feat(ci): integrate Datadog CI products for enhanced visibility

[platinummonkey]

Summary

Integrates Datadog CI products (Test Visibility, Code Coverage, CI Pipeline Visibility, and Static Analysis) to monitor and improve the pup development pipeline using Datadog's own products.

Changes

GitHub Actions Workflow

• Test Visibility: Instrument Go tests with orchestrion for automatic test result reporting (.github/workflows/ci.yml:L39-L51)
• Code Coverage: Upload coverage reports to Datadog using datadog-ci CLI (.github/workflows/ci.yml:L93-L100)
• CI Pipeline Visibility: Track GitHub Actions workflow execution with full git history
• Static Analysis (SAST): Add security scanning job that runs on pull requests (.github/workflows/ci.yml:L308-L336)
• Graceful degradation when Datadog credentials not configured

Configuration Files

• .datadog-ci.json - Configuration for datadog-ci CLI with coverage format and SAST rules
• Added environment variables: DD_ENV=ci, DD_SERVICE=pup

Documentation

• docs/DATADOG_CI.md (392 lines) - Comprehensive guide covering:

  • Product features and benefits
  • Setup requirements and configuration
  • Local development usage
  • Troubleshooting guide
  • Cost considerations and optimization

• docs/DATADOG_CI_SETUP.md (330 lines) - Step-by-step setup guide:

  • Credential acquisition walkthrough
  • GitHub Secrets configuration steps
  • Integration verification checklist
  • Maintenance procedures

• Updated docs/TESTING.md and CLAUDE.md to reference new documentation

Products Integrated

Product	Purpose	View Results
Test Visibility	Track test performance, detect flaky tests, historical trends	Dashboard
Code Coverage	Per-commit coverage tracking, trend analysis, regression detection	Dashboard
CI Pipeline Visibility	Monitor workflow duration, job performance, identify bottlenecks	Dashboard
Static Analysis (SAST)	Security vulnerability detection, code quality analysis	Dashboard

Testing

Local Testing (without Datadog credentials)

# Workflow runs without Datadog integration
go test -v -race ./...
✅ Tests pass as normal

With Datadog Credentials

# Set up credentials
export DD_API_KEY="your-api-key"
export DD_SITE="datadoghq.com"

# Run with orchestrion
go install github.com/DataDog/orchestrion@latest
orchestrion go test -v ./...
✅ Tests reported to Datadog Test Visibility

# Upload coverage
npm install -g @datadog/datadog-ci
datadog-ci coverage upload --format=go-cover coverage.out
✅ Coverage uploaded to Datadog

CI Testing

• ✅ Workflow validates without secrets (graceful degradation)
• ✅ Tests run successfully with orchestrion when DD_API_KEY provided
• ✅ Coverage upload succeeds with valid credentials
• ✅ SAST scan runs on pull requests only
• ✅ All existing jobs continue to function

Setup Requirements

Required GitHub Secrets (optional for graceful degradation):

• DD_API_KEY - Datadog API key (required for all features)
• DD_APP_KEY - Datadog Application key (required for SAST)
• DD_SITE - Datadog site (optional, defaults to datadoghq.com)

See DATADOG_CI_SETUP.md for detailed setup instructions.

Benefits

• ✅ Enhanced Test Visibility - Track test performance, detect flaky tests automatically
• ✅ Coverage Trends - Monitor coverage over time, prevent regressions
• ✅ Security Scanning - Automatic vulnerability detection in pull requests
• ✅ Pipeline Monitoring - Identify CI bottlenecks and optimize build times
• ✅ Dog-fooding - Use Datadog's own products for Datadog CLI development
• ✅ Zero Breaking Changes - Graceful degradation when credentials not configured

Cost Considerations

• Test Visibility: Charged per test execution (~163 tests per run)
• Code Coverage: Included with Test Visibility
• SAST: Charged per analyzed commit (PR-only to minimize usage)
• CI Pipeline: Per pipeline run

See docs/DATADOG_CI.md for cost optimization strategies.

Related Issues

N/A - New feature enhancement

Breaking Changes

None - All changes are additive and degrade gracefully without Datadog credentials.

---

🤖 Generated with Claude Code

[github-actions]

📊 Test Coverage Report

Overall Coverage: 82.4%

Threshold: 80% ✅

Coverage by Package

## Coverage by Package

- github.com/DataDog/pup/pkg/auth/callback/server.go:40: 81.2%
- github.com/DataDog/pup/pkg/auth/dcr/client.go:28: 100.0%
- github.com/DataDog/pup/pkg/auth/dcr/types.go:24: 100.0%
- github.com/DataDog/pup/pkg/auth/oauth/client.go:22: 100.0%
- github.com/DataDog/pup/pkg/auth/oauth/pkce.go:24: 85.7%
- github.com/DataDog/pup/pkg/auth/storage/factory.go:53: 94.7%
- github.com/DataDog/pup/pkg/auth/storage/keychain.go:44: 42.9%
- github.com/DataDog/pup/pkg/auth/storage/storage.go:58: 71.4%
- github.com/DataDog/pup/pkg/auth/types/types.go:23: 100.0%
- github.com/DataDog/pup/pkg/client/auth_validator.go:79: 100.0%
- github.com/DataDog/pup/pkg/client/client.go:32: 100.0%
- github.com/DataDog/pup/pkg/config/alias.go:26: 100.0%
- github.com/DataDog/pup/pkg/config/config.go:22: 100.0%
- github.com/DataDog/pup/pkg/formatter/formatter.go:31: 100.0%
- github.com/DataDog/pup/pkg/useragent/useragent.go:32: 100.0%
- github.com/DataDog/pup/pkg/util/time.go:29: 96.0%

## Summary

total:								(statements)		82.4%

---

📈 Coverage Status: ✅ PASSED - Coverage meets minimum threshold

_{Updated for commit d83c87d}

[datadog-datadog-prod-us1]

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

🎯 Code Coverage
• Patch Coverage: 85.11%
• Overall Coverage: 79.44%

View detailed report

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: b9412d2 | Docs | Datadog PR Page | Was this helpful? Give us feedback!}