Skip to content

Commit 675f3a6

Browse files
steveny91steveny91
authored
Migrate rest of workflows to dd-octo-sts (DataDog#23188)
* Add dd-octo-sts trust policy for labeler workflows * octo-sts policies * test workflows for dd-octo-sts migration * migrate last one and also test * remove test workflows * migrate workflows
1 parent 47e19ea commit 675f3a6

6 files changed

Lines changed: 128 additions & 15 deletions

‎.github/chainguard/self.resolve-build-deps.push.sts.yaml‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
# Policy for: .github/workflows/resolve-build-deps.yaml publish job in DataDog/integrations-core
2+
# Triggered by push to master or release branches, or workflow_dispatch
3+
#
4+
# Naming convention:
5+
# self: Only this repository (DataDog/integrations-core) can use this policy
6+
# resolve-build-deps: Specific workflow
7+
# push: Primary trigger is push to protected branches
8+
#
9+
# Security model:
10+
# - Publish job runs on push or workflow_dispatch to protected branches (master and X.Y.x)
11+
# - Workflow file must be committed to the same branch
12+
# - Pull request events are excluded by the job's if condition
13+
#
14+
# Permissions granted:
15+
# - contents: write - Push commits to branches
16+
# - pull_requests: write - Create pull requests
17+
# - workflows: write - Modify workflow files in generated commits
18+
#
19+
# Usage in workflows:
20+
# - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
21+
# with:
22+
# scope: DataDog/integrations-core
23+
# policy: self.resolve-build-deps.push
24+
25+
issuer: https://token.actions.githubusercontent.com
26+
27+
subject_pattern: repo:DataDog/integrations-core:ref:refs/heads/(master|\d+\.\d+\..*)
28+
29+
claim_pattern:
30+
event_name: (push|workflow_dispatch)
31+
job_workflow_ref: DataDog/integrations-core/\.github/workflows/resolve-build-deps\.yaml@refs/heads/(master|\d+\.\d+\..*)
32+
ref: refs/heads/(master|\d+\.\d+\..*)
33+
repository: DataDog/integrations-core
34+
35+
permissions:
36+
contents: write
37+
pull_requests: write
38+
workflows: write

‎.github/chainguard/self.update-agent-changelog.tag-push.sts.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Policy for: .github/workflows/update-agent-changelog.yml in DataDog/integrations-core
2+
# Triggered by pushing semver tags (e.g., 7.56.0)
3+
#
4+
# Naming convention:
5+
# self: Only this repository (DataDog/integrations-core) can use this policy
6+
# update-agent-changelog: Specific workflow
7+
# tag-push: Triggered by release tag push
8+
#
9+
# Security model:
10+
# - Workflow runs on push events for tags matching semver pattern
11+
# - Workflow file must be committed at the tag ref
12+
# - Tag creation is controlled by release process
13+
#
14+
# Permissions granted:
15+
# - contents: write - Create branches and push commits
16+
# - pull_requests: write - Create pull requests
17+
#
18+
# Usage in workflows:
19+
# - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
20+
# with:
21+
# scope: DataDog/integrations-core
22+
# policy: self.update-agent-changelog.tag-push
23+
24+
issuer: https://token.actions.githubusercontent.com
25+
26+
subject_pattern: repo:DataDog/integrations-core:ref:refs/tags/\d+\.\d+\.\d+
27+
28+
claim_pattern:
29+
event_name: push
30+
job_workflow_ref: DataDog/integrations-core/\.github/workflows/update-agent-changelog\.yml@refs/tags/\d+\.\d+\.\d+
31+
ref: refs/tags/\d+\.\d+\.\d+
32+
repository: DataDog/integrations-core
33+
34+
permissions:
35+
contents: write
36+
pull_requests: write

‎.github/chainguard/self.update-build-agent-yaml.dispatch.sts.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Policy for: .github/workflows/update-build-agent-yaml.yml in DataDog/integrations-core
2+
# Triggered by workflow_dispatch from master (manual trigger)
3+
#
4+
# Naming convention:
5+
# self: Only this repository (DataDog/integrations-core) can use this policy
6+
# update-build-agent-yaml: Specific workflow
7+
# dispatch: Triggered only via workflow_dispatch
8+
#
9+
# Security model:
10+
# - Workflow is manually triggered via workflow_dispatch from master
11+
# - Workflow file is committed to master (protected branch)
12+
# - User provides the target release branch as input
13+
#
14+
# Permissions granted:
15+
# - contents: write - Create branches and push commits
16+
# - pull_requests: write - Create pull requests
17+
#
18+
# Usage in workflows:
19+
# - uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
20+
# with:
21+
# scope: DataDog/integrations-core
22+
# policy: self.update-build-agent-yaml.dispatch
23+
24+
issuer: https://token.actions.githubusercontent.com
25+
26+
subject: repo:DataDog/integrations-core:ref:refs/heads/master
27+
28+
claim_pattern:
29+
event_name: workflow_dispatch
30+
job_workflow_ref: DataDog/integrations-core/\.github/workflows/update-build-agent-yaml\.yml@refs/heads/master
31+
ref: refs/heads/master
32+
repository: DataDog/integrations-core
33+
34+
permissions:
35+
contents: write
36+
pull_requests: write

‎.github/workflows/resolve-build-deps.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -371,13 +371,12 @@ jobs:
371371
rm ${{ steps.auth.outputs.credentials_file_path }}
372372
rm -rf targets
373373
374-
- name: Create token
375-
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
374+
- name: Get token via dd-octo-sts
375+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
376376
id: token-generator
377377
with:
378-
app-id: ${{ vars.DD_AGENT_INTEGRATIONS_BOT_APP_ID }}
379-
private-key: ${{ secrets.DD_AGENT_INTEGRATIONS_BOT_PRIVATE_KEY }}
380-
repositories: integrations-core
378+
scope: DataDog/integrations-core
379+
policy: self.resolve-build-deps.push
381380

382381
- name: Find triggering PR
383382
id: find-pr

‎.github/workflows/update-agent-changelog.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,9 @@ jobs:
99
update_agent_changelog:
1010
name: Update the Agent Changelog
1111
runs-on: ubuntu-latest
12+
permissions:
13+
contents: read
14+
id-token: write
1215
steps:
1316
- name: Checkout
1417
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -37,13 +40,12 @@ jobs:
3740
- name: Update the integration changelogs
3841
run: |-
3942
ddev release agent integrations-changelog --write
40-
- name: Create token
41-
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
43+
- name: Get token via dd-octo-sts
44+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
4245
id: token-generator
4346
with:
44-
app-id: ${{ secrets.DD_AGENT_INTEGRATIONS_BOT_APP_ID }}
45-
private-key: ${{ secrets.DD_AGENT_INTEGRATIONS_BOT_PRIVATE_KEY }}
46-
repositories: integrations-core
47+
scope: DataDog/integrations-core
48+
policy: self.update-agent-changelog.tag-push
4749
- name: Create Pull Request
4850
id: cpr
4951
uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0

‎.github/workflows/update-build-agent-yaml.yml‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ jobs:
1212
update:
1313
name: Update build_agent.yaml (${{ inputs.branch }})
1414
runs-on: ubuntu-latest
15+
permissions:
16+
contents: read
17+
id-token: write
1518
env:
1619
BRANCH: ${{ inputs.branch }}
1720
steps:
@@ -37,14 +40,13 @@ jobs:
3740
run: |-
3841
sed -i "s/^ branch: main$/ branch: $BRANCH/" .gitlab/build_agent.yaml
3942
40-
- name: Create token
43+
- name: Get token via dd-octo-sts
4144
if: env.needs_update == 'true'
42-
uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
45+
uses: DataDog/dd-octo-sts-action@96a25462dbcb10ebf0bfd6e2ccc917d2ab235b9a # v1.0.4
4346
id: token-generator
4447
with:
45-
app-id: ${{ secrets.DD_AGENT_INTEGRATIONS_BOT_APP_ID }}
46-
private-key: ${{ secrets.DD_AGENT_INTEGRATIONS_BOT_PRIVATE_KEY }}
47-
repositories: integrations-core
48+
scope: DataDog/integrations-core
49+
policy: self.update-build-agent-yaml.dispatch
4850

4951
- name: Create Pull Request
5052
if: env.needs_update == 'true'

0 commit comments

Comments
 (0)