[FOLLOW-UP] docker job will fail once build-and-test is unblocked — Dockerfile has no SDK in build context

[dcccrypto]

Follow-up to #232 / #233.

Problem

The Dockerfile builder stage runs:

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./
RUN pnpm install --frozen-lockfile

The lockfile resolves @percolatorct/sdk as file:../../percolator-sdk, which is not in the build context, so this will hit the same ENOENT ... scandir failure that #233 fixes for build-and-test.

Why it is not visible today

The docker job is gated behind needs: build-and-test and if: github.ref == 'refs/heads/main'. Since build-and-test has never passed, docker has never run.

#233 makes it reachable, so main is expected to go red here until this is fixed.

Likely fix

Mirror dcccrypto/percolator-indexer#175: check the SDK out into the build context (not as a sibling, as build-and-test needs), then COPY it to the path the lockfile expects. Note that inside the container WORKDIR /app, ../../percolator-sdk resolves to /percolator-sdk, so the destination differs from the indexer's.

Why it is not in #233

The Docker daemon was unavailable on the machine where #233 was verified, and I would rather not ship an unverified image-build change. Splitting it keeps #233 to something proven end-to-end.

[dcccrypto]

#238 should close this by construction.

The Dockerfile COPYs only package.json + lockfiles into the build context and then runs pnpm install --frozen-lockfile. With @percolatorct/sdk declared as file:../../percolator-sdk, that install can never succeed — a sibling path is unreachable from any Docker build context, so this was unfixable at the Dockerfile level.

#238 changes the dependency to a pinned public git tarball (github:dcccrypto/percolator-sdk#673bc47), leaving zero local-path references in the lockfile. There is nothing left for --frozen-lockfile to chase outside the context.

Caveat — I have not proven this. No Docker daemon on this machine, so I could not run docker build. The docker job is also if: github.ref == 'refs/heads/main', so it stays skipping on PRs and won't validate before merge (that's #384's territory in the keeper repo, same pattern here). It will get its first real exercise on the post-merge main run — worth watching that one.

Verified on #238's CI instead: pnpm install --frozen-lockfile and pnpm build both pass, and the Vercel deployment — which has the same COPY-only constraint — went green for the first time in ~33 days.