[setnilson]

Motivation

PR #14 merged with a green deploy and scott-mountains never went live. The deploy job built the app, wrote a zip to the runner, and exited 0 without ever contacting Datadog.

@datadog/vite-plugin 3.3.0 removed the in-build upload and publish path. Diffing the tarballs:

string in bundle	3.2.12	3.3.0	3.4.0-dev.1
upload assets	✅	❌	❌
Published uploaded version	✅	❌	❌
App package written to	❌	✅	✅

Every app's upload script was DD_APPS_UPLOAD_ASSETS=1 vite build, which depended on that path. (That env var is read by neither version — uploading in 3.2.x was driven purely by apps.enable plus auth during the build, so the variable was always decorative.) The root range is ^3.2.1, so when #14 regenerated package-lock.json from scratch it floated 3.2.12 → 3.3.0 and upload silently became build. Nothing in the pipeline noticed: the plugin exits 0, and the job's only failure modes were a missing-secrets check and a build error.

This affected every app in the repo, not just scott-mountains — the next deploy of clock or k8s-pods would have no-opped the same way.

Changes

Uploading moves to @datadog/apps-cli, which is what @datadog/create-apps@0.2.0 now pairs with plugin 3.3.x.

• Root package.json — add @datadog/apps-cli (>=0.0.2 <0.1.0, matching the scaffolder), move the plugin range to ^3.3.0. The lockfile change is additions only: 32 new packages, zero version changes, zero removals — deliberately not a full regeneration, since that is what caused this.
• Each app's upload script → npx datadog-apps upload. One-line diffs; dev and build stay on plain Vite, which is still correct.
• Deploy workflow — run the root-installed binary from each app's directory (so it picks up that app's datadog-app.config.json) with --version-name "$GITHUB_SHA", and fail the step if the CLI exits 0 without printing Published version. The CLI already throws on its own failure paths; this guard is the backstop against the whole class of silent-no-op regressions.
• Agent docs — docs/agents/scaffolding.md pitfall Add Barak Rainbow app #1 actively instructed the next agent to replace the generated CLI scripts with bare Vite scripts, because the old @datadog/apps package 404'd. That is how this happened. Rewritten, along with the stale upload/publish guidance in build-upload-auth.md (plus three per-app copies) and cicd.md.

Testing

• npm ci reproduces the lockfile; node_modules/.bin/datadog-apps links correctly.
• npm run typecheck, npm run lint, and npm run build all pass — all 11 apps build.
• Ran the exact CI invocation from an app directory: datadog-apps upload --help resolves and --version-name is a real flag.
• datadog-apps build from apps/scott-mountains succeeds credential-free and emits the zip the CLI uploads, confirming the new split (plugin packages, CLI uploads).
• Negative test: datadog-apps upload with no credentials in a non-interactive shell exits 1 with No login is saved for datad0g.com — it fails loudly rather than no-opping, and no browser is opened.
• Verified the new guard would have caught the original failure: a build-only run prints App package written… / App build complete. and never Published version, so grep -q fires.

No upload was run against Datadog from this branch.

Note on merge

Every app's package.json changed, so the change-detection step will select all 11 apps and upload them one matrix leg each. That is intended here — they have all been silently un-deployed since the plugin bump, so this re-syncs them and exercises the new path on every app.

Follow-up not in this PR

docs/agents/build-upload-auth.md has pre-existing drift beyond the upload path — it documents npm run deploy / npm run publish scripts, --no-publish, DD_APPS_PUBLISH, keyring OAuth, and .env.local, none of which match this workspace or the current CLI. I fixed only what describes the path this PR changes. Happy to do a full docs pass separately.

🤖 Generated with Claude Code