Make CI action bumps easier to validate

[lucia-sb]

What does this PR do?

Makes two CI workflows able to exercise their actions on demand, so version bumps (e.g. Renovate updates) can be validated without risky side effects:

• release-hash-check.yml: adds the workflow file to the pull_request paths filter and guards the hash-check script on steps.changed-files.outputs.any_changed == 'true'. The tj-actions/changed-files step now runs on PRs that edit the workflow (validating action bumps), while the script step is skipped when no .in-toto/*.link file changed so the check stays green.
• test-results-master.yml / flaky-tests.yml: adds a dry_run input to the reusable test-results-master.yml that runs the badge step but skips the commit/push to the badges branch, and exposes it as a workflow_dispatch input on flaky-tests.yml. This lets emibcn/badge-action bumps be validated by dispatching flaky-tests with dry_run: true, without moving the public test-results badge.

Motivation

Several actions used in this repo never run on normal PRs because their workflows are triggered by push-to-master, tags, schedules, or workflow_call. As a result, Renovate action bumps to those workflows merge without ever being exercised in CI. These two changes give tj-actions/changed-files and emibcn/badge-action a safe validation path. Existing callers of test-results-master.yml (master.yml, master-windows.yml) pass no dry_run, so they default to false and continue committing the badge as before.

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add `qa/required` if this PR needs QA validation, or `qa/skip-qa` if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the `backport/` label to the PR and it will automatically open a backport PR once this one is merged

🤖 Generated with Claude Code

[dkirov-dd]

question
I don't see where this is exercised from the PR changes
What is the use case for the dry_run?

[lucia-sb]

It’s so we can trigger the workflow manually with workflow_dispatch to validate changes for Renovate PRs, without updating the badge. It's on the PR description

[dkirov-dd]

I see, from the description I understood it was meant to be used automatically to check the Renovate PRs

[dkirov-dd]

Does this mean we will need to remember to do this on each Renovate PR?
If so, can we run the dry_run versions of these workflows automatically instead?

[lucia-sb]

I would add the validation steps to the runbook along with the other actions that need to be checked.
My concern was that this workflow is fairly expensive to run every time there's a change, since it's only really needed when emibcn/badge-action is bumped, not when the other action is. But Renovate PRs only run once a week, so I guess it's not a big deal. I added the trigger.

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run

[datadog-official]

✨ Fix all issues with BitsAI

⚠️ Warnings

🚦 4 Pipeline jobs failed

Daily Flaky Tests (every 8 hours) | test / j06ca546 / SNMP     

See error

Connection error: Failed to resolve 'ddintegrations.blob.core.windows.net' during test execution.

Daily Flaky Tests (every 8 hours) | test / j46da136 / JBoss_WildFly     

See error

Could not resolve 'ddintegrations.blob.core.windows.net:443'. Unable to start the Agent due to failed network resolution.

Daily Flaky Tests (every 8 hours) | test / j5a9585a / IBM ACE     

See error

Failed to download required file from ddintegrations.blob.core.windows.net. Error: Could not resolve host: ddintegrations.blob.core.windows.net

View all 4 failed jobs.

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5b87fee | Docs | Datadog PR Page | Give us feedback!}

[github-actions]

Test Results

543 files  +3  543 suites  +3   54m 8s ⏱️ +2s
 67 tests ±0   66 ✅ +5   1 💤 ±0  0 ❌  - 1 
706 runs  ±0  658 ✅ +5  48 💤 ±0  0 ❌  - 1 

Results for commit 5b87fee. ± Comparison against base commit 1577abb.