Make the apps plugin build-only: move upload, publish, and OAuth to apps-cli by oliverli · Pull Request #494 · DataDog/build-plugins

oliverli · 2026-08-28T19:49:46Z

Summary

The apps plugin is now build-only. @datadog/apps-cli owns everything that touches Datadog APIs: OAuth, app identity, deploy settings, uploading, and publishing.

A production vite build writes a single datadog-app-assets.zip (frontend + backend + manifest.json) next to the Vite output. Packaging makes no API requests.

For the dev server, authentication is resolved from the environment: DD_API_KEY + DD_APP_KEY first, then DD_OAUTH_ACCESS_TOKEN (passed by datadog-apps dev, per the RFC on OAuth multi-org credential management in the apps CLI).

Details

Removed

Upload & publish paths: upload.ts, vite/handle-upload.ts, and their tests.
OAuth flow: core/helpers/oauth-request.ts (browser auth, keychain storage, token refresh) and its test. OAuth now lives entirely in apps-cli, which passes a resolved access token via DD_OAUTH_ACCESS_TOKEN.
Identity resolution: identifier.ts (identifier/name computed from git remote / package.json). apps-cli resolves the app's identity at deploy time.
Removed options: apps.dryRun, apps.identifier, apps.name, apps.description, apps.selfService, apps.permissions (and the AuthMethod/AppsProtectionLevel types), apps.authOverrides.
Removed env vars: DD_APPS_INTAKE_URL, DD_APPS_PUBLISH, DD_APPS_UPLOAD_ASSETS, DD_APPS_VERSION_NAME, DD_APPS_AUTH_METHOD (and DATADOG_ aliases).
Removed dependencies: @napi-rs/keyring and oauth4webapi from core and all five published packages (both were OAuth-only), plus the chalk dep in the apps plugin.
Dead code: siteSubdomain on AuthOptionsWithDefaults (written, never read), getHighestPackageJsonDir (test-only), APPS_API_PATH, hasActionCatalogImports, unused post-message transport types.

Notes for reviewers

The manifest inside the zip is now only { backend: { functions } } — the deploy-time settings (description, permissions, self-service) are apps-cli's concern.
apps.longPolling and the local-execution (?dd-local-exec) work recently merged to master are preserved; the long-poll option threads through the same validate/types surface this PR rewrites.
The dev server warns once at startup when no credentials are configured; individual /__dd/executeAction requests return 400 with guidance.
packages/published/vite-plugin/package.json is reindented (2-space) but semantically unchanged except the two removed dependencies; workspace exports["."] still points at source, publishConfig.exports at dist.
LICENSES-3rdparty.csv, yarn.lock, .yarn/cache, CODEOWNERS, and the oss/apply.ts license overrides are regenerated/purged accordingly.

Verification

All apps/core/factory unit suites pass (637 tests), including the long-polling and local-execution tests ported from master.
Typecheck, lint, and yarn cli integrity (link checks) pass.
Repo-wide greps confirm no remaining references to any removed symbol, option, or env var.

oliverli · 2026-08-28T19:49:59Z

This stack of pull requests is managed by Graphite. Learn more about stacking.

datadog-datadog-prod-us1-2 · 2026-08-28T19:52:49Z

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: a8a18a9 | Docs | View more details | Give us feedback!}

chatgpt-codex-connector · 2026-09-02T19:33:22Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T20:08:57.423062Z	`a8a18a9`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 46462ed6e0

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-02T19:36:53Z

+                await buildAppPackage({
                    backendOutputs,
                    backendFunctions,
                    context,
-                    doAuthenticatedRequest,
                    options,
                });


Restrict package generation to production builds

Vite 6 also invokes closeBundle when a development server's plugin container closes, so stopping vite dev executes this call. If dist contains an existing production package, buildAppPackage deletes and replaces it using stale frontend output and only the backend functions discovered during that dev session, potentially leaving an incomplete archive for a subsequent datadog-apps upload. Gate this hook on Vite's build command, or split the production and development hooks into separately applied plugins.

Useful? React with 👍 / 👎.

Verified and fixed in a8a18a9.

The behavior is real: confirmed in the Vite 6.3.5 source that dev server shutdown → pluginContainer.close() → closeBundle fires unconditionally, so a vite dev exit was re-running the backend build and re-packaging (and deleting the existing dist zip first).

The P1 impact isn't reachable, though: datadog-apps upload/deploy always trigger their own fresh vite build as a child process with DATADOG_APPS_PACKAGE_DIR pointed at a controlled directory, so the zip in the project's dist is never the upload source. The dev-session-derived archive couldn't have been consumed.

Still worth guarding for the residual issues: wasted nested build + packaging on every dev exit, deletion of any manual vite build output in dist, and a possible noisy rejection at shutdown if the dev session surfaced an invalid backend file.

The guard: configureServer (dev-only hook) marks the session; closeBundle skips packaging when that flag is set. Covered by a test that starts a dev session then asserts closeBundle neither builds backend functions nor packages.

Squashed from 8 commits (see git reflog b84888d for prior history) ahead of rebasing onto master's upload/publish removal (PR #494). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

oliverli mentioned this pull request Aug 28, 2026

Remove OAuth from the dev server and use DD_OAUTH_ACCESS_TOKEN passed by the apps CLI #495

Closed

oliverli changed the title ~~Remove app upload/publish API calls from build plugins~~ Remove app upload/publish API calls from the apps plugin Aug 28, 2026

oliverli force-pushed the oliverli/remove-app-upload/publish-api-calls-from-build-plugins branch from 5e76625 to b09d7f1 Compare August 28, 2026 20:24

oliverli changed the title ~~Remove app upload/publish API calls from the apps plugin~~ Remove app upload, publish, and OAuth from the apps plugin; apps-cli now owns deploy and auth Aug 28, 2026

oliverli force-pushed the oliverli/remove-app-upload/publish-api-calls-from-build-plugins branch from b09d7f1 to b8a6a16 Compare August 28, 2026 21:06

oliverli changed the title ~~Remove app upload, publish, and OAuth from the apps plugin; apps-cli now owns deploy and auth~~ Make the apps plugin build-only: move upload, publish, and OAuth to apps-cli Aug 28, 2026

oliverli force-pushed the oliverli/remove-app-upload/publish-api-calls-from-build-plugins branch from b8a6a16 to 620d3f9 Compare August 28, 2026 21:24

Remove app upload/publish API calls from build plugins

b0b9366

oliverli force-pushed the oliverli/remove-app-upload/publish-api-calls-from-build-plugins branch from 620d3f9 to 46462ed Compare September 2, 2026 19:26

oliverli marked this pull request as ready for review September 2, 2026 19:33

oliverli requested review from a team as code owners September 2, 2026 19:33

oliverli requested review from wfa207 and removed request for a team September 2, 2026 19:33

wfa207 approved these changes Sep 2, 2026

View reviewed changes

chatgpt-codex-connector Bot reviewed Sep 2, 2026

View reviewed changes

Remove OAuth from dev server, use DD_OAUTH_ACCESS_TOKEN instead

a8a18a9

oliverli force-pushed the oliverli/remove-app-upload/publish-api-calls-from-build-plugins branch from 46462ed to a8a18a9 Compare September 2, 2026 20:04

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: queued mergequeue-status: in_progress and removed mergequeue-status: queued labels Sep 2, 2026

gh-worker-dd-mergequeue-cf854d Bot merged commit 38a205c into master Sep 2, 2026
5 checks passed

gh-worker-dd-mergequeue-cf854d Bot deleted the oliverli/remove-app-upload/publish-api-calls-from-build-plugins branch September 2, 2026 20:43

gh-worker-dd-devflow-36fce6 Bot added mergequeue-status: done and removed mergequeue-status: in_progress labels Sep 2, 2026

Navigation Menu

Uh oh!

Make the apps plugin build-only: move upload, publish, and OAuth to apps-cli - #494

Make the apps plugin build-only: move upload, publish, and OAuth to apps-cli#494
gh-worker-dd-mergequeue-cf854d[bot] merged 2 commits into
masterfrom
oliverli/remove-app-upload/publish-api-calls-from-build-plugins

oliverli commented Aug 28, 2026 •

edited

Loading

Uh oh!

oliverli commented Aug 28, 2026

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Aug 28, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot commented Sep 2, 2026 •

edited

Loading

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Sep 2, 2026

Uh oh!

oliverli Sep 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

oliverli commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Removed

Notes for reviewers

Verification

Uh oh!

oliverli commented Aug 28, 2026

Uh oh!

datadog-datadog-prod-us1-2 Bot commented Aug 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

oliverli Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

oliverli commented Aug 28, 2026 •

edited

Loading

datadog-datadog-prod-us1-2 Bot commented Aug 28, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Sep 2, 2026 •

edited

Loading