Skip to content

Commit d31ec85

Browse files
sarah-wittAAraKKe
sarah-witt
and
AAraKKe
authored
Use dd-sts for github workflows using api and app keys (DataDog#23190)
* use dd-sts for static analysis * update permissions * fix permissions * migrate other workflows to dd-sts * Fix steps * fix * update permissions * add for macos * Fix workflow * revert static analysis for now * Add static analysis back * update to use only the api key policy when needed" * Update gitlab job * lint gitlab job * fix gitlab script * add better logging to gitlab job * update audience --------- Co-authored-by: Juanpe Araque <juanpedro.araque@datadoghq.com>
1 parent 1328bfc commit d31ec85

5 files changed

Lines changed: 93 additions & 24 deletions

File tree

‎.github/workflows/build-ddev.yml‎

Lines changed: 46 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -56,19 +56,27 @@ jobs:
5656
name: Build wheel and source distribution
5757
runs-on: ubuntu-latest
5858
needs: define-tags
59-
59+
permissions:
60+
# needed for dd-sts
61+
id-token: write
6062
steps:
6163
- name: Checkout code
6264
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
6365
with:
6466
fetch-depth: 0
6567

68+
- name: Get Datadog credentials
69+
id: dd-sts
70+
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
71+
with:
72+
policy: integrations-core-api-key
73+
6674
- name: Tag Job
6775
uses: ./.github/actions/tag-job
6876
if: ${{ github.event.pull_request.head.repo.fork != true }}
6977
with:
7078
tags: '${{ needs.define-tags.outputs.base_tags }},step:build-artifacts'
71-
dd_api_key: ${{ secrets.DD_API_KEY }}
79+
dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
7280

7381
- name: Install build frontend
7482
run: python -m pip install --upgrade build
@@ -89,6 +97,9 @@ jobs:
8997
- define-tags
9098
- python-artifacts
9199
runs-on: ${{ matrix.job.os }}
100+
permissions:
101+
# needed for dd-sts
102+
id-token: write
92103
strategy:
93104
fail-fast: false
94105
matrix:
@@ -133,12 +144,18 @@ jobs:
133144
with:
134145
fetch-depth: 0
135146

147+
- name: Get Datadog credentials
148+
id: dd-sts
149+
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
150+
with:
151+
policy: integrations-core-api-key
152+
136153
- name: Tag Job
137154
uses: ./.github/actions/tag-job
138155
if: ${{ github.event.pull_request.head.repo.fork != true }}
139156
with:
140157
tags: '${{ needs.define-tags.outputs.base_tags }},step:build-binary,os:${{ matrix.job.os }},target:${{ matrix.job.target }}'
141-
dd_api_key: ${{ secrets.DD_API_KEY }}
158+
dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
142159

143160
- name: Fetch PyApp
144161
run: >-
@@ -303,20 +320,27 @@ jobs:
303320
- define-tags
304321
- binaries
305322
runs-on: windows-2022
306-
323+
permissions:
324+
# needed for dd-sts
325+
id-token: write
307326
env:
308327
VERSION: ${{ needs.binaries.outputs.version }}
309328

310329
steps:
311330
- name: Checkout code
312331
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
332+
- name: Get Datadog credentials
333+
id: dd-sts
334+
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
335+
with:
336+
policy: integrations-core-api-key
313337

314338
- name: Tag Job
315339
uses: ./.github/actions/tag-job
316340
if: ${{ github.event.pull_request.head.repo.fork != true }}
317341
with:
318342
tags: '${{ needs.define-tags.outputs.base_tags }},step:package-windows,os:windows'
319-
dd_api_key: ${{ secrets.DD_API_KEY }}
343+
dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
320344

321345
- name: Set up Python ${{ env.PYTHON_VERSION }}
322346
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -418,20 +442,28 @@ jobs:
418442
- define-tags
419443
- binaries
420444
runs-on: macos-14-large
421-
445+
permissions:
446+
# needed for dd-sts
447+
id-token: write
422448
env:
423449
VERSION: ${{ needs.binaries.outputs.version }}
424450

425451
steps:
426452
- name: Checkout code
427453
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
428454

455+
- name: Get Datadog credentials
456+
id: dd-sts
457+
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
458+
with:
459+
policy: integrations-core-api-key
460+
429461
- name: Tag Job
430462
uses: ./.github/actions/tag-job
431463
if: ${{ github.event.pull_request.head.repo.fork != true }}
432464
with:
433465
tags: '${{ needs.define-tags.outputs.base_tags }},step:package-macos,os:macos'
434-
dd_api_key: ${{ secrets.DD_API_KEY }}
466+
dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
435467

436468
- name: Set up Python ${{ env.PYTHON_VERSION }}
437469
uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
@@ -659,12 +691,18 @@ jobs:
659691
- name: Checkout code
660692
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
661693

694+
- name: Get Datadog credentials
695+
id: dd-sts
696+
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
697+
with:
698+
policy: integrations-core-api-key
699+
662700
- name: Tag Job
663701
uses: ./.github/actions/tag-job
664702
if: ${{ github.event.pull_request.head.repo.fork != true }}
665703
with:
666704
tags: '${{ needs.define-tags.outputs.base_tags }},step:publish'
667-
dd_api_key: ${{ secrets.DD_API_KEY }}
705+
dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
668706

669707
- name: Download Python artifacts
670708
uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0

‎.github/workflows/datadog-static-analysis.yml‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,20 +4,26 @@ name: Datadog Static Analysis
44

55
jobs:
66
static-analysis:
7+
permissions:
8+
# needed for dd-sts
9+
id-token: write
710
# Dependabot PRs don't have access to the required secrets
811
if: github.actor != 'dependabot[bot]'
912
runs-on: ubuntu-latest
1013
name: Datadog Static Analyzer
1114
steps:
1215
- name: Checkout
1316
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
17+
- name: Get Datadog credentials
18+
id: dd-sts
19+
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
20+
with:
21+
policy: integrations-core
1422
- name: Check code meets quality and security standards
1523
id: datadog-static-analysis
1624
uses: DataDog/datadog-static-analyzer-github-action@c0e10d1c37e5b306b85e5bcf29b06bb233a71dc8 # v3.0.0
1725
with:
18-
dd_api_key: ${{ secrets.DD_API_KEY }}
19-
dd_app_key: ${{ secrets.DD_STATIC_ANALYSIS_APP_KEY }}
20-
dd_service: integration-core
21-
dd_env: ci
26+
dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
27+
dd_app_key: ${{ steps.dd-sts.outputs.app_key }}
2228
dd_site: datadoghq.com
2329
cpu_count: 2

‎.github/workflows/measure-disk-usage.yml‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ jobs:
1616
permissions:
1717
contents: read
1818
actions: read
19+
# needed for dd-sts
20+
id-token: write
1921
steps:
2022
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
2123
with:
@@ -26,6 +28,12 @@ jobs:
2628
with:
2729
python-version: ${{ env.PYTHON_VERSION }}
2830

31+
- name: Get Datadog credentials
32+
id: dd-sts
33+
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
34+
with:
35+
policy: integrations-core-api-key
36+
2937
- name: Install ddev
3038
run: |
3139
pip install -e ./datadog_checks_dev[cli]
@@ -45,7 +53,7 @@ jobs:
4553
cmd="ddev -v size status --commit \"$HEAD_SHA\" --format json"
4654
4755
if [ "$EVENT_NAME" = "push" ] && [ "$HEAD_BRANCH" = "master" ]; then
48-
cmd="$cmd --to-dd-key ${{ secrets.DD_API_KEY }}"
56+
cmd="$cmd --to-dd-key ${{ steps.dd-sts.outputs.api_key }}"
4957
fi
5058
echo "cmd=$cmd" >> $GITHUB_OUTPUT
5159

‎.github/workflows/test-fips-e2e.yml‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
DD_TRACE_ANALYTICS_ENABLED: "true"
4444

4545
permissions:
46-
# needed for codecov in test-target.yml, allows the action to get a JWT signed by Github
46+
# needed for dd-sts and codecov in test-target.yml, allows the action to get a JWT signed by Github
4747
id-token: write
4848
# needed for compute-matrix in test-target.yml
4949
contents: read
@@ -79,6 +79,11 @@ jobs:
7979
)}}
8080
restore-keys: |-
8181
v01-python-${{ env.pythonLocation }}
82+
- name: Get Datadog credentials
83+
id: dd-sts
84+
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
85+
with:
86+
policy: integrations-core-api-key
8287

8388
- name: Install ddev from local folder
8489
run: |-
@@ -105,14 +110,14 @@ jobs:
105110
- name: Run E2E tests with FIPS disabled
106111
env:
107112
DDEV_E2E_AGENT: "${{ inputs.agent-image || 'registry.datadoghq.com/agent-dev:master-py3' }}"
108-
DD_API_KEY: "${{ secrets.DD_API_KEY }}"
113+
DD_API_KEY: "${{ steps.dd-sts.outputs.api_key }}"
109114
run: |
110115
ddev env test --base --new-env --junit ${{ inputs.target || 'tls' }} -- all -m "fips_off"
111116
112117
- name: Run E2E tests with FIPS enabled
113118
env:
114119
DDEV_E2E_AGENT: "${{ inputs.agent-image-fips || 'registry.datadoghq.com/agent-dev:master-fips' }}"
115-
DD_API_KEY: "${{ secrets.DD_API_KEY }}"
120+
DD_API_KEY: "${{ steps.dd-sts.outputs.api_key }}"
116121
run: |
117122
ddev env test --base --new-env --junit ${{ inputs.target || 'tls' }} -- all -k "fips_on"
118123

‎.gitlab/software_composition_analysis.yaml‎

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -4,17 +4,29 @@ datadog-sca-ci:
44
tags: ["arch:amd64"]
55
image: 486234852809.dkr.ecr.us-east-1.amazonaws.com/datadog-static-analyzer:2024031801
66
when: always
7-
# We don't want to disrupt the pipeline so let's fail silently.
7+
# We don’t want to disrupt the pipeline so let’s fail silently.
88
allow_failure: true
99
# This specifies the job does not have any dependency, meaning it can start as soon as it can.
1010
needs: []
11+
id_tokens:
12+
DD_STS_OIDC_TOKEN:
13+
aud: rapid-seceng-sit
1114
script:
12-
# Disabling tracing to avoid leaking secrets.
13-
# See https://www.gnu.org/software/bash/manual/bash.html#The-Set-Builtin:
14-
# "Using ‘+’ rather than ‘-’ causes these options to be turned off"
15-
- set +o xtrace
16-
- export DD_API_KEY=$(aws ssm get-parameter --region us-east-1 --name "ci.integrations-core.datadog_api_key_org2" --with-decryption --query "Parameter.Value" --out text)
17-
- export DD_APP_KEY=$(aws ssm get-parameter --region us-east-1 --name "ci.integrations-core.datadog_app_key_org2" --with-decryption --query "Parameter.Value" --out text)
18-
- set -o xtrace
15+
- |
16+
set +o xtrace
17+
DD_STS_RESPONSE=$(curl -sS -w "\n%{http_code}" \
18+
-H "Authorization: Bearer ${DD_STS_OIDC_TOKEN}" \
19+
"https://dd-sts.us1.ddbuild.io/sts/datadog/exchange?policy=integrations-core-gitlab")
20+
HTTP_CODE=$(echo "$DD_STS_RESPONSE" | tail -n1)
21+
RESPONSE_BODY=$(echo "$DD_STS_RESPONSE" | head -n -1)
22+
if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 300 ]; then
23+
echo "STS token exchange successful"
24+
else
25+
echo "ERROR: STS token exchange failed (HTTP ${HTTP_CODE}): $RESPONSE_BODY"
26+
exit 1
27+
fi
28+
export DD_API_KEY=$(echo "$RESPONSE_BODY" | jq -re ".api_key")
29+
export DD_APP_KEY=$(echo "$RESPONSE_BODY" | jq -re ".application_key")
30+
set -o xtrace
1931
- osv-scanner --skip-git --recursive --experimental-only-packages --format=cyclonedx-1-4 --output=/tmp/sbom.json .
2032
- datadog-ci sbom upload --service integrations-core --env ci /tmp/sbom.json

0 commit comments

Comments
 (0)