feat(runner): self-hosted observability on Cloudflare (ADR-0041, ADR-0042)

.github/workflows/ci.yml

@@ -43,15 +43,18 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
         with:
           # The gate diffs the PR range against its base — it needs history,
           # not just the merge commit.
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
+          # setup-node v5 auto-enables pnpm caching from the root package.json
+          # `packageManager` field; this job never installs pnpm.
+          package-manager-cache: false
 
       - name: Test-presence gate (source change ⇒ test change)
         run: node runner/scripts/check-test-presence.mjs "${{ github.base_ref }}"
@@ -62,13 +65,13 @@ jobs:
       run:
         working-directory: runner
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: runner/package.json
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: pnpm
@@ -86,15 +89,15 @@ jobs:
       run:
         working-directory: runner
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       # Read the pnpm version from runner/package.json's packageManager field
       # (avoids a conflict with the repo-root package.json).
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: runner/package.json
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: pnpm
@@ -110,7 +113,7 @@ jobs:
         run: pnpm typecheck
 
       - name: Upload the runtime build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: runtime-dist
           path: runner/packages/runtime/dist/
@@ -124,13 +127,13 @@ jobs:
       run:
         working-directory: runner
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: runner/package.json
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: pnpm
@@ -139,7 +142,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Download the runtime build
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: runtime-dist
           path: runner/packages/runtime/dist/
@@ -155,7 +158,7 @@ jobs:
         run: node scripts/check-compiler-chunk.mjs
 
       - name: Upload the authoring build
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: authoring-dist
           path: runner/apps/authoring/dist/
@@ -176,13 +179,13 @@ jobs:
       run:
         working-directory: runner
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v5
         with:
           package_json_file: runner/package.json
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           cache: pnpm
@@ -191,7 +194,7 @@ jobs:
       - run: pnpm install --frozen-lockfile
 
       - name: Download the authoring build (the e2e target)
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: authoring-dist
           path: runner/apps/authoring/dist/
@@ -201,7 +204,7 @@ jobs:
 
       - name: Upload Playwright report on failure
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: playwright-report
           # playwright-report/ holds the html report, test-results/ the traces.
@@ -210,3 +213,111 @@ jobs:
             runner/test-results/
           retention-days: 7
           if-no-files-found: warn
+
+  # The CI home for the local telemetry path (contract §10). Its own build,
+  # separate from the `authoring`/`e2e` jobs above — VITE_TELEMETRY_LOCAL=1
+  # must never reach the real authoring-dist artifact those jobs share (the
+  # post-build leak check in master.yml exists to catch that), so this job
+  # builds its own dist and never uploads it. Both specs are self-contained
+  # (own preview server, `page.route` interception of `/telemetry/collect`,
+  # no o11y or API worker), unlike e2e/telemetry-metrics.spec.ts and
+  # e2e/o11y-local.spec.ts, which need a live worker/compose stack and run
+  # instead in `.github/workflows/e2e-o11y-local.yml`, off the per-PR gate.
+  e2e-telemetry:
+    needs: build
+    runs-on: ubuntu-latest
+    container:
+      image: mcr.microsoft.com/playwright:v1.61.1-noble
+    defaults:
+      run:
+        working-directory: runner
+    steps:
+      - uses: actions/checkout@v5
+
+      # The leak checks now run in PR CI as well as post-merge in master.yml,
+      # so a regression here (dead-code elimination of the local telemetry
+      # seam, or the dev-login bypass sentinel check itself) is caught before
+      # merge instead of surfacing as a blocked deploy. actionlint runs here
+      # too, so a workflow-YAML mistake in either fix is itself caught in PR
+      # CI, not just by reading the diff.
+      - name: actionlint (workflow YAML)
+        uses: reviewdog/action-actionlint@v1
+        with:
+          fail_level: error
+
+      - uses: pnpm/action-setup@v5
+        with:
+          package_json_file: runner/package.json
+
+      - uses: actions/setup-node@v5
+        with:
+          node-version: 22
+          cache: pnpm
+          cache-dependency-path: runner/pnpm-lock.yaml
+
+      - run: pnpm install --frozen-lockfile
+
+      - name: Download the runtime build
+        uses: actions/download-artifact@v7
+        with:
+          name: runtime-dist
+          path: runner/packages/runtime/dist/
+
+      # Production-mode build (no VITE_TELEMETRY_LOCAL) — the same shape
+      # master.yml's `build` job ships, built here too so both leak checks
+      # run in PR CI, not only after merge.
+      - name: Build authoring in production mode
+        run: pnpm --filter @handsontable/demo-authoring build
+
+      # Same check as master.yml's "Leak check — dev-login bypass must not
+      # reach the production bundle" step (AGENTS.md's own sanity check),
+      # now also gating the PR instead of only a post-merge deploy.
+      - name: Leak check — dev-login bypass must not reach the production bundle
+        run: |
+          if grep -rl "localhost:8787\|VITE_DEV_USER\|dev@handsontable.com" apps/authoring/dist; then
+            echo "::error::dev-login bypass leaked into the production bundle — rebuild with .env.local absent (AGENTS.md)"
+            exit 1
+          fi
+          echo "ok: no dev-bypass sentinel found"
+
+      # Same check as master.yml's "Leak check — local telemetry path must
+      # not reach the production bundle" step (contract §10).
+      - name: Leak check — local telemetry path must not reach the production bundle
+        run: pnpm check:telemetry-leak
+
+      - name: Build authoring with the local telemetry path (contract §10)
+        run: pnpm --filter @handsontable/demo-authoring build
+        env:
+          VITE_TELEMETRY_LOCAL: '1'
+
+      # Negative control: nothing in CI otherwise proves `check:telemetry-leak`
+      # can actually FAIL — only that it passes against builds where the
+      # sentinels are already absent. Assert it fails against a build made
+      # WITH the local telemetry path enabled; if the checker itself
+      # regresses (a
+      # dead-code-elimination change, a sentinel string edit) and stops
+      # detecting the leak, this step turns red instead of the check quietly
+      # passing everything forever.
+      - name: Leak check negative control — check:telemetry-leak must FAIL against a VITE_TELEMETRY_LOCAL=1 build
+        run: |
+          if pnpm check:telemetry-leak; then
+            echo "::error::check:telemetry-leak passed against a VITE_TELEMETRY_LOCAL=1 build — the leak check itself is broken"
+            exit 1
+          fi
+          echo "ok: check:telemetry-leak correctly failed against the flag build"
+
+      - name: E2E — Faro in the authoring app + example-analytics (T06, T12)
+        env:
+          E2E_TELEMETRY: '1'
+        run: pnpm e2e e2e/telemetry-faro.spec.ts e2e/example-analytics.spec.ts
+
+      - name: Upload Playwright report on failure
+        if: failure()
+        uses: actions/upload-artifact@v6
+        with:
+          name: playwright-report-telemetry
+          path: |
+            runner/playwright-report/
+            runner/test-results/
+          retention-days: 7
+          if-no-files-found: warn

.github/workflows/e2e-live.yml

@@ -220,6 +220,33 @@ jobs:
           E2E_BASE_URL: ${{ env.BASE_URL }}
         run: pnpm e2e e2e/ai-live.spec.ts
 
+      # A syntax error typed into a Tier-1 parcel example must reach
+      # /telemetry/collect as one `sandpack.compile_error` and no
+      # `preview.runtime_error`; a typed throwing line as one
+      # `preview.runtime_error`. Needs a VITE_TELEMETRY_LOCAL=1 build (the
+      # spec's own E2E_TELEMETRY gate, `page.route`-mocked collect) AND the
+      # hosted bundler (E2E_LIVE: the edit path needs a mounted Sandpack
+      # client), so it lives here rather than in ci.yml's deterministic
+      # e2e-telemetry job. Local mode only, and last: it rebuilds dist with
+      # the flag, then puts the plain build back. E2E_BASE_URL is a dummy
+      # that only disables the shared webServer (the spec serves its own
+      # dist); the guard proves the gated test ran instead of skipping to a
+      # green exit.
+      - name: E2E — typed syntax and runtime errors count once each (local telemetry build)
+        if: ${{ !inputs.smoke && env.BASE_URL == '' }}
+        env:
+          E2E_LIVE: '1'
+          E2E_TELEMETRY: '1'
+          E2E_BASE_URL: 'http://127.0.0.1:1'
+          PLAYWRIGHT_JSON_OUTPUT_NAME: telemetry-compile-error-report.json
+        run: |
+          VITE_TELEMETRY_LOCAL=1 pnpm --filter @handsontable/demo-authoring build
+          status=0
+          pnpm e2e e2e/telemetry-faro.spec.ts -g "typed key by key reaches /telemetry/collect" --workers=1 --reporter=list,json || status=$?
+          pnpm --filter @handsontable/demo-authoring build
+          [ "$status" -eq 0 ] || exit $status
+          node scripts/ci/assert-e2e-ran.mjs telemetry-compile-error-report.json
+
       - name: Upload Playwright report on failure
         if: failure()
         uses: actions/upload-artifact@v4