feat(linux): TablePro accounts and usage data

.github/workflows/core.yml

@@ -62,7 +62,8 @@ jobs:
         run: |
           cargo check --locked --target "$TARGET" --features "$FEATURES" --features "$IN_PROCESS_SSH" \
             -p tablepro-core -p tablepro-net -p tablepro-storage -p tablepro-ssh -p tablepro-session \
-            -p tablepro-foreign-import -p tablepro-ai -p tablepro-mcp -p tablepro-test-support -p tablepro-test-fixtures \
+            -p tablepro-foreign-import -p tablepro-ai -p tablepro-mcp -p tablepro-account \
+            -p tablepro-test-support -p tablepro-test-fixtures \
             -p tablepro-driver-cassandra -p tablepro-driver-clickhouse -p tablepro-driver-duckdb \
             -p tablepro-driver-mongodb -p tablepro-driver-mssql -p tablepro-driver-mysql \
             -p tablepro-driver-postgres -p tablepro-driver-redis -p tablepro-driver-sqlite
@@ -77,6 +78,9 @@ jobs:
           # The rest of net's tests read how Linux handles a full listen backlog.
           cargo test --locked --target "$TARGET" -p tablepro-net --lib -- loopback private_
           cargo test --locked --target "$TARGET" --features tablepro-ssh/in-process -p tablepro-ssh --lib in_process
+      # The sign-in's loopback listener and the token's file on each platform.
+      - name: Account unit tests
+        run: cargo test --locked --target "$TARGET" -p tablepro-account --lib
       - name: Start Windows' OpenSSH Server
         if: runner.os == 'Windows'
         shell: pwsh

.github/workflows/linux-packages.yml

@@ -21,6 +21,8 @@ name: Linux packages
 # A run by hand can add arm64, which the nightly and pull requests leave out.
 # Given a release tag, it packages that release's tarballs instead, with
 # the packaging from this checkout, for a PPA upload with a new revision.
+# Only release-linux.yml passes the PostHog key, so every other run builds
+# packages that send no usage data.
 
 on:
   pull_request:
@@ -80,6 +82,11 @@ on:
         description: The Flatpak branch, stable or beta.
         type: string
         default: stable
+      # Only a release's call passes it, so a run of this workflow on its own builds packages without one.
+      posthog-key:
+        description: The PostHog project key the vendor tarball carries for the .deb and .rpm. Public by design.
+        type: string
+        default: ""
 
 # A pull request keeps only its newest run; every other run, a release's call included, has its own group.
 concurrency:
@@ -132,7 +139,9 @@ jobs:
           persist-credentials: false
       - name: Make the source and vendor tarballs
         if: inputs.release-tag == ''
-        run: linux/build-aux/packaging/make-sources.sh --install-deps _packages/sources
+        env:
+          POSTHOG_KEY: ${{ inputs.posthog-key }}
+        run: linux/build-aux/packaging/make-sources.sh --install-deps --posthog-key "$POSTHOG_KEY" _packages/sources
       - name: Download the released source and vendor tarballs
         if: inputs.release-tag != ''
         env:

.github/workflows/release-linux.yml

@@ -40,6 +40,10 @@ name: Release Linux
 # Variables LINUX_PPA and LINUX_PPA_BETA: the stable and the beta PPA, as
 # owner/name.
 # Variable LINUX_FLATPAK_R2_ENDPOINT: https://<account id>.r2.cloudflarestorage.com.
+# Variable POSTHOG_PROJECT_KEY: the PostHog project key the macOS release
+# (release.yml) builds with too, public by design, which make-sources.sh puts
+# in the vendor tarball. The packages send usage data to it unless the user
+# turns it off. A packaging fix reuses the release's tarballs, and so its key.
 # Variable LINUX_BRANCH: the branch a release tag must be on, main when unset.
 
 on:
@@ -83,6 +87,14 @@ jobs:
       version: ${{ steps.check.outputs.version }}
       flatpak-branch: ${{ steps.check.outputs.flatpak-branch }}
     steps:
+      - name: The PostHog key is set
+        env:
+          POSTHOG_KEY: ${{ vars.POSTHOG_PROJECT_KEY }}
+        run: |
+          if [ -z "$POSTHOG_KEY" ]; then
+            echo "::error::Set the POSTHOG_PROJECT_KEY repository variable, the PostHog project key the packages send usage data to"
+            exit 1
+          fi
       # meson introspect detects the project's compilers, C and Rust, before it reads the version.
       - name: Install git, meson and the compilers
         run: |
@@ -132,6 +144,7 @@ jobs:
     with:
       deb-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'
       rpm-runners: '["ubuntu-24.04", "ubuntu-24.04-arm"]'
+      posthog-key: ${{ vars.POSTHOG_PROJECT_KEY }}
       flatpak: true
       flatpak-branch: ${{ needs.verify.outputs.flatpak-branch }}
 

.github/workflows/release.yml

@@ -111,7 +111,7 @@ jobs:
 
       - name: Write Secrets.xcconfig
         env:
-          POSTHOG_PROJECT_KEY: ${{ secrets.POSTHOG_PROJECT_KEY }}
+          POSTHOG_PROJECT_KEY: ${{ vars.POSTHOG_PROJECT_KEY }}
         run: printf 'POSTHOG_PROJECT_KEY = %s\n' "$POSTHOG_PROJECT_KEY" > Configs/Secrets.xcconfig
 
       - uses: ./.github/actions/prepare-build