Skip to content

Commit 1f60386

Browse files
ikraemer-ddikraemer-dd
committed
use dd-octo-sts policies
1 parent 9727dd3 commit 1f60386

File tree

10 files changed

+36
-91
lines changed

10 files changed

+36
-91
lines changed

‎.github/workflows/approved_status.yml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
name: Send PR Approval Status
22

3-
permissions:
4-
contents: read
5-
checks: write
6-
73
on:
84
pull_request:
95
branches:
@@ -16,20 +12,22 @@ on:
1612

1713
jobs:
1814
send_status:
15+
permissions:
16+
contents: read
17+
id-token: write # Required for dd-octo-sts OIDC token
1918
runs-on: ubuntu-latest
2019
if: >
2120
github.event.pull_request.draft == false &&
2221
!contains(github.event.pull_request.labels.*.name, 'ci/skip') &&
2322
!contains(github.event.pull_request.head.ref, 'datadog-api-spec/test/') &&
2423
contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/')
2524
steps:
26-
- name: Get GitHub App token
25+
- name: Get GitHub token via dd-octo-sts
2726
id: get_token
28-
uses: actions/create-github-app-token@v1
27+
uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
2928
with:
30-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
31-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
32-
repositories: datadog-api-spec
29+
scope: DataDog/datadog-api-spec
30+
policy: datadog-api-client-java.approved_status.post-review-status
3331
- name: Post PR review status check
3432
uses: DataDog/github-actions/post-review-status@v2
3533
with:

‎.github/workflows/release.yml‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,5 @@
11
name: Release
22

3-
permissions:
4-
contents: write
5-
pull-requests: write
6-
73
env:
84
GIT_AUTHOR_EMAIL: "packages@datadoghq.com"
95
GIT_AUTHOR_NAME: "ci.datadog-api-spec"
@@ -16,24 +12,26 @@ on:
1612

1713
jobs:
1814
create_release:
15+
permissions:
16+
contents: read
17+
id-token: write # Required for dd-octo-sts OIDC token
1918
name: Create release
2019
runs-on: ubuntu-latest
2120
if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/')
2221
steps:
23-
- name: Get GitHub App token
24-
id: get_token
25-
uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 #v1.11.1
26-
with:
27-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
28-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
29-
3022
- name: Checkout ${{ github.event.pull_request.base.ref }}
3123
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
3224
with:
33-
token: ${{ steps.get_token.outputs.token }}
3425
ref: ${{ github.event.pull_request.base.ref }}
3526
fetch-depth: 0
3627

28+
- name: Get GitHub token via dd-octo-sts
29+
id: get_token
30+
uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
31+
with:
32+
scope: DataDog/datadog-api-client-java
33+
policy: self.github.release.master
34+
3735
- name: Release packages
3836
env:
3937
HEAD_SHA: ${{ github.event.pull_request.merge_commit_sha }}

‎.github/workflows/reusable-ci.yml‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,6 @@ on:
2929
type: string
3030
default: './check-examples.sh'
3131
secrets:
32-
PIPELINE_GITHUB_APP_ID:
33-
required: false
34-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
35-
required: false
3632
# Integration test secrets
3733
DD_API_KEY:
3834
required: false
@@ -49,25 +45,16 @@ jobs:
4945
with:
5046
target-branch: ${{ inputs.target-branch }}
5147
enable-commit-changes: false # Don't auto-commit in external CI
52-
secrets:
53-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
54-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
5548

5649
javadoc:
5750
uses: ./.github/workflows/reusable-javadoc.yml
5851
with:
5952
target-branch: ${{ inputs.target-branch }}
60-
secrets:
61-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
62-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
6353

6454
shading:
6555
uses: ./.github/workflows/reusable-shading.yml
6656
with:
6757
target-branch: ${{ inputs.target-branch }}
68-
secrets:
69-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
70-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
7158

7259
test:
7360
uses: ./.github/workflows/reusable-java-test.yml
@@ -77,27 +64,20 @@ jobs:
7764
platforms: ${{ inputs.platforms }}
7865
test-script: ${{ inputs.test-script }}
7966
secrets:
80-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
81-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
8267
DD_API_KEY: ${{ secrets.DD_API_KEY }}
8368

8469
examples:
8570
uses: ./.github/workflows/reusable-examples.yml
8671
with:
8772
target-branch: ${{ inputs.target-branch }}
8873
examples-script: ${{ inputs.examples-script }}
89-
secrets:
90-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
91-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
9274

9375
integration:
9476
uses: ./.github/workflows/reusable-integration-test.yml
9577
with:
9678
target-branch: ${{ inputs.target-branch }}
9779
has-integration-label: ${{ contains(github.event.pull_request.labels.*.name, 'ci/integrations') }}
9880
secrets:
99-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
100-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
10181
DD_API_KEY: ${{ secrets.DD_API_KEY }}
10282
DD_CLIENT_API_KEY: ${{ secrets.DD_CLIENT_API_KEY }}
10383
DD_CLIENT_APP_KEY: ${{ secrets.DD_CLIENT_APP_KEY }}

‎.github/workflows/reusable-examples.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,6 @@ on:
1818
required: false
1919
type: string
2020
default: '16'
21-
secrets:
22-
PIPELINE_GITHUB_APP_ID:
23-
required: false
24-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
25-
required: false
2621

2722
jobs:
2823
examples:

‎.github/workflows/reusable-integration-test.yml‎

Lines changed: 7 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
name: Reusable Integration Test Workflow
22

3-
permissions:
4-
contents: read
5-
63
on:
74
pull_request:
85
types:
@@ -44,10 +41,6 @@ on:
4441
type: boolean
4542
default: false
4643
secrets:
47-
PIPELINE_GITHUB_APP_ID:
48-
required: false
49-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
50-
required: false
5144
DD_API_KEY:
5245
required: true
5346
DD_CLIENT_API_KEY:
@@ -63,6 +56,9 @@ concurrency:
6356

6457
jobs:
6558
test_integration:
59+
permissions:
60+
contents: read
61+
id-token: write # Required for dd-octo-sts OIDC token
6662
runs-on: ubuntu-latest
6763
if: >
6864
(github.event_name == 'pull_request' &&
@@ -82,14 +78,13 @@ jobs:
8278
DD_HOSTNAME: "none"
8379
DD_INSIDE_CI: "true"
8480
steps:
85-
- name: Get GitHub App token
81+
- name: Get GitHub token via dd-octo-sts
8682
if: github.event_name == 'pull_request'
8783
id: get_token
88-
uses: actions/create-github-app-token@v1
84+
uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
8985
with:
90-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
91-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
92-
repositories: ${{ inputs.target-repo || 'datadog-api-spec' }}
86+
scope: DataDog/${{ inputs.target-repo || 'datadog-api-spec' }}
87+
policy: datadog-api-client-java.reusable-integration-test.post-status
9388
- name: Checkout code
9489
uses: actions/checkout@v3
9590
with:

‎.github/workflows/reusable-java-test.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,6 @@ on:
2424
type: string
2525
default: './run-tests.sh'
2626
secrets:
27-
PIPELINE_GITHUB_APP_ID:
28-
required: false
29-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
30-
required: false
3127
DD_API_KEY:
3228
required: false
3329

‎.github/workflows/reusable-javadoc.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ on:
1313
required: false
1414
type: string
1515
default: '8'
16-
secrets:
17-
PIPELINE_GITHUB_APP_ID:
18-
required: false
19-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
20-
required: false
2116

2217
jobs:
2318
javadoc:

‎.github/workflows/reusable-pre-commit.yml‎

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ on:
1313
required: false
1414
type: boolean
1515
default: true
16-
secrets:
17-
PIPELINE_GITHUB_APP_ID:
18-
required: false
19-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
20-
required: false
2116

2217
env:
2318
GIT_AUTHOR_EMAIL: "packages@datadoghq.com"
@@ -26,14 +21,16 @@ env:
2621
jobs:
2722
pre-commit:
2823
runs-on: ubuntu-latest
24+
permissions:
25+
id-token: write # Required for dd-octo-sts OIDC token
2926
steps:
30-
- name: Get GitHub App token
27+
- name: Get GitHub token via dd-octo-sts
3128
id: get_token
3229
if: inputs.enable-commit-changes
33-
uses: actions/create-github-app-token@v1
30+
uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
3431
with:
35-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
36-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
32+
scope: DataDog/datadog-api-client-java
33+
policy: self.github.pre-commit.pull-requests
3734
- uses: actions/checkout@v3
3835
with:
3936
fetch-depth: 0

‎.github/workflows/reusable-shading.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ on:
1313
required: false
1414
type: string
1515
default: '8'
16-
secrets:
17-
PIPELINE_GITHUB_APP_ID:
18-
required: false
19-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
20-
required: false
2116

2217
jobs:
2318
shading:

‎.github/workflows/test.yml‎

Lines changed: 6 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,6 @@ jobs:
2828
uses: ./.github/workflows/reusable-pre-commit.yml
2929
with:
3030
enable-commit-changes: true
31-
secrets:
32-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
33-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
3431

3532
javadoc:
3633
if: >
@@ -60,8 +57,6 @@ jobs:
6057
platforms: '["ubuntu-latest"]'
6158
test-script: './run-tests.sh'
6259
secrets:
63-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
64-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
6560
DD_API_KEY: ${{ secrets.DD_API_KEY }}
6661

6762
examples:
@@ -78,20 +73,21 @@ jobs:
7873
report:
7974
runs-on: ubuntu-latest
8075
if: always() && github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/')
76+
permissions:
77+
id-token: write # Required for dd-octo-sts OIDC token
8178
needs:
8279
- test
8380
- examples
8481
- javadoc
8582
- shading
8683
steps:
87-
- name: Get GitHub App token
84+
- name: Get GitHub token via dd-octo-sts
8885
if: github.event_name == 'pull_request'
8986
id: get_token
90-
uses: actions/create-github-app-token@v1
87+
uses: DataDog/dd-octo-sts-action@acaa02eee7e3bb0839e4272dacb37b8f3b58ba80 # v1.0.3
9188
with:
92-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
93-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
94-
repositories: datadog-api-spec
89+
scope: DataDog/datadog-api-spec
90+
policy: datadog-api-client-java.test.post-status
9591
- name: Post status check
9692
uses: DataDog/github-actions/post-status-check@v2
9793
with:

0 commit comments

Comments
 (0)