fix(telemetry): commit the reconciled canonical in docs fragment PRs too

Revalidation against current main (the branch was 1345 commits behind):

- docs workflow ran `pnpm reconcile` but `add-paths` listed only the
  fragment, so its PR would land a fresh fragment beside a stale
  telemetry-events.json and fail the registry's telemetry-reconcile
  staleness gate — the exact failure the runtime workflow was already
  fixed for. Verified against the registry's shipped emitters: every
  automated fragment PR there (website.corp, Intelligence surfaces)
  carries telemetry-events.json alongside its fragment.
- Refresh the action pins to the SHAs main now uses everywhere
  (checkout v7, setup-node v7.0.0, pnpm/action-setup v6.0.10).
- Narrow the docs trigger to code under shell-docs/src, excluding
  src/content (1000+ MDX/JSON prose files that cannot hold a
  posthog.capture call site) so prose edits stop firing a full install.
- Note in the zizmor justification why setup-node v7's new
  package-manager-cache auto-path still leaves this workflow cacheless
  (it engages only for npm-declared repos; this one declares pnpm).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/telemetry-docs-fragment.yml

@@ -12,7 +12,11 @@ on:
   push:
     branches: [main]
     paths:
-      - "showcase/shell-docs/**"
+      # Only the code under `src/**`: the emitter walks showcase/shell-docs/src
+      # for .ts/.tsx, and src/content is pure MDX/JSON prose (1000+ files, the
+      # bulk of docs traffic) that cannot contain a posthog.capture call site.
+      - "showcase/shell-docs/src/**"
+      - "!showcase/shell-docs/src/content/**"
       - "scripts/telemetry/**"
       - ".github/workflows/telemetry-docs-fragment.yml"
   workflow_dispatch: {}
@@ -36,15 +40,15 @@ jobs:
       REGISTRY_APP_ID: ${{ secrets.TELEMETRY_REGISTRY_APP_ID }}
     steps:
       - name: Checkout CopilotKit
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.x
 
@@ -66,7 +70,7 @@ jobs:
 
       - name: Checkout oss-path-to-production
         if: steps.token.outputs.token != ''
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: CopilotKit/oss-path-to-production
           token: ${{ steps.token.outputs.token }}
@@ -82,7 +86,7 @@ jobs:
       # Use the registry's own pnpm (its packageManager field).
       - name: Setup pnpm for registry
         if: steps.token.outputs.token != ''
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: p2p/package.json
 
@@ -99,7 +103,9 @@ jobs:
         with:
           token: ${{ steps.token.outputs.token }}
           path: p2p
-          add-paths: telemetry-registry/fragments/CopilotKit.docs.json
+          add-paths: |
+            telemetry-registry/fragments/CopilotKit.docs.json
+            telemetry-registry/telemetry-events.json
           base: main
           branch: telemetry/copilotkit-docs
           delete-branch: true
@@ -109,4 +115,5 @@ jobs:
             Automated update of the `CopilotKit.docs` telemetry-registry fragment
             (showcase/shell-docs), extracted from inline posthog.capture call sites.
 
-            Reconcile (telemetry-reconcile) will fold this into `telemetry-events.json`.
+            `telemetry-events.json` is regenerated alongside it (`pnpm reconcile`) so the
+            registry's reconcile check sees a fresh canonical; curated fields are preserved.

.github/workflows/telemetry-runtime-fragment.yml

@@ -40,15 +40,15 @@ jobs:
       REGISTRY_APP_ID: ${{ secrets.TELEMETRY_REGISTRY_APP_ID }}
     steps:
       - name: Checkout CopilotKit
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Setup pnpm
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
       - name: Setup Node
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.x
 
@@ -71,7 +71,7 @@ jobs:
 
       - name: Checkout oss-path-to-production
         if: steps.token.outputs.token != ''
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: CopilotKit/oss-path-to-production
           token: ${{ steps.token.outputs.token }}
@@ -87,7 +87,7 @@ jobs:
       # Use the registry's own pnpm (its packageManager field).
       - name: Setup pnpm for registry
         if: steps.token.outputs.token != ''
-        uses: pnpm/action-setup@0e279bb959325dab635dd2c09392533439d90093 # v6.0.8
+        uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           package_json_file: p2p/package.json
 
@@ -116,4 +116,5 @@ jobs:
             Automated update of the `CopilotKit.runtime` telemetry-registry fragment,
             emitted from the CopilotKit runtime type catalog on a stable release.
 
-            Reconcile (telemetry-reconcile) will fold this into `telemetry-events.json`.
+            `telemetry-events.json` is regenerated alongside it (`pnpm reconcile`) so the
+            registry's reconcile check sees a fresh canonical; curated fields are preserved.

.github/zizmor.yml

@@ -84,7 +84,9 @@ rules:
   #
   # telemetry-runtime-fragment.yml: reviewed, does not apply. The workflow
   # configures NO cache (setup-node caching is opt-in via `cache:`, which this
-  # workflow does not set), and it publishes no build artifact — it reads the
+  # workflow does not set; setup-node v7's `package-manager-cache` auto-path
+  # only engages when package.json declares npm, and this repo declares pnpm),
+  # and it publishes no build artifact — it reads the
   # runtime's type catalog, emits a JSON registry fragment, and opens a PR
   # against another repo. There is no runtime artifact a restored cache could
   # poison.