From 51f8dcc04f671f8fa8d86786975b648e5844bcfa Mon Sep 17 00:00:00 2001
From: Rhys Sullivan <39114868+RhysSullivan@users.noreply.github.com>
Date: Thu, 20 Aug 2026 10:21:36 -0700
Subject: [PATCH] Disable product telemetry in every workflow

The first pass only covered the workflows that looked like they ran product
code and missed preview, deploy, pkg-pr-new and publish-executor-package, which
also invoke the CLI. Blacksmith runners kept reporting to the production
PostHog project after the fix merged.

Apply the opt-out at the top level of every workflow instead of guessing. The
variables are inert where the product is not executed.
---
 .github/workflows/deploy.yml                   | 10 ++++++++++
 .github/workflows/pkg-pr-new.yml               | 10 ++++++++++
 .github/workflows/preview-sweep.yml            | 10 ++++++++++
 .github/workflows/preview.yml                  | 10 ++++++++++
 .github/workflows/publish-executor-package.yml | 10 ++++++++++
 5 files changed, 50 insertions(+)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index a946f0ae8b..2f0d97c242 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,6 +9,16 @@ concurrency:
   group: deploy-production
   cancel-in-progress: false
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   migrate:
     name: Migrate database
diff --git a/.github/workflows/pkg-pr-new.yml b/.github/workflows/pkg-pr-new.yml
index a4720cf515..9af29d8041 100644
--- a/.github/workflows/pkg-pr-new.yml
+++ b/.github/workflows/pkg-pr-new.yml
@@ -10,6 +10,16 @@ concurrency:
   group: pkg-pr-new-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   # Per-platform matrix: build the executor binary, tar it, upload to R2.
   # The wrapper npm package is built later by the `publish` job which just
diff --git a/.github/workflows/preview-sweep.yml b/.github/workflows/preview-sweep.yml
index 243e654cea..fd7ab6483e 100644
--- a/.github/workflows/preview-sweep.yml
+++ b/.github/workflows/preview-sweep.yml
@@ -16,6 +16,16 @@ permissions:
   contents: read
   pull-requests: read
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   sweep:
     name: Destroy previews for closed PRs
diff --git a/.github/workflows/preview.yml b/.github/workflows/preview.yml
index 288e33cbf7..2409fd4f23 100644
--- a/.github/workflows/preview.yml
+++ b/.github/workflows/preview.yml
@@ -23,6 +23,16 @@ concurrency:
   group: preview-${{ github.event.pull_request.number }}
   cancel-in-progress: ${{ github.event.action != 'closed' }}
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   deploy:
     name: Deploy preview
diff --git a/.github/workflows/publish-executor-package.yml b/.github/workflows/publish-executor-package.yml
index 2ef813a679..fefdf8d89d 100644
--- a/.github/workflows/publish-executor-package.yml
+++ b/.github/workflows/publish-executor-package.yml
@@ -21,6 +21,16 @@ concurrency:
   group: publish-executor-package-${{ github.ref }}
   cancel-in-progress: false
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   publish:
     runs-on: ubuntu-latest