From cf77980fa23bddf5e78b6fcfc051500b4c066c0d Mon Sep 17 00:00:00 2001
From: Anton Burnashev <anton.burnashev@gmail.com>
Date: Tue, 30 Jun 2026 18:06:53 +0200
Subject: [PATCH] chore(release): load PostHog key from .make.env and make make
 check it

---
 .gitignore      |  3 +++
 CONTRIBUTING.md |  4 ++++
 Makefile        | 13 +++++++++++--
 3 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/.gitignore b/.gitignore
index 4f145b0..7cd8697 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,3 +12,6 @@ build/
 examples/
 
 src/dlthub_init/_telemetry_key.py
+
+# Local release secrets loaded by the Makefile (e.g. DLTHUB_INIT_POSTHOG_KEY)
+.make.env
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f098f39..0a73581 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -88,6 +88,10 @@ DLTHUB_INIT_POSTHOG_HOST=https://eu.i.posthog.com \
   uv run dlthub-init my-workspace --yes
 ```
 
+For releases, put the real key in a gitignored `.make.env`
+(`DLTHUB_INIT_POSTHOG_KEY=phc_…`); the Makefile loads it into `uv build`, and
+`make publish` refuses to run without it.
+
 ## Code style
 
 Write self-explanatory code. Do not add comments that narrate what the code
diff --git a/Makefile b/Makefile
index 85a3d7a..d8b888e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,10 +1,13 @@
 .DEFAULT_GOAL := help
 
-.PHONY: help dev lint lint-fix format format-check fl lint-ci test test-integration build clean-dist version-upgrade version-upgrade-patch version-upgrade-minor version-upgrade-major publish ci lock-upgrade lock-check scaffold-lock-upgrade scaffold-lock-check generate-skills update-skills check-skills workspace workspace-init
+.PHONY: help dev lint lint-fix format format-check fl lint-ci test test-integration build clean-dist version-upgrade version-upgrade-patch version-upgrade-minor version-upgrade-major require-posthog-key publish ci lock-upgrade lock-check scaffold-lock-upgrade scaffold-lock-check generate-skills update-skills check-skills workspace workspace-init
 
 PYTHON_SOURCES := src tests tests_integration scripts
 SCAFFOLD_DIR ?= src/dlthub_init/scaffolds/minimal_workspace
 
+-include .make.env
+export DLTHUB_INIT_POSTHOG_KEY
+
 help: ## Show this help message
 	@echo "Available targets:"
 	@grep -E '^[a-zA-Z0-9_.-]+:.*?## .*$$' $(MAKEFILE_LIST) \
@@ -89,7 +92,13 @@ version-upgrade-minor: ## Bump the minor version non-interactively (AI/CI-friend
 version-upgrade-major: ## Bump the major version non-interactively (AI/CI-friendly)
 	@$(MAKE) version-upgrade LEVEL=major
 
-publish: clean-dist build ## Build and publish dlthub-init to PyPI
+require-posthog-key:
+	@case "$(DLTHUB_INIT_POSTHOG_KEY)" in \
+		phc_*) ;; \
+		*) echo "publish: DLTHUB_INIT_POSTHOG_KEY not set (or not a phc_ key) — add it to .make.env"; exit 1;; \
+	esac
+
+publish: require-posthog-key clean-dist build ## Build and publish dlthub-init to PyPI
 	ls -l dist/
 	@bash -c 'read -s -p "Enter PyPI API token: " PYPI_API_TOKEN; echo; \
 	uv publish --token "$$PYPI_API_TOKEN"'