[APPS][Connections Part 1] Add backend connection manifest upload plumbing

[sdkennedy2]

Motivation

Backend Functions that use connections need to provide a static list of allowed connection ids. When the backend function executes only connections defined within this list can be used as part of an action defined within the backend function.

In the following example: 'c1ef81d2-78e6-4e4c-bf30-9c04f448d0a2' would need to be defined in the allowed connection ids for listHosts.

import { listHosts as listHostsAction, type ListHostsResponse } from '@datadog/action-catalog/dd/hosts';

export async function listHosts(filter?: string): Promise<ListHostsResponse> {
    const response = await listHostsAction({
        inputs: {
            filter: filter ?? '*',
            count: 10,
            include_hosts_metadata: true,
        },
        connectionId: 'c1ef81d2-78e6-4e4c-bf30-9c04f448d0a2'
    });

    return response;
}

The allowed connection ids needs to be submitted to the backend during app upload as part of the manifest.json file (more details in the RFC here).

For this example the expected manifest.json would look like the following:

{
  "backend": {
    "functions": {
      "YzFlZjgxZDItNzhlNi00ZTRjLWJmMzAtOWMwNGY0NDhkMGEy.listHosts": {
        "allowedConnectionIds": ['c1ef81d2-78e6-4e4c-bf30-9c04f448d0a2']
      }
    }
  }
}

Changes

Adds the plumbing necessary to submit allowedConnectionIds as part of the manifest.json and when testing backend functions as part of the dev server.

Initially allowedConnectionIds will always be empty. Connection ID extraction is intentionally deferred to follow-up PRs in this stack.

QA Instructions

E2E and unit tests added. We can run those.

Blast Radius

This affects the apps Vite plugin backend function transform, upload archive assembly, and dev-preview execution payloads. The first PR emits empty allowlists only, so it establishes structure without enabling connection-using actions.

Documentation

• How to reliably make frontend production changes
• PR Description Guidelines
• Deploy steps

[sdkennedy2]

• [APPS][Connections Part 4] Analyze backend connection IDs across modules #341
• [APPS][Connections Part 3] Resolve same-module backend connection IDs #340
• [APPS][Connections Part 2] Extract inline backend connection IDs #339
• [APPS][Connections Part 1] Add backend connection manifest upload plumbing #338 👈 (View in Graphite)
• [APPS] Stop exposing raw index.html standalone URL #329 : 1 other dependent PR (#330 )
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[datadog-datadog-prod-us1]

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 8aeb377 | Docs | Datadog PR Page | Give us feedback!}

[sdkennedy2]

@codex review
@cursor review

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d230cbd1d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Upload the manifest even when no frontend assets exist

Because this manifest is created only after the earlier if (!assets.length) return guard, any build where collectAssets() finds no frontend files skips the new manifest entirely, and also skips any backend outputs passed into handleUpload. In a backend-only app or an empty frontend output directory, getBackendFunctions()/backendOutputs can still be non-empty, but no manifest.json connection allowlist is archived or uploaded. Move the no-assets decision until after backend bundles and the manifest have been appended, or base it on the final allAssets list.

Useful? React with 👍 / 👎.

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. 👍

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sdkennedy2]

We will populate this value in a later PR.

[yoannmoinet]

LGTM