dd-sts migration by nccatoni · Pull Request #6679 · DataDog/system-tests

nccatoni · 2026-04-02T14:37:11Z

Motivation

Changes

Workflow

⚠️ Create your PR as draft ⚠️
Work on you PR until the CI passes
Mark it as ready for review
- Test logic is modified? -> Get a review from RFC owner.
- Framework is modified, or non obvious usage of it -> get a review from R&P team

🚀 Once your PR is reviewed and the CI green, you can merge it!

🛟 #apm-shared-testing 🛟

Reviewer checklist

Anything but tests/ or manifests/ is modified ? I have the approval from R&P team
A docker base image is modified?
- the relevant build-XXX-image label is present
A scenario is added, removed or renamed?
- Get a review from R&P team

github-actions · 2026-04-02T14:37:41Z

CODEOWNERS have been resolved as:

.github/actions/push_to_test_optim/action.yml                           @DataDog/system-tests-core
.github/workflows/ci.yml                                                @DataDog/system-tests-core
.github/workflows/run-end-to-end.yml                                    @DataDog/system-tests-core
.github/workflows/run-parametric.yml                                    @DataDog/system-tests-core
.github/workflows/system-tests.yml                                      @DataDog/system-tests-core

ikraemer-dd · 2026-04-02T16:54:39Z

.github/workflows/ci.yml

    secrets: inherit
+    permissions:
+      contents: read
+      id-token: write


The permission block is not needed here: id-token: write is specified line 74, and contents: read should be defined in the policy

ikraemer-dd · 2026-04-03T08:39:05Z

.github/workflows/run-exotics.yml


 on:
  workflow_call:
+    inputs:


it will also need a permission block with id-token: write since this workflow calls DataDog/dd-sts-action

ikraemer-dd · 2026-04-03T08:40:28Z

.github/workflows/run-end-to-end.yml

      with:
        repository: 'DataDog/system-tests'
        ref: ${{ steps.compute_ref.outputs.ref }}
+    - name: Get Datadog credentials


will need id-token: write permissions to invoke DataDog/dd-sts-action

ikraemer-dd · 2026-04-03T08:40:50Z

.github/workflows/run-parametric.yml

        default: "datadoghq.com"
        required: false
        type: string
+      dd_sts_policy:


will need id-token: write permissions to invoke DataDog/dd-sts-action

datadog-datadog-prod-us1 · 2026-04-07T14:11:20Z

✅ Tests

🎉 All green!

❄️ No new flaky tests detected
🧪 All tests passed

_{This comment will be updated automatically if new data arrives.

🔗 Commit SHA: d4a2f58 | Docs | Datadog PR Page | Was this helpful? React with 👍/👎 or give us feedback!}

lloeki · 2026-04-08T12:34:06Z

@nccatoni with https://github.com/DataDog/dd-source/pull/405204 it should be possible to test your PR as a nested workflow on DataDog/dd-trace-rb

nccatoni · 2026-04-08T12:41:06Z

@lloeki We are calling this as a nested workflow from the system-tests repo directly so the current tests on this PR run against this policy which you should be able to adapt to your repo

lloeki · 2026-04-08T14:22:17Z

Updated: https://github.com/DataDog/dd-source/pull/405204
Opened: Use dd-sts via policy to push test results dd-trace-rb#5566 (fails for now until above is merged)

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d4a2f58d65

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-04-09T12:19:55Z

.github/actions/push_to_test_optim/action.yml

    # https://docs.datadoghq.com/tests/setup/junit_xml/?tab=linux
    - name: Push results
-      if: github.event.pull_request.user.login != 'dependabot[bot]' && inputs.datadog_api_key != ''
+      if: github.event.pull_request.user.login != 'dependabot[bot]'


Skip upload when no Datadog credentials are configured

The Push results step now runs for every non-Dependabot execution, even when both credential sources are empty. If inputs.datadog_api_key is '' and inputs.dd_sts_policy is also '', the dd-sts step is skipped and DATADOG_API_KEY resolves to an empty value, so datadog-ci junit upload is still invoked without auth and can fail the job. This is a regression from the previous guard and affects callers that enable push_to_test_optimization without passing either credential source (for example workflows that rely on system-tests.yml defaults).

Useful? React with 👍 / 👎.

nccatoni force-pushed the nccatoni/dd-sts-migration branch 5 times, most recently from 7935ce3 to b3a6f0c Compare April 2, 2026 15:33

nccatoni changed the title ~~dd sts migration~~ dd-sts migration Apr 2, 2026

ikraemer-dd reviewed Apr 3, 2026

View reviewed changes

nccatoni force-pushed the nccatoni/dd-sts-migration branch 6 times, most recently from 7a4fc9b to 107bbb0 Compare April 3, 2026 13:01

dd-sts migration

b4b5967

nccatoni force-pushed the nccatoni/dd-sts-migration branch from 107bbb0 to b4b5967 Compare April 3, 2026 13:35

nccatoni added 2 commits April 7, 2026 14:08

Merge branch 'main' into nccatoni/dd-sts-migration

18462a8

Merge branch 'main' into nccatoni/dd-sts-migration

f86a612

This was referenced Apr 8, 2026

Disable system tests test optimisation push DataDog/dd-trace-rb#5565

Merged

Use dd-sts via policy to push test results DataDog/dd-trace-rb#5566

Draft

nccatoni added 2 commits April 8, 2026 18:17

Cleanup

c289262

Merge branch 'main' into nccatoni/dd-sts-migration

d4a2f58

nccatoni marked this pull request as ready for review April 9, 2026 12:15

nccatoni requested a review from a team as a code owner April 9, 2026 12:15

nccatoni merged commit 53b68b0 into main Apr 9, 2026
1990 of 1994 checks passed

nccatoni deleted the nccatoni/dd-sts-migration branch April 9, 2026 12:17

chatgpt-codex-connector bot reviewed Apr 9, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

dd-sts migration#6679

dd-sts migration#6679
nccatoni merged 5 commits intomainfrom
nccatoni/dd-sts-migration

nccatoni commented Apr 2, 2026

Uh oh!

github-actions bot commented Apr 2, 2026 •

edited

Loading

Uh oh!

ikraemer-dd Apr 2, 2026

Uh oh!

ikraemer-dd Apr 3, 2026

Uh oh!

ikraemer-dd Apr 3, 2026

Uh oh!

ikraemer-dd Apr 3, 2026

Uh oh!

datadog-datadog-prod-us1 bot commented Apr 7, 2026 •

edited by datadog-official bot

Loading

Uh oh!

lloeki commented Apr 8, 2026

Uh oh!

nccatoni commented Apr 8, 2026

Uh oh!

lloeki commented Apr 8, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Uh oh!

chatgpt-codex-connector bot Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

nccatoni commented Apr 2, 2026

Motivation

Changes

Workflow

Reviewer checklist

Uh oh!

github-actions bot commented Apr 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ikraemer-dd Apr 2, 2026

Choose a reason for hiding this comment

Uh oh!

ikraemer-dd Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

ikraemer-dd Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

ikraemer-dd Apr 3, 2026

Choose a reason for hiding this comment

Uh oh!

datadog-datadog-prod-us1 bot commented Apr 7, 2026 • edited by datadog-official bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

lloeki commented Apr 8, 2026

Uh oh!

nccatoni commented Apr 8, 2026

Uh oh!

lloeki commented Apr 8, 2026

Uh oh!

Uh oh!

chatgpt-codex-connector bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector bot Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

github-actions bot commented Apr 2, 2026 •

edited

Loading

datadog-datadog-prod-us1 bot commented Apr 7, 2026 •

edited by datadog-official bot

Loading