chore(ci): use dd-sts instead of DD_API_KEY (#25235)

* chore(ci): use dd-octo-sts instead of DD_API_KEY

* chore(ci): rename policy to public-vectordotdev-vector

* chore(ci): grant id-token: write to reusable workflow callers

* Format

* chore(ci): introduce dd-token composite action to federate Datadog credentials

* Fix policy name

Author: thomasqueirozb

.github/actions/dd-token/action.yml

@@ -0,0 +1,28 @@
+name: "Datadog Short-Lived Token"
+description: "Federate a short-lived Datadog token via dd-sts-action and export DD_API_KEY (and DD_APP_KEY when available) to the job environment."
+
+inputs:
+  policy:
+    required: false
+    default: public-vectordotdev-vector
+    description: "dd-sts policy to federate against."
+
+runs:
+  using: "composite"
+  steps:
+    - name: Federate Datadog token
+      id: dd-sts
+      uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75
+      with:
+        policy: ${{ inputs.policy }}
+
+    - name: Export Datadog credentials to environment
+      shell: bash
+      env:
+        DD_STS_API_KEY: ${{ steps.dd-sts.outputs.api_key }}
+        DD_STS_APP_KEY: ${{ steps.dd-sts.outputs.app_key }}
+      run: |
+        echo "DD_API_KEY=${DD_STS_API_KEY}" >> "$GITHUB_ENV"
+        if [ -n "${DD_STS_APP_KEY}" ]; then
+          echo "DD_APP_KEY=${DD_STS_APP_KEY}" >> "$GITHUB_ENV"
+        fi

.github/workflows/ci-integration-review.yml

@@ -41,7 +41,6 @@ env:
   TEST_DATADOG_API_KEY: ${{ secrets.CI_TEST_DATADOG_API_KEY }}
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   RUST_BACKTRACE: full
   VECTOR_LOG: vector=debug
   VERBOSE: true
@@ -100,6 +99,7 @@ jobs:
     timeout-minutes: 90
     permissions:
       contents: read
+      id-token: write
       packages: read # Required to pull test runner image from GHCR
     strategy:
       fail-fast: false
@@ -160,6 +160,9 @@ jobs:
           submodules: "recursive"
           ref: ${{ github.event.review.commit_id }}
 
+      - uses: ./.github/actions/dd-token
+        if: steps.run_condition.outputs.should_run == 'true'
+
       - uses: ./.github/actions/setup
         with:
           vdev: true
@@ -191,6 +194,7 @@ jobs:
     permissions:
       contents: read
       packages: read # Required to pull test runner image from GHCR
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -214,6 +218,9 @@ jobs:
           submodules: "recursive"
           ref: ${{ github.event.review.commit_id }}
 
+      - uses: ./.github/actions/dd-token
+        if: steps.run_condition.outputs.should_run == 'true'
+
       - uses: ./.github/actions/setup
         with:
           vdev: true

.github/workflows/ci-review-trigger.yml

@@ -31,6 +31,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 env:
   DD_ENV: "ci"

.github/workflows/coverage.yml

@@ -16,6 +16,9 @@ env:
 jobs:
   coverage:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
@@ -31,9 +34,10 @@ jobs:
       - name: "Generate code coverage"
         run: cargo llvm-cov nextest --workspace --lcov --output-path lcov.info
 
+      - uses: ./.github/actions/dd-token
+
       - name: "Upload coverage to Datadog"
         env:
-          DD_API_KEY: ${{ secrets.DD_API_KEY }}
           DD_SITE: datadoghq.com
           DD_ENV: ci
         run: datadog-ci coverage upload lcov.info

.github/workflows/integration-test.yml

@@ -23,7 +23,6 @@ env:
   TEST_APPSIGNAL_PUSH_API_KEY: ${{ secrets.TEST_APPSIGNAL_PUSH_API_KEY }}
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   RUST_BACKTRACE: full
   VECTOR_LOG: vector=debug
   VERBOSE: true
@@ -34,6 +33,9 @@ jobs:
   test-integration:
     runs-on: ubuntu-24.04
     timeout-minutes: 40
+    permissions:
+      contents: read
+      id-token: write
     if: inputs.if || github.event_name == 'workflow_dispatch'
     steps:
       - name: (PR comment) Get PR branch
@@ -51,6 +53,8 @@ jobs:
         if: ${{ github.event_name != 'issue_comment' }}
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - uses: ./.github/actions/dd-token
+
       - run: bash scripts/environment/prepare.sh --modules=rustup,datadog-ci
 
       - run: make test-integration-${{ inputs.test_name }}

.github/workflows/integration.yml

@@ -23,7 +23,6 @@ permissions:
 env:
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   TEST_DATADOG_API_KEY: ${{ secrets.CI_TEST_DATADOG_API_KEY }}
   TEST_APPSIGNAL_PUSH_API_KEY: ${{ secrets.TEST_APPSIGNAL_PUSH_API_KEY }}
   AXIOM_TOKEN: ${{ secrets.AXIOM_TOKEN }}
@@ -65,6 +64,9 @@ jobs:
 
   integration-tests:
     runs-on: ubuntu-24.04-8core
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - changes
       - build-test-runner
@@ -141,6 +143,9 @@ jobs:
         with:
           submodules: "recursive"
 
+      - uses: ./.github/actions/dd-token
+        if: steps.check.outputs.should_run == 'true'
+
       - uses: ./.github/actions/setup
         if: steps.check.outputs.should_run == 'true'
         with:
@@ -167,6 +172,9 @@ jobs:
 
   e2e-tests:
     runs-on: ubuntu-24.04-8core
+    permissions:
+      contents: read
+      id-token: write
     needs:
       - changes
       - build-test-runner
@@ -205,6 +213,9 @@ jobs:
         with:
           submodules: "recursive"
 
+      - uses: ./.github/actions/dd-token
+        if: steps.check.outputs.should_run == 'true'
+
       - uses: ./.github/actions/setup
         if: steps.check.outputs.should_run == 'true'
         with:

.github/workflows/master_merge_queue.yml

@@ -21,6 +21,7 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 concurrency:
   # `github.ref` is unique for MQ runs and PRs
@@ -30,7 +31,6 @@ concurrency:
 env:
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   RUST_BACKTRACE: full
   VECTOR_LOG: vector=debug
   VERBOSE: true

.github/workflows/static-analysis.yml

@@ -13,14 +13,18 @@ permissions:
 jobs:
   static-analysis:
     runs-on: ubuntu-latest
-    env:
-      DD_API_KEY: ${{ secrets.DD_API_KEY }}
-      DD_APP_KEY: ${{ secrets.DD_APP_KEY }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
+      - id: dd-token
+        uses: ./.github/actions/dd-token
+        with:
+          policy: public-vectordotdev-vector-static-analysis
+
       - name: Datadog Static Analyzer
-        if: ${{ env.DD_API_KEY != '' }}
         uses: DataDog/datadog-static-analyzer-github-action@8340f18875fcefca86844b5f947ce2431387e552 # v3.0.0
         with:
           dd_api_key: ${{ env.DD_API_KEY }}

.github/workflows/test-make-command.yml

@@ -32,17 +32,22 @@ permissions:
 jobs:
   run-make-command:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
     timeout-minutes: 90
     env:
       CARGO_INCREMENTAL: 0
       DD_ENV: "ci"
-      DD_API_KEY: ${{ secrets.DD_API_KEY }}
     steps:
       - name: Checkout branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ inputs.ref }}
 
+      - uses: ./.github/actions/dd-token
+        if: ${{ inputs.upload_test_results }}
+
       - uses: ./.github/actions/setup
         with:
           rust: true

.github/workflows/test.yml

@@ -17,7 +17,6 @@ concurrency:
 env:
   CONTAINER_TOOL: "docker"
   DD_ENV: "ci"
-  DD_API_KEY: ${{ secrets.DD_API_KEY }}
   VECTOR_LOG: vector=debug
   VERBOSE: true
   CI: true
@@ -57,6 +56,9 @@ jobs:
 
   test:
     needs: changes
+    permissions:
+      contents: read
+      id-token: write
     if: ${{ needs.changes.outputs.source == 'true' || needs.changes.outputs.test-yml == 'true' }}
     uses: ./.github/workflows/unit-tests.yml
     with: