Deploy through the Datadog Apps CLI instead of the build plugins - #105
Deploy through the Datadog Apps CLI instead of the build plugins#105oliverli wants to merge 7 commits into
Conversation
The build plugins no longer upload or publish; @datadog/apps-cli owns build, upload, and publish. Replace the build-command step (which relied on DATADOG_APPS_UPLOAD_ASSETS=1) with a CLI install followed by `datadog-apps deploy`. Site and version name (GITHUB_SHA) are passed as CLI flags; only the API and app keys go through the environment.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cf2ff443d7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
When the app's package.json lists @datadog/apps-cli as a dependency, run that pinned version with `npx datadog-apps deploy` instead of installing the CLI globally. The cli-version input now applies only to the global-install fallback.
npm accepts an empty string as a dependency range (equivalent to `*`), so check property presence rather than the value when detecting @datadog/apps-cli in package.json. Also narrow the malformed-package.json comment to what the fallback actually guarantees.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e50f82972e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
A custom install command can skip the section that lists the CLI (for example `npm ci --omit=dev`), and bare `npx datadog-apps` then fetches the unrelated registry package `datadog-apps` instead of failing. Search node_modules/.bin upward from the app directory — the same way npx resolves binaries — and fall back to a global install when the binary is absent.
npm install --global requires write access to npm's global prefix, which self-hosted runners may not grant, and mutates shared runner state. Run the deploy through npx in both cases instead: the project's installed binary when present, else npx --package @datadog/apps-cli@<cli-version>, which fetches the pinned package into the runner user's npx cache.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0e406ff2ce
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
3 participants
Summary
With upload and publish API calls removed from the Datadog build plugins, the deploy action now runs
datadog-apps deploythroughnpx— using the@datadog/apps-clialready installed in the app'snode_moduleswhen present, otherwise the version pinned by the newcli-versioninput (fetched into the runner user's npx cache; no global install).Release note: the
@datadog/apps-cliversion currently on npm (0.0.1) is a stub — merge and release this action only after the real CLI version publishes under the same package name. No further code changes will be needed; workflows can pin the exact version via the newcli-versioninput.Implementation details
src/main.ts: after the dependency install, the action runsnpx --yes datadog-apps deployin the app directory whennode_modules/.bin/datadog-appsis installed (searching upward from the app directory, the way npx resolves binaries — monorepo-hoisted CLIs count); otherwisenpx --yes --package @datadog/apps-cli@<cli-version> datadog-apps deploy. Nonpm install --global: no write access to npm's global prefix, no shared runner state mutated.npm ci --omit=dev), and barenpx datadog-appswould then fetch the unrelated registry packagedatadog-apps. With the binary absent the action falls back to the pinned--packageform, so the unrelated package can never be fetched.--site <datadog-site>(when set) and--version-name <GITHUB_SHA>(when set). OnlyDATADOG_API_KEYandDATADOG_APP_KEYgo through the environment, which is where the CLI reads them from; this keeps the keys out ofargvand runner logs.DATADOG_APPS_UPLOAD_ASSETSis gone — nothing reads it anymore; the CLI drives the build (the project's ownbuildscript, package manager detected from lockfiles) and packages the bundle itself.build-command(the CLI owns the build invocation now); added optionaldatadog-site(else the CLI resolves fromDD_SITE/DATADOG_SITEordatadog-app.config.json) andcli-version(defaultlatest, ignored when the project has the CLI installed).package.jsonversion bumped0.0.2→0.1.0(breaking input removal, pre-1.0 minor).dist/regenerated.Changes to dependencies
None at build time. The action fetches
@datadog/apps-cliat run time via npx when the project does not install it itself.Review
Parallel reviewer agents plus the Codex review pass were addressed: the P1 (bare
npx datadog-appscould fetch an unrelated registry package when the declared CLI was not actually installed) is fixed by selecting on the installed binary; the P2 (npm install --globalneeds global-prefix write access) is fixed by the npx-only design.Breaking change for action consumers: the
build-commandinput no longer exists — move any custom build logic into the project'sbuildscript.