Skip to content

[incident-52391] Split dd-sts policies to only request an app key when needed #7941

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
KSerrania wants to merge 2 commits into
base: master
Choose a base branch
from
Draft

[incident-52391] Split dd-sts policies to only request an app key when needed #7941

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
043a5f7
[incident-52391] Split dd-sts policies to only request an app key whe…
KSerrania Apr 7, 2026
f4a8512
Trigger CI
KSerrania Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,6 +192,7 @@

# CI
/.github/actions/dd-sts/action.yml @Datadog/lang-platform-js
/.github/actions/dd-sts-api-key/action.yml @Datadog/lang-platform-js
/.github/chainguard @DataDog/sdlc-security
/.github/workflows/apm-capabilities.yml @DataDog/apm-sdk-capabilities-js
/.github/workflows/apm-integrations.yml @DataDog/apm-idm-js
Expand Down
16 changes: 16 additions & 0 deletions .github/actions/dd-sts-api-key/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,16 @@
name: Get Datadog API key
description: Exchange GitHub OIDC token for Datadog API key via dd-sts.

outputs:
api_key:
description: "Datadog API key"
value: ${{ steps.dd-sts.outputs.api_key }}

runs:
using: composite
steps:
- name: Get Datadog API key
id: dd-sts
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
with:
policy: dd-trace-js-api-key
8 changes: 4 additions & 4 deletions .github/workflows/aiguard.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node/latest
- uses: ./.github/actions/install
Expand All @@ -43,7 +43,7 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node/oldest-maintenance-lts
- uses: ./.github/actions/install
Expand All @@ -70,7 +70,7 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node/latest
- uses: ./.github/actions/install
Expand All @@ -96,7 +96,7 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node
with:
Expand Down
6 changes: 3 additions & 3 deletions .github/workflows/apm-capabilities.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node/latest
- uses: ./.github/actions/install
Expand All @@ -48,7 +48,7 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node/oldest-maintenance-lts
- uses: ./.github/actions/install
Expand All @@ -74,7 +74,7 @@ jobs:
id-token: write
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node/latest
- uses: ./.github/actions/install
Expand Down
32 changes: 16 additions & 16 deletions .github/workflows/apm-integrations.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,7 +66,7 @@ jobs:
PACKAGE_VERSION_RANGE: ${{ matrix.range }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node
Expand Down Expand Up @@ -217,7 +217,7 @@ jobs:
PLUGINS: child_process
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node/oldest-maintenance-lts
- uses: ./.github/actions/install
Expand Down Expand Up @@ -289,7 +289,7 @@ jobs:
PACKAGE_VERSION_RANGE: ${{ matrix.range }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node
Expand Down Expand Up @@ -358,7 +358,7 @@ jobs:
DD_INJECT_FORCE: "true"
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node
Expand Down Expand Up @@ -394,7 +394,7 @@ jobs:
PLUGINS: dns
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node/oldest-maintenance-lts
Expand Down Expand Up @@ -435,7 +435,7 @@ jobs:
SERVICES: elasticsearch
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node/latest
Expand Down Expand Up @@ -586,7 +586,7 @@ jobs:
PLUGINS: http
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node
Expand Down Expand Up @@ -615,7 +615,7 @@ jobs:
PLUGINS: http2
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node/oldest-maintenance-lts
Expand Down Expand Up @@ -675,7 +675,7 @@ jobs:
SERVICES: kafka
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node
Expand Down Expand Up @@ -927,7 +927,7 @@ jobs:
PLUGINS: net
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node/oldest-maintenance-lts
Expand Down Expand Up @@ -995,7 +995,7 @@ jobs:
PACKAGE_VERSION_RANGE: ${{ matrix.range }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node/latest
Expand Down Expand Up @@ -1070,7 +1070,7 @@ jobs:
DD_INJECT_FORCE: "true"
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/node
with:
Expand Down Expand Up @@ -1106,7 +1106,7 @@ jobs:
PLUGINS: pino
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node/newest-maintenance-lts
Expand Down Expand Up @@ -1203,7 +1203,7 @@ jobs:
PACKAGE_VERSION_RANGE: ${{ matrix.range }}
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node
Expand Down Expand Up @@ -1367,7 +1367,7 @@ jobs:
PLUGINS: sharedb
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node/latest
Expand Down Expand Up @@ -1404,7 +1404,7 @@ jobs:
SERVICES: mssql
steps:
- uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
- uses: ./.github/actions/dd-sts
- uses: ./.github/actions/dd-sts-api-key
id: dd-sts
- uses: ./.github/actions/testagent/start
- uses: ./.github/actions/node/latest
Expand Down
Loading
Loading