fix(ci): scope the CLI telemetry token to the build and publish steps

[waleedlatif1]

Summary

• The publish job set SIM_CLI_TELEMETRY_KEY at job level, so the Run tests step inherited it. install.process.test.ts runs the real CLI (sim update) in a child process that inherits the environment, and the CLI reads the token at runtime, so every publish run sent fake cli_command_executed events (update, version 2.1.2, the test fixture's version) to production usage data
• Scope the token to the only two steps that build the bundle, following least-privilege step scoping: Build package and Publish to npm (whose prepublishOnly rebuild is what ships). Every other step, tests included, runs without it

Type of Change

• Bug fix

Testing

• Reproduced against a local capture server: the test step with the token sends 6 update events per run; without it, none
• Build step with the token: key baked into dist, no runtime env reads, sim telemetry status reports on; the smoke step (--version, no token) sends nothing; a rebuild without the token reports off, so publish still needs it
• actionlint, sim-cli suite without the token (10 consecutive runs), lint, check:audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Sep 18, 2026 8:07am UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge and preserves telemetry in the published CLI while preventing test commands from reporting production usage.

Summary

This PR limits the CLI telemetry configuration to the two steps that build distributable code.

• Removes the telemetry key and host from the publish job’s shared environment.
• Supplies them directly to the initial package build.
• Supplies them to the publish step so its prepublishOnly rebuild still produces the correctly configured artifact.
• Prevents tests and unrelated release steps from inheriting production telemetry configuration.

_{Reviews (1) · Last reviewed commit: "fix(ci): scope the CLI telemetry token t..."}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}