[APPS][Connections Part 2] Extract inline backend connection IDs

[sdkennedy2]

Motivation

Backend manifests currently carry required allowedConnectionIds arrays, but they remain empty.

This PR extracts connectionIds that are statically defined within action catalog function calls such as the following:

import { request } from '@datadog/action-catalog/http/http';

export function run() {
    return request({ connectionId: '358b602d-794f-420e-9802-3caca434060a', inputs: {} });
}

This should include '358b602d-794f-420e-9802-3caca434060a' in allowedConnectionIds.

Changes

Adds the inline connection ID extractor in the same module structure used by the follow-up static value resolution work:

• action-catalog-imports.ts collects action-catalog function and namespace imports.
• action-catalog-call-sites.ts uses eslint-scope and the internal walkAst helper from [APPS][Connections Part 1] Add internal AST traversal helper #350 to find action-catalog call sites while staying safe around shadowed names and unsupported aliases.
• connection-id-values.ts reads the connectionId property from a known action-catalog call and extracts inline string literals.
• extract-connection-ids.ts stays as the small public orchestration layer used by backend proxy module generation.

extractConnectionIds does the following for each *.backend.ts file:

1. Collects the names imported from the action catalog library.

2. Uses eslint-scope to map identifiers back to their declarations. This lets us distinguish an actual action-catalog import from a local binding with the same name, such as this shadowed request parameter:

   import { request } from '@datadog/action-catalog/http/http';
   
   export function run(request) {
       return request({ connectionId: 'ignored', inputs: {} });
   }

3. Uses the internal walkAst helper from [APPS][Connections Part 1] Add internal AST traversal helper #350 to traverse the ESTree AST for each *.backend.ts file.

4. Finds action-catalog call sites and extracts inline string connectionId values.

5. Fails closed for action-catalog call shapes that could hide a connection ID.

Added dependencies

• eslint-scope: despite the name, this package is focused on ESTree scope analysis. It lets us resolve each identifier to the declaration it actually references, which is what makes shadowing-safe extraction possible.
• rollup as a dev dependency because the tests need parseAst to create the same Rollup ESTree shape that plugin this.parse() provides. Vite re-exports parseAst from its ESM API, but this repo's Jest/ts-jest setup loads Vite through its CJS facade, where Vite intentionally throws for parseAst. Importing rollup/parseAst directly keeps the tests simple and avoids adding a misleading Vite test shim.

QA Instructions

Added extractor tests.

Validated with /Users/scott.kennedy/dd/test-action-catalog-app by building the linked local Vite plugin, redirecting app upload to a local capture server, and inspecting the captured manifest. A temporary backend entrypoint with one inline string connectionId and one shadowed catch (request) call produced only the inline ID in allowedConnectionIds.

Blast Radius

This affects backend manifest connection ID extraction during the apps plugin build/dev-preview flow. It adds a direct eslint-scope runtime dependency to @dd/apps-plugin, plus a rollup dev dependency for parser-backed tests. AST traversal comes from the internal helper added in #350.

Documentation

• Not applicable.

[sdkennedy2]

• [APPS][Connections Part 2] Extract inline backend connection IDs #349 : 2 dependent PRs (#351 , #352 ) 👈 (View in Graphite)
• [APPS][Connections Part 1] Add internal AST traversal helper #350
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5740b4654b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sdkennedy2]

@codex review
@cursor review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e8b5f13859

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[sdkennedy2]

AI validation note:

I revalidated this PR with /Users/scott.kennedy/dd/test-action-catalog-app using the linked local @datadog/vite-plugin built from this branch.

Validated paths:

• Upload/build path: DD_APPS_UPLOAD_ASSETS=1 ... npm run build succeeded, built all 3 backend functions, uploaded the 7-file archive, and published version 02c7302bb790dcef live on staging.
• Dev-server path: npm run dev plus a direct /__dd/executeAction call succeeded for a backend function with an inline @datadog/action-catalog/http/http connectionId; the HTTP probe returned success: true, ok: true, and status 200.

Scope note: the original test-app shape had the action-catalog call in an imported helper module. That failed closed with Datadog's expected allowlist error because this PR extracts inline connection IDs from the .backend.ts file itself, not from imported helper modules. Moving the action-catalog call into the backend file validated the intended #349 behavior.