ci(chainguard): Add dd-octo-sts policy for slapr workflow

[chouetz]

What does this PR do?

Adds a new dd-octo-sts trust policy at .github/chainguard/self.slapr.read-members.sts.yaml to grant the slapr.yml workflow short-lived GitHub tokens with contents:read, pull_requests:read, and members:read permissions.

Motivation

The slapr workflow needs to read organization members to function properly. This policy allows it to obtain scoped tokens via dd-octo-sts instead of relying on broader credentials.

Describe how you validated your changes

Policy file follows the established dd-octo-sts pattern used by other policies in .github/chainguard/. The claim patterns match pull_request and pull_request_review events on PR merge refs and main.

Additional Notes

The policy scopes to:

• Subject: repo:DataDog/datadog-agent:pull_request
• Events: pull_request and pull_request_review
• Refs: PR merge refs and main
• Workflow: slapr.yml only

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 042d1b9e63

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Point policy to an existing workflow file

The job_workflow_ref claim is pinned to .github/workflows/slapr.yml, but this repository tree at ea79d7c4701cd4aa266eef005459d348358f120e does not contain that workflow file under .github/workflows/. Because dd-octo-sts only mints tokens when all claim patterns match, this policy is currently unreachable and will not grant the intended members:read token to any existing workflow run; either reference the actual workflow filename or include the workflow in the same change.

Useful? React with 👍 / 👎.

[agent-platform-auto-pr]

Files inventory check summary

File checks results against ancestor 2c465803:

Results for datadog-agent_7.78.0~devel.git.590.042d1b9.pipeline.102518638-1_amd64.deb:

No change detected