[pull] master from DataDog:master

.builders/scripts/files_to_remove.toml

@@ -16,7 +16,7 @@ excluded_paths = [
   "gssapi/**/py.typed",
 
   # --- Tests ---
- 
+
   "idlelib/idle_test/",
   "bs4/tests/",
   "Cryptodome/SelfTest/",
@@ -42,4 +42,18 @@ excluded_paths = [
   "vertica_python/tests/",
   "websocket/tests/",
   "win32com/test/",
+
+  # --- Botocore ---
+  "botocore/data/*",
+  # We use sts in several integrations for assuming roles:
+  # - amazon_msk
+  # - postres
+  # - mysql
+  "!botocore/data/sts",
+  # amazon_msk also needs the kafka client.
+  "!botocore/data/kafka",
+  # postgres and mysql also need the rds.
+  "!botocore/data/rds",
+  # Riakcs integration monitors s3.
+  "!botocore/data/s3",
 ]

activemq_xml/assets/configuration/spec.yaml

@@ -11,6 +11,7 @@ files:
     options:
     - name: url
       fleet_configurable: true
+      formats: ["url"]
       required: true
       description: |
         url to gather the stats from.

airflow/assets/configuration/spec.yaml

@@ -11,6 +11,7 @@ files:
     options:
     - name: url
       fleet_configurable: true
+      formats: ["url"]
       required: true
       description: The URL used to connect to the Airflow instance (use the Airflow web server REST API endpoint).
       value:

ambari/assets/configuration/spec.yaml

@@ -21,6 +21,7 @@ files:
     options:
     - name: url
       fleet_configurable: true
+      formats: ["url"]
       required: true
       description: The URL of the Ambari Server, include http:// or https://
       value:

apache/assets/configuration/spec.yaml

@@ -14,6 +14,7 @@ files:
       required: true
       display_priority: 2
       description: Status url of your Apache server.
+      formats: ["url"]
       value:
         example: http://localhost/server-status?auto
         type: string

citrix_hypervisor/assets/configuration/spec.yaml

@@ -12,6 +12,7 @@ files:
     - name: url
       description: Url of the hypervisor
       fleet_configurable: true
+      formats: ["url"]
       required: true
       value:
         type: string

cloud_foundry_api/assets/configuration/spec.yaml

@@ -8,6 +8,7 @@ files:
     - name: api_url
       description: URL of the Cloud Controller API.
       fleet_configurable: true
+      formats: ["url"]
       required: true
       value:
         type: string
@@ -25,9 +26,9 @@ files:
         for communication with the Cloud Controller API.
       fleet_configurable: true
       required: true
+      secret: true
       value:
         type: string
-      secret: true
     - name: event_filter
       description: |
         A list of the types of audit events to fetch.

cloudera/assets/configuration/spec.yaml

@@ -18,6 +18,7 @@ files:
         The Workload password. This value can be found in the `User Management` tab of the Management
         Console in the `Workload Password`.
       fleet_configurable: true
+      secret: true
       required: true
       secret: true
       value:
@@ -27,6 +28,7 @@ files:
     options:
     - name: api_url
       fleet_configurable: true
+      formats: ["url"]
       required: true
       description: |
         The URL endpoint for the Cloudera Manager API. This can be found under the Endpoints tab for

consul/assets/configuration/spec.yaml

@@ -11,6 +11,7 @@ files:
     options:
     - name: url
       fleet_configurable: true
+      formats: ["url"]
       display_priority: 2
       required: true
       description: |

couch/assets/configuration/spec.yaml

@@ -11,6 +11,7 @@ files:
     options:
     - name: server
       fleet_configurable: true
+      formats: ["url"]
       required: true
       description: The Couch server's url.
       display_priority: 3

datadog_checks_dev/datadog_checks/dev/tooling/configuration/consumers/example.py

@@ -26,6 +26,7 @@
     'template',
     'overrides',
     'fleet_configurable',
+    'formats',
 }
 ALLOWED_VALUE_FIELDS = OPENAPI_SCHEMA_PROPERTIES | {'example', 'display_default', 'compact_example'}
 DESCRIPTION_LINE_LENGTH_LIMIT = 120

datadog_checks_dev/datadog_checks/dev/tooling/templates/configuration/instances/http.yaml

@@ -167,6 +167,7 @@
     See https://github.com/requests/requests-kerberos#explicit-principal
 - name: kerberos_keytab
   fleet_configurable: true
+  formats: ["path"]
   value:
     example: <KEYTAB_FILE_PATH>
     type: string

datadog_checks_dev/datadog_checks/dev/tooling/templates/configuration/instances/jmx.yaml

@@ -8,6 +8,7 @@
 - name: port
   required: true
   description: JMX port to connect to.
+  formats: ["port"]
   value:
     type: integer
   fleet_configurable: true
@@ -25,6 +26,7 @@
 - name: jmx_url
   description: JMX URL to connect to. Can be used instead of host/port configs.
   hidden: true
+  formats: ["url"]
   value:
     type: string
   fleet_configurable: true
@@ -63,6 +65,7 @@
     Note: tools.jar was removed in Java 9: https://openjdk.java.net/jeps/220.
     This option is supported in Java 8 and below.
   fleet_configurable: true
+  formats: ["path"]
   value:
     type: string
 
@@ -81,13 +84,15 @@
 - name: java_options
   description: 'A list of Java JVM options, for example: "-Xmx200m -Xms50m".'
   fleet_configurable: true
+  formats: ["java_jvm_options"]
   value:
     type: string
 
 - name: trust_store_path
   description: |
     The path to your trusted store.
     `trust_store_path` should be set if SSL is enabled.
+  formats: ["path"]
   value:
     type: string
   fleet_configurable: true
@@ -104,6 +109,7 @@
   description: |
     The path to your key store.
     `key_store_path` should be set if client authentication is enabled on the target JVM.
+  formats: ["path"]
   value:
     type: string
   fleet_configurable: true

ddev/CHANGELOG.md

@@ -2,6 +2,12 @@
 
 <!-- towncrier release notes start -->
 
+## 14.3.1 / 2026-02-20
+
+***Fixed***:
+
+* Stop writing the GitHub username and token to the config file. Read them directly from environment variables instead. ([#22691](https://github.com/DataDog/integrations-core/pull/22691))
+
 ## 14.3.0 / 2026-02-13
 
 ***Added***:

ddev/src/ddev/cli/application.py

@@ -94,6 +94,11 @@ def initialize_old_cli(self):
         self.__config['color'] = not self.console.no_color
         self.__config['dd_api_key'] = self.config.orgs.get('default', {}).get('api_key', '')
         self.__config['dd_app_key'] = self.config.orgs.get('default', {}).get('app_key', '')
+        # Ensure GitHub config is available for old CLI commands that need it
+        self.__config['github'] = {
+            'user': self.config.github.user,
+            'token': self.config.github.token,
+        }
         # Make sure that envvar overrides of repo make it into config.
         self.__config['repo'] = self.repo.name
         # Transfer the -x/--here flag to the old CLI.

ddev/src/ddev/config/model.py

@@ -487,7 +487,7 @@ def user(self):
 
                 self._field_user = user
             else:
-                self._field_user = self.raw_data['user'] = get_github_user()
+                self._field_user = get_github_user()
 
         return self._field_user
 
@@ -506,7 +506,7 @@ def token(self):
 
                 self._field_token = token
             else:
-                self._field_token = self.raw_data['token'] = get_github_token()
+                self._field_token = get_github_token()
 
         return self._field_token
 

ddev/tests/config/test_model.py

@@ -35,10 +35,7 @@ def test_default():
                 'log_url': os.getenv('DD_LOGS_CONFIG_LOGS_DD_URL', ''),
             },
         },
-        'github': {
-            'user': get_github_user(),
-            'token': get_github_token(),
-        },
+        'github': {},
         'pypi': {
             'user': '',
             'auth': '',
@@ -714,10 +711,7 @@ def test_default(self):
         assert config.github.user == config.github.user == get_github_user()
         assert config.github.token == config.github.token == get_github_token()
         assert config.raw_data == {
-            'github': {
-                'user': get_github_user(),
-                'token': get_github_token(),
-            },
+            'github': {},
         }
 
     def test_not_table(self, helpers):
@@ -1409,3 +1403,74 @@ def test_styles_spinner_set_lazy_error(self, helpers):
             ),
         ):
             _ = config.terminal.styles.spinner
+
+
+class TestGitHubConfig:
+    def test_default_github_config_empty_raw_data(self):
+        config = RootConfig({})
+        config.parse_fields()
+
+        # GitHub config should be empty in raw_data when not explicitly set
+        assert config.raw_data['github'] == {}
+
+        # But properties should still work via environment variables
+        assert config.github.user == get_github_user()
+        assert config.github.token == get_github_token()
+
+        # After accessing properties, raw_data should still be empty
+        assert config.raw_data['github'] == {}
+
+    def test_explicit_github_config_in_raw_data(self):
+        config = RootConfig({'github': {'user': 'explicit_user', 'token': 'explicit_token'}})
+
+        # When explicitly set, values should be in raw_data
+        assert config.raw_data['github']['user'] == 'explicit_user'
+        assert config.raw_data['github']['token'] == 'explicit_token'
+
+        # Properties should return explicit values
+        assert config.github.user == 'explicit_user'
+        assert config.github.token == 'explicit_token'
+
+    def test_partial_github_config_explicit_user_only(self):
+        config = RootConfig({'github': {'user': 'explicit_user'}})
+
+        # Only explicitly set field should be in raw_data
+        assert config.raw_data['github']['user'] == 'explicit_user'
+        assert 'token' not in config.raw_data['github']
+
+        # Properties should work - explicit user, env var token
+        assert config.github.user == 'explicit_user'
+        assert config.github.token == get_github_token()
+
+        # raw_data should still only have explicit field
+        assert config.raw_data['github']['user'] == 'explicit_user'
+        assert 'token' not in config.raw_data['github']
+
+    def test_partial_github_config_explicit_token_only(self):
+        config = RootConfig({'github': {'token': 'explicit_token'}})
+
+        # Only explicitly set field should be in raw_data
+        assert 'user' not in config.raw_data['github']
+        assert config.raw_data['github']['token'] == 'explicit_token'
+
+        # Properties should work - env var user, explicit token
+        assert config.github.user == get_github_user()
+        assert config.github.token == 'explicit_token'
+
+        # raw_data should still only have explicit field
+        assert 'user' not in config.raw_data['github']
+        assert config.raw_data['github']['token'] == 'explicit_token'
+
+    def test_github_config_with_environment_variables(self, monkeypatch):
+        # Mock environment variables
+        monkeypatch.setenv('DD_GITHUB_USER', 'env_user')
+        monkeypatch.setenv('DD_GITHUB_TOKEN', 'env_token')
+
+        config = RootConfig({})
+
+        # Properties should return environment variable values
+        assert config.github.user == 'env_user'
+        assert config.github.token == 'env_token'
+
+        # raw_data should still be empty
+        assert config.raw_data['github'] == {}

druid/assets/configuration/spec.yaml

@@ -12,6 +12,7 @@ files:
     - name: url
       description: coordinator url used to connect to the Druid instance.
       fleet_configurable: true
+      formats: ["url"]
       required: true
       value:
         type: string

elastic/assets/configuration/spec.yaml

@@ -15,6 +15,7 @@ files:
       description: |
         The URL where Elasticsearch accepts HTTP requests. This is used to
         fetch statistics from the nodes and information about the cluster health.
+      formats: ["url"]
       value:
         example: http://localhost:9200
         type: string

gitlab/assets/configuration/spec.yaml

@@ -10,6 +10,7 @@ files:
     options:
     - name: gitlab_url
       fleet_configurable: true
+      formats: ["url"]
       display_priority: 2
       description: |
         The GitLab external URL to probe for service health status

gitlab_runner/assets/configuration/spec.yaml

@@ -62,6 +62,7 @@ files:
     options:
       - name: gitlab_url
         fleet_configurable: true
+        formats: ["url"]
         required: true
         description: |
           Master URL to probe for service health status.
@@ -71,6 +72,7 @@ files:
           type: string
       - name: prometheus_endpoint
         fleet_configurable: true
+        formats: ["url"]
         required: true
         description: URL of the metrics endpoint of prometheus
         value:

haproxy/assets/configuration/spec.yaml

@@ -42,6 +42,7 @@ files:
         prometheus_url.required: false
     - name: url
       fleet_configurable: true
+      formats: ["url"]
       enabled: true
       legacy: true
       value:

harbor/assets/configuration/spec.yaml

@@ -12,6 +12,7 @@ files:
     - name: url
       description: The Harbor HTTP url.
       fleet_configurable: true
+      formats: ["url"]
       required: true
       value:
         type: string

http_check/assets/configuration/spec.yaml

@@ -21,6 +21,7 @@ files:
         type: string
     - name: url
       fleet_configurable: true
+      formats: ["url"]
       required: true
       description: |
         Url to check

kube_controller_manager/assets/configuration/spec.yaml

@@ -32,6 +32,7 @@ files:
       description: |
         The URL for the kube-controller-manager health endpoint.
       fleet_configurable: true
+      formats: ["url"]
       value:
         type: string
         example: http://localhost:10252/healthz