Skip to content

Commit add72e5

Browse files
jack-edmonds-ddjack-edmonds-dd
authored
Add trust policies and use dd-octo-sts. (#3854)
1 parent 3eb37a5 commit add72e5

File tree

8 files changed

+59
-47
lines changed

8 files changed

+59
-47
lines changed

‎.github/chainguard/self.github.pre-commit.pull-requests.sts.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Trust policy for pre-commit fixes on pull requests
2+
# Allows pushing pre-commit fixes back to PR branches
3+
# Will be called in reusable-pre-commit.yml
4+
issuer: https://token.actions.githubusercontent.com
5+
subject: repo:DataDog/datadog-api-client-typescript:pull_request
6+
7+
claim_pattern:
8+
event_name: pull_request
9+
job_workflow_ref: DataDog/datadog-api-client-typescript/\.github/workflows/reusable-pre-commit\.yml@refs/pull/[0-9]+/merge
10+
ref: refs/pull/[0-9]+/merge
11+
repository: DataDog/datadog-api-client-typescript
12+
13+
permissions:
14+
contents: write # Required for pushing pre-commit fixes

‎.github/chainguard/self.github.release.master.sts.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
# Trust policy for creating releases on master branch
2+
# Restricted to master branch (protected ref) for security
3+
# Will be called in release.yml
4+
issuer: https://token.actions.githubusercontent.com
5+
subject: repo:DataDog/datadog-api-client-typescript:pull_request
6+
7+
claim_pattern:
8+
event_name: pull_request
9+
job_workflow_ref: DataDog/datadog-api-client-typescript/\.github/workflows/release\.yml@refs/heads/master
10+
repository: DataDog/datadog-api-client-typescript
11+
ref: refs/heads/master
12+
13+
permissions:
14+
contents: write

‎.github/workflows/approved_status.yml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,14 +22,15 @@ jobs:
2222
!contains(github.event.pull_request.labels.*.name, 'ci/skip') &&
2323
!contains(github.event.pull_request.head.ref, 'datadog-api-spec/test/') &&
2424
contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/')
25+
permissions:
26+
id-token: write
2527
steps:
2628
- name: Get GitHub App token
2729
id: get_token
28-
uses: actions/create-github-app-token@v1
30+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
2931
with:
30-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
31-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
32-
repositories: datadog-api-spec
32+
scope: DataDog/datadog-api-spec
33+
policy: datadog-api-client-typescript.approved_status.post-review-status
3334
- name: Post PR review status check
3435
uses: DataDog/github-actions/post-review-status@v2
3536
with:

‎.github/workflows/release.yml‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,13 +19,15 @@ jobs:
1919
name: Create release
2020
runs-on: ubuntu-latest
2121
if: github.event.pull_request.merged == true && startsWith(github.head_ref, 'release/')
22+
permissions:
23+
id-token: write
2224
steps:
2325
- name: Get GitHub App token
2426
id: get_token
25-
uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 #v1.11.1
27+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
2628
with:
27-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
28-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
29+
scope: DataDog/datadog-api-client-typescript
30+
policy: self.github.release.master
2931

3032
- name: Checkout ${{ github.event.pull_request.base.ref }}
3133
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

‎.github/workflows/reusable-ci.yml‎

Lines changed: 0 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,6 @@ on:
3535
default: '16'
3636

3737
secrets:
38-
PIPELINE_GITHUB_APP_ID:
39-
required: false
40-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
41-
required: false
4238
# Integration test secrets
4339
DD_API_KEY:
4440
required: false
@@ -55,9 +51,6 @@ jobs:
5551
with:
5652
target-branch: ${{ inputs.target-branch }}
5753
enable-commit-changes: false # Don't auto-commit in external CI
58-
secrets:
59-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
60-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
6154

6255
test:
6356
uses: ./.github/workflows/reusable-typescript-test.yml
@@ -66,9 +59,6 @@ jobs:
6659
node-versions: ${{ inputs.node-versions }}
6760
platforms: ${{ inputs.platforms }}
6861
test-script: ${{ inputs.test-script }}
69-
secrets:
70-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
71-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
7262

7363
examples:
7464
uses: ./.github/workflows/reusable-examples.yml
@@ -83,10 +73,7 @@ jobs:
8373
target-branch: ${{ inputs.target-branch }}
8474
has-integration-label: ${{ contains(github.event.pull_request.labels.*.name, 'ci/integrations') }}
8575
secrets:
86-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
87-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
8876
DD_API_KEY: ${{ secrets.DD_API_KEY }}
8977
DD_CLIENT_API_KEY: ${{ secrets.DD_CLIENT_API_KEY }}
9078
DD_CLIENT_APP_KEY: ${{ secrets.DD_CLIENT_APP_KEY }}
9179
SLEEP_AFTER_REQUEST: ${{ secrets.SLEEP_AFTER_REQUEST }}
92-

‎.github/workflows/reusable-integration-test.yml‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -44,10 +44,6 @@ on:
4444
type: boolean
4545
default: false
4646
secrets:
47-
PIPELINE_GITHUB_APP_ID:
48-
required: false
49-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
50-
required: false
5147
DD_API_KEY:
5248
required: true
5349
DD_CLIENT_API_KEY:
@@ -81,15 +77,17 @@ jobs:
8177
DD_API_KEY: ${{ secrets.DD_API_KEY }}
8278
DD_HOSTNAME: "none"
8379
DD_INSIDE_CI: "true"
80+
permissions:
81+
id-token: write
82+
contents: read
8483
steps:
8584
- name: Get GitHub App token
8685
if: github.event_name == 'pull_request'
8786
id: get_token
88-
uses: actions/create-github-app-token@v1
87+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
8988
with:
90-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
91-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
92-
repositories: ${{ inputs.target-repo || 'datadog-api-spec' }}
89+
scope: DataDog/datadog-api-spec
90+
policy: datadog-api-client-typescript.reusable-integration-test.post-status
9391
- name: Checkout code
9492
uses: actions/checkout@v3
9593
with:

‎.github/workflows/reusable-pre-commit.yml‎

Lines changed: 7 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,6 @@ on:
1313
required: false
1414
type: boolean
1515
default: true
16-
secrets:
17-
PIPELINE_GITHUB_APP_ID:
18-
required: false
19-
PIPELINE_GITHUB_APP_PRIVATE_KEY:
20-
required: false
2116

2217
env:
2318
GIT_AUTHOR_EMAIL: "packages@datadoghq.com"
@@ -26,14 +21,17 @@ env:
2621
jobs:
2722
pre-commit:
2823
runs-on: ubuntu-latest
24+
permissions:
25+
id-token: write
26+
contents: read
2927
steps:
3028
- name: Get GitHub App token
3129
id: get_token
32-
if: inputs.enable-commit-changes
33-
uses: actions/create-github-app-token@v1
30+
if: inputs.enable-commit-changes && github.event_name == 'pull_request'
31+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
3432
with:
35-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
36-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
33+
scope: DataDog/datadog-api-client-typescript
34+
policy: self.github.pre-commit.pull-requests
3735
- uses: actions/checkout@v3
3836
with:
3937
fetch-depth: 0

‎.github/workflows/test.yml‎

Lines changed: 8 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@ jobs:
2525
!contains(github.event.pull_request.labels.*.name, 'ci/skip') &&
2626
!contains(github.event.pull_request.head.ref, 'datadog-api-spec/test/')) ||
2727
github.event_name == 'schedule'
28+
permissions:
29+
id-token: write
30+
contents: read
2831
uses: ./.github/workflows/reusable-pre-commit.yml
2932
with:
3033
enable-commit-changes: true
31-
secrets:
32-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
33-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
3434

3535
test:
3636
if: >
@@ -43,9 +43,6 @@ jobs:
4343
node-versions: '["16", "18"]'
4444
platforms: '["ubuntu-latest"]'
4545
test-script: './run-tests.sh'
46-
secrets:
47-
PIPELINE_GITHUB_APP_ID: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
48-
PIPELINE_GITHUB_APP_PRIVATE_KEY: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
4946

5047
examples:
5148
if: >
@@ -64,15 +61,16 @@ jobs:
6461
needs:
6562
- test
6663
- examples
64+
permissions:
65+
id-token: write
6766
steps:
6867
- name: Get GitHub App token
6968
if: github.event_name == 'pull_request'
7069
id: get_token
71-
uses: actions/create-github-app-token@v1
70+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
7271
with:
73-
app-id: ${{ secrets.PIPELINE_GITHUB_APP_ID }}
74-
private-key: ${{ secrets.PIPELINE_GITHUB_APP_PRIVATE_KEY }}
75-
repositories: datadog-api-spec
72+
scope: DataDog/datadog-api-spec
73+
policy: datadog-api-client-typescript.test.post-status
7674
- name: Post status check
7775
uses: DataDog/github-actions/post-status-check@v2
7876
with:

0 commit comments

Comments
 (0)