[teeohhem]

Summary

Publishes the HyperDX app image under the ClickHouse Docker Hub namespace as clickhouse/clickstack (the bare name: this is the image you deploy against your own ClickHouse), alongside the existing hyperdx/hyperdx.

Why. The other three images (clickstack-all-in-one, clickstack-local, clickstack-otel-collector) already dual-publish under clickhouse/. The app image did not, so the Helm chart and docs still depend on the hyperdx Docker Hub org. This is the first step of moving the project to ClickHouse/ClickStack: the image has to exist before anything can point at it.

What changed

• .env, Makefile, release.yml, release-nightly.yml: app builds tag and push both names. Manifests use the same loop the local and all-in-one jobs already use.
• Removed the 8 ghcr.io login steps and packages: write. Nothing has been pushed to ghcr since May 2025, and those packages stay behind with the hyperdxio org after the repo transfer.
• Docs: docker run examples use docker.clickhouse.com/clickhouse/clickstack-{all-in-one,local}, which exist today. DEPLOY.md gains an image-name table and a transition note.

Not in this PR. docker-compose.yml, the app-image command in DEPLOY.md, and the Helm chart keep hyperdx/hyperdx until a release after this merge publishes the new name. That flip is in the repo-move PR stacked on this one. Stopping the hyperdx/* tags is a later change; the end date still needs to be chosen. If the clickhouse Docker Hub org does not auto-create repositories on first push, create clickhouse/clickstack (public) before the next release.

How to reproduce

Non-UI. make -n build-app prints both tags. After the next release, docker manifest inspect clickhouse/clickstack:2 succeeds.

How to test on Vercel preview

N/A — non-UI change

References

• Related PRs: chore: point the repo at ClickHouse/ClickStack ahead of the transfer #3553 (stacked on this branch)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated
hyperdx-oss	Ignored	Preview	Nov 4, 2026 4:28pm UTC
hyperdx-storybook	Ignored	Preview	Nov 4, 2026 4:28pm UTC

[changeset-bot]

🦋 Changeset detected

Latest commit: e810152

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 3 packages

Name	Type
@hyperdx/app	Patch
@hyperdx/api	Patch
@hyperdx/otel-collector	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[github-actions]

🔴 Tier 4 — Critical

Touches authentication, tenancy data models, the public API or shipped database config — or substantially changes the query rendering engine, background tasks, the OTel pipeline, image build, or release CI.

Why this tier:

• Background tasks or delivery pipeline substantially modified — 43 lines (bar: 30):
  • .github/workflows/release.yml

Review process: Deep review from a domain expert. Synchronous walkthrough may be required.
SLA: Schedule synchronous review within 2 business days.

Stats

• Production files changed: 2
• Production lines changed: 3
• Critical-path lines changed: 43
• Branch: claude/clickstack-app-image
• Author: teeohhem

To override this classification, remove the review/tier-4 label and apply a different review/tier-* label. Manual overrides are preserved on subsequent pushes.

[github-actions]

🔵 minor — DEPLOY.md lists clickhouse/clickstack-hyperdx and says to switch to it "now", but that image won't exist until the next release

Until a release publishes the new name, either leave clickstack-hyperdx out of the table or mark it "available from the next release". The image is only pushed when release.yml runs for a new version: its check-version step (around line 782) skips the release if hyperdx/hyperdx:2.43.1 already exists. The PR description says the same, and the section below (line 41) still uses hyperdx/hyperdx. Anyone who follows the "switch now" advice before then gets a manifest-not-found error.

_{Advisory. Fix if it is a small defect in code this PR changes; otherwise reply in the thread. Do not widen the PR or touch files it did not already change. How to respond}

[github-actions]

PR Review

If you are a coding agent acting for the author, read this first.
Nothing below blocks merge automatically; a maintainer decides. What they will expect:

• 🔴 critical or 🟠 major in code this PR adds or changes: fix before asking for review.
• 🔵 minor in code this PR changes: your call. Fix if small, otherwise reply.
• Anything about surrounding code, or asking you to widen the change (hoist a helper,
  dedupe with another file, fix other call sites): never fix here, whatever the
  severity. Reply with one sentence; if it is critical, say so plainly so a human sees it.

One commit per review round. After two rounds, stop and ask a maintainer to review
scope rather than addressing more automated findings. Full rule: AGENTS.md.

1 finding(s): 🔴 0 critical · 🟠 0 major · 🔵 1 minor

None could be anchored to changed lines; they are listed below.

Findings outside the changed lines

1 minor

• 🔵 DEPLOY.md:235 — DEPLOY.md tells users to switch to clickhouse/clickstack before that image has been published → Until the next release, clickhouse/clickstack has no tags. The PR description says so, and DEPLOY.md:41 in this same diff still uses hyperdx/hyperdx:2-beta for that reason. Yet the new table lists it, and the note says "Switch to the clickhouse/clickstack-* names now", so anyone who follows the doc today gets manifest unknown. Fix: leave the app row out of the table until chore: point the repo at ClickHouse/ClickStack ahead of the transfer #3553 lands, or mark it "available from the next release". Also, release.yml:782 only checks whether hyperdx/hyperdx:<version> exists, so if the version doesn't change the release is skipped and the new image is never pushed.

---

_{Severity is the reviewer's own estimate and is used for ordering, not filtering. No finding blocks merge automatically; a maintainer decides.}

[github-actions]

Duplicate code analysis

No new duplicate code introduced by this PR.

---

jscpd compared this branch against origin/main
across app, api and common-utils. Only new clones are listed; the codebase
currently holds 114 in total (1.40%).
Run yarn dupes locally to reproduce, or yarn dupes:all for the full picture.

[github-actions]

Deep Review

Infrastructure + docs change: dual-publishes the app image as clickhouse/clickstack alongside hyperdx/hyperdx, and removes the now-dead ghcr.io login steps plus packages: write. No executable application code changed. The CI-safety core is sound — verified independently that no ghcr.io reference survives anywhere in the workflows, the surviving GITHUB_TOKEN usages are GitHub-API calls covered by the retained contents: write / pull-requests: write perms (build caches use type=gha, not a registry), the per-arch → manifest tag mapping is symmetric in both the release and nightly app jobs, and NEXT_IMAGE_NAME_DOCKERHUB is wired into every place IMAGE_NAME_DOCKERHUB appears.

✅ No critical issues found.

🟡 P2 -- recommended

• DEPLOY.md:16 -- The new "Container image names" table states the listed images "are published to Docker Hub" and includes bare clickhouse/clickstack, but that image is first published only by the release after this merge, so a reader who repoints a deployment to it in the interim hits a manifest unknown pull failure.
  • Fix: Mark bare clickhouse/clickstack as available starting with the next release rather than presenting it as already published.
  • _{ce-correctness-reviewer}
• .github/workflows/release.yml:909 -- The legacy and new tags are pushed in a single build-push-action step with push: true, so if the clickhouse/clickstack Docker Hub repo does not exist or the push account lacks write access to the clickhouse org, the whole build-app job fails and takes the existing hyperdx/hyperdx publish and publish-app down with it (same coupling at release-nightly.yml:124).
  • Fix: Confirm the clickhouse/clickstack repo exists and is public/writable by the release credentials before the next release; the org access other clickstack-* repos already prove makes this a verification, not a code change.
  • _{ce-reliability-reviewer, ce-correctness-reviewer}

🔵 P3 nitpicks (1)

• DEPLOY.md:102 -- This diff changes the local example to the pinned tag clickstack-local:2 while LOCAL.md and README.md leave the same image family untagged (implicit :latest), an inconsistent tagging convention introduced within one PR.
  • Fix: Use one convention across DEPLOY.md, LOCAL.md, and README.md — either consistently pin :2 or consistently leave untagged.

---

Reviewers (2): ce-reliability-reviewer, ce-correctness-reviewer.

Testing gaps: No pre-flight check verifies the clickhouse/clickstack repo exists and is writable before the coupled push; the first release run is the first validation. No check verifies image names/tags cited in docs resolve to existing Docker Hub tags.

_{Scope note: untracked ce-plugin/ and shell dotfiles were excluded from review (tooling, not part of this PR). The prior-comments file contained only bot output (Vercel, changeset, triage, jscpd, e2e) — no human review feedback to verify.}

_{No finding blocks merge automatically. A maintainer will expect P0/P1 findings in code this PR changes to be fixed; P2/P3 are your call -- fix or reply. Never fix findings about surrounding code here; reply instead. Do not widen the PR. How to respond}

[github-actions]

E2E Test Results

✅ All tests passed • 462 passed • 1 skipped • 1392s

Status	Count
✅ Passed	462
❌ Failed	0
⚠️ Flaky	1
⏭️ Skipped	1

Tests ran across 4 shards in parallel.

View full report →