Skip to content

Commit 6eee8c8

Browse files
jack-edmonds-ddjack-edmonds-dd
authored
Use dd-octo-sts and clean up unused secret values. (#3691)
1 parent 7e98a5f commit 6eee8c8

File tree

9 files changed

+21
-61
lines changed

9 files changed

+21
-61
lines changed

‎.github/workflows/approved_status.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,15 @@ jobs:
2222
!contains(github.event.pull_request.labels.*.name, 'ci/skip') &&
2323
!contains(github.event.pull_request.head.ref, 'datadog-api-spec/test/') &&
2424
contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/')
25+
permissions:
26+
id-token: write
2527
steps:
2628
- name: Get GitHub App token
2729
id: get_token
28-
uses: actions/create-github-app-token@v1
30+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
2931
with:
30-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
31-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
32-
repositories: datadog-api-spec
32+
scope: DataDog/datadog-api-spec
33+
policy: datadog-api-client-java.approved_status.post-review-status
3334
- name: Post PR review status check
3435
uses: DataDog/github-actions/post-review-status@v2
3536
with:

‎.github/workflows/release.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,15 @@ jobs:
1919
name: Create release
2020
runs-on: ubuntu-latest
2121
if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/')
22+
permissions:
23+
id-token: write
2224
steps:
2325
- name: Get GitHub App token
2426
id: get_token
25-
uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 #v1.11.1
27+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
2628
with:
27-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
28-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
29+
scope: DataDog/datadog-api-client-java
30+
policy: self.github.release.master
2931

3032
- name: Checkout ${{ github.event.pull_request.base.ref }}
3133
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

‎.github/workflows/reusable-ci.yml‎

Lines changed: 0 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,6 @@ on:
2929
type: string
3030
default: './check-examples.sh'
3131
secrets:
32-
PIPELINE_GITHUB_APP_ID:
33-
required: false
34-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
35-
required: false
3632
# Integration test secrets
3733
DD_API_KEY:
3834
required: false
@@ -49,25 +45,16 @@ jobs:
4945
with:
5046
target-branch: ${{ inputs.target-branch }}
5147
enable-commit-changes: false # Don't auto-commit in external CI
52-
secrets:
53-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
54-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
5548

5649
javadoc:
5750
uses: ./.github/workflows/reusable-javadoc.yml
5851
with:
5952
target-branch: ${{ inputs.target-branch }}
60-
secrets:
61-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
62-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
6353

6454
shading:
6555
uses: ./.github/workflows/reusable-shading.yml
6656
with:
6757
target-branch: ${{ inputs.target-branch }}
68-
secrets:
69-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
70-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
7158

7259
test:
7360
uses: ./.github/workflows/reusable-java-test.yml
@@ -77,29 +64,21 @@ jobs:
7764
platforms: ${{ inputs.platforms }}
7865
test-script: ${{ inputs.test-script }}
7966
secrets:
80-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
81-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
8267
DD_API_KEY: ${{ secrets.DD_API_KEY }}
8368

8469
examples:
8570
uses: ./.github/workflows/reusable-examples.yml
8671
with:
8772
target-branch: ${{ inputs.target-branch }}
8873
examples-script: ${{ inputs.examples-script }}
89-
secrets:
90-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
91-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
9274

9375
integration:
9476
uses: ./.github/workflows/reusable-integration-test.yml
9577
with:
9678
target-branch: ${{ inputs.target-branch }}
9779
has-integration-label: ${{ contains(github.event.pull_request.labels.*.name, 'ci/integrations') }}
9880
secrets:
99-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
100-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
10181
DD_API_KEY: ${{ secrets.DD_API_KEY }}
10282
DD_CLIENT_API_KEY: ${{ secrets.DD_CLIENT_API_KEY }}
10383
DD_CLIENT_APP_KEY: ${{ secrets.DD_CLIENT_APP_KEY }}
10484
SLEEP_AFTER_REQUEST: ${{ secrets.SLEEP_AFTER_REQUEST }}
105-

‎.github/workflows/reusable-examples.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,6 @@ on:
1818
required: false
1919
type: string
2020
default: '16'
21-
secrets:
22-
PIPELINE_GITHUB_APP_ID:
23-
required: false
24-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
25-
required: false
2621

2722
jobs:
2823
examples:

‎.github/workflows/reusable-integration-test.yml‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,6 @@ on:
4444
type: boolean
4545
default: false
4646
secrets:
47-
PIPELINE_GITHUB_APP_ID:
48-
required: false
49-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
50-
required: false
5147
DD_API_KEY:
5248
required: true
5349
DD_CLIENT_API_KEY:
@@ -81,15 +77,17 @@ jobs:
8177
DD_API_KEY: ${{ secrets.DD_API_KEY }}
8278
DD_HOSTNAME: "none"
8379
DD_INSIDE_CI: "true"
80+
permissions:
81+
id-token: write
82+
contents: read
8483
steps:
8584
- name: Get GitHub App token
8685
if: github.event_name == 'pull_request'
8786
id: get_token
88-
uses: actions/create-github-app-token@v1
87+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
8988
with:
90-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
91-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
92-
repositories: ${{ inputs.target-repo || 'datadog-api-spec' }}
89+
scope: DataDog/datadog-api-spec
90+
policy: datadog-api-client-java.reusable-integration-test.post-status
9391
- name: Checkout code
9492
uses: actions/checkout@v3
9593
with:

‎.github/workflows/reusable-java-test.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,10 +24,6 @@ on:
2424
type: string
2525
default: './run-tests.sh'
2626
secrets:
27-
PIPELINE_GITHUB_APP_ID:
28-
required: false
29-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
30-
required: false
3127
DD_API_KEY:
3228
required: false
3329

‎.github/workflows/reusable-javadoc.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ on:
1313
required: false
1414
type: string
1515
default: '8'
16-
secrets:
17-
PIPELINE_GITHUB_APP_ID:
18-
required: false
19-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
20-
required: false
2116

2217
jobs:
2318
javadoc:

‎.github/workflows/reusable-shading.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ on:
1313
required: false
1414
type: string
1515
default: '8'
16-
secrets:
17-
PIPELINE_GITHUB_APP_ID:
18-
required: false
19-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
20-
required: false
2116

2217
jobs:
2318
shading:

‎.github/workflows/test.yml‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -60,8 +60,6 @@ jobs:
6060
platforms: '["ubuntu-latest"]'
6161
test-script: './run-tests.sh'
6262
secrets:
63-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
64-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
6563
DD_API_KEY: ${{ secrets.DD_API_KEY }}
6664

6765
examples:
@@ -83,15 +81,16 @@ jobs:
8381
- examples
8482
- javadoc
8583
- shading
84+
permissions:
85+
id-token: write
8686
steps:
8787
- name: Get GitHub App token
8888
if: github.event_name == 'pull_request'
8989
id: get_token
90-
uses: actions/create-github-app-token@v1
90+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
9191
with:
92-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
93-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
94-
repositories: datadog-api-spec
92+
scope: DataDog/datadog-api-spec
93+
policy: datadog-api-client-java.test.post-status
9594
- name: Post status check
9695
uses: DataDog/github-actions/post-status-check@v2
9796
with:

0 commit comments

Comments
 (0)