ContextThe telemetry system works by:
Recommendations
Overall Assessment🚨 Requires Changes: The functionality works correctly, but the security implications of logging tokens in CI environments must be addressed. This is especially important for open-source projects where CI logs may be publicly accessible. Suggested Fix: // packages/cli/tsup.config.ts:19
console.log('TELEMETRY_TRACKING_TOKEN present:', !!process.env['TELEMETRY_TRACKING_TOKEN']);# .github/workflows/build-test.yml:69
run: pnpm run build |
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: Code Review Findings✅ Code Quality & Best Practices
🚨 CRITICAL Security Concerns
✅ Performance Considerations
✅ Potential Bugs
|
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: Code Review Findings✅ Code Quality & Best Practices
🚨 CRITICAL Security Concerns
✅ Performance Considerations
✅ Potential Bugs
|
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (2)
packages/cli/package.json (1)
25-25: Move post-build step to npm’spostbuildlifecycle
Split the scripts so npm runs the post-build automatically andtsxis available from the workspace root:- "build": "tsc --noEmit && tsup-node && tsx scripts/post-build.ts", + "build": "tsc --noEmit && tsup-node", + "postbuild": "tsx scripts/post-build.ts",
tsxis already declared in the root package.json (package.json:29), so it will be hoisted into the CLI package. For watch-mode builds, consider using tsup’s--onSuccesshook.packages/cli/scripts/post-build.ts (1)
15-15: Replace all occurrences of the placeholderIf the placeholder appears multiple times, only the first gets replaced.
- const updatedContent = content.replace('<TELEMETRY_TRACKING_TOKEN>', token); + const updatedContent = content.replaceAll('<TELEMETRY_TRACKING_TOKEN>', token);
📜 Review details
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (3)
packages/cli/package.json(1 hunks)packages/cli/scripts/post-build.ts(1 hunks)packages/cli/tsup.config.ts(0 hunks)
💤 Files with no reviewable changes (1)
- packages/cli/tsup.config.ts
🧰 Additional context used
📓 Path-based instructions (1)
{packages,samples,tests}/**
📄 CodeRabbit inference engine (CLAUDE.md)
Packages are located in
packages/,samples/, andtests/
Files:
packages/cli/scripts/post-build.tspackages/cli/package.json
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: build-test (20.x)
- GitHub Check: claude-review
🔇 Additional comments (1)
packages/cli/scripts/post-build.ts (1)
12-17: Add guardrails in post-build.ts: skip missing files, warn on absent placeholders, use correct absolute pathsfor (const file of filesToProcess) { - const content = fs.readFileSync(path.join(_dirname, '..', file), 'utf-8'); - const updatedContent = content.replace('<TELEMETRY_TRACKING_TOKEN>', token); - fs.writeFileSync(file, updatedContent, 'utf-8'); + const absPath = path.join(_dirname, '..', file); + if (!fs.existsSync(absPath)) { + console.warn(`Skip: ${absPath} not found`); + continue; + } + const content = fs.readFileSync(absPath, 'utf-8'); + const updatedContent = content.replaceAll('<TELEMETRY_TRACKING_TOKEN>', token); + if (updatedContent === content) console.warn(`Placeholder not found in ${file}`); + fs.writeFileSync(absPath, updatedContent, 'utf-8'); }After building, verify no placeholders remain:
rg -n "<TELEMETRY_TRACKING_TOKEN>" packages/cli/dist || echo "OK: no placeholders found"
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: Code Review Findings✅ Code Quality & Best Practices
🚨 CRITICAL Security Concerns
✅ Performance Considerations
|
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: Code Review Findings✅ Code Quality & Best Practices
🚨 CRITICAL Security Concerns
✅ Performance Considerations
|
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: Code Review Findings✅ Code Quality & Best Practices
🚨 CRITICAL Security Concerns
✅ Performance Considerations
|
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: Code Review Findings✅ Code Quality & Best Practices
|
|
Claude finished @ymc9's task —— View job Code Review: Telemetry Token FixReviewing this PR that fixes telemetry token configuration. Todo List:
Change Summary: Code Review Findings✅ Code Quality & Best Practices
|
Summary by CodeRabbit