From 14873bb7d13f6d57904380c94eab7301091af010 Mon Sep 17 00:00:00 2001 From: Flotapponnier <160007691+Flotapponnier@users.noreply.github.com> Date: Sun, 20 Sep 2026 14:21:29 +0200 Subject: [PATCH] deploy: NEXT_PUBLIC_POSTHOG_KEY injected at build from a repository variable; vercel pull hands sensitive env vars back as the literal "[SENSITIVE]" and that string shipped as the PostHog token since 2026-08-24 (#2542) Claude-Session: https://claude.ai/code/session_01HJgbZCqjR4nvCfcJSzofbw Co-authored-by: Flotapponnier Co-authored-by: Claude Opus 5 (1M context) (cherry picked from commit 1425bc87110c09891df37f7af57f24e802d68633) --- .github/workflows/prod-deploy.yml | 8 ++++++++ .github/workflows/staging-deploy.yml | 4 ++++ 2 files changed, 12 insertions(+) diff --git a/.github/workflows/prod-deploy.yml b/.github/workflows/prod-deploy.yml index 7858ce16b..bf28d291b 100644 --- a/.github/workflows/prod-deploy.yml +++ b/.github/workflows/prod-deploy.yml @@ -54,6 +54,14 @@ jobs: run: vercel pull --yes --environment=production --token=${{ secrets.VERCEL_TOKEN }} - name: Build + # NEXT_PUBLIC_POSTHOG_KEY comes from a repository variable: `vercel pull` + # writes the literal "[SENSITIVE]" for env vars flagged sensitive on + # Vercel, and that string was compiled into the bundle as the PostHog + # token (no event reached PostHog from 2026-08-24 to 2026-09-20). + # process.env wins over the pulled .env file. The token is public by + # nature (it ships to every browser), so a variable, not a secret. + env: + NEXT_PUBLIC_POSTHOG_KEY: ${{ vars.NEXT_PUBLIC_POSTHOG_KEY }} run: vercel build --prod --token=${{ secrets.VERCEL_TOKEN }} - name: Deploy to Production diff --git a/.github/workflows/staging-deploy.yml b/.github/workflows/staging-deploy.yml index 76b930fc6..06bca10bb 100644 --- a/.github/workflows/staging-deploy.yml +++ b/.github/workflows/staging-deploy.yml @@ -47,6 +47,10 @@ jobs: run: vercel pull --yes --environment=preview --token=${{ secrets.VERCEL_TOKEN }} - name: Build + # Same repository variable as prod-deploy.yml (see the note there). + # Staging events are excluded by the CRM's host filter. + env: + NEXT_PUBLIC_POSTHOG_KEY: ${{ vars.NEXT_PUBLIC_POSTHOG_KEY }} run: vercel build --token=${{ secrets.VERCEL_TOKEN }} - name: Deploy Preview