From a809e30a280395c9e5d40580acd1390c4964c5d9 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Thu, 17 Sep 2026 12:03:38 +0200 Subject: [PATCH 1/4] ci: trust datadog-api-spec workflows via Octo STS --- ...datadog-api-spec.github.cache-builder.sts.yaml | 14 ++++++++++++++ ...ec.github.ci-cd.detect-client-changes.sts.yaml | 14 ++++++++++++++ ...i-spec.github.ci-cd.pipeline-generate.sts.yaml | 15 +++++++++++++++ ...atadog-api-spec.github.merged.cleanup.sts.yaml | 15 +++++++++++++++ 4 files changed, 58 insertions(+) create mode 100644 .github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml create mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml create mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml create mode 100644 .github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml diff --git a/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml b/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml new file mode 100644 index 00000000000..8aee8fc3497 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml @@ -0,0 +1,14 @@ +# Allows the scheduled cache builder in ddoghq/datadog-api-spec to read this repository. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:ref:refs/heads/master + +claim_pattern: + event_name: schedule + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/cache-builder\.yml@refs/heads/master + ref: refs/heads/master + repository: ddoghq/datadog-api-spec + +permissions: + contents: read + diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml new file mode 100644 index 00000000000..7ec4d8cd872 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml @@ -0,0 +1,14 @@ +# Allows PR detection from ddoghq/datadog-api-spec without granting write access. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + ref: refs/pull/[0-9]+/merge + repository: ddoghq/datadog-api-spec + +permissions: + pull_requests: read + diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml new file mode 100644 index 00000000000..abfc718e405 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml @@ -0,0 +1,15 @@ +# Allows the generation pipeline in ddoghq/datadog-api-spec to push generated code and create PRs. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + ref: refs/pull/[0-9]+/merge + repository: ddoghq/datadog-api-spec + +permissions: + contents: write + pull_requests: write + diff --git a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml new file mode 100644 index 00000000000..d3734a146cd --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml @@ -0,0 +1,15 @@ +# Allows the close workflow in ddoghq/datadog-api-spec to close generated PRs and delete branches. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/merged\.yml@refs/(heads/master|pull/[0-9]+/merge) + ref: refs/(heads/master|pull/[0-9]+/merge) + repository: ddoghq/datadog-api-spec + +permissions: + contents: write + pull_requests: write + From 281688ac620fd2fd7c05dde679570f38a7e22378 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Thu, 17 Sep 2026 12:20:19 +0200 Subject: [PATCH 2/4] ci: constrain token policies to master PRs --- ...datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml | 2 +- .../datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml | 2 +- .../chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml index 7ec4d8cd872..d08687c4aa7 100644 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml @@ -4,6 +4,7 @@ issuer: https://token.actions.githubusercontent.com subject: repo:ddoghq/datadog-api-spec:pull_request claim_pattern: + base_ref: master event_name: pull_request job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge ref: refs/pull/[0-9]+/merge @@ -11,4 +12,3 @@ claim_pattern: permissions: pull_requests: read - diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml index abfc718e405..4091b742628 100644 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml @@ -4,6 +4,7 @@ issuer: https://token.actions.githubusercontent.com subject: repo:ddoghq/datadog-api-spec:pull_request claim_pattern: + base_ref: master event_name: pull_request job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge ref: refs/pull/[0-9]+/merge @@ -12,4 +13,3 @@ claim_pattern: permissions: contents: write pull_requests: write - diff --git a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml index d3734a146cd..66843a50ab6 100644 --- a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml @@ -4,6 +4,7 @@ issuer: https://token.actions.githubusercontent.com subject: repo:ddoghq/datadog-api-spec:pull_request claim_pattern: + base_ref: master event_name: pull_request job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/merged\.yml@refs/(heads/master|pull/[0-9]+/merge) ref: refs/(heads/master|pull/[0-9]+/merge) @@ -12,4 +13,3 @@ claim_pattern: permissions: contents: write pull_requests: write - From 44fd5e32980de7a02cb6672e737b2103bbb3e511 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Thu, 17 Sep 2026 13:11:24 +0200 Subject: [PATCH 3/4] ci: limit token policies to ci-cd --- ...datadog-api-spec.github.cache-builder.sts.yaml | 14 -------------- ...atadog-api-spec.github.merged.cleanup.sts.yaml | 15 --------------- 2 files changed, 29 deletions(-) delete mode 100644 .github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml delete mode 100644 .github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml diff --git a/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml b/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml deleted file mode 100644 index 8aee8fc3497..00000000000 --- a/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Allows the scheduled cache builder in ddoghq/datadog-api-spec to read this repository. -issuer: https://token.actions.githubusercontent.com - -subject: repo:ddoghq/datadog-api-spec:ref:refs/heads/master - -claim_pattern: - event_name: schedule - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/cache-builder\.yml@refs/heads/master - ref: refs/heads/master - repository: ddoghq/datadog-api-spec - -permissions: - contents: read - diff --git a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml deleted file mode 100644 index 66843a50ab6..00000000000 --- a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Allows the close workflow in ddoghq/datadog-api-spec to close generated PRs and delete branches. -issuer: https://token.actions.githubusercontent.com - -subject: repo:ddoghq/datadog-api-spec:pull_request - -claim_pattern: - base_ref: master - event_name: pull_request - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/merged\.yml@refs/(heads/master|pull/[0-9]+/merge) - ref: refs/(heads/master|pull/[0-9]+/merge) - repository: ddoghq/datadog-api-spec - -permissions: - contents: write - pull_requests: write From 943bab7753fd0b488ddf4d001d519ea9eed7eda9 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Thu, 17 Sep 2026 13:35:59 +0200 Subject: [PATCH 4/4] ci: support current and post-migration sources --- ...ub.ci-cd.detect-client-changes.ddoghq.sts.yaml | 14 ++++++++++++++ ...ec.github.ci-cd.detect-client-changes.sts.yaml | 8 ++++---- ...github.ci-cd.pipeline-generate.ddoghq.sts.yaml | 15 +++++++++++++++ ...i-spec.github.ci-cd.pipeline-generate.sts.yaml | 8 ++++---- 4 files changed, 37 insertions(+), 8 deletions(-) create mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml create mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml new file mode 100644 index 00000000000..d08687c4aa7 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml @@ -0,0 +1,14 @@ +# Allows PR detection from ddoghq/datadog-api-spec without granting write access. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + base_ref: master + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + ref: refs/pull/[0-9]+/merge + repository: ddoghq/datadog-api-spec + +permissions: + pull_requests: read diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml index d08687c4aa7..8647bd6b7ec 100644 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml @@ -1,14 +1,14 @@ -# Allows PR detection from ddoghq/datadog-api-spec without granting write access. +# Allows PR detection from DataDog/datadog-api-spec without granting write access. issuer: https://token.actions.githubusercontent.com -subject: repo:ddoghq/datadog-api-spec:pull_request +subject: repo:DataDog/datadog-api-spec:pull_request claim_pattern: base_ref: master event_name: pull_request - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + job_workflow_ref: DataDog/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge ref: refs/pull/[0-9]+/merge - repository: ddoghq/datadog-api-spec + repository: DataDog/datadog-api-spec permissions: pull_requests: read diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml new file mode 100644 index 00000000000..4091b742628 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml @@ -0,0 +1,15 @@ +# Allows the generation pipeline in ddoghq/datadog-api-spec to push generated code and create PRs. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + base_ref: master + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + ref: refs/pull/[0-9]+/merge + repository: ddoghq/datadog-api-spec + +permissions: + contents: write + pull_requests: write diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml index 4091b742628..e7a9447d250 100644 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml @@ -1,14 +1,14 @@ -# Allows the generation pipeline in ddoghq/datadog-api-spec to push generated code and create PRs. +# Allows the generation pipeline in DataDog/datadog-api-spec to push generated code and create PRs. issuer: https://token.actions.githubusercontent.com -subject: repo:ddoghq/datadog-api-spec:pull_request +subject: repo:DataDog/datadog-api-spec:pull_request claim_pattern: base_ref: master event_name: pull_request - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + job_workflow_ref: DataDog/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge ref: refs/pull/[0-9]+/merge - repository: ddoghq/datadog-api-spec + repository: DataDog/datadog-api-spec permissions: contents: write