| name: Log Issue Events to Statsig | |
| on: | |
| issues: | |
| types: [opened, closed] | |
| jobs: | |
| log-to-statsig: | |
| runs-on: ubuntu-latest | |
| permissions: | |
| issues: read | |
| steps: | |
| - name: Log issue creation to Statsig | |
| env: | |
| STATSIG_API_KEY: ${{ secrets.STATSIG_API_KEY }} | |
| ISSUE_NUMBER: ${{ github.event.issue.number }} | |
| REPO: ${{ github.repository }} | |
| ISSUE_TITLE: ${{ github.event.issue.title }} | |
| AUTHOR: ${{ github.event.issue.user.login }} | |
| CREATED_AT: ${{ github.event.issue.created_at }} | |
| run: | | |
| # All values are now safely passed via environment variables | |
| # No direct templating in the shell script to prevent injection attacks | |
| curl -X POST "https://events.statsigapi.net/v1/log_event" \ | |
| -H "Content-Type: application/json" \ | |
| -H "statsig-api-key: $STATSIG_API_KEY" \ | |
| -d '{ | |
| "events": [{ | |
| "eventName": "github_issue_created", | |
| "metadata": { | |
| "issue_number": "'"$ISSUE_NUMBER"'", | |
| "repository": "'"$REPO"'", | |
| "title": "'"$(echo "$ISSUE_TITLE" | sed "s/\"/\\\\\"/g")"'", | |
| "author": "'"$AUTHOR"'", | |
| "created_at": "'"$CREATED_AT"'" | |
| }, | |
| "time": '"$(date +%s)000"' | |
| }] | |
| }' |