…p that triggers the build (#23063)

* Pass PACKAGE_BASE_URL to triggered agent builds

When integrations-core triggers agent CI builds, pass PACKAGE_BASE_URL
pointing to dev storage. This prepares for lockfiles switching to
${PACKAGE_BASE_URL}/... format so PR-triggered builds use dev wheels.
No-op today since current lockfiles use hardcoded URLs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* Update ddev size tools to handle both lockfile URL formats

Support both the legacy hardcoded URL format and the new
\${PACKAGE_BASE_URL}/... template format in lockfile entries.
Resolves \${PACKAGE_BASE_URL} to the stable base URL before
downloading wheels for size calculations.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Upload wheels to dev/ prefix and use \${PACKAGE_BASE_URL} in lockfiles

Wheels are now uploaded to dev/{artifact_type}/{project_name}/ paths
in GCS instead of the unprefixed paths. Lockfile entries are templated
with \${PACKAGE_BASE_URL} so pip resolves the URL at install time using
either the dev or stable base URL depending on the environment.

Also fix brittle index extraction in generate_artifact_listings and
list_wheels_with_prefix to use split('/')[-1] and split('/')[-2]
instead of hardcoded indices.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Update promote.py to parse \${PACKAGE_BASE_URL} lockfile format

Lockfiles now use \${PACKAGE_BASE_URL}/... template entries instead of
hardcoded URLs. Update url_to_blob_path to extract the relative path
from \${PACKAGE_BASE_URL}/... entries, then prepend dev/ when looking up
blobs in GCS and stable/ for the promotion destination.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Change publish job to run on PRs only and commit lockfiles to branch

Instead of creating a separate PR with updated lockfiles, the publish
job now commits them directly to the PR branch. This collapses the
two-PR dependency update workflow into a single PR.

- Trigger: pull_request only (remove push and workflow_dispatch)
- Permission: contents: write (needed for git push)
- Token: GitHub App token checked out before checkout so push works
- Replace peter-evans/create-pull-request with a git commit + push step

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add promote-gate and promote-wheels workflows

promote-gate.yaml runs on every PR push to master/7.*.*. If dependency
files (agent_requirements.in or .deps/resolved/) changed, it sets the
promote-wheels commit status to pending, blocking merge. Otherwise it
sets it to success (no promotion needed).

promote-wheels.yaml is triggered via workflow_dispatch (by ddev promote).
It checks out the PR branch at the given SHA, runs .builders/promote.py
to copy wheels from dev/ to stable/ in GCS, then sets the promote-wheels
commit status to success and posts a comment on the PR.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Update upload tests and add promote tests for new lockfile format

test_upload.py: update all blob path assertions to use dev/ prefix
and all lockfile URL assertions to use \${PACKAGE_BASE_URL} format.
Update generate_artifact_listings assertions to use dev/-prefixed paths.

test_promote.py (new): test lockfile parsing, url_to_blob_path,
collect_relative_paths, GCS copy with correct dev/stable paths,
idempotency, and failure on missing source blobs.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* add changelog

* Update dependency resolution [skip ci]

* Replace PACKAGE_BASE_URL with INTEGRATIONS_WHEELS_STORAGE

PACKAGE_BASE_URL was a full URL env var, which is more than needed and
potentially dangerous. Replace it with INTEGRATIONS_WHEELS_STORAGE whose
value is only "dev" or "stable".

Lockfile entries now use the form:
  https://agent-int-packages.datadoghq.com/\${INTEGRATIONS_WHEELS_STORAGE}/...

The base domain is hardcoded; only the storage tier is variable. This
limits what a compromised env var could redirect to.

Update all affected files: upload.py, promote.py, size tools, tests,
build_agent.yaml, and the promotion workflows.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Rename promotion workflows to dependency-wheel-promotion{,-gate}

Rename promote-gate.yaml -> dependency-wheel-promotion-gate.yaml and
promote-wheels.yaml -> dependency-wheel-promotion.yaml so the two
related workflows sort next to each other and their purpose is explicit.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Fix promote-gate to use GitHub API instead of git diff

The actions/checkout shallow clone does not include the base branch,
so git diff --name-only against origin/<base> fails. Replace the git
command with a GitHub API call (pulls.listFiles) which does not require
a checkout at all.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Skip publish job for fork PRs in resolve-build-deps

Fork PRs cannot access repo secrets (GCS credentials, GitHub App key)
or the Workload Identity Provider used by google-github-actions/auth.
Add !github.event.pull_request.head.repo.fork to the publish job condition
so it only runs on PRs from branches within the repo.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Add ddev dep promote command to trigger wheel promotion

ddev dep promote <PR_URL> extracts the PR number from the URL, fetches
the head SHA and branch from the GitHub API, then dispatches the
dependency-wheel-promotion workflow via workflow_dispatch.

This avoids both wasted runner minutes (no issue_comment polling) and
new infrastructure (no webhook handler). The workflow only runs when
explicitly dispatched.

Also add get_pr_head() and dispatch_workflow() to GitHubManager.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix lint

* codex feedback

* Update dependency resolution [skip ci]

* Enable CI when resolving deps

* Address feedback

* Update dependency resolution [skip ci]

* Temporarily use push trigger on promotion gate for testing

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Update dependency resolution [skip ci]

* Update dependency resolution [skip ci]

* Fix dependency resolution commit message (again)

* Update dependency resolution

* Fix build-agent-auto glob to match .deps subdirectories

The `.deps/*` glob only matches files directly in `.deps/`, not in
subdirectories like `.deps/resolved/`. Use `**/*` to recurse.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Revert "Temporarily use push trigger on promotion gate for testing"

This reverts commit 28fb9d5.

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: dd-agent-integrations-bot[bot] <dd-agent-integrations-bot[bot]@users.noreply.github.com>

…#23194)

* Test Incident_io README changes with new shortcode

* Add webhook_config.json