From cf52f0228d5594cc905db876690877d5ac18b4f8 Mon Sep 17 00:00:00 2001
From: JonathanLab <jonathan@posthog.com>
Date: Tue, 21 Jul 2026 14:36:59 +0200
Subject: [PATCH 1/2] ci(agent): verify release build before merge

---
 .../actions/build-agent-release/action.yml    | 13 ++++++
 .github/workflows/agent-release-verify.yml    | 41 +++++++++++++++++++
 .github/workflows/agent-release.yml           | 19 +--------
 3 files changed, 56 insertions(+), 17 deletions(-)
 create mode 100644 .github/actions/build-agent-release/action.yml
 create mode 100644 .github/workflows/agent-release-verify.yml

diff --git a/.github/actions/build-agent-release/action.yml b/.github/actions/build-agent-release/action.yml
new file mode 100644
index 0000000000..f5042633fb
--- /dev/null
+++ b/.github/actions/build-agent-release/action.yml
@@ -0,0 +1,13 @@
+name: Build agent release
+description: Build and test the agent package with all workspace dependencies
+runs:
+  using: composite
+  steps:
+    - name: Build agent and workspace dependencies
+      shell: bash
+      run: pnpm --filter @posthog/agent... run build
+
+    - name: Run agent tests
+      shell: bash
+      run: pnpm --filter @posthog/agent run test
+
diff --git a/.github/workflows/agent-release-verify.yml b/.github/workflows/agent-release-verify.yml
new file mode 100644
index 0000000000..92698e5156
--- /dev/null
+++ b/.github/workflows/agent-release-verify.yml
@@ -0,0 +1,41 @@
+name: Verify Agent Release
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - "packages/agent/**"
+      - "packages/enricher/**"
+      - "packages/git/**"
+      - "packages/harness/**"
+      - "packages/shared/**"
+      - ".github/actions/build-agent-release/**"
+      - ".github/workflows/agent-release.yml"
+      - ".github/workflows/agent-release-verify.yml"
+      - "pnpm-lock.yaml"
+
+jobs:
+  verify:
+    name: Verify agent release build
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Setup pnpm
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+
+      - name: Set up Node 24
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 24
+          cache: "pnpm"
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Build and test agent release
+        uses: ./.github/actions/build-agent-release
diff --git a/.github/workflows/agent-release.yml b/.github/workflows/agent-release.yml
index bcd48962ab..a8b7439eb8 100644
--- a/.github/workflows/agent-release.yml
+++ b/.github/workflows/agent-release.yml
@@ -48,23 +48,8 @@ jobs:
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Build shared (agent dependency)
-        run: pnpm --filter @posthog/shared run build
-
-      - name: Build git (agent dependency)
-        run: pnpm --filter @posthog/git run build
-
-      - name: Build enricher (agent dependency)
-        run: pnpm --filter @posthog/enricher run build
-
-      - name: Build harness (agent dependency)
-        run: pnpm --filter @posthog/harness run build
-
-      - name: Build the package
-        run: pnpm --filter agent run build
-
-      - name: Run tests
-        run: pnpm --filter agent run test
+      - name: Build and test agent release
+        uses: ./.github/actions/build-agent-release
 
       - name: Publish the package to npm registry
         working-directory: packages/agent

From 2e30498490535fe4ecaceec1d489ba18947e2a48 Mon Sep 17 00:00:00 2001
From: JonathanLab <jonathan@posthog.com>
Date: Tue, 21 Jul 2026 17:52:10 +0200
Subject: [PATCH 2/2] ci(agent): scope release verification permissions

---
 .github/workflows/agent-release-verify.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/agent-release-verify.yml b/.github/workflows/agent-release-verify.yml
index 92698e5156..967406e4ad 100644
--- a/.github/workflows/agent-release-verify.yml
+++ b/.github/workflows/agent-release-verify.yml
@@ -1,5 +1,8 @@
 name: Verify Agent Release
 
+permissions:
+  contents: read
+
 on:
   pull_request:
     branches:
@@ -14,6 +17,7 @@ on:
       - ".github/workflows/agent-release.yml"
       - ".github/workflows/agent-release-verify.yml"
       - "pnpm-lock.yaml"
+      - "pnpm-workspace.yaml"
 
 jobs:
   verify: