fix(docker): copy css.d.ts into app build stage to fix nightly build

[jordan-simonovski]

Why

The nightly release (run 29215841780) has been failing across the App, All-in-One, and Local image builds with:

Type error: Cannot find module or type declarations for side-effect import of '@mantine/core/styles.css'.

The TypeScript 6 upgrade (#2617) introduced the stricter TS2882 check for side-effect imports of otherwise-untyped modules. To satisfy it, that PR added packages/app/css.d.ts with ambient declare module '*.css' (and .scss/.sass) declarations, which cover the stylesheet imports in pages/_app.tsx.

This works locally, but both Dockerfiles only copy mdx.d.ts into the build stage, not css.d.ts. Inside the container the ambient declaration is missing, so next build fails type-checking. Local tsc/CI passed because css.d.ts is present on disk there — a source-level type check fundamentally cannot catch a file that exists in the repo but was never COPYed into the image.

What

The fix

• Add css.d.ts to the COPY line in docker/hyperdx/Dockerfile (App / All-in-One / Local nightly + release images) and packages/app/Dockerfile (standalone app image), right alongside the existing mdx.d.ts.
• Drop a stray export on getAlertWindowStart (packages/api/src/tasks/checkAlerts/index.ts) — only used within its own file. Pre-existing dead export flagged by the pre-commit knip check, which was blocking commits through the hook.
• Patch changeset for @hyperdx/app.

Prevention — new Docker Build workflow (.github/workflows/docker-build.yml)

• Builds each released image on PRs with push: false, so image-only build failures are caught in review instead of the nightly.
• Conditional on changed paths (via tj-actions/changed-files, matching the existing otel-collector gating in main.yml) so unrelated PRs skip the builds:
  • OTel Collector image → docker/otel-collector/**, packages/otel-collector/**
  • App/prod image → packages/{api,app,common-utils}/**, docker/hyperdx/**, root deps
  • All-in-one image → the above plus docker/clickhouse/**, docker/otel-collector/**
• Single-arch (amd64), warmed from the nightly gha cache scopes, to keep PR runtimes low. Build errors here are arch-independent.

Verification

Ran the docker/hyperdx builder target locally (the stage that runs next build) with the fix:

#34 [builder 10/11] RUN yarn workspace @hyperdx/api run build && yarn workspace @hyperdx/app run build
#34   Running TypeScript ...
#34 ✓ Compiled successfully in 25.7s
...
#36 DONE   (exit 0)

The TS2882 error is gone and the image builds cleanly.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4463181

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@hyperdx/app	Patch
@hyperdx/api	Patch
@hyperdx/otel-collector	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hyperdx-oss	Ignored	Preview	Jul 13, 2026 6:14am
hyperdx-storybook	Ignored	Preview	Jul 13, 2026 6:14am

[github-actions]

🔴 Tier 4 — Critical

Touches auth, data models, config, tasks, OTel pipeline, ClickHouse, or CI/CD.

Why this tier:

• Critical-path files (2):
  • docker/hyperdx/Dockerfile
  • packages/api/src/tasks/checkAlerts/index.ts
• Cross-layer change: touches frontend (packages/app) + backend (packages/api)

Additional context: agent branch (claude/fix-nightly-css-dts-docker)

Review process: Deep review from a domain expert. Synchronous walkthrough may be required.
SLA: Schedule synchronous review within 2 business days.

Stats

• Production files changed: 3
• Production lines changed: 6
• Branch: claude/fix-nightly-css-dts-docker
• Author: jordan-simonovski

To override this classification, remove the review/tier-4 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[greptile-apps]

Greptile Summary

This PR fixes container builds that were missing the app's stylesheet declarations. The main changes are:

• Copy css.d.ts into both app Docker build stages.
• Add path-gated PR builds for released Docker images.
• Add a patch changeset for @hyperdx/app.
• Make getAlertWindowStart private to its module.

Confidence Score: 5/5

This looks safe to merge.

• Both app builders inherit the stages that now copy css.d.ts.
• The removed export has no repository importers.
• No blocking issues were found in the updated code.

Important Files Changed

Filename	Overview
docker/hyperdx/Dockerfile	Copies css.d.ts into the shared Node stage used by the app build.
packages/app/Dockerfile	Copies css.d.ts into the standalone app image's build stage.
.github/workflows/docker-build.yml	Adds conditional PR builds for the app, all-in-one, and OTel Collector images.
packages/api/src/tasks/checkAlerts/index.ts	Removes the public export from a helper used only within the module.
.changeset/fix-nightly-css-dts-docker.md	Adds an app patch changeset for the Docker build fix.

_{Reviews (3): Last reviewed commit: "ci: stop rebuilding the app inside the a..." | Re-trigger Greptile}

[github-actions]

Deep Review

This PR is a targeted infra fix: it copies css.d.ts into both Docker build stages to unblock the nightly release (TS2882), drops a verified-dead export, and adds a non-blocking docker-build.yml PR check to catch image-only build failures earlier. The core fix is sound — css.d.ts lands in node_base, which builder inherits before next build runs, and removing the export on getAlertWindowStart is safe (sole caller is line 1525 in the same file; no external or test importers). No correctness regressions. The findings below are all about the coverage of the new prevention mechanism the PR introduces.

✅ No critical issues found.

🟡 P2 -- recommended

• .github/workflows/docker-build.yml:63 -- The app-image gate lists package.json, yarn.lock, and .yarn/** but omits .yarnrc.yml, .prettierrc, and .prettierignore, which the node_base stage also COPYs; a PR editing only .yarnrc.yml (e.g. nodeLinker) changes the build yet skips the verification job — the exact build-input escape this workflow exists to catch.
  • Fix: Add .yarnrc.yml (and the other node_base config inputs) to the app-image and all-in-one-image changed-files gates so they match the Dockerfile's COPY list.
  • _{correctness, maintainability}
• packages/app/Dockerfile:12 -- The same css.d.ts fix is applied here, but this Dockerfile is built by no in-repo workflow or compose file, so the new docker-build.yml only verifies docker/hyperdx/Dockerfile; a future d.ts-style omission here would go uncaught by the very prevention check this PR adds.
  • Fix: Add a build target for packages/app/Dockerfile to docker-build.yml, or confirm and document that it is unused/dev-only.
  • _{maintainability, correctness}

🔵 P3 nitpicks (4)

• .github/workflows/docker-build.yml:95 -- CODE_VERSION resolves to pr- (empty suffix) on workflow_dispatch runs because github.event.pull_request.number is unset outside pull_request events; harmless since push: false, but produces a meaningless image tag on manual runs.
  • Fix: Fall back to a run identifier, e.g. CODE_VERSION=pr-${{ github.event.pull_request.number || github.run_id }}.
  • _{correctness, reliability}
• .github/workflows/docker-build.yml:143 -- The all-in-one-image cache-from omits the app cache scope while its base does COPY --from=prod /app /app, so on any app-cache miss the ~8-minute Node prod build reruns cold, pushing toward the 40-minute timeout.
  • Fix: Add type=gha,scope=app-nightly-amd64 and type=gha,scope=docker-build-pr-app to the all-in-one-image cache-from.
• .github/workflows/docker-build.yml:92 -- Nightly cache scope names (app-nightly-amd64, all-in-one-nightly-amd64, otel-collector-nightly-amd64) are hardcoded to mirror release-nightly.yml with no shared source, so renaming a scope there silently degrades PR cache hits with no failing signal.
  • Fix: Add a comment cross-referencing release-nightly.yml scope names, or centralize the scope prefixes.
• .github/workflows/docker-build.yml:47 -- Fork PRs run under pull_request with a read-only token, so cache-to: type=gha writes to an isolated PR-scoped cache; builds still succeed and the exporter does not fail the step, but external-contributor PRs get little cache warming and may emit noisy export warnings.
  • Fix: Optionally gate cache-to to same-repo PRs via if: github.event.pull_request.head.repo.full_name == github.repository.

---

Reviewers (6): correctness, testing, maintainability, project-standards, kieran-typescript, reliability.

Testing gaps:

• packages/app/Dockerfile's COPY list (including the new css.d.ts) is not exercised end-to-end by any CI job.
• The docker-build.yml workflow does not gate on edits to itself, so a future gating regression ships unverified.

[github-actions]

E2E Test Results

✅ All tests passed • 236 passed • 3 skipped • 1544s

Status	Count
✅ Passed	236
❌ Failed	0
⚠️ Flaky	0
⏭️ Skipped	3

Tests ran across 4 shards in parallel.

View full report →

[jordan-simonovski]

Superseded by #2632 — this PR auto-closed when the branch was renamed claude/fix-nightly-css-dts-docker → jordansimonovski/fix-nightly-css-dts-docker. Same commits plus the review-comment fixes. Please continue review there.