Merge branch 'master' into stephan.koshcheev/RUM-17237/add-rum-shopify-documentation

Author: lierniel

.github/chainguard/self.gitlab.release.dispatch-wheel-publishing.sts.yaml

@@ -0,0 +1,15 @@
+# Allows the protected integrations-extras GitLab release job to dispatch the
+# post-tag GitHub wheel workflow. GitHub exposes workflow dispatch through the
+# repository-wide actions:write permission; the token cannot write contents or tags.
+issuer: https://gitlab.ddbuild.io
+subject: project_path:DataDog/integrations-extras:ref_type:branch:ref:master
+
+claim_pattern:
+  ci_config_ref_uri: gitlab\.ddbuild\.io/DataDog/integrations-extras//\.gitlab-ci\.yml@refs/heads/master
+  pipeline_source: push
+  project_path: DataDog/integrations-extras
+  ref_protected: "true"
+  ref_path: refs/heads/master
+
+permissions:
+  actions: write

.github/chainguard/self.release.tag-push.sts.yaml

@@ -1,15 +1,11 @@
 name: Trigger Wheel Builds
 
-# Thin wrapper — all tagging and dispatch logic lives in integrations-core's
-# reusable release-dispatch.yml workflow.
+# The legacy GitLab release job owns signing and tag creation. This receiver
+# delegates detection, validation, and wheel dispatch to integrations-core.
 
 on:
-  push:
-    branches:
-      - master
-    paths:
-      - "*/CHANGELOG.md"
-      - "*/datadog_checks/*/__about__.py"
+  # Automatic push triggering is intentionally disabled. The legacy GitLab release
+  # job dispatches this workflow with the exact signed SHA after pushing all tags.
   workflow_dispatch:
     inputs:
       packages:
@@ -32,6 +28,10 @@ on:
         required: false
         type: string
 
+concurrency:
+  group: release-${{ inputs.source-repo-ref }}
+  cancel-in-progress: false
+
 jobs:
   context:
     name: Detect release context
@@ -47,25 +47,19 @@ jobs:
             echo "is-stable-release=false" >> "$GITHUB_OUTPUT"
           fi
 
-  approve:
-    name: Await release approval
-    needs: context
-    runs-on: ubuntu-latest
-    environment: release
-    steps:
-      - run: echo "Release approved"
-
   dispatch:
     name: Release
-    needs: [context, approve]
+    needs: context
     uses: DataDog/integrations-core/.github/workflows/release-dispatch.yml@master
     with:
       source-repo: integrations-extras
       packages: ${{ inputs.packages || '' }}
-      source-repo-ref: ${{ inputs.source-repo-ref || github.sha }}
+      source-repo-ref: ${{ inputs.source-repo-ref }}
+      source-repo-branch: master
+      create-tags: false
       dry-run: ${{ inputs.dry-run || false }}
       ddev-version: ${{ inputs.ddev-version || '' }}
       is-stable-release: ${{ needs.context.outputs.is-stable-release }}
     permissions:
       id-token: write
-      contents: write
+      contents: read

.github/workflows/release-trigger.yml

@@ -16,6 +16,9 @@ workflow:
 release-auto:
   stage: release
   image: $TAGGER_IMAGE
+  id_tokens:
+    DDOCTOSTS_ID_TOKEN:
+      aud: dd-octo-sts
   script:
     - ddev --version
     - ddev config set repos.extras .
@@ -24,5 +27,5 @@ release-auto:
     - eval "$(ssh-agent -s)"
     - ./.gitlab/release/git-auth.sh
     # Prefix every line with a timestamp
-    - ./.gitlab/release/tag-release.sh 2>&1 | ts "[%H:%M:%S %Z]  "
+    - set -o pipefail; ./.gitlab/release/tag-release.sh 2>&1 | ts "[%H:%M:%S %Z]  "
   tags: ["arch:amd64"]

.gitlab-ci.yml

@@ -0,0 +1,29 @@
+#!/bin/bash
+set -euo pipefail
+IFS=$'\n\t'
+
+SOURCE_REPO_REF=$(git rev-parse HEAD)
+if [[ ! "$SOURCE_REPO_REF" =~ ^[0-9a-f]{40}$ ]]; then
+    echo "Expected a full signed commit SHA, got: $SOURCE_REPO_REF" >&2
+    exit 1
+fi
+
+payload=$(printf '{"ref":"master","inputs":{"source-repo-ref":"%s"}}' "$SOURCE_REPO_REF")
+
+echo "Dispatching autonomous wheel publishing for integrations-extras@$SOURCE_REPO_REF"
+set +x
+DISPATCH_TOKEN=$(dd-octo-sts token \
+    --scope DataDog/integrations-extras \
+    --policy self.gitlab.release.dispatch-wheel-publishing)
+trap 'set +x; dd-octo-sts revoke -t "$DISPATCH_TOKEN" 2>/dev/null || true' EXIT
+
+# A lost success response can produce a duplicate dispatch. That is safe: each
+# run uses the same source SHA and downstream TUF writes are retry-safe.
+curl --fail-with-body --silent --show-error \
+    --retry 3 --retry-all-errors --retry-delay 2 --max-time 30 \
+    --request POST \
+    --header "Accept: application/vnd.github+json" \
+    --header "Authorization: Bearer $DISPATCH_TOKEN" \
+    --header "X-GitHub-Api-Version: 2022-11-28" \
+    --data "$payload" \
+    https://api.github.com/repos/DataDog/integrations-extras/actions/workflows/release-trigger.yml/dispatches

.gitlab/release/dispatch-wheel-publishing.sh

@@ -14,10 +14,12 @@ if [[ $status -eq 0 ]]; then
     # Order of steps matter as we want the tag to point to the signing commit.
     # 1. Sign
     # 2. Create tag(s)
-    # 3. Trigger the build pipeline
+    # 3. Trigger the legacy build pipeline
+    # 4. Dispatch autonomous wheel publishing from the signed, tagged commit
     ./.gitlab/release/sign-release.sh
     ddev release tag all
     ./.gitlab/release/build-packages.sh
+    ./.gitlab/release/dispatch-wheel-publishing.sh
 elif [[ $status -eq 2 ]]; then
     echo "No new releases, skipping the build pipeline trigger"
 else