Feat/oss readiness and analytics by jpdevhub · Pull Request #39 · jpdevhub/FreshScanAi

jpdevhub · 2026-05-27T09:03:15Z

Summary by cubic

Adds PostHog analytics with SPA pageviews, user identification, and a Vercel proxy for ingestion; also streamlines OSS setup, docs, and templates to make contributions easier.

New Features
- Integrated posthog-js; initializes only when VITE_POSTHOG_KEY is set and opts out in dev.
- Tracks $pageview on route changes via PostHogPageView; app wrapped in PostHogProvider.
- Identifies users from JWT sub after auth; resets analytics on logout to avoid session carry-over.
- Added Vercel rewrites for /ingest/* and /ingest/static/* to US PostHog endpoints.
- .env.example: added VITE_POSTHOG_KEY and VITE_POSTHOG_HOST (defaults to https://us.i.posthog.com).
Refactors and Fixes
- Simplified GitHub issue templates, removed the stale workflow, and added a PR size labeler.
- Updated CONTRIBUTING and README to reference .env.local; clarified setup and removed emojis in docs and scripts/dev-setup.sh.
- Fixed lint by adding PostHog to useEffect dependency arrays.
- Synced package-lock.json with package.json.

^{Written for commit ad6a9a6. Summary will update on new commits. Review in cubic}

vercel · 2026-05-27T09:03:20Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
fresh-scan-ai	Ready	Preview, Comment	May 27, 2026 9:10am

cubic-dev-ai

7 issues found across 18 files

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="vercel.json">

<violation number="1" location="vercel.json:9">
P1: Missing required `/ingest/array/` rewrite for PostHog remote config. Without it, remote config requests (e.g., `/ingest/array/{token}/config.js`) fall through to the main API, which strips cache-control headers and can cause browsers to use stale SDK configuration.

Add a third rewrite before the catch-all `/ingest/:path*` rule:
```json
{
  "source": "/ingest/array/:path*",
  "destination": "https://us-assets.i.posthog.com/array/:path*"
}
```</violation>
</file>

<file name=".github/workflows/pr-size-labeler.yml">

<violation number="1" location=".github/workflows/pr-size-labeler.yml:9">
P2: Missing `contents: read` permission required by the action. Add `contents: read` to the permissions block.</violation>

<violation number="2" location=".github/workflows/pr-size-labeler.yml:14">
P2: Pin to the latest release v0.5.7 instead of v0.5.5 to get the Node 24 runtime update, security fixes, and updated dependencies.</violation>
</file>

<file name="src/components/PostHogPageView.tsx">

<violation number="1" location="src/components/PostHogPageView.tsx:14">
P1: This component duplicates PostHog's built-in SPA pageview tracking because `defaults: '2026-01-30'` in main.tsx already sets `capture_pageview: 'history_change'`. Every SPA navigation fires two `$pageview` events — one from PostHog's auto-capture and one from this useEffect — inflating pageview counts by 2x.

Either:
1. Remove this component and rely on PostHog's automatic `history_change` tracking (already active), or
2. Add `capture_pageview: false` to the PostHog init config in main.tsx to keep only this manual capture.</violation>
</file>

<file name="src/pages/AuthPage.tsx">

<violation number="1" location="src/pages/AuthPage.tsx:39">
P2: JWT payload decoding uses `atob` directly on a base64url segment, which fails for valid tokens and silently drops PostHog identification.</violation>

<violation number="2" location="src/pages/AuthPage.tsx:40">
P2: `posthog` is used inside `useEffect` but omitted from its dependency array, which can cause user identification to be missed when the client initializes after first render.</violation>
</file>

<file name="src/main.tsx">

<violation number="1" location="src/main.tsx:27">
P2: `PostHogProvider` is always rendered even when `posthog.init` is skipped, so it can receive an uninitialized client when `VITE_POSTHOG_KEY` is absent.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Re-trigger cubic}

cubic-dev-ai · 2026-05-27T09:09:12Z

+    },
+    {
+      "source": "/ingest/:path*",
+      "destination": "https://us.i.posthog.com/:path*"


P1: Missing required /ingest/array/ rewrite for PostHog remote config. Without it, remote config requests (e.g., /ingest/array/{token}/config.js) fall through to the main API, which strips cache-control headers and can cause browsers to use stale SDK configuration.

Add a third rewrite before the catch-all /ingest/:path* rule:

{ "source": "/ingest/array/:path*", "destination": "https://us-assets.i.posthog.com/array/:path*" }

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At vercel.json, line 9: <comment>Missing required `/ingest/array/` rewrite for PostHog remote config. Without it, remote config requests (e.g., `/ingest/array/{token}/config.js`) fall through to the main API, which strips cache-control headers and can cause browsers to use stale SDK configuration. Add a third rewrite before the catch-all `/ingest/:path*` rule: ```json { "source": "/ingest/array/:path*", "destination": "https://us-assets.i.posthog.com/array/:path*" } ```</comment> <file context> @@ -1,5 +1,13 @@ + }, + { + "source": "/ingest/:path*", + "destination": "https://us.i.posthog.com/:path*" + }, { "source": "/(.*)", "destination": "/" } </file context>

cubic-dev-ai · 2026-05-27T09:09:12Z

+  const location = useLocation();
+  const posthog = usePostHog();
+
+  useEffect(() => {


P1: This component duplicates PostHog's built-in SPA pageview tracking because defaults: '2026-01-30' in main.tsx already sets capture_pageview: 'history_change'. Every SPA navigation fires two $pageview events — one from PostHog's auto-capture and one from this useEffect — inflating pageview counts by 2x.

Either:

Remove this component and rely on PostHog's automatic history_change tracking (already active), or

Add capture_pageview: false to the PostHog init config in main.tsx to keep only this manual capture.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/components/PostHogPageView.tsx, line 14: <comment>This component duplicates PostHog's built-in SPA pageview tracking because `defaults: '2026-01-30'` in main.tsx already sets `capture_pageview: 'history_change'`. Every SPA navigation fires two `$pageview` events — one from PostHog's auto-capture and one from this useEffect — inflating pageview counts by 2x. Either: 1. Remove this component and rely on PostHog's automatic `history_change` tracking (already active), or 2. Add `capture_pageview: false` to the PostHog init config in main.tsx to keep only this manual capture.</comment> <file context> @@ -0,0 +1,21 @@ + const location = useLocation(); + const posthog = usePostHog(); + + useEffect(() => { + posthog?.capture('$pageview', { + $current_url: window.location.href, </file context>

cubic-dev-ai · 2026-05-27T09:09:12Z

+      pull-requests: write
+    steps:
+      - name: Add PR Size Label
+        uses: pascalgn/size-label-action@v0.5.5


P2: Pin to the latest release v0.5.7 instead of v0.5.5 to get the Node 24 runtime update, security fixes, and updated dependencies.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/pr-size-labeler.yml, line 14: <comment>Pin to the latest release v0.5.7 instead of v0.5.5 to get the Node 24 runtime update, security fixes, and updated dependencies.</comment> <file context> @@ -0,0 +1,23 @@ + pull-requests: write + steps: + - name: Add PR Size Label + uses: pascalgn/size-label-action@v0.5.5 + env: + GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}" </file context>

cubic-dev-ai · 2026-05-27T09:09:12Z

+jobs:
+  size-label:
+    runs-on: ubuntu-latest
+    permissions:


P2: Missing contents: read permission required by the action. Add contents: read to the permissions block.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/pr-size-labeler.yml, line 9: <comment>Missing `contents: read` permission required by the action. Add `contents: read` to the permissions block.</comment> <file context> @@ -0,0 +1,23 @@ +jobs: + size-label: + runs-on: ubuntu-latest + permissions: + issues: write + pull-requests: write </file context>

cubic-dev-ai · 2026-05-27T09:09:12Z

+      // Identify the user in PostHog using their JWT sub claim as the ID.
+      // The token is a JWT; we decode the payload to get the user ID.
+      try {
+        const payload = JSON.parse(atob(accessToken.split('.')[1]));


P2: JWT payload decoding uses atob directly on a base64url segment, which fails for valid tokens and silently drops PostHog identification.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/AuthPage.tsx, line 39: <comment>JWT payload decoding uses `atob` directly on a base64url segment, which fails for valid tokens and silently drops PostHog identification.</comment> <file context> @@ -31,6 +33,14 @@ export default function AuthPage() { + // Identify the user in PostHog using their JWT sub claim as the ID. + // The token is a JWT; we decode the payload to get the user ID. + try { + const payload = JSON.parse(atob(accessToken.split('.')[1])); + posthog?.identify(payload.sub, { email: payload.email }); + } catch { </file context>

Suggested change

const payload = JSON.parse(atob(accessToken.split('.')[1]));

const base64Url = accessToken.split('.')[1];

const payload = JSON.parse(atob(base64Url.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(base64Url.length / 4) * 4, '=')));

cubic-dev-ai · 2026-05-27T09:09:13Z

+      // The token is a JWT; we decode the payload to get the user ID.
+      try {
+        const payload = JSON.parse(atob(accessToken.split('.')[1]));
+        posthog?.identify(payload.sub, { email: payload.email });


P2: posthog is used inside useEffect but omitted from its dependency array, which can cause user identification to be missed when the client initializes after first render.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/pages/AuthPage.tsx, line 40: <comment>`posthog` is used inside `useEffect` but omitted from its dependency array, which can cause user identification to be missed when the client initializes after first render.</comment> <file context> @@ -31,6 +33,14 @@ export default function AuthPage() { + // The token is a JWT; we decode the payload to get the user ID. + try { + const payload = JSON.parse(atob(accessToken.split('.')[1])); + posthog?.identify(payload.sub, { email: payload.email }); + } catch { + // Not a JWT or malformed — skip identification silently </file context>

cubic-dev-ai · 2026-05-27T09:09:13Z

+    <PostHogProvider client={posthog}>
+      <App />
+    </PostHogProvider>


P2: PostHogProvider is always rendered even when posthog.init is skipped, so it can receive an uninitialized client when VITE_POSTHOG_KEY is absent.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/main.tsx, line 27: <comment>`PostHogProvider` is always rendered even when `posthog.init` is skipped, so it can receive an uninitialized client when `VITE_POSTHOG_KEY` is absent.</comment> <file context> @@ -1,10 +1,31 @@ createRoot(document.getElementById('root')!).render( <StrictMode> - <App /> + <PostHogProvider client={posthog}> + <App /> + </PostHogProvider> </file context>

Suggested change

<PostHogProvider client={posthog}>

<App />

</PostHogProvider>

{POSTHOG_KEY ? (

<PostHogProvider client={posthog}>

<App />

</PostHogProvider>

) : (

<App />

)}

jpdevhub added 3 commits May 27, 2026 14:31

chore(ci): simplify issue templates and add PR size labeler

8895409

feat(auth): integrate posthog analytics and vercel reverse proxy

2ac42a4

docs(api): finalize open-source instructions and remove emojis

e30031a

Merge branch 'main' into feat/oss-readiness-and-analytics

7cc5dc7

vercel Bot deployed to Preview May 27, 2026 09:05 View deployment

fix(lint): add posthog to useEffect dependency array

8d750c1

vercel Bot deployed to Preview May 27, 2026 09:07 View deployment

cubic-dev-ai Bot reviewed May 27, 2026

View reviewed changes

chore(deps): sync package-lock.json with package.json

ad6a9a6

vercel Bot deployed to Preview May 27, 2026 09:10 View deployment

jpdevhub merged commit 2a9ce00 into main May 27, 2026
7 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat/oss readiness and analytics#39

Feat/oss readiness and analytics#39
jpdevhub merged 6 commits into
mainfrom
feat/oss-readiness-and-analytics

jpdevhub commented May 27, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

vercel Bot commented May 27, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

cubic-dev-ai Bot May 27, 2026

Uh oh!

cubic-dev-ai Bot May 27, 2026

Uh oh!

cubic-dev-ai Bot May 27, 2026

Uh oh!

cubic-dev-ai Bot May 27, 2026

Uh oh!

cubic-dev-ai Bot May 27, 2026

Uh oh!

cubic-dev-ai Bot May 27, 2026

Uh oh!

cubic-dev-ai Bot May 27, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	const payload = JSON.parse(atob(accessToken.split('.')[1]));
	const base64Url = accessToken.split('.')[1];
	const payload = JSON.parse(atob(base64Url.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(base64Url.length / 4) * 4, '=')));

Conversation

jpdevhub commented May 27, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by cubic

Uh oh!

vercel Bot commented May 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

cubic-dev-ai Bot May 27, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jpdevhub commented May 27, 2026 •

edited by cubic-dev-ai Bot

Loading

vercel Bot commented May 27, 2026 •

edited

Loading