From 86eed758cbba0a5bce25a9a44b0ba07ccc0bd56b Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Wed, 23 Sep 2026 14:13:26 +0200 Subject: [PATCH] Revert "ci: trust datadog-api-spec ci-cd via Octo STS (#3828)" This reverts commit 0030cc28c5a78fb6f8acb43ab022de96fe5a71ec. --- ...ub.ci-cd.detect-client-changes.ddoghq.sts.yaml | 14 -------------- ...ec.github.ci-cd.detect-client-changes.sts.yaml | 14 -------------- ...github.ci-cd.pipeline-generate.ddoghq.sts.yaml | 15 --------------- ...i-spec.github.ci-cd.pipeline-generate.sts.yaml | 15 --------------- 4 files changed, 58 deletions(-) delete mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml delete mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml delete mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml delete mode 100644 .github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml deleted file mode 100644 index d08687c4aa71..000000000000 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.ddoghq.sts.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Allows PR detection from ddoghq/datadog-api-spec without granting write access. -issuer: https://token.actions.githubusercontent.com - -subject: repo:ddoghq/datadog-api-spec:pull_request - -claim_pattern: - base_ref: master - event_name: pull_request - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge - ref: refs/pull/[0-9]+/merge - repository: ddoghq/datadog-api-spec - -permissions: - pull_requests: read diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml deleted file mode 100644 index 8647bd6b7eca..000000000000 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.detect-client-changes.sts.yaml +++ /dev/null @@ -1,14 +0,0 @@ -# Allows PR detection from DataDog/datadog-api-spec without granting write access. -issuer: https://token.actions.githubusercontent.com - -subject: repo:DataDog/datadog-api-spec:pull_request - -claim_pattern: - base_ref: master - event_name: pull_request - job_workflow_ref: DataDog/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge - ref: refs/pull/[0-9]+/merge - repository: DataDog/datadog-api-spec - -permissions: - pull_requests: read diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml deleted file mode 100644 index 4091b7426287..000000000000 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.ddoghq.sts.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Allows the generation pipeline in ddoghq/datadog-api-spec to push generated code and create PRs. -issuer: https://token.actions.githubusercontent.com - -subject: repo:ddoghq/datadog-api-spec:pull_request - -claim_pattern: - base_ref: master - event_name: pull_request - job_workflow_ref: ddoghq/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge - ref: refs/pull/[0-9]+/merge - repository: ddoghq/datadog-api-spec - -permissions: - contents: write - pull_requests: write diff --git a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml b/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml deleted file mode 100644 index e7a9447d250c..000000000000 --- a/.github/chainguard/datadog-api-spec.github.ci-cd.pipeline-generate.sts.yaml +++ /dev/null @@ -1,15 +0,0 @@ -# Allows the generation pipeline in DataDog/datadog-api-spec to push generated code and create PRs. -issuer: https://token.actions.githubusercontent.com - -subject: repo:DataDog/datadog-api-spec:pull_request - -claim_pattern: - base_ref: master - event_name: pull_request - job_workflow_ref: DataDog/datadog-api-spec/\.github/workflows/ci-cd\.yml@refs/pull/[0-9]+/merge - ref: refs/pull/[0-9]+/merge - repository: DataDog/datadog-api-spec - -permissions: - contents: write - pull_requests: write