[CI] (6b2dc8b) swift/hackers-ios

[wizard-ci-bot]

Automated wizard CI run

Source: wizard-pr
Trigger ID: 6b2dc8b
App: swift/hackers-ios
App directory: apps/swift/hackers-ios
Workbench branch: wizard-ci-6b2dc8b-swift-hackers-ios
Wizard branch: release-please--branches--main--components--wizard
Context Mill branch: main
PostHog (MCP) branch: master
Timestamp: 2026-09-01T16:10:15.227Z
Duration: 798.7s

YARA Scanner

✓ 169 tool calls scanned, 0 violations detected

No violations: ✓ 169 clean scans

[wizard-ci-bot]

Now I have all the context I need. Let me write the evaluation.

---

PR Evaluation Report

Summary

This PR integrates PostHog into a Swift/UIKit iOS app (Hackers for Hacker News) by adding the posthog-ios SDK via SPM, initializing it in AppDelegate, capturing six custom events across navigation and auth flows, and enabling error auto-capture. The API key is loaded via an .env xcconfig file piped through INFOPLIST_KEY_* build settings, with a ProcessInfo.processInfo.environment fallback for debug builds.

Files changed	Lines added	Lines removed
7	+86	-2

Confidence score: 4/5 👍

• No identify() call after login: The app authenticates users via sessionService.authenticate() but never calls PostHogSDK.shared.identify(), so all events remain anonymous and cannot be attributed to specific users. [CRITICAL]
• No reset() call on logout: sessionService.unauthenticate() is called but PostHogSDK.shared.reset() is never called, so a subsequent user on the same device inherits the previous user's anonymous ID. [CRITICAL]
• .env.example uses # comments — invalid xcconfig syntax: The .env file is used as baseConfigurationReference (xcconfig) in the pbxproj, but the .env.example template uses # comments. Xcconfig files only support // comments; # lines are interpreted as C preprocessor directives and will cause build warnings or errors when copied to .env. [MEDIUM]

---

File changes

Filename	Score	Description
App/AppDelegate.swift	3/5	PostHog initialization with env var + Info.plist fallback; error tracking enabled; missing identify integration
App/ContentView.swift	3/5	login_succeeded and logout_completed capture calls added but no identify()/reset() alongside them
App/NavigationStore.swift	4/5	post_opened, login_presented, settings_opened captures with properties on post events
App/OnboardingCoordinator.swift	4/5	onboarding_completed capture on dismiss
Hackers.xcodeproj/project.pbxproj	4/5	SPM dependency correctly added with three required objects; xcconfig base config reference added
Package.resolved	5/5	Resolved to posthog-ios 3.71.0
.env.example	3/5	Documents required env vars but uses invalid xcconfig comment syntax

---

App sanity check ⚠️

Criteria	Result	Description
App builds and runs	Yes	Valid Swift syntax, SPM dependency resolves, app should build (missing .env file produces a warning but doesn't block compilation)
Preserves existing env vars & configs	Yes	No existing code or configs modified destructively; configurePostHog() called before existing URL cache setup
No syntax or type errors	Yes	All Swift code is syntactically valid
Correct imports/exports	Yes	import PostHog used correctly in all files
Minimal, focused changes	Yes	Only PostHog-related additions; Foundation import reorder in ContentView is trivial alphabetical sort
Pre-existing issues	None	—

Issues

• .env.example uses invalid xcconfig comment syntax: The .env file is set as baseConfigurationReference in the pbxproj (i.e., treated as an xcconfig file). The .env.example template uses # comment syntax, but xcconfig files only support // comments. Copying .env.example to .env will cause Xcode build warnings or preprocessor errors. The template should use // comment syntax instead. [MEDIUM]
• INFOPLIST_KEY_ for custom keys without GENERATE_INFOPLIST_FILE: The PR adds INFOPLIST_KEY_POSTHOG_HOST and INFOPLIST_KEY_POSTHOG_PROJECT_TOKEN build settings, expecting them to be injected into Info.plist at build time. However, GENERATE_INFOPLIST_FILE is not set in this project (it uses a traditional INFOPLIST_FILE). While modern Xcode versions may merge these for custom keys, this is a non-standard pattern that may silently fail, causing PostHog to not initialize in production (the #else return branch). [MEDIUM]

Other completed criteria

• Environment variables documented in .env.example
• Build configuration valid — SPM dependency correctly declared with PBXBuildFile, XCSwiftPackageProductDependency, and XCRemoteSwiftPackageReference
• No XcodeGen project.yml found, so direct pbxproj edits are appropriate

---

PostHog implementation ⚠️

Criteria	Result	Description
PostHog SDKs installed	Yes	posthog-ios added via SPM (minimum 3.59.3, resolved to 3.71.0) with correct pbxproj objects
PostHog client initialized	Yes	PostHogConfig(projectToken:host:) with PostHogSDK.shared.setup(config) in AppDelegate.application(_:didFinishLaunchingWithOptions:)
capture()	Yes	Six meaningful capture calls: login_succeeded, logout_completed, post_opened, login_presented, settings_opened, onboarding_completed
identify()	No	No PostHogSDK.shared.identify() call after user authentication; no PostHogSDK.shared.reset() on logout
Error tracking	Yes	config.errorTrackingConfig.autoCapture = true enables automatic exception capture
Reverse proxy	N/A	iOS native app — reverse proxy only applies to posthog-js in browsers

Issues

• Missing identify() after login: The app has authentication (sessionService.authenticate()) but never calls PostHogSDK.shared.identify() with the user's ID. All events remain anonymous and cannot be attributed to specific users. The login_succeeded capture should be followed by an identify call using the authenticated user's ID (e.g., PostHogSDK.shared.identify(userId, userProperties: ["email": email])). [CRITICAL]
• Missing reset() on logout: sessionService.unauthenticate() is called but PostHogSDK.shared.reset() is never invoked. Without reset, the next user on the same device inherits the previous user's anonymous/distinct ID, causing data pollution. [CRITICAL]
• API key not hardcoded per iOS best practice: Per PostHog iOS docs, the project token is a public client-side key safe to ship in the binary, and hardcoding is the recommended approach. The PR instead relies on .env xcconfig → INFOPLIST_KEY_* → Bundle.main.object(forInfoDictionaryKey:), which is fragile (depends on proper .env setup, and ProcessInfo.processInfo.environment primary check only works in Xcode debug runs). [LOW]

Other completed criteria

• PostHog host correctly configurable via same env/Info.plist mechanism
• Screen views autocaptured by default (captureScreenViews defaults to true in iOS SDK)
• Error tracking properly enabled with autoCapture
• SDK installed with all three required pbxproj objects (PBXBuildFile, XCSwiftPackageProductDependency, XCRemoteSwiftPackageReference)

---

PostHog insights and events ⚠️

Filename	PostHog events	Description
AppDelegate.swift	errorTrackingConfig.autoCapture	Automatic exception/crash capture enabled
ContentView.swift	login_succeeded, logout_completed	Captures auth flow events (3 login + 3 logout locations for different UI layouts)
NavigationStore.swift	post_opened, login_presented, settings_opened	Navigation events; post_opened includes post_id property
OnboardingCoordinator.swift	onboarding_completed	Tracks when user finishes onboarding

Issues

• Most events lack contextual properties: Only post_opened includes enriched properties (post_id). Events like login_succeeded (could include auth method), logout_completed (could include session duration), settings_opened (could include current tab), and onboarding_completed (could include step count or time spent) are bare captures with no properties, limiting analytical value. [MEDIUM]

Other completed criteria

• Events represent real user actions (login, logout, post viewing, settings, onboarding)
• Events enable product insights (login→post funnel, onboarding completion rate, settings engagement)
• No PII in event properties
• Event naming is consistent snake_case with descriptive [object]_[verb] format

---

Reviewed by wizard workbench PR evaluator