v5.96.0 proposal

.github/CODEOWNERS

@@ -191,6 +191,8 @@
 /packages/dd-trace/test/openfeature/ @DataDog/feature-flagging
 
 # CI
+/.github/actions/dd-sts-app-key/action.yml @Datadog/lang-platform-js
+/.github/actions/dd-sts-api-key/action.yml @Datadog/lang-platform-js
 /.github/chainguard @DataDog/sdlc-security
 /.github/workflows/apm-capabilities.yml @DataDog/apm-sdk-capabilities-js
 /.github/workflows/apm-integrations.yml @DataDog/apm-idm-js

.github/actions/coverage/action.yml

@@ -28,7 +28,7 @@ runs:
     - name: Upload coverage to Datadog
       if: always()
       continue-on-error: true
-      uses: DataDog/coverage-upload-github-action@d2cf302a39c05e0ad22063360a2bf6ce0cc4906c # v1
+      uses: DataDog/coverage-upload-github-action@f80c0e6e64e5d20d6af251ba00361eeaebc7ff99 # v1
       with:
         api_key: ${{ inputs.dd_api_key }}
         files: .

.github/actions/dd-sts-api-key/action.yml

@@ -0,0 +1,16 @@
+name: Get Datadog API key
+description: Exchange GitHub OIDC token for a Datadog API key via dd-sts.
+
+outputs:
+  api_key:
+    description: "Datadog API key"
+    value: ${{ steps.dd-sts.outputs.api_key }}
+
+runs:
+  using: composite
+  steps:
+    - name: Get Datadog API key
+      id: dd-sts
+      uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
+      with:
+        policy: dd-trace-js-api-key

.github/actions/dd-sts-app-key/action.yml

@@ -0,0 +1,16 @@
+name: Get Datadog App key
+description: Exchange GitHub OIDC token for a Datadog App key via dd-sts.
+
+outputs:
+  app_key:
+    description: "Datadog application key"
+    value: ${{ steps.dd-sts.outputs.app_key }}
+
+runs:
+  using: composite
+  steps:
+    - name: Get Datadog App key
+      id: dd-sts
+      uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
+      with:
+        policy: dd-trace-js

.github/actions/instrumentations/test/action.yml

@@ -1,12 +1,10 @@
 name: Instrumentation Tests
 description: Run instrumentation tests
-inputs:
-  dd_api_key:
-    description: DD_API_KEY used to push test results
-    required: true
 runs:
   using: composite
   steps:
+    - uses: ./.github/actions/dd-sts-api-key
+      id: dd-sts
     - uses: ./.github/actions/node/oldest-maintenance-lts
     - uses: ./.github/actions/install
     - run: yarn test:instrumentations:ci
@@ -17,8 +15,8 @@ runs:
     - uses: ./.github/actions/coverage
       with:
         flags: instrumentations-${{ github.job }}
-        dd_api_key: ${{ inputs.dd_api_key }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
     - uses: ./.github/actions/push_to_test_optimization
       if: "!cancelled()"
       with:
-        dd_api_key: ${{ inputs.dd_api_key }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}

.github/actions/plugins/test-and-upstream/action.yml

@@ -1,12 +1,10 @@
 name: Plugin and Upstream Tests
 description: Run plugin tests and upstream test suite
-inputs:
-  dd_api_key:
-    description: DD_API_KEY used to push test results
-    required: true
 runs:
   using: composite
   steps:
+    - uses: ./.github/actions/dd-sts-api-key
+      id: dd-sts
     - uses: ./.github/actions/testagent/start
     - uses: ./.github/actions/node/oldest-maintenance-lts
     - uses: ./.github/actions/install
@@ -22,12 +20,12 @@ runs:
     - uses: ./.github/actions/coverage
       with:
         flags: plugins-test-and-upstream-${{ github.job }}
-        dd_api_key: ${{ inputs.dd_api_key }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
     - if: always()
       uses: ./.github/actions/testagent/logs
       with:
         suffix: test-and-upstream-${{ github.job }}
     - uses: ./.github/actions/push_to_test_optimization
       if: "!cancelled()"
       with:
-        dd_api_key: ${{ inputs.dd_api_key }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}

.github/actions/plugins/test/action.yml

@@ -1,12 +1,10 @@
 name: Plugin Tests
 description: Run plugin tests
-inputs:
-  dd_api_key:
-    description: DD_API_KEY used to push test results
-    required: true
 runs:
   using: composite
   steps:
+    - uses: ./.github/actions/dd-sts-api-key
+      id: dd-sts
     - uses: ./.github/actions/testagent/start
     - uses: ./.github/actions/node/oldest-maintenance-lts
     - uses: ./.github/actions/install
@@ -18,12 +16,12 @@ runs:
     - uses: ./.github/actions/coverage
       with:
         flags: plugins-${{ github.job }}
-        dd_api_key: ${{ inputs.dd_api_key }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
     - if: always()
       uses: ./.github/actions/testagent/logs
       with:
         suffix: test-${{ github.job }}
     - uses: ./.github/actions/push_to_test_optimization
       if: "!cancelled()"
       with:
-        dd_api_key: ${{ inputs.dd_api_key }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}

.github/actions/plugins/upstream/action.yml

@@ -1,12 +1,10 @@
 name: Plugin Upstream Tests
 description: Run upstream test suite
-inputs:
-  dd_api_key:
-    description: DD_API_KEY used to push test results
-    required: true
 runs:
   using: composite
   steps:
+    - uses: ./.github/actions/dd-sts-api-key
+      id: dd-sts
     - uses: ./.github/actions/testagent/start
     - uses: ./.github/actions/node/oldest-maintenance-lts
     - uses: ./.github/actions/install
@@ -18,12 +16,12 @@ runs:
     - uses: ./.github/actions/coverage
       with:
         flags: plugins-upstream-${{ github.job }}
-        dd_api_key: ${{ inputs.dd_api_key }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
     - if: always()
       uses: ./.github/actions/testagent/logs
       with:
         suffix: upstream-${{ github.job }}
     - uses: ./.github/actions/push_to_test_optimization
       if: "!cancelled()"
       with:
-        dd_api_key: ${{ inputs.dd_api_key }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}

.github/actions/push_to_test_optimization/action.yml

@@ -14,7 +14,7 @@ runs:
       # >  from a forked repository, and are also subject to these restrictions.
       #
       # Which means they do not have access to secrets.
-      uses: DataDog/junit-upload-github-action@293a1d0af2a269c6300930eb13d3bf0ddec21863 # v2.2.0
+      uses: DataDog/junit-upload-github-action@24449d01fc01e721fa36ccd2caa3caae6922f0e8 # v3.0.0
       with:
         api_key: ${{ inputs.dd_api_key }}
         service: dd-trace-js-tests

.github/dependabot.yml

@@ -151,6 +151,10 @@ updates:
       - dependencies
       - javascript
       - semver-patch
+    ignore:
+      - dependency-name: "office-addin-mock"
+        # Pinned to 2.x due to compatibility issues with newer major versions
+        update-types: ["version-update:semver-major"]
     groups:
       test-versions:
         patterns:

.github/workflows/aiguard.yml

@@ -18,25 +18,33 @@ jobs:
   macos:
     name: ${{ github.workflow }} / macos
     runs-on: macos-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
       - run: yarn test:aiguard:ci
       - uses: ./.github/actions/coverage
         with:
           flags: aiguard-macos
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   ubuntu:
     name: ${{ github.workflow }} / ubuntu
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
       - uses: ./.github/actions/node/oldest-maintenance-lts
       - uses: ./.github/actions/install
       - run: yarn test:aiguard:ci
@@ -49,17 +57,21 @@ jobs:
       - uses: ./.github/actions/coverage
         with:
           flags: aiguard-ubuntu
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   windows:
     name: ${{ github.workflow }} / windows
     runs-on: windows-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
         with:
@@ -68,20 +80,24 @@ jobs:
       - uses: ./.github/actions/coverage
         with:
           flags: aiguard-windows
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   integration:
     name: ${{ github.workflow }} / integration (node-${{ matrix.version }})
     strategy:
       matrix:
         version: [maintenance, active, latest]
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
       - uses: ./.github/actions/node
         with:
           version: ${{ matrix.version }}
@@ -90,4 +106,4 @@ jobs:
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}

.github/workflows/apm-capabilities.yml

@@ -24,24 +24,32 @@ env:
 jobs:
   tracing-macos:
     runs-on: macos-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
       - run: yarn test:trace:core:ci
       - uses: ./.github/actions/coverage
         with:
           flags: apm-capabilities-tracing-macos
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   tracing-ubuntu:
     runs-on: ubuntu-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
       - uses: ./.github/actions/node/oldest-maintenance-lts
       - uses: ./.github/actions/install
       - run: yarn test:trace:core:ci
@@ -54,16 +62,20 @@ jobs:
       - uses: ./.github/actions/coverage
         with:
           flags: apm-capabilities-tracing-ubuntu
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
 
   tracing-windows:
     runs-on: windows-latest
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: ./.github/actions/dd-sts-api-key
+        id: dd-sts
       - uses: ./.github/actions/node/latest
       - uses: ./.github/actions/install
         with:
@@ -72,8 +84,8 @@ jobs:
       - uses: ./.github/actions/coverage
         with:
           flags: apm-capabilities-tracing-windows
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
       - uses: ./.github/actions/push_to_test_optimization
         if: "!cancelled()"
         with:
-          dd_api_key: ${{ secrets.DD_API_KEY }}
+          dd_api_key: ${{ steps.dd-sts.outputs.api_key }}