Skip to content

Use dd-octo-sts and clean up unused secret values. #3691

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jack-edmonds-dd merged 1 commit into from
Apr 3, 2026
Merged

Use dd-octo-sts and clean up unused secret values. #3691

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions .github/workflows/approved_status.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,14 +22,15 @@ jobs:
!contains(github.event.pull_request.labels.*.name, 'ci/skip') &&
!contains(github.event.pull_request.head.ref, 'datadog-api-spec/test/') &&
contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/')
permissions:
id-token: write
steps:
- name: Get GitHub App token
id: get_token
uses: actions/create-github-app-token@v1
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
with:
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
repositories: datadog-api-spec
scope: DataDog/datadog-api-spec
policy: datadog-api-client-java.approved_status.post-review-status
- name: Post PR review status check
uses: DataDog/github-actions/post-review-status@v2
with:
Expand Down
8 changes: 5 additions & 3 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,13 +19,15 @@ jobs:
name: Create release
runs-on: ubuntu-latest
if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/')
permissions:
id-token: write
steps:
- name: Get GitHub App token
id: get_token
uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 #v1.11.1
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
with:
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
scope: DataDog/datadog-api-client-java
policy: self.github.release.master

- name: Checkout ${{ github.event.pull_request.base.ref }}
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
Expand Down
21 changes: 0 additions & 21 deletions .github/workflows/reusable-ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,10 +29,6 @@ on:
type: string
default: './check-examples.sh'
secrets:
PIPELINE_GITHUB_APP_ID:
required: false
PIPELINE_GITHUB_APP_PRIVATE_KEY:
required: false
# Integration test secrets
DD_API_KEY:
required: false
Expand All @@ -49,25 +45,16 @@ jobs:
with:
target-branch: ${{ inputs.target-branch }}
enable-commit-changes: false # Don't auto-commit in external CI
secrets:
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}

javadoc:
uses: ./.github/workflows/reusable-javadoc.yml
with:
target-branch: ${{ inputs.target-branch }}
secrets:
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}

shading:
uses: ./.github/workflows/reusable-shading.yml
with:
target-branch: ${{ inputs.target-branch }}
secrets:
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}

test:
uses: ./.github/workflows/reusable-java-test.yml
Expand All @@ -77,29 +64,21 @@ jobs:
platforms: ${{ inputs.platforms }}
test-script: ${{ inputs.test-script }}
secrets:
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
DD_API_KEY: ${{ secrets.DD_API_KEY }}

examples:
uses: ./.github/workflows/reusable-examples.yml
with:
target-branch: ${{ inputs.target-branch }}
examples-script: ${{ inputs.examples-script }}
secrets:
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}

integration:
uses: ./.github/workflows/reusable-integration-test.yml
with:
target-branch: ${{ inputs.target-branch }}
has-integration-label: ${{ contains(github.event.pull_request.labels.*.name, 'ci/integrations') }}
secrets:
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
DD_API_KEY: ${{ secrets.DD_API_KEY }}
DD_CLIENT_API_KEY: ${{ secrets.DD_CLIENT_API_KEY }}
DD_CLIENT_APP_KEY: ${{ secrets.DD_CLIENT_APP_KEY }}
SLEEP_AFTER_REQUEST: ${{ secrets.SLEEP_AFTER_REQUEST }}

5 changes: 0 additions & 5 deletions .github/workflows/reusable-examples.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,6 @@ on:
required: false
type: string
default: '16'
secrets:
PIPELINE_GITHUB_APP_ID:
required: false
PIPELINE_GITHUB_APP_PRIVATE_KEY:
required: false

jobs:
examples:
Expand Down
14 changes: 6 additions & 8 deletions .github/workflows/reusable-integration-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,10 +44,6 @@ on:
type: boolean
default: false
secrets:
PIPELINE_GITHUB_APP_ID:
required: false
PIPELINE_GITHUB_APP_PRIVATE_KEY:
required: false
DD_API_KEY:
required: true
DD_CLIENT_API_KEY:
Expand Down Expand Up @@ -81,15 +77,17 @@ jobs:
DD_API_KEY: ${{ secrets.DD_API_KEY }}
DD_HOSTNAME: "none"
DD_INSIDE_CI: "true"
permissions:
id-token: write
contents: read
steps:
- name: Get GitHub App token
if: github.event_name == 'pull_request'
id: get_token
uses: actions/create-github-app-token@v1
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
with:
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
repositories: ${{ inputs.target-repo || 'datadog-api-spec' }}
scope: DataDog/datadog-api-spec
policy: datadog-api-client-java.reusable-integration-test.post-status
- name: Checkout code
uses: actions/checkout@v3
with:
Expand Down
4 changes: 0 additions & 4 deletions .github/workflows/reusable-java-test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,10 +24,6 @@ on:
type: string
default: './run-tests.sh'
secrets:
PIPELINE_GITHUB_APP_ID:
required: false
PIPELINE_GITHUB_APP_PRIVATE_KEY:
required: false
DD_API_KEY:
required: false

Expand Down
5 changes: 0 additions & 5 deletions .github/workflows/reusable-javadoc.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,6 @@ on:
required: false
type: string
default: '8'
secrets:
PIPELINE_GITHUB_APP_ID:
required: false
PIPELINE_GITHUB_APP_PRIVATE_KEY:
required: false

jobs:
javadoc:
Expand Down
5 changes: 0 additions & 5 deletions .github/workflows/reusable-shading.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,6 @@ on:
required: false
type: string
default: '8'
secrets:
PIPELINE_GITHUB_APP_ID:
required: false
PIPELINE_GITHUB_APP_PRIVATE_KEY:
required: false

jobs:
shading:
Expand Down
11 changes: 5 additions & 6 deletions .github/workflows/test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,8 +60,6 @@ jobs:
platforms: '["ubuntu-latest"]'
test-script: './run-tests.sh'
secrets:
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
DD_API_KEY: ${{ secrets.DD_API_KEY }}

examples:
Expand All @@ -83,15 +81,16 @@ jobs:
- examples
- javadoc
- shading
permissions:
id-token: write
steps:
- name: Get GitHub App token
if: github.event_name == 'pull_request'
id: get_token
uses: actions/create-github-app-token@v1
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
with:
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
repositories: datadog-api-spec
scope: DataDog/datadog-api-spec
policy: datadog-api-client-java.test.post-status
- name: Post status check
uses: DataDog/github-actions/post-status-check@v2
with:
Expand Down
Loading