From 407b0be85c5209f07eb8beb84ade8f07fffd9f29 Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Sat, 25 Jul 2026 06:32:41 -0700
Subject: [PATCH 1/2] fix(selfhost): unset POSTHOG_CLI_HOST when blank, don't
 pass empty

posthog-cli treats a present-but-empty POSTHOG_CLI_HOST as an explicit
(invalid) URL rather than "unset, use the default" -- confirmed live:
orb-v3.4.0-beta.8's release build failed with `Oops! Invalid Host: "Host
must be a valid URL"` because the workflow always sets the env var to
`secrets.POSTHOG_CLI_HOST`, which resolves to an empty string (not an
absent var) when the secret doesn't exist. Mirrors the old SENTRY_URL
handling this replaced (`if [ -z "${SENTRY_URL:-}" ]; then unset
SENTRY_URL; fi`). scripts/deploy-selfhost-prebuilt.sh's own
${host:+-e POSTHOG_CLI_HOST=...} already avoided this correctly.
---
 .github/workflows/release-selfhost.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release-selfhost.yml b/.github/workflows/release-selfhost.yml
index 791937d9e3..a7e857996d 100644
--- a/.github/workflows/release-selfhost.yml
+++ b/.github/workflows/release-selfhost.yml
@@ -166,6 +166,10 @@ jobs:
           set -euo pipefail
           test -n "$POSTHOG_CLI_API_KEY"
           test -n "$POSTHOG_CLI_PROJECT_ID"
+          # posthog-cli treats a PRESENT-but-empty POSTHOG_CLI_HOST as an explicit (invalid) URL, not as
+          # "unset, use the default" -- unset it outright when blank, mirroring the old SENTRY_URL handling
+          # this replaced.
+          if [ -z "${POSTHOG_CLI_HOST:-}" ]; then unset POSTHOG_CLI_HOST; fi
           # No separate "create release" step -- PostHog release metadata is a byproduct of the inject/
           # upload calls below, unlike Sentry's releases/commits/deploys/finalize lifecycle this replaces.
           npx -y "$POSTHOG_CLI_PACKAGE" sourcemap inject --directory dist --release-version "$POSTHOG_RELEASE"
@@ -259,6 +263,7 @@ jobs:
           POSTHOG_RELEASE: ${{ steps.version.outputs.release }}
         run: |
           set -euo pipefail
+          if [ -z "${POSTHOG_CLI_HOST:-}" ]; then unset POSTHOG_CLI_HOST; fi
           # PostHog's release-read path can lag briefly behind the upload write above.
           # review-enrichment/src/upload-sourcemaps.ts's runReleaseValidation() already retry-polls this
           # same script for REES's own deploy path -- mirror that here instead of failing the whole

From 35aca7befc508d007364ca5ad52754bb3e712bbb Mon Sep 17 00:00:00 2001
From: JSONbored <49853598+JSONbored@users.noreply.github.com>
Date: Sat, 25 Jul 2026 07:21:18 -0700
Subject: [PATCH 2/2] fix(selfhost): reword comment to stop tripping the
 SENTRY_ drift guard

The previous commit's own comment named the old SENTRY_URL var literally,
which trips this file's own docs-selfhost-posthog-release.test.ts
assertion (not.toContain("SENTRY_")) added when Sentry was removed from
this pipeline. Same guard, reworded without the literal substring.
---
 .github/workflows/release-selfhost.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release-selfhost.yml b/.github/workflows/release-selfhost.yml
index a7e857996d..8aa9f744cc 100644
--- a/.github/workflows/release-selfhost.yml
+++ b/.github/workflows/release-selfhost.yml
@@ -167,8 +167,8 @@ jobs:
           test -n "$POSTHOG_CLI_API_KEY"
           test -n "$POSTHOG_CLI_PROJECT_ID"
           # posthog-cli treats a PRESENT-but-empty POSTHOG_CLI_HOST as an explicit (invalid) URL, not as
-          # "unset, use the default" -- unset it outright when blank, mirroring the old SENTRY_URL handling
-          # this replaced.
+          # "unset, use the default" -- unset it outright when blank, same guard this pipeline's old
+          # Sentry-org-URL override once needed for the identical reason.
           if [ -z "${POSTHOG_CLI_HOST:-}" ]; then unset POSTHOG_CLI_HOST; fi
           # No separate "create release" step -- PostHog release metadata is a byproduct of the inject/
           # upload calls below, unlike Sentry's releases/commits/deploys/finalize lifecycle this replaces.