From 46c9c855b4731d417afb644355c5755e318d923b Mon Sep 17 00:00:00 2001 From: sarah-witt Date: Thu, 11 Jun 2026 14:59:22 -0400 Subject: [PATCH 1/4] migrate test-target to dd-sts --- .github/workflows/master.yml | 2 ++ .../workflows/nightly-base-package-windows.yml | 2 ++ .github/workflows/nightly-base-package.yml | 2 ++ .github/workflows/pr-all-windows.yml | 2 ++ .github/workflows/pr-all.yml | 2 ++ .github/workflows/pr.yml | 2 ++ .github/workflows/test-agent.yml | 2 ++ .github/workflows/test-target.yml | 15 ++++++++++++--- .github/workflows/weekly-latest.yml | 2 ++ 9 files changed, 28 insertions(+), 3 deletions(-) diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml index 374a0cc211ba5..16b8c3630da48 100644 --- a/.github/workflows/master.yml +++ b/.github/workflows/master.yml @@ -50,6 +50,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write publish-test-results: needs: diff --git a/.github/workflows/nightly-base-package-windows.yml b/.github/workflows/nightly-base-package-windows.yml index 53f1d4094f507..b261cce986247 100644 --- a/.github/workflows/nightly-base-package-windows.yml +++ b/.github/workflows/nightly-base-package-windows.yml @@ -19,6 +19,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write with: repo: core diff --git a/.github/workflows/nightly-base-package.yml b/.github/workflows/nightly-base-package.yml index 1d3459ebc02e9..c4275292d790b 100644 --- a/.github/workflows/nightly-base-package.yml +++ b/.github/workflows/nightly-base-package.yml @@ -17,6 +17,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write with: repo: core diff --git a/.github/workflows/pr-all-windows.yml b/.github/workflows/pr-all-windows.yml index e9bc38d991eb0..53a77ee0f8707 100644 --- a/.github/workflows/pr-all-windows.yml +++ b/.github/workflows/pr-all-windows.yml @@ -28,6 +28,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write with: repo: core diff --git a/.github/workflows/pr-all.yml b/.github/workflows/pr-all.yml index 0bb3bf1aafd48..53a8cb4234c5c 100644 --- a/.github/workflows/pr-all.yml +++ b/.github/workflows/pr-all.yml @@ -29,6 +29,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write with: repo: core diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml index 7315836ddb7b4..864c307465a18 100644 --- a/.github/workflows/pr.yml +++ b/.github/workflows/pr.yml @@ -26,3 +26,5 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write diff --git a/.github/workflows/test-agent.yml b/.github/workflows/test-agent.yml index c70461895d14d..c0163810c982b 100644 --- a/.github/workflows/test-agent.yml +++ b/.github/workflows/test-agent.yml @@ -53,3 +53,5 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write diff --git a/.github/workflows/test-target.yml b/.github/workflows/test-target.yml index 64ebc87d596f4..15ec13ef7dad3 100644 --- a/.github/workflows/test-target.yml +++ b/.github/workflows/test-target.yml @@ -102,6 +102,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts to fetch a temporary API key via OIDC + id-token: write steps: - name: Set up Windows @@ -159,6 +161,13 @@ jobs: # Use a specific sub-folder path: core-temp + - name: Get Datadog credentials + if: github.event.pull_request.head.repo.fork != true + id: dd-sts + uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0 + with: + policy: integrations-test-target-api-key + - name: Install workflow scripts (core) if: inputs.repo == 'core' uses: ./.github/actions/setup-test-target-scripts @@ -220,7 +229,7 @@ jobs: INPUT_JOB_NAME: "${{ inputs.job-name }}${{ inputs.target-env && format('-{0}', inputs.target-env) || '' }}" INPUT_PYTEST_ARGS: ${{ inputs.pytest-args }} INPUT_IS_FORK: ${{ github.event.pull_request.head.repo.fork || false }} - DD_API_KEY_SECRET: ${{ secrets.DD_API_KEY }} + DD_API_KEY_SECRET: ${{ steps.dd-sts.outputs.api_key }} SETUP_ENV_VARS: ${{ inputs.setup-env-vars }} DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }} DOCKER_ACCESS_TOKEN: ${{ secrets.DOCKER_ACCESS_TOKEN }} @@ -230,12 +239,12 @@ jobs: DD_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - name: Tag job for CI Visibility - # Skip on fork PRs and non-core repos since secrets won't be available + # Skip on fork PRs and non-core repos since dd-sts credentials won't be available if: env.INPUT_IS_FORK != 'true' && env.INPUT_REPO == 'core' uses: ./.github/actions/tag-job with: tags: ${{ env.DD_TAGS }} - dd_api_key: ${{ secrets.DD_API_KEY }} + dd_api_key: ${{ steps.dd-sts.outputs.api_key }} dd_site: ${{ env.DD_SITE }} - name: Set up Python 2.7 diff --git a/.github/workflows/weekly-latest.yml b/.github/workflows/weekly-latest.yml index 5b8b3747a7ada..94554d775adcb 100644 --- a/.github/workflows/weekly-latest.yml +++ b/.github/workflows/weekly-latest.yml @@ -18,3 +18,5 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write From 6e4a570a7c90737517edb8394ee20d7359bf031d Mon Sep 17 00:00:00 2001 From: sarah-witt Date: Tue, 23 Jun 2026 17:04:07 -0700 Subject: [PATCH 2/4] add permissions --- .github/workflows/flaky-tests-windows.yml | 2 ++ .github/workflows/flaky-tests.yml | 2 ++ .github/workflows/master-windows.yml | 2 ++ .github/workflows/test-agent-target.yml | 2 ++ .github/workflows/test-agent-windows.yml | 2 ++ 5 files changed, 10 insertions(+) diff --git a/.github/workflows/flaky-tests-windows.yml b/.github/workflows/flaky-tests-windows.yml index 22a9ba39179f4..c0d3172115d08 100644 --- a/.github/workflows/flaky-tests-windows.yml +++ b/.github/workflows/flaky-tests-windows.yml @@ -34,6 +34,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write publish-test-results: needs: diff --git a/.github/workflows/flaky-tests.yml b/.github/workflows/flaky-tests.yml index 253eb156e9824..7dfc5415015d7 100644 --- a/.github/workflows/flaky-tests.yml +++ b/.github/workflows/flaky-tests.yml @@ -41,6 +41,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write publish-test-results: needs: diff --git a/.github/workflows/master-windows.yml b/.github/workflows/master-windows.yml index 0e810f7e1b299..996bb77a4b546 100644 --- a/.github/workflows/master-windows.yml +++ b/.github/workflows/master-windows.yml @@ -52,6 +52,8 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write publish-test-results: diff --git a/.github/workflows/test-agent-target.yml b/.github/workflows/test-agent-target.yml index a90be1218a566..735fa87073319 100644 --- a/.github/workflows/test-agent-target.yml +++ b/.github/workflows/test-agent-target.yml @@ -65,3 +65,5 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write diff --git a/.github/workflows/test-agent-windows.yml b/.github/workflows/test-agent-windows.yml index 5a1fde593115c..42cb1044a1cc5 100644 --- a/.github/workflows/test-agent-windows.yml +++ b/.github/workflows/test-agent-windows.yml @@ -53,3 +53,5 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write From 0cf17d2e7b47510b703924cf46839df8562d40ea Mon Sep 17 00:00:00 2001 From: sarah-witt Date: Tue, 23 Jun 2026 17:39:04 -0700 Subject: [PATCH 3/4] fix --- .github/workflows/weekly-latest-windows.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/weekly-latest-windows.yml b/.github/workflows/weekly-latest-windows.yml index 032e60eca0019..5bcb83f1a26dd 100644 --- a/.github/workflows/weekly-latest-windows.yml +++ b/.github/workflows/weekly-latest-windows.yml @@ -20,3 +20,5 @@ jobs: permissions: # needed for compute-matrix in test-target.yml contents: read + # needed for dd-sts in test-target.yml + id-token: write From bab7a134a1b1c4ed23b61d13a004b199cd52c7ce Mon Sep 17 00:00:00 2001 From: sarah-witt Date: Fri, 26 Jun 2026 16:07:52 -0400 Subject: [PATCH 4/4] add to callers --- .github/workflows/pr-test.yml | 10 ++++++++++ .github/workflows/test-all-windows.yml | 6 ++++++ .github/workflows/test-all.yml | 6 ++++++ 3 files changed, 22 insertions(+) diff --git a/.github/workflows/pr-test.yml b/.github/workflows/pr-test.yml index 81d447b522a51..ba2c4ba30c35d 100644 --- a/.github/workflows/pr-test.yml +++ b/.github/workflows/pr-test.yml @@ -61,6 +61,11 @@ jobs: python-version: "${{ inputs.python-version }}" pytest-args: ${{ inputs.pytest-args }} secrets: inherit + permissions: + # needed for compute-matrix in test-target.yml + contents: read + # needed for dd-sts in test-target.yml + id-token: write test-minimum-base-package: needs: @@ -93,6 +98,11 @@ jobs: pytest-args: ${{ inputs.pytest-args }} context: "pr" secrets: inherit + permissions: + # needed for compute-matrix in test-target.yml + contents: read + # needed for dd-sts in test-target.yml + id-token: write save-event: needs: diff --git a/.github/workflows/test-all-windows.yml b/.github/workflows/test-all-windows.yml index 5993cff0ef99a..72530b4ea6543 100644 --- a/.github/workflows/test-all-windows.yml +++ b/.github/workflows/test-all-windows.yml @@ -63,6 +63,12 @@ on: default: "standard" type: string +permissions: + # needed for compute-matrix in test-target.yml + contents: read + # needed for dd-sts in test-target.yml + id-token: write + jobs: j6712d43: uses: ./.github/workflows/test-target.yml diff --git a/.github/workflows/test-all.yml b/.github/workflows/test-all.yml index 6815241311fbe..927242515c113 100644 --- a/.github/workflows/test-all.yml +++ b/.github/workflows/test-all.yml @@ -61,6 +61,12 @@ on: default: "standard" type: string +permissions: + # needed for compute-matrix in test-target.yml + contents: read + # needed for dd-sts in test-target.yml + id-token: write + jobs: jd316aba: uses: ./.github/workflows/test-target.yml