Skip to content

Commit 387c87a

Browse files
jack-edmonds-ddjack-edmonds-dd
authored
Migrate to dd-octo-sts. (#1450)
1 parent 82d7650 commit 387c87a

10 files changed

+54
-63
lines changed

‎.github/chainguard/self.github.pre-commit.pull-requests.sts.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
# Policy for: .github/workflows/reusable-pre-commit.yml in DataDog/datadog-api-client-rust
3+
# Allows the pre-commit workflow to push fixes back to the PR branch
4+
issuer: https://token.actions.githubusercontent.com
5+
subject: repo:DataDog/datadog-api-client-rust:pull_request
6+
7+
claim_pattern:
8+
event_name: pull_request
9+
job_workflow_ref: DataDog/datadog-api-client-rust/\.github/workflows/reusable-pre-commit\.yml@refs/pull/[0-9]+/merge
10+
repository: DataDog/datadog-api-client-rust
11+
12+
permissions:
13+
contents: write

‎.github/chainguard/self.github.release.master.sts.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
---
2+
# Policy for: .github/workflows/release.yml in DataDog/datadog-api-client-rust
3+
# Allows the release workflow to create tags and GitHub releases
4+
issuer: https://token.actions.githubusercontent.com
5+
subject: repo:DataDog/datadog-api-client-rust:pull_request
6+
7+
claim_pattern:
8+
event_name: pull_request
9+
job_workflow_ref: DataDog/datadog-api-client-rust/\.github/workflows/release\.yml@refs/pull/[0-9]+/merge
10+
repository: DataDog/datadog-api-client-rust
11+
12+
permissions:
13+
contents: write

‎.github/workflows/approved_status.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,15 @@ jobs:
2222
!contains(github.event.pull_request.labels.*.name, 'ci/skip') &&
2323
!contains(github.event.pull_request.head.ref, 'datadog-api-spec/test/') &&
2424
contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/')
25+
permissions:
26+
id-token: write
2527
steps:
2628
- name: Get GitHub App token
2729
id: get_token
28-
uses: actions/create-github-app-token@v1
30+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
2931
with:
30-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
31-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
32-
repositories: datadog-api-spec
32+
scope: DataDog/datadog-api-spec
33+
policy: datadog-api-client-rust.approved_status.post-review-status
3334
- name: Post PR review status check
3435
uses: DataDog/github-actions/post-review-status@v2
3536
with:

‎.github/workflows/release.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,15 @@ jobs:
1919
name: Create release
2020
runs-on: ubuntu-latest
2121
if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/')
22+
permissions:
23+
id-token: write
2224
steps:
2325
- name: Get GitHub App token
2426
id: get_token
25-
uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 #v1.11.1
27+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
2628
with:
27-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
28-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
29+
scope: DataDog/datadog-api-client-rust
30+
policy: self.github.release.master
2931

3032
- name: Checkout ${{ github.event.pull_request.base.ref }}
3133
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

‎.github/workflows/reusable-ci.yml‎

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -29,10 +29,6 @@ on:
2929
type: string
3030
default: 'cargo check --examples'
3131
secrets:
32-
PIPELINE_GITHUB_APP_ID:
33-
required: false
34-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
35-
required: false
3632
# Integration test secrets
3733
DD_API_KEY:
3834
required: false
@@ -47,9 +43,6 @@ jobs:
4743
with:
4844
target-branch: ${{ inputs.target-branch }}
4945
enable-commit-changes: false # Don't auto-commit in external CI
50-
secrets:
51-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
52-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
5346

5447
test:
5548
uses: ./.github/workflows/reusable-rust-test.yml
@@ -58,28 +51,19 @@ jobs:
5851
rust-versions: ${{ inputs.rust-versions }}
5952
platforms: ${{ inputs.platforms }}
6053
test-script: ${{ inputs.test-script }}
61-
secrets:
62-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
63-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
6454

6555
examples:
6656
uses: ./.github/workflows/reusable-examples.yml
6757
with:
6858
target-branch: ${{ inputs.target-branch }}
6959
examples-command: ${{ inputs.examples-command }}
70-
secrets:
71-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
72-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
7360

7461
integration:
7562
uses: ./.github/workflows/reusable-integration-test.yml
7663
with:
7764
target-branch: ${{ inputs.target-branch }}
7865
has-integration-label: ${{ contains(github.event.pull_request.labels.*.name, 'ci/integrations') }}
7966
secrets:
80-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
81-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
8267
DD_API_KEY: ${{ secrets.DD_API_KEY }}
8368
DD_CLIENT_API_KEY: ${{ secrets.DD_CLIENT_API_KEY }}
8469
DD_CLIENT_APP_KEY: ${{ secrets.DD_CLIENT_APP_KEY }}
85-

‎.github/workflows/reusable-examples.yml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,12 +18,6 @@ on:
1818
required: false
1919
type: string
2020
default: 'stable'
21-
secrets:
22-
PIPELINE_GITHUB_APP_ID:
23-
required: false
24-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
25-
required: false
26-
2721
jobs:
2822
examples:
2923
runs-on: ubuntu-latest

‎.github/workflows/reusable-integration-test.yml‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,6 @@ on:
4444
type: boolean
4545
default: false
4646
secrets:
47-
PIPELINE_GITHUB_APP_ID:
48-
required: false
49-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
50-
required: false
5147
DD_API_KEY:
5248
required: true
5349
DD_CLIENT_API_KEY:
@@ -70,6 +66,9 @@ jobs:
7066
contains(github.event.pull_request.labels.*.name, 'ci/integrations')) ||
7167
github.event_name == 'schedule' ||
7268
(github.event_name == 'workflow_call' && inputs.has-integration-label)
69+
permissions:
70+
id-token: write
71+
contents: read
7372
services:
7473
datadog-agent:
7574
image: gcr.io/datadoghq/agent:latest
@@ -83,11 +82,10 @@ jobs:
8382
- name: Get GitHub App token
8483
if: github.event_name == 'pull_request'
8584
id: get_token
86-
uses: actions/create-github-app-token@v1
85+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
8786
with:
88-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
89-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
90-
repositories: ${{ inputs.target-repo || 'datadog-api-spec' }}
87+
scope: DataDog/datadog-api-spec
88+
policy: datadog-api-client-rust.reusable-integration-test.post-status
9189
- name: Checkout code
9290
uses: actions/checkout@v3
9391
with:

‎.github/workflows/reusable-pre-commit.yml‎

Lines changed: 7 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,27 +13,24 @@ on:
1313
required: false
1414
type: boolean
1515
default: true
16-
secrets:
17-
PIPELINE_GITHUB_APP_ID:
18-
required: false
19-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
20-
required: false
21-
2216
env:
2317
GIT_AUTHOR_EMAIL: "packages@datadoghq.com"
2418
GIT_AUTHOR_NAME: "ci.datadog-api-spec"
2519

2620
jobs:
2721
pre-commit:
2822
runs-on: ubuntu-latest
23+
permissions:
24+
id-token: write
25+
contents: read
2926
steps:
3027
- name: Get GitHub App token
3128
id: get_token
32-
if: inputs.enable-commit-changes
33-
uses: actions/create-github-app-token@v1
29+
if: inputs.enable-commit-changes && github.event_name == 'pull_request'
30+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
3431
with:
35-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
36-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
32+
scope: DataDog/datadog-api-client-rust
33+
policy: self.github.pre-commit.pull-requests
3734
- uses: actions/checkout@v3
3835
with:
3936
fetch-depth: 0

‎.github/workflows/reusable-rust-test.yml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -23,12 +23,6 @@ on:
2323
required: false
2424
type: string
2525
default: './run-tests.sh'
26-
secrets:
27-
PIPELINE_GITHUB_APP_ID:
28-
required: false
29-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
30-
required: false
31-
3226
jobs:
3327
test:
3428
strategy:

‎.github/workflows/test.yml‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -28,9 +28,6 @@ jobs:
2828
uses: ./.github/workflows/reusable-pre-commit.yml
2929
with:
3030
enable-commit-changes: true
31-
secrets:
32-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
33-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
3431

3532
test:
3633
if: >
@@ -43,9 +40,6 @@ jobs:
4340
rust-versions: '["stable"]'
4441
platforms: '["ubuntu-latest"]'
4542
test-script: './run-tests.sh'
46-
secrets:
47-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
48-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
4943

5044
examples:
5145
if: >
@@ -64,15 +58,16 @@ jobs:
6458
needs:
6559
- test
6660
- examples
61+
permissions:
62+
id-token: write
6763
steps:
6864
- name: Get GitHub App token
6965
if: github.event_name == 'pull_request'
7066
id: get_token
71-
uses: actions/create-github-app-token@v1
67+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
7268
with:
73-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
74-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
75-
repositories: datadog-api-spec
69+
scope: DataDog/datadog-api-spec
70+
policy: datadog-api-client-rust.test.post-status
7671
- name: Post status check
7772
uses: DataDog/github-actions/post-status-check@v2
7873
with:

0 commit comments

Comments
 (0)