fix(ci): make the release guard reject only genuinely untagged pull requests

[github-actions]

Opened automatically when lewis/analytics-tracking was pushed.

The title is written from the diff and rewritten as you push, because this is squashed onto main and the title becomes the commit subject and the changelog line. Retitle it yourself and it is yours — the automation stops touching it.

---

Summary by cubic

Adds first‑party website tracking with form capture and source attribution, plus a settings UI and CRM views to see visitor activity. Includes CI and test stability fixes, and hardens tracking with safer config caching, counter release, and better duplicate‑submission handling.

• Bug Fixes

  • Config caching: only writes to cache when the current hash matches to prevent stale reads; clarified cache invalidation behavior.
  • Counters: handle zero/negative increments and add a release method to decrement counters; improved hourly contact cap so duplicate submissions don’t consume CONTACTS_PER_HOUR.
  • Docs: clarified referrer matching rules (including country‑code requirement) and concurrency around contact attachment; added tests for counter and filing behavior.

• Migration

  • Run database migrations.
  • Set CRON_SECRET and (recommended) REDIS_URL for shared counters and compiled config.
  • Enable tracking in Settings → Tracking & Analytics, add allowed domains, and copy the snippet:
    • <script src="/t/crm.js" data-site="cmp_XXXXXXXX" defer></script>
  • Deploy so /t/crm.js and /t/[site].js are publicly reachable.

^{Written for commit 0c28e0a. Summary will update on new commits.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
crm-agent	Ready	Preview	Aug 11, 2026 2:18am
crm-api	Ready	Preview	Aug 11, 2026 2:18am
crm-app	Ready	Preview	Aug 11, 2026 2:18am

[cubic-dev-ai]

4 issues found and verified against the latest diff

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/tracking/tracking.controller.ts">

<violation number="1" location="apps/api/src/tracking/tracking.controller.ts:153">
P2: Retention stops after 500,000 rows per nightly run, so a backlog or sustained allowed traffic leaves events older than 90 days indefinitely. Continue deletion asynchronously/add runs until caught up, or explicitly surface and schedule continuation for an incomplete sweep.</violation>
</file>

<file name="AGENTS.md">

<violation number="1" location="AGENTS.md:15">
P3: The new rows points contributors to docs/tracking.md, but that file does not exist in the repo (verified across the whole tree); every other doc referenced in this table exists. Since AGENTS.md's first rule is 'Read the doc for the area you are touching before you touch it', this row sends developers to a missing file and the tracking doc is never actually enforced. Add docs/tracking.md in this PR or drop the row until it exists.</violation>
</file>

<file name="apps/api/src/tracking/tracking-rollup.service.ts">

<violation number="1" location="apps/api/src/tracking/tracking-rollup.service.ts:22">
P1: Daily rows undercount the retention-boundary day because consecutive runs split one calendar day and retain only the larger partial aggregate. Roll and delete whole completed days (or otherwise merge non-overlapping partial slices) so both portions are preserved.</violation>
</file>

<file name="apps/app/app/(app)/[slug]/settings/tracking/traffic-sources.tsx">

<violation number="1" location="apps/app/app/(app)/[slug]/settings/tracking/traffic-sources.tsx:30">
P1: Non-managers visiting a ready tracking settings page receive a forbidden `sources` prefetch and the route render fails; render/prefetch TrafficSources only when `tracking.data.canManage` is true (or make the query available to authorized page viewers).</violation>
</file>

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 8 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="packages/db/src/tracking.ts">

<violation number="1" location="packages/db/src/tracking.ts:161">
P3: The `?? "/"` fallback after `raw.split(/[?#]/)[0]` is dead code: `String.prototype.split` always returns an array with at least one element (the original string when there is no match), so `[0]` is always a defined string and the fallback is unreachable. This is harmless but misleading — a reader may assume the fallback guards an empty result. Simplify to `const path = raw.split(/[?#]/)[0];` to keep the intent clear. (The rest of the normalization — query/fragment stripping, leading-slash check, and trailing-slash collapse — correctly implements the one-page-is-one-row goal.)</violation>
</file>

<sub>Tip: Review your code locally with the cubic CLI to iterate faster.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P3: The ?? "/" fallback after raw.split(/[?#]/)[0] is dead code: String.prototype.split always returns an array with at least one element (the original string when there is no match), so [0] is always a defined string and the fallback is unreachable. This is harmless but misleading — a reader may assume the fallback guards an empty result. Simplify to const path = raw.split(/[?#]/)[0]; to keep the intent clear. (The rest of the normalization — query/fragment stripping, leading-slash check, and trailing-slash collapse — correctly implements the one-page-is-one-row goal.)

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/db/src/tracking.ts, line 161:

<comment>The `?? "/"` fallback after `raw.split(/[?#]/)[0]` is dead code: `String.prototype.split` always returns an array with at least one element (the original string when there is no match), so `[0]` is always a defined string and the fallback is unreachable. This is harmless but misleading — a reader may assume the fallback guards an empty result. Simplify to `const path = raw.split(/[?#]/)[0];` to keep the intent clear. (The rest of the normalization — query/fragment stripping, leading-slash check, and trailing-slash collapse — correctly implements the one-page-is-one-row goal.)</comment>

<file context>
@@ -154,6 +154,18 @@ export function normalizeHost(input: string | null | undefined): string | null {
+	const raw = input?.trim();
+	if (!raw) return "/";
+
+	const path = raw.split(/[?#]/)[0] ?? "/";
+	if (!path.startsWith("/")) return "/";
+
</file context>

[cubic-dev-ai]

3 issues found across 26 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/api/src/tracking/tracking-config.service.ts">

<violation number="1" location="apps/api/src/tracking/tracking-config.service.ts:27">
P1: Tracking changes can be undone in the shared cache when API replicas race: this process-local generation does not protect Redis writes from another replica. Use a shared/atomic config version (or distributed lock/CAS) before accepting a cache write, so paused, rotated, or domain-restricted config cannot be replaced with stale data for the TTL.</violation>
</file>

<file name="packages/db/src/attribution.ts">

<violation number="1" location="packages/db/src/attribution.ts:222">
P2: Referrers such as `google.com.example` are classified as trusted Google organic traffic because any `com.<label>` tail is accepted as a suffix. Use a Public Suffix List-based registrable-domain check (or a verified suffix mapping) so lookalike domains remain referrals.</violation>
</file>

<file name="apps/api/src/tracking/tracking-ingest.service.ts">

<violation number="1" location="apps/api/src/tracking/tracking-ingest.service.ts:212">
P2: Concurrent duplicate deliveries can consume multiple hourly-contact cap slots and race contact creation because both see the unfiled row and call `file()` before either `attach()` claims it. Claim the submission (or add an in-progress state) atomically before filing, while retaining a recoverable retry path for interrupted filings.</violation>
</file>

<sub>Tip: instead of fixing issues one by one fix them all with cubic
Tip: Review your code locally with the cubic CLI to iterate faster.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Tracking changes can be undone in the shared cache when API replicas race: this process-local generation does not protect Redis writes from another replica. Use a shared/atomic config version (or distributed lock/CAS) before accepting a cache write, so paused, rotated, or domain-restricted config cannot be replaced with stale data for the TTL.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/tracking/tracking-config.service.ts, line 27:

<comment>Tracking changes can be undone in the shared cache when API replicas race: this process-local generation does not protect Redis writes from another replica. Use a shared/atomic config version (or distributed lock/CAS) before accepting a cache write, so paused, rotated, or domain-restricted config cannot be replaced with stale data for the TTL.</comment>

<file context>
@@ -24,6 +24,8 @@ export interface CompiledConfig {
 export class TrackingConfigService {
 	private readonly logger = new Logger(TrackingConfigService.name);
 
+	private generation = 0;
+
 	constructor(
</file context>

[cubic-dev-ai]

P2: Referrers such as google.com.example are classified as trusted Google organic traffic because any com.<label> tail is accepted as a suffix. Use a Public Suffix List-based registrable-domain check (or a verified suffix mapping) so lookalike domains remain referrals.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At packages/db/src/attribution.ts, line 222:

<comment>Referrers such as `google.com.example` are classified as trusted Google organic traffic because any `com.<label>` tail is accepted as a suffix. Use a Public Suffix List-based registrable-domain check (or a verified suffix mapping) so lookalike domains remain referrals.</comment>

<file context>
@@ -177,13 +190,38 @@ function mediumFrom(value: string | null | undefined): Medium {
+	if (tail.length === 1) return true;
+	if (tail.length !== 2) return false;
+
+	return SECOND_LEVEL.has(tail[0] ?? "");
+}
+
</file context>

[cubic-dev-ai]

P2: Concurrent duplicate deliveries can consume multiple hourly-contact cap slots and race contact creation because both see the unfiled row and call file() before either attach() claims it. Claim the submission (or add an in-progress state) atomically before filing, while retaining a recoverable retry path for interrupted filings.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At apps/api/src/tracking/tracking-ingest.service.ts, line 212:

<comment>Concurrent duplicate deliveries can consume multiple hourly-contact cap slots and race contact creation because both see the unfiled row and call `file()` before either `attach()` claims it. Claim the submission (or add an in-progress state) atomically before filing, while retaining a recoverable retry path for interrupted filings.</comment>

<file context>
@@ -164,20 +197,19 @@ export class TrackingIngestService {
 		});
 
 		if (!submission) return;
+		if (created.count === 0 && !unfiled(submission)) return;
 
 		const outcome = await this.filing.file({
</file context>