test(acceptance): move listen telemetry proxy test under telemetry tag

- Add telemetry_listen_test.go (//go:build telemetry) with TestTelemetryListenProxy
- Remove test from listen_test.go so matrix slices with telemetry disabled never run it
- CI/run_parallel: single go test -tags=telemetry (no separate listen invocation)
- README: document telemetry-tagged proxy tests

Made-with: Cursor

Author: leggetter

.github/workflows/test-acceptance.yml

@@ -17,14 +17,15 @@ jobs:
             tags: "basic connection source destination gateway mcp listen project_use connection_list connection_upsert connection_error_hints connection_oauth_aws connection_update"
           - slice: "1"
             api_key_secret: HOOKDECK_CLI_TESTING_API_KEY_2
-            tags: "request event telemetry"
+            tags: "request event"
           - slice: "2"
             api_key_secret: HOOKDECK_CLI_TESTING_API_KEY_3
             tags: "attempt metrics issue transformation"
     runs-on: ubuntu-latest
     env:
       ACCEPTANCE_SLICE: ${{ matrix.slice }}
       HOOKDECK_CLI_TESTING_API_KEY: ${{ secrets[matrix.api_key_secret] }}
+      HOOKDECK_CLI_TELEMETRY_DISABLED: "1"
     steps:
       - name: Check out code
         uses: actions/checkout@v3
@@ -36,3 +37,23 @@ jobs:
 
       - name: Run Go Acceptance Tests (slice ${{ matrix.slice }})
         run: go test -tags="${{ matrix.tags }}" ./test/acceptance/... -v -timeout 12m
+
+  # Telemetry proxy tests require the real telemetry header; matrix jobs set
+  # HOOKDECK_CLI_TELEMETRY_DISABLED=1. This job runs only -tags=telemetry without
+  # disabling telemetry (same as local when HOOKDECK_CLI_TELEMETRY_DISABLED is unset).
+  acceptance-telemetry:
+    runs-on: ubuntu-latest
+    env:
+      ACCEPTANCE_SLICE: "0"
+      HOOKDECK_CLI_TESTING_API_KEY: ${{ secrets.HOOKDECK_CLI_TESTING_API_KEY }}
+    steps:
+      - name: Check out code
+        uses: actions/checkout@v3
+
+      - name: Set up Go
+        uses: actions/setup-go@v3
+        with:
+          go-version: "1.24.9"
+
+      - name: Run telemetry acceptance tests
+        run: go test -tags=telemetry ./test/acceptance/... -v -timeout 12m

test/acceptance/README.md

@@ -20,7 +20,7 @@ These tests require browser-based authentication via `hookdeck login` and must b
 
 ### Recording proxy (telemetry tests)
 
-Some tests (e.g. `TestTelemetryGatewayConnectionListProxy` in `telemetry_test.go`) use a **recording proxy**: the CLI is run with `--api-base` pointing at a local HTTP server that forwards every request to the real Hookdeck API and records method, path, and the `X-Hookdeck-CLI-Telemetry` header. The same `CLIRunner` and `go run main.go` flow are used as in other acceptance tests; only the API base URL is overridden so traffic goes through the proxy. This verifies that a single CLI run sends consistent telemetry (same `invocation_id` and `command_path`) on all API calls. Helpers: `StartRecordingProxy`, `AssertTelemetryConsistent`.
+Some tests (e.g. `TestTelemetryGatewayConnectionListProxy` in `telemetry_test.go`, `TestTelemetryListenProxy` in `telemetry_listen_test.go`) use a **recording proxy**: the CLI is run with `--api-base` pointing at a local HTTP server that forwards every request to the real Hookdeck API and records method, path, and the `X-Hookdeck-CLI-Telemetry` header. The same `CLIRunner` and `go run main.go` flow are used as in other acceptance tests; only the API base URL is overridden so traffic goes through the proxy. This verifies that a single CLI run sends consistent telemetry (same `invocation_id` and `command_path`) on all API calls. Helpers: `StartRecordingProxy`, `AssertTelemetryConsistent`.
 
 **Login telemetry test (TestTelemetryLoginProxy)** uses the same proxy approach: it runs `hookdeck login --api-key KEY` with `--api-base` set to the proxy, and asserts exactly one recorded request (GET `/2025-07-01/cli-auth/validate`) with consistent telemetry. It uses **HOOKDECK_CLI_TESTING_CLI_KEY** (not the API/CI key), because the validate endpoint accepts CLI keys from interactive login; if unset, the test is skipped. Other telemetry tests still use the normal API key via `NewCLIRunner`.
 
@@ -48,7 +48,11 @@ HOOKDECK_CLI_TESTING_API_KEY_3=key_for_slice2
 
 ### CI/CD
 
-CI runs acceptance tests in **three parallel jobs**, each with its own API key (`HOOKDECK_CLI_TESTING_API_KEY`, `HOOKDECK_CLI_TESTING_API_KEY_2`, `HOOKDECK_CLI_TESTING_API_KEY_3`). No test-name list in the workflow—tests are partitioned by **feature tags** (see [Parallelisation](#parallelisation)).
+CI runs **three parallel matrix jobs**, each with its own API key (`HOOKDECK_CLI_TESTING_API_KEY`, `HOOKDECK_CLI_TESTING_API_KEY_2`, `HOOKDECK_CLI_TESTING_API_KEY_3`). Those jobs set **`HOOKDECK_CLI_TELEMETRY_DISABLED=1`** so the CLI does not send telemetry during normal acceptance tests.
+
+A **fourth job** (`acceptance-telemetry` in `.github/workflows/test-acceptance.yml`) does **not** disable telemetry. It runs `go test -tags=telemetry` only (all proxy tests that assert `X-Hookdeck-CLI-Telemetry`, including listen, live under the `telemetry` build tag). It uses `HOOKDECK_CLI_TESTING_API_KEY` and `ACCEPTANCE_SLICE=0` (same project as slice 0; tests use unique resource names).
+
+No test-name list in the workflow—tests are partitioned by **feature tags** (see [Parallelisation](#parallelisation)).
 
 ## Running Tests
 
@@ -62,25 +66,27 @@ go test -tags="basic connection source destination gateway mcp listen project_us
 Same commands as CI; use when debugging a subset or running in parallel:
 ```bash
 # Slice 0 (same tags as CI job 0)
-ACCEPTANCE_SLICE=0 go test -tags="basic connection source destination gateway mcp listen project_use connection_list connection_upsert connection_error_hints connection_oauth_aws connection_update" ./test/acceptance/... -v -timeout 12m
+ACCEPTANCE_SLICE=0 HOOKDECK_CLI_TELEMETRY_DISABLED=1 go test -tags="basic connection source destination gateway mcp listen project_use connection_list connection_upsert connection_error_hints connection_oauth_aws connection_update" ./test/acceptance/... -v -timeout 12m
 
-# Slice 1 (same tags as CI job 1: request, event, telemetry)
-ACCEPTANCE_SLICE=1 go test -tags="request event telemetry" ./test/acceptance/... -v -timeout 12m
+# Slice 1 (same tags as CI job 1)
+ACCEPTANCE_SLICE=1 HOOKDECK_CLI_TELEMETRY_DISABLED=1 go test -tags="request event" ./test/acceptance/... -v -timeout 12m
 
 # Slice 2 (same tags as CI job 2)
-ACCEPTANCE_SLICE=2 go test -tags="attempt metrics issue transformation" ./test/acceptance/... -v -timeout 12m
+ACCEPTANCE_SLICE=2 HOOKDECK_CLI_TELEMETRY_DISABLED=1 go test -tags="attempt metrics issue transformation" ./test/acceptance/... -v -timeout 12m
 
+# Telemetry (same as CI acceptance-telemetry: do not set HOOKDECK_CLI_TELEMETRY_DISABLED)
+ACCEPTANCE_SLICE=0 go test -tags=telemetry ./test/acceptance/... -v -timeout 12m
 ```
-For slice 1 set `HOOKDECK_CLI_TESTING_API_KEY_2`; for slice 2 set `HOOKDECK_CLI_TESTING_API_KEY_3` (or set `HOOKDECK_CLI_TESTING_API_KEY` to that key).
+For slice 1 set `HOOKDECK_CLI_TESTING_API_KEY_2`; for slice 2 set `HOOKDECK_CLI_TESTING_API_KEY_3` (or set `HOOKDECK_CLI_TESTING_API_KEY` to that key). For telemetry, use the slice 0 key and leave `HOOKDECK_CLI_TELEMETRY_DISABLED` unset.
 
 **Project list tests** (`TestProjectListShowsType`, `TestProjectListJSONOutput`) require a **CLI key**, not an API or CI key: only keys created via interactive login can list or switch projects. Set `HOOKDECK_CLI_TESTING_CLI_KEY` in your `.env` (or environment) to run these tests; if unset, they are skipped with a clear message.
 
 ### Run in parallel locally (three keys)
-From the **repository root**, run the script that runs all three slices in parallel (same as CI):
+From the **repository root**, run the script that runs three matrix slices plus telemetry in parallel (same as CI):
 ```bash
 ./test/acceptance/run_parallel.sh
 ```
-Requires `HOOKDECK_CLI_TESTING_API_KEY`, `HOOKDECK_CLI_TESTING_API_KEY_2`, and `HOOKDECK_CLI_TESTING_API_KEY_3` in `.env` or the environment.
+Requires `HOOKDECK_CLI_TESTING_API_KEY`, `HOOKDECK_CLI_TESTING_API_KEY_2`, and `HOOKDECK_CLI_TESTING_API_KEY_3` in `.env` or the environment. The script sets `HOOKDECK_CLI_TELEMETRY_DISABLED=1` for matrix slices only; the telemetry run leaves it unset.
 
 ### Run manual tests (requires human authentication):
 ```bash
@@ -100,13 +106,14 @@ Use the same `-tags` as "Run all" if you want to skip the full acceptance set. A
 
 ## Parallelisation
 
-Tests are partitioned by **feature build tags** so CI and local runs can execute three slices in parallel (each slice uses its own Hookdeck project and config file).
+Tests are partitioned by **feature build tags** so CI and local runs can execute three matrix slices in parallel (each slice uses its own Hookdeck project and config file).
 
 - **Slice 0 features:** `basic`, `connection`, `source`, `destination`, `gateway`, `mcp`, `listen`, `project_use`, `connection_list`, `connection_upsert`, `connection_error_hints`, `connection_oauth_aws`, `connection_update`
-- **Slice 1 features:** `request`, `event`, `telemetry`
+- **Slice 1 features:** `request`, `event`
 - **Slice 2 features:** `attempt`, `metrics`, `issue`, `transformation`
+- **Telemetry job:** `telemetry` only — separate CI job with telemetry **not** disabled (see [CI/CD](#cicd))
 
-The CI workflow (`.github/workflows/test-acceptance.yml`) runs three jobs with the same `go test -tags="..."` commands and env (`ACCEPTANCE_SLICE`, API keys). No test names or regexes are listed in YAML.
+The CI workflow (`.github/workflows/test-acceptance.yml`) runs three matrix jobs plus `acceptance-telemetry`. Matrix jobs set `HOOKDECK_CLI_TELEMETRY_DISABLED=1`; the telemetry job does not. No test names or regexes are listed in YAML.
 
 **Untagged files:** A test file with **no** build tag is included in every build and runs in **both** slices (duplicated). **Every new acceptance test file must have exactly one feature tag** so it runs in only one slice.
 

test/acceptance/listen_test.go

@@ -163,36 +163,3 @@ func TestListenCommandWithContext(t *testing.T) {
 
 	t.Logf("Listen command terminated via context cancellation")
 }
-
-// TestTelemetryListenProxy runs "listen" with the CLI pointed at a recording proxy
-// that forwards to the real API. It lets listen run for a few seconds (so it can
-// perform initial API calls: get sources, get connections, create session), then
-// stops it. Asserts that every API request in that run has the same invocation_id
-// and command_path "hookdeck listen".
-func TestTelemetryListenProxy(t *testing.T) {
-	if testing.Short() {
-		t.Skip("Skipping acceptance test in short mode")
-	}
-
-	cli := NewCLIRunner(t)
-	proxy := StartRecordingProxy(t, defaultAPIUpstream)
-	defer proxy.Close()
-
-	timestamp := generateTimestamp()
-	sourceName := "test-telemetry-" + timestamp
-
-	_, _, _ = cli.RunListenWithTimeout([]string{
-		"--api-base", proxy.URL(),
-		"listen", "9999", sourceName,
-		"--output", "compact",
-	}, 6*time.Second)
-	// Process is killed after 6s; we don't assert on exit error
-
-	recorded := proxy.Recorded()
-	require.GreaterOrEqual(t, len(recorded), 1,
-		"expected at least one API request from listen (sources, connections, or cli-sessions)")
-	for i, req := range recorded {
-		t.Logf("listen API request %d: %s %s (telemetry: %s)", i+1, req.Method, req.Path, req.Telemetry)
-	}
-	AssertTelemetryConsistent(t, recorded, "hookdeck listen")
-}

test/acceptance/run_parallel.sh

@@ -1,10 +1,13 @@
 #!/usr/bin/env bash
-# Run acceptance tests in three parallel slices (same as CI).
+# Run acceptance tests in four parallel jobs (same as CI): three matrix slices + telemetry.
 # Requires HOOKDECK_CLI_TESTING_API_KEY, HOOKDECK_CLI_TESTING_API_KEY_2, and HOOKDECK_CLI_TESTING_API_KEY_3 in environment or test/acceptance/.env.
 # Run from the repository root.
 #
+# Matrix slices set HOOKDECK_CLI_TELEMETRY_DISABLED=1. The telemetry slice unsets it and runs
+# -tags=telemetry (telemetry_test.go and telemetry_listen_test.go).
+#
 # Output: each slice writes to a log file so you can see which run produced what.
-# Logs are written to test/acceptance/logs/slice0.log, slice1.log, slice2.log (created on first run).
+# Logs are written to test/acceptance/logs/slice0.log, slice1.log, slice2.log, telemetry.log (created on first run).
 
 set -e
 
@@ -24,47 +27,61 @@ mkdir -p "$LOG_DIR"
 SLICE0_LOG="$LOG_DIR/slice0.log"
 SLICE1_LOG="$LOG_DIR/slice1.log"
 SLICE2_LOG="$LOG_DIR/slice2.log"
+TELEMETRY_LOG="$LOG_DIR/telemetry.log"
 
 SLICE0_TAGS="basic connection source destination gateway mcp listen project_use connection_list connection_upsert connection_error_hints connection_oauth_aws connection_update"
-SLICE1_TAGS="request event telemetry"
+SLICE1_TAGS="request event"
 SLICE2_TAGS="attempt metrics issue transformation"
 
 run_slice0() {
-  ACCEPTANCE_SLICE=0 go test -tags="$SLICE0_TAGS" ./test/acceptance/... -v -timeout 12m > "$SLICE0_LOG" 2>&1
+  ACCEPTANCE_SLICE=0 HOOKDECK_CLI_TELEMETRY_DISABLED=1 go test -tags="$SLICE0_TAGS" ./test/acceptance/... -v -timeout 12m > "$SLICE0_LOG" 2>&1
 }
 
 run_slice1() {
-  ACCEPTANCE_SLICE=1 go test -tags="$SLICE1_TAGS" ./test/acceptance/... -v -timeout 12m > "$SLICE1_LOG" 2>&1
+  ACCEPTANCE_SLICE=1 HOOKDECK_CLI_TELEMETRY_DISABLED=1 go test -tags="$SLICE1_TAGS" ./test/acceptance/... -v -timeout 12m > "$SLICE1_LOG" 2>&1
 }
 
 run_slice2() {
-  ACCEPTANCE_SLICE=2 go test -tags="$SLICE2_TAGS" ./test/acceptance/... -v -timeout 12m > "$SLICE2_LOG" 2>&1
+  ACCEPTANCE_SLICE=2 HOOKDECK_CLI_TELEMETRY_DISABLED=1 go test -tags="$SLICE2_TAGS" ./test/acceptance/... -v -timeout 12m > "$SLICE2_LOG" 2>&1
+}
+
+run_telemetry() {
+  (
+    unset HOOKDECK_CLI_TELEMETRY_DISABLED
+    export ACCEPTANCE_SLICE=0
+    go test -tags=telemetry ./test/acceptance/... -v -timeout 12m
+  ) > "$TELEMETRY_LOG" 2>&1
 }
 
-echo "Running acceptance tests in parallel (slice 0, 1, and 2)..."
+echo "Running acceptance tests in parallel (slice 0, 1, 2, and telemetry)..."
 echo "  Slice 0 -> $SLICE0_LOG"
 echo "  Slice 1 -> $SLICE1_LOG"
 echo "  Slice 2 -> $SLICE2_LOG"
+echo "  Telemetry -> $TELEMETRY_LOG"
 run_slice0 &
 PID0=$!
 run_slice1 &
 PID1=$!
 run_slice2 &
 PID2=$!
+run_telemetry &
+PIDT=$!
 
 FAIL=0
 wait $PID0 || FAIL=1
 wait $PID1 || FAIL=1
 wait $PID2 || FAIL=1
+wait $PIDT || FAIL=1
 
 if [ $FAIL -eq 1 ]; then
   echo ""
   echo "One or more slices failed. Tail of failed log(s):"
   [ ! -f "$SLICE0_LOG" ] || (echo "--- slice 0 ---" && tail -50 "$SLICE0_LOG")
   [ ! -f "$SLICE1_LOG" ] || (echo "--- slice 1 ---" && tail -50 "$SLICE1_LOG")
   [ ! -f "$SLICE2_LOG" ] || (echo "--- slice 2 ---" && tail -50 "$SLICE2_LOG")
+  [ ! -f "$TELEMETRY_LOG" ] || (echo "--- telemetry ---" && tail -50 "$TELEMETRY_LOG")
 fi
 
 echo ""
-echo "Logs: $SLICE0_LOG  $SLICE1_LOG  $SLICE2_LOG"
+echo "Logs: $SLICE0_LOG  $SLICE1_LOG  $SLICE2_LOG  $TELEMETRY_LOG"
 exit $FAIL

test/acceptance/telemetry_listen_test.go

@@ -0,0 +1,46 @@
+//go:build telemetry
+
+package acceptance
+
+import (
+	"testing"
+	"time"
+
+	"github.com/stretchr/testify/require"
+)
+
+// TestTelemetryListenProxy runs "listen" with the CLI pointed at a recording proxy
+// that forwards to the real API. It lets listen run for a few seconds (so it can
+// perform initial API calls: get sources, get connections, create session), then
+// stops it. Asserts that every API request in that run has the same invocation_id
+// and command_path "hookdeck listen".
+//
+// Build tag telemetry: runs only in the acceptance-telemetry CI job (telemetry enabled),
+// not in matrix slices where HOOKDECK_CLI_TELEMETRY_DISABLED=1.
+func TestTelemetryListenProxy(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping acceptance test in short mode")
+	}
+
+	cli := NewCLIRunner(t)
+	proxy := StartRecordingProxy(t, defaultAPIUpstream)
+	defer proxy.Close()
+
+	timestamp := generateTimestamp()
+	sourceName := "test-telemetry-" + timestamp
+
+	_, _, _ = cli.RunListenWithTimeout([]string{
+		"--api-base", proxy.URL(),
+		"listen", "9999", sourceName,
+		"--output", "compact",
+	}, 6*time.Second)
+	// Process is killed after 6s; we don't assert on exit error
+
+	recorded := proxy.Recorded()
+	require.GreaterOrEqual(t, len(recorded), 1,
+		"expected at least one API request from listen (sources, connections, or cli-sessions)")
+	for i, req := range recorded {
+		t.Logf("listen API request %d: %s %s (telemetry: %s)", i+1, req.Method, req.Path, req.Telemetry)
+	}
+	AssertTelemetryConsistent(t, recorded, "hookdeck listen")
+}