[CI] (e2f7ab0) swift/hackers-ios

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: e2f7ab0
App: swift/hackers-ios
App directory: apps/swift/hackers-ios
Workbench branch: wizard-ci-e2f7ab0-swift-hackers-ios
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-07-06T22:16:06.164Z
Duration: 263.6s

YARA Scanner

✓ 85 tool calls scanned, 0 violations detected

No violations: ✓ 85 clean scans

[wizard-ci-bot]

Now I have everything I need to produce the evaluation.

---

PR Evaluation Report

Summary

This PR integrates the PostHog iOS SDK into the Hackers (Hacker News client) iOS app via Swift Package Manager. It initializes PostHog in AppDelegate, adds 12 custom capture events across feed, comments, settings, and purchase flows, implements user identification on login/app launch, and calls reset() on logout.

Files changed	Lines added	Lines removed
9	+179	-4

Confidence score: 4/5 👍

• API key configuration will silently fail in production builds: The code reads the PostHog API key from ProcessInfo.processInfo.environment (Xcode scheme only — not available in Archive/Release builds) with a fallback to Info.plist which itself references `` build setting. If that build setting isn't populated (e.g., via xcconfig), the value resolves to an empty string, the guard fails, and PostHog silently does not initialize. Per iOS SDK guidelines, the project token is a public client-side key and should be hardcoded directly in code. [CRITICAL]
• No error tracking configured: The PR does not set up any error/exception tracking (e.g., errorTrackingConfig on PostHogConfig), missing a key PostHog capability. [MEDIUM]
• Redundant app_opened event: The PR manually captures app_opened while also enabling captureApplicationLifecycleEvents = true, which already auto-captures "Application Opened". This creates duplicate app-open tracking. [LOW]

---

File changes

Filename	Score	Description
App/AppDelegate.swift	3/5	Adds PostHog initialization with environment-based config that will fail in production; captures redundant app_opened event
App/Supporting Files/Hackers-Info.plist	3/5	Adds POSTHOG_API_KEY and POSTHOG_HOST entries referencing build settings
Features/Comments/Sources/Comments/CommentsView.swift	5/5	Adds well-structured comments_viewed and comment_thread_toggled events with rich properties
Features/Feed/Sources/Feed/FeedView.swift	5/5	Adds feed_viewed, post_opened, and bookmark_toggled events with contextual properties
Features/Settings/Sources/Settings/SettingsView.swift	5/5	Adds settings_viewed event on appear
Features/Settings/Sources/Settings/SupportViewModel.swift	5/5	Adds purchase funnel events (support_products_loaded, support_purchase_started, support_purchase_completed)
Hackers.xcodeproj/project.pbxproj	5/5	Correctly adds SPM dependency with all 3 required objects (PBXBuildFile, XCSwiftPackageProductDependency, XCRemoteSwiftPackageReference) at version 3.59.3
Shared/Sources/Shared/Session/SessionService.swift	4/5	Good identify on login and app init, proper reset on logout; uses username as distinct_id which is acceptable
posthog-setup-report.md	N/A	Setup report — not production code

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	SPM dependency correctly wired, syntax is valid Swift, imports resolve
Preserves existing env vars & configs	Yes	All existing code preserved; PostHog additions are additive
No syntax or type errors	Yes	Valid Swift syntax throughout
Correct imports/exports	Yes	import PostHog used correctly in all files
Minimal, focused changes	Yes	All changes relate to PostHog integration
Pre-existing issues	None	No pre-existing issues detected

Issues

• API key configuration fragile for production: The `` build setting must be manually configured via xcconfig or Xcode build settings — if omitted, PostHog silently fails to initialize. No documentation is provided for setting this up beyond a note in the setup report. [CRITICAL]
• debug = true hardcoded: config.debug = true is set unconditionally, which will produce verbose PostHog logs in production builds. Should be conditioned on #if DEBUG. [LOW]

Other completed criteria

• All changes are PostHog-related
• Existing app functionality preserved
• SPM build configuration is valid with correct repository URL and version

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-ios 3.59.3 added via SPM with correct PBXBuildFile, XCSwiftPackageProductDependency, and XCRemoteSwiftPackageReference
PostHog client initialized	No	Initialization guarded by environment/build-setting values that won't be present in production Archive builds unless manually configured. Per iOS guidelines, the token should be hardcoded in code
capture()	Yes	12 meaningful capture calls across app launch, feed, comments, settings, and purchase flows
identify()	Yes	Calls PostHogSDK.shared.identify(user.username) on login and on app init for returning users; calls reset() on logout
Error tracking	No	No error tracking configuration (e.g., errorTrackingConfig) set up
Reverse proxy	N/A	Not applicable for iOS mobile apps

Issues

• PostHog won't initialize in production builds: ProcessInfo.processInfo.environment is only injected when launching from Xcode. The Info.plist fallback uses `` which resolves from build settings — if not set via xcconfig, the API key is empty and PostHog returns nil config. The fix is to hardcode the project token directly: `PostHogConfig(apiKey: "phc_xxxx", host: "https://us.i.posthog.com")`. [CRITICAL]
• No error tracking: Error tracking is not configured. Add config.errorTrackingConfig.captureUncaughtExceptions = true (or equivalent) to enable crash/exception tracking. [MEDIUM]

Other completed criteria

• API host defaults to https://us.i.posthog.com correctly
• PostHogSDK.shared.reset() called on logout
• Identify called both on fresh login and returning user init
• Username used as distinct_id is a real identifier from the auth system

---

PostHog insights and events ✅

Filename	PostHog events	Description
AppDelegate.swift	app_opened	Redundant with auto-captured "Application Opened" lifecycle event
FeedView.swift	feed_viewed, post_opened, bookmark_toggled	Feed browsing funnel with feed type, post ID, destination, and sidebar context
CommentsView.swift	comments_viewed, comment_thread_toggled	Comment engagement tracking with post/comment IDs, levels, and collapse state
SettingsView.swift	settings_viewed	Settings access with auth state context
SupportViewModel.swift	support_products_loaded, support_purchase_started, support_purchase_completed	Full purchase funnel from product load through completion
SessionService.swift	login_succeeded, logout_completed	Auth lifecycle events; identify and reset called appropriately

Issues

• Redundant app_opened event: captureApplicationLifecycleEvents = true already captures "Application Opened". The manual app_opened creates duplication. Remove the manual capture or disable the lifecycle auto-capture. [LOW]

Other completed criteria

• Events represent real user actions (browsing, bookmarking, commenting, purchasing, authenticating)
• Events enable product insights — clear funnels: feed → post → comments; product load → purchase start → purchase complete; login → usage
• All events include contextual properties (post_id, feed_type, product_kind, etc.)
• No PII in event properties — username is set via person properties in identify(), not in capture() properties
• Consistent snake_case naming convention throughout

---

Reviewed by wizard workbench PR evaluator