feat: ga gtm integration (#75)

.env.example

@@ -1,12 +1,50 @@
 VITE_SUPPORT_API_BASE_URL=
 
+# -----------------------------------------------------------------------------
+# Sentry — error monitoring (see docs/sentry-setup.md)
+# One project, one DSN; VITE_SENTRY_ENVIRONMENT separates dev/prod in the dashboard.
+# -----------------------------------------------------------------------------
+
+# Runtime (browser) — required in every deployed environment
+# Leave empty locally to disable Sentry.
+# Example: https://<public-key>@o<org-id>.ingest.sentry.io/<project-id>
+VITE_SENTRY_DSN=
+# Environment label shown in Sentry: local | dev | production
+VITE_SENTRY_ENVIRONMENT=local
+# Set to the git SHA at build time (injected automatically by the deploy workflow).
+VITE_SENTRY_RELEASE=
+
+# Build-time only — used by @sentry/vite-plugin to upload source maps.
+# Not embedded in the browser bundle. Leave empty to skip source map upload locally.
+# Example: <sentry-auth-token> / <sentry-org-slug> / <sentry-project-slug>
+SENTRY_AUTH_TOKEN=
+SENTRY_ORG=
+SENTRY_PROJECT=
+
+# -----------------------------------------------------------------------------
+# Analytics (GA4 + GTM) — see docs/analytics-setup.md
+#
+# Local dev: leave both empty to disable tracking (recommended).
+# To test against the dev stack locally, set VITE_GTM_CONTAINER_ID to your dev GTM container.
+#
+# Deployed builds use GitHub secrets that map to these same Vite vars at build time:
+#   trustvc.io      → VITE_GTM_CONTAINER_ID_PRODUCTION / VITE_GA4_TAG_ID_PRODUCTION
+#   dev.trustvc.io  → VITE_GTM_CONTAINER_ID_DEVELOPMENT / VITE_GA4_TAG_ID_DEVELOPMENT
+#
+# GTM-only is recommended: set VITE_GTM_CONTAINER_ID, leave VITE_GA4_TAG_ID empty.
+# Setting both to the same GA4 property double-counts events.
+VITE_GTM_CONTAINER_ID=
+VITE_GA4_TAG_ID=
+
 # reCAPTCHA: site key (frontend).
 # Must match API secret key server-side.
 # In production, this must be set; do not allow verification bypass when missing.
 VITE_RECAPTCHA_SITE_KEY=
 
-# Optional: platform/environment for Jira (e.g. dev, staging, prod). Default: dev
-VITE_PLATFORM=dev
+# Platform label sent on every analytics event (environment dimension).
+# Deployed builds: set automatically by deploy-prod.yml (production) / deploy-dev.yml (dev).
+# Local dev only — use local (default when unset):
+VITE_PLATFORM=local
 
 VITE_MAGIC_API_KEY=
 VITE_NETWORK_TYPE=mainnet

.github/workflows/ci.yml

@@ -42,3 +42,7 @@ jobs:
         env:
           VITE_RPC_URL_1: ${{ secrets.VITE_RPC_URL_1 }}
           VITE_RPC_URL_101010: ${{ secrets.VITE_RPC_URL_101010 }}
+          # Analytics disabled in CI — matches local .env.example defaults
+          VITE_GTM_CONTAINER_ID: ''
+          VITE_GA4_TAG_ID: ''
+          VITE_PLATFORM: local

.github/workflows/deploy-dev.yml

@@ -39,6 +39,12 @@ jobs:
       AWS_REGION: ap-southeast-1
       S3_BUCKET: ${{ secrets.S3_BUCKET_DEV }}
       ENV_FILE: ${{ secrets.TRUSTVC_WEB_ENV_DEVELOPMENT }}
+      VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+      VITE_SENTRY_ENVIRONMENT: dev
+      VITE_SENTRY_RELEASE: ${{ github.sha }}
+      VITE_GTM_CONTAINER_ID: ${{ secrets.VITE_GTM_CONTAINER_ID_DEVELOPMENT }}
+      VITE_GA4_TAG_ID: ${{ secrets.VITE_GA4_TAG_ID_DEVELOPMENT }}
+      VITE_PLATFORM: dev
 
     steps:
       - name: Checkout code
@@ -54,13 +60,30 @@ jobs:
           cache-dependency-path: package-lock.json
 
       - name: Create .env for build
-        run: printf '%s' "$ENV_FILE" > .env
+        run: |
+          printf '%s\n' "$ENV_FILE" \
+            | grep -v '^VITE_SENTRY_DSN=' \
+            | grep -v '^VITE_SENTRY_ENVIRONMENT=' \
+            | grep -v '^VITE_SENTRY_RELEASE=' \
+            | grep -v '^VITE_GTM_CONTAINER_ID=' \
+            | grep -v '^VITE_GA4_TAG_ID=' \
+            | grep -v '^VITE_PLATFORM=' > .env
+          echo "VITE_GTM_CONTAINER_ID=${VITE_GTM_CONTAINER_ID}" >> .env
+          echo "VITE_GA4_TAG_ID=${VITE_GA4_TAG_ID}" >> .env
+          echo "VITE_PLATFORM=${VITE_PLATFORM}" >> .env
+          echo "VITE_SENTRY_DSN=${VITE_SENTRY_DSN}" >> .env
+          echo "VITE_SENTRY_ENVIRONMENT=${VITE_SENTRY_ENVIRONMENT}" >> .env
+          echo "VITE_SENTRY_RELEASE=${VITE_SENTRY_RELEASE}" >> .env
 
       - name: Install dependencies
         run: npm ci
 
       - name: Build
         run: npm run build
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
 
       - name: Upload build artifact (Dev)
         uses: actions/upload-artifact@v4

.github/workflows/deploy-prod.yml

@@ -18,6 +18,12 @@ jobs:
       S3_BUCKET: ${{ secrets.S3_BUCKET_PROD }}
       CF_DISTRIBUTION: ${{ secrets.CLOUDFRONT_DISTRIBUTION_ID_PROD }}
       ENV_FILE: ${{ secrets.TRUSTVC_WEB_ENV_PRODUCTION }}
+      VITE_SENTRY_DSN: ${{ secrets.VITE_SENTRY_DSN }}
+      VITE_SENTRY_ENVIRONMENT: production
+      VITE_SENTRY_RELEASE: ${{ github.sha }}
+      VITE_GTM_CONTAINER_ID: ${{ secrets.VITE_GTM_CONTAINER_ID_PRODUCTION }}
+      VITE_GA4_TAG_ID: ${{ secrets.VITE_GA4_TAG_ID_PRODUCTION }}
+      VITE_PLATFORM: production
 
     steps:
       - name: Checkout code
@@ -33,7 +39,20 @@ jobs:
           cache-dependency-path: package-lock.json
 
       - name: Create .env for build
-        run: printf '%s\n' "$ENV_FILE" > .env
+        run: |
+          printf '%s\n' "$ENV_FILE" \
+            | grep -v '^VITE_SENTRY_DSN=' \
+            | grep -v '^VITE_SENTRY_ENVIRONMENT=' \
+            | grep -v '^VITE_SENTRY_RELEASE=' \
+            | grep -v '^VITE_GTM_CONTAINER_ID=' \
+            | grep -v '^VITE_GA4_TAG_ID=' \
+            | grep -v '^VITE_PLATFORM=' > .env
+          echo "VITE_GTM_CONTAINER_ID=${VITE_GTM_CONTAINER_ID}" >> .env
+          echo "VITE_GA4_TAG_ID=${VITE_GA4_TAG_ID}" >> .env
+          echo "VITE_PLATFORM=${VITE_PLATFORM}" >> .env
+          echo "VITE_SENTRY_DSN=${VITE_SENTRY_DSN}" >> .env
+          echo "VITE_SENTRY_ENVIRONMENT=${VITE_SENTRY_ENVIRONMENT}" >> .env
+          echo "VITE_SENTRY_RELEASE=${VITE_SENTRY_RELEASE}" >> .env
 
       - name: Install dependencies
         run: npm ci
@@ -43,6 +62,10 @@ jobs:
 
       - name: Build
         run: npm run build
+        env:
+          SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
+          SENTRY_ORG: ${{ secrets.SENTRY_ORG }}
+          SENTRY_PROJECT: ${{ secrets.SENTRY_PROJECT }}
 
       - name: Configure AWS credentials
         uses: aws-actions/configure-aws-credentials@v4

.github/workflows/e2e-verify.yml

@@ -50,6 +50,10 @@ jobs:
           VITE_APP_NETWORK: local
           VITE_NETWORK_TYPE: testnet
           VITE_RPC_URL_1337: http://127.0.0.1:8545
+          # Analytics disabled in E2E — no events sent to GA4/GTM during test runs
+          VITE_GTM_CONTAINER_ID: ''
+          VITE_GA4_TAG_ID: ''
+          VITE_PLATFORM: local
 
       - name: Wait for dev server
         run: npx wait-on http://localhost:5173 --timeout 180000

.github/workflows/e2e.yml

@@ -48,6 +48,10 @@ jobs:
           VITE_RPC_URL_1337: http://127.0.0.1:8545
           VITE_RPC_URL_80002: https://rpc-amoy.polygon.technology/
           VITE_RPC_URL_137: https://rpc.ankr.com/polygon
+          # Analytics disabled in E2E — no events sent to GA4/GTM during test runs
+          VITE_GTM_CONTAINER_ID: ''
+          VITE_GA4_TAG_ID: ''
+          VITE_PLATFORM: local
 
       - name: Wait for dev server
         run: npx wait-on http://localhost:5173 --timeout 180000

index.html

@@ -7,6 +7,15 @@
     <title>TrustVC</title>
   </head>
   <body>
+    <!-- GTM noscript fallback: must be static HTML so it works before JS runs -->
+    <noscript
+      ><iframe
+        src="https://www.googletagmanager.com/ns.html?id=%VITE_GTM_CONTAINER_ID%"
+        height="0"
+        width="0"
+        style="display:none;visibility:hidden"
+      ></iframe
+    ></noscript>
     <div id="root"></div>
     <script type="module" src="/src/main.tsx"></script>
   </body>