[rush reporter][R4] Harden reporter telemetry privacy projections

Open
#5,977 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
52/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
typescript
Domain
observability, security, testing-qa

Research direction

Start at TelemetrySubscriber.ingest() and trace the full telemetry projection, paying attention to fields derived from envelope source metadata. Locate the reporter telemetry tests and cover public, local-sensitive, and secret events; done means private producer identities are excluded while public aggregation remains deterministic and intact.

Written by the indexing model from the issue text.

Description

enhancement

Parent: #5858

Blocked by: #5976

Goal

Close the telemetry privacy follow-up identified during #5867 before reporter events are wired into uploaded Rush telemetry.

Context

Follow-up review: https://github.com/microsoft/rushstack/pull/5867#discussion_r3866455319

TelemetrySubscriber.ingest() currently records producer package identities for every envelope, including local-sensitive extension events. Private plugin identities must not leak into uploaded telemetry.

Scope

  • Collect producer identities only from public events, or introduce an explicit source-metadata allowlist/classification with equivalent protection.
  • Review the full telemetry projection for fields derived from non-public envelopes.
  • Add regression tests for public, local-sensitive, and secret events.

Acceptance criteria

  • Local-sensitive and secret extension events cannot contribute producer package names/versions to uploaded telemetry.
  • Public first-party producer/version aggregation remains intact.
  • The projection remains allowlisted and deterministic.

DAG

Runs in parallel with the demo stream work; gates R8 and R9.

Part of #5858.

Dominant language
TypeScript
Stars
6.5k
Forks
708
Avg merge
5d 19h
Merged PRs (30d)
48

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from microsoft/rushstack

All issues in microsoft/rushstack

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.