feat(blog): add automated PostHog tiles update workflow#7978
Merged
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughA new workflow runs a Node.js script that scans blog MDX frontmatter, derives post counts and recent slugs, builds three PostHog HogQL queries, and patches the configured insights. The script also supports dry-run mode and exits when the API key is missing. ChangesBlog PostHog Tiles
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
|
The latest updates on your projects. Learn more about Argos notifications ↗︎
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/blog-posthog-tiles.yml (1)
27-33: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winHarden the checkout and pin actions to commit SHAs.
Two things your static analysis is (correctly) nudging on:
persist-credentials—actions/checkoutleaves theGITHUB_TOKENin.git/configby default. This job only reads frontmatter and talks to PostHog; it never needs to push back to the repo, so persisting the credential just widens the blast radius if a later step is compromised. Disable it.- Hash pinning —
@v4is a moving tag; pinning to a full commit SHA prevents a re-tagged/compromised release from silently flowing into this workflow, which your blanket policy requires.🔒 Suggested changes
- name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@<full-commit-sha> # v4.x.x + with: + persist-credentials: false - name: Setup Node.js - uses: actions/setup-node@v4 + uses: actions/setup-node@<full-commit-sha> # v4.x.x with: node-version: "20"🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/blog-posthog-tiles.yml around lines 27 - 33, Harden the workflow by updating the Checkout repository and Setup Node.js steps in the blog-posthog-tiles job: set actions/checkout to not persist credentials because this job only reads content and does not need repo write access, and replace the moving `@v4` references with pinned full commit SHAs for both actions. Use the existing step names and the actions/checkout and actions/setup-node entries to locate the changes.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@apps/blog/scripts/update-posthog-blog-tiles.mjs`:
- Around line 156-163: The guard in update-posthog-blog-tiles.mjs currently
treats a missing POSTHOG_API_KEY the same as --dry-run, which can turn a real CI
run into a false success. Split the logic around the main execution path so
--dry-run remains the only case that prints the generated queries and exits
cleanly, and make the normal path fail explicitly when POSTHOG_API_KEY is
absent. Keep the behavior localized near the existing argv/env check and the
query-writing flow so accidental secret misconfiguration is surfaced
immediately.
- Around line 116-119: The recentPostsQuery helper is building a HogQL array
from slugs by interpolating raw values into quoted literals, which can break on
apostrophes and create an injection foot-gun. Update recentPostsQuery to escape
or serialize each slug before joining them into the array expression, keeping
the query construction safe while preserving the existing CAST([] AS
Array(String)) fallback.
---
Nitpick comments:
In @.github/workflows/blog-posthog-tiles.yml:
- Around line 27-33: Harden the workflow by updating the Checkout repository and
Setup Node.js steps in the blog-posthog-tiles job: set actions/checkout to not
persist credentials because this job only reads content and does not need repo
write access, and replace the moving `@v4` references with pinned full commit SHAs
for both actions. Use the existing step names and the actions/checkout and
actions/setup-node entries to locate the changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: f08f95de-75de-4c8e-b308-619699f85178
📒 Files selected for processing (2)
.github/workflows/blog-posthog-tiles.ymlapps/blog/scripts/update-posthog-blog-tiles.mjs
AmanVarshney01
approved these changes
Jun 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary by CodeRabbit