Upload PostHog source maps during builds

Dockerfile

@@ -26,7 +26,17 @@ ENV TRACKER_API_BASE=$TRACKER_API_BASE
 ENV NEXT_PUBLIC_SITE_URL=$NEXT_PUBLIC_SITE_URL
 ENV NEXT_PUBLIC_POSTHOG_TOKEN=$NEXT_PUBLIC_POSTHOG_TOKEN
 
-RUN pnpm run build
+# PostHog source map upload configuration. The project ID is not sensitive and
+# can be passed as a build argument. Pass POSTHOG_API_KEY as a BuildKit secret
+# so it is not persisted in the image history or build cache.
+ARG POSTHOG_PROJECT_ID
+ENV POSTHOG_PROJECT_ID=$POSTHOG_PROJECT_ID
+
+RUN --mount=type=secret,id=POSTHOG_API_KEY \
+    if [ -f /run/secrets/POSTHOG_API_KEY ]; then \
+      export POSTHOG_API_KEY="$(cat /run/secrets/POSTHOG_API_KEY)"; \
+    fi; \
+    pnpm run build
 
 FROM base AS runner
 WORKDIR /app

next.config.ts

@@ -1,3 +1,4 @@
+import { withPostHogConfig } from "@posthog/nextjs-config";
 import type { NextConfig } from "next";
 
 const nextConfig: NextConfig = {
@@ -164,4 +165,16 @@ const nextConfig: NextConfig = {
   },
 };
 
-export default nextConfig;
+const posthogApiKey = process.env.POSTHOG_API_KEY;
+const posthogProjectId = process.env.POSTHOG_PROJECT_ID;
+
+export default withPostHogConfig(nextConfig, {
+  personalApiKey: posthogApiKey ?? "",
+  projectId: posthogProjectId,
+  sourcemaps: {
+    // Keep builds working in local development and deployments where source
+    // map upload credentials have not been configured yet.
+    enabled: Boolean(posthogApiKey && posthogProjectId),
+    deleteAfterUpload: true,
+  },
+});

package.json

@@ -19,6 +19,7 @@
     "@buildcanada/colours": "^0.3.3",
     "@buildcanada/components": "^0.3.5",
     "@cloudflare/stream-react": "^1.9.3",
+    "@posthog/nextjs-config": "^1.9.68",
     "@radix-ui/react-checkbox": "^1.3.3",
     "@radix-ui/react-label": "^2.1.7",
     "@radix-ui/react-select": "^2.2.5",