From 4a1ffc9c28fcfbb5f9751ced0edb6cefeee2f67b Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Thu, 17 Sep 2026 12:03:40 +0200 Subject: [PATCH 1/4] ci: trust datadog-api-spec workflows via Octo STS --- ...datadog-api-spec.github.cache-builder.sts.yaml | 14 ++++++++++++++ ...ec.github.ci-cd.detect-client-changes.sts.yaml | 14 ++++++++++++++ ...i-spec.github.ci-cd.pipeline-generate.sts.yaml | 15 +++++++++++++++ ...atadog-api-spec.github.merged.cleanup.sts.yaml | 15 +++++++++++++++ 4 files changed, 58 insertions(+) create mode 100644 .github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml create mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml create mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml create mode 100644 .github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml diff --git a/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml b/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml new file mode 100644 index 0000000000..8aee8fc349 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml @@ -0,0 +1,14 @@ +# Allows the scheduled cache builder in ddoghq/datadog-api-spec to read this repository. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:ref:refs/heads/master + +claim_pattern: + event_name: schedule + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/cache-builder\.yml@refs/heads/master + ref: refs/heads/master + repository: ddoghq/datadog-api-spec + +permissions: + contents: read + diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml new file mode 100644 index 0000000000..7ec4d8cd87 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml @@ -0,0 +1,14 @@ +# Allows PR detection from ddoghq/datadog-api-spec without granting write access. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + ref: refs/pull/[0-9]+/merge + repository: ddoghq/datadog-api-spec + +permissions: + pull_requests: read + diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml new file mode 100644 index 0000000000..abfc718e40 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml @@ -0,0 +1,15 @@ +# Allows the generation pipeline in ddoghq/datadog-api-spec to push generated code and create PRs. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + ref: refs/pull/[0-9]+/merge + repository: ddoghq/datadog-api-spec + +permissions: + contents: write + pull_requests: write + diff --git a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml new file mode 100644 index 0000000000..d3734a146c --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml @@ -0,0 +1,15 @@ +# Allows the close workflow in ddoghq/datadog-api-spec to close generated PRs and delete branches. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/merged\.yml@refs/(heads/master|pull/[0-9]+/merge) + ref: refs/(heads/master|pull/[0-9]+/merge) + repository: ddoghq/datadog-api-spec + +permissions: + contents: write + pull_requests: write + From f68f9a39a7baf2aee3108129a0083e2a3750e394 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Thu, 17 Sep 2026 12:20:19 +0200 Subject: [PATCH 2/4] ci: constrain token policies to master PRs --- ...datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml | 2 +- .../datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml | 2 +- .../chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml index 7ec4d8cd87..d08687c4aa 100644 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml @@ -4,6 +4,7 @@ issuer: https://token.actions.githubusercontent.com subject: repo:ddoghq/datadog-api-spec:pull_request claim_pattern: + base_ref: master event_name: pull_request job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge ref: refs/pull/[0-9]+/merge @@ -11,4 +12,3 @@ claim_pattern: permissions: pull_requests: read - diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml index abfc718e40..4091b74262 100644 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml @@ -4,6 +4,7 @@ issuer: https://token.actions.githubusercontent.com subject: repo:ddoghq/datadog-api-spec:pull_request claim_pattern: + base_ref: master event_name: pull_request job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge ref: refs/pull/[0-9]+/merge @@ -12,4 +13,3 @@ claim_pattern: permissions: contents: write pull_requests: write - diff --git a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml index d3734a146c..66843a50ab 100644 --- a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml @@ -4,6 +4,7 @@ issuer: https://token.actions.githubusercontent.com subject: repo:ddoghq/datadog-api-spec:pull_request claim_pattern: + base_ref: master event_name: pull_request job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/merged\.yml@refs/(heads/master|pull/[0-9]+/merge) ref: refs/(heads/master|pull/[0-9]+/merge) @@ -12,4 +13,3 @@ claim_pattern: permissions: contents: write pull_requests: write - From 469adb325642aaf176fb359a024f09577d0358a9 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Thu, 17 Sep 2026 13:11:25 +0200 Subject: [PATCH 3/4] ci: limit token policies to ci-cd --- ...datadog-api-spec.github.cache-builder.sts.yaml | 14 -------------- ...atadog-api-spec.github.merged.cleanup.sts.yaml | 15 --------------- 2 files changed, 29 deletions(-) delete mode 100644 .github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml delete mode 100644 .github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml diff --git a/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml b/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml deleted file mode 100644 index 8aee8fc349..0000000000 --- a/.github/chainguard/datadog-api-spec.github.cache-builder.sts.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Allows the scheduled cache builder in ddoghq/datadog-api-spec to read this repository. -issuer: https://token.actions.githubusercontent.com - -subject: repo:ddoghq/datadog-api-spec:ref:refs/heads/master - -claim_pattern: - event_name: schedule - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/cache-builder\.yml@refs/heads/master - ref: refs/heads/master - repository: ddoghq/datadog-api-spec - -permissions: - contents: read - diff --git a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml b/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml deleted file mode 100644 index 66843a50ab..0000000000 --- a/.github/chainguard/datadog-api-spec.github.merged.cleanup.sts.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Allows the close workflow in ddoghq/datadog-api-spec to close generated PRs and delete branches. -issuer: https://token.actions.githubusercontent.com - -subject: repo:ddoghq/datadog-api-spec:pull_request - -claim_pattern: - base_ref: master - event_name: pull_request - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/merged\.yml@refs/(heads/master|pull/[0-9]+/merge) - ref: refs/(heads/master|pull/[0-9]+/merge) - repository: ddoghq/datadog-api-spec - -permissions: - contents: write - pull_requests: write From 216518e272066fe2cefec47a11cdab89dbc84e8c Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Thu, 17 Sep 2026 13:36:00 +0200 Subject: [PATCH 4/4] ci: support current and post-migration sources --- ...ub.ci-cd.detect-client-changes.ddoghq.sts.yaml | 14 ++++++++++++++ ...ec.github.ci-cd.detect-client-changes.sts.yaml | 8 ++++---- ...github.ci-cd.pipeline-generate.ddoghq.sts.yaml | 15 +++++++++++++++ ...i-spec.github.ci-cd.pipeline-generate.sts.yaml | 8 ++++---- 4 files changed, 37 insertions(+), 8 deletions(-) create mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml create mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml new file mode 100644 index 0000000000..d08687c4aa --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml @@ -0,0 +1,14 @@ +# Allows PR detection from ddoghq/datadog-api-spec without granting write access. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + base_ref: master + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + ref: refs/pull/[0-9]+/merge + repository: ddoghq/datadog-api-spec + +permissions: + pull_requests: read diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml index d08687c4aa..8647bd6b7e 100644 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml @@ -1,14 +1,14 @@ -# Allows PR detection from ddoghq/datadog-api-spec without granting write access. +# Allows PR detection from DataDog/datadog-api-spec without granting write access. issuer: https://token.actions.githubusercontent.com -subject: repo:ddoghq/datadog-api-spec:pull_request +subject: repo:DataDog/datadog-api-spec:pull_request claim_pattern: base_ref: master event_name: pull_request - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + job_workflow_ref: DataDog/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge ref: refs/pull/[0-9]+/merge - repository: ddoghq/datadog-api-spec + repository: DataDog/datadog-api-spec permissions: pull_requests: read diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml new file mode 100644 index 0000000000..4091b74262 --- /dev/null +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml @@ -0,0 +1,15 @@ +# Allows the generation pipeline in ddoghq/datadog-api-spec to push generated code and create PRs. +issuer: https://token.actions.githubusercontent.com + +subject: repo:ddoghq/datadog-api-spec:pull_request + +claim_pattern: + base_ref: master + event_name: pull_request + job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + ref: refs/pull/[0-9]+/merge + repository: ddoghq/datadog-api-spec + +permissions: + contents: write + pull_requests: write diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml index 4091b74262..e7a9447d25 100644 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml +++ b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml @@ -1,14 +1,14 @@ -# Allows the generation pipeline in ddoghq/datadog-api-spec to push generated code and create PRs. +# Allows the generation pipeline in DataDog/datadog-api-spec to push generated code and create PRs. issuer: https://token.actions.githubusercontent.com -subject: repo:ddoghq/datadog-api-spec:pull_request +subject: repo:DataDog/datadog-api-spec:pull_request claim_pattern: base_ref: master event_name: pull_request - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge + job_workflow_ref: DataDog/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge ref: refs/pull/[0-9]+/merge - repository: ddoghq/datadog-api-spec + repository: DataDog/datadog-api-spec permissions: contents: write