Disable product telemetry in every workflow (#1709)

The first pass only covered the workflows that looked like they ran product
code and missed preview, deploy, pkg-pr-new and publish-executor-package, which
also invoke the CLI. Blacksmith runners kept reporting to the production
PostHog project after the fix merged.

Apply the opt-out at the top level of every workflow instead of guessing. The
variables are inert where the product is not executed.

Author: RhysSullivan

.github/workflows/deploy.yml

@@ -9,6 +9,16 @@ concurrency:
   group: deploy-production
   cancel-in-progress: false
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   migrate:
     name: Migrate database

.github/workflows/pkg-pr-new.yml

@@ -10,6 +10,16 @@ concurrency:
   group: pkg-pr-new-${{ github.event.pull_request.number }}
   cancel-in-progress: true
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   # Per-platform matrix: build the executor binary, tar it, upload to R2.
   # The wrapper npm package is built later by the `publish` job which just

.github/workflows/preview-sweep.yml

@@ -16,6 +16,16 @@ permissions:
   contents: read
   pull-requests: read
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   sweep:
     name: Destroy previews for closed PRs

.github/workflows/preview.yml

@@ -23,6 +23,16 @@ concurrency:
   group: preview-${{ github.event.pull_request.number }}
   cancel-in-progress: ${{ github.event.action != 'closed' }}
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   deploy:
     name: Deploy preview

.github/workflows/publish-executor-package.yml

@@ -21,6 +21,16 @@ concurrency:
   group: publish-executor-package-${{ github.ref }}
   cancel-in-progress: false
 
+# CI is not a user — see the note in ci.yml. Applied to every workflow rather
+# than the ones that look like they run product code: the first pass guessed,
+# missed preview/deploy/pkg-pr-new, and kept leaking. These vars are inert
+# where the product is not executed, so the blanket application is the cheap
+# structural answer.
+env:
+  DO_NOT_TRACK: "1"
+  EXECUTOR_DISABLE_ANALYTICS: "1"
+  EXECUTOR_DISABLE_INTEGRATIONS_FETCH: "1"
+
 jobs:
   publish:
     runs-on: ubuntu-latest