Skip to content

dd-sts migration #6679

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nccatoni merged 5 commits into from
Apr 9, 2026
Merged

dd-sts migration #6679

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
b4b5967
dd-sts migration
nccatoni Apr 3, 2026
18462a8
Merge branch 'main' into nccatoni/dd-sts-migration
nccatoni Apr 7, 2026
f86a612
Merge branch 'main' into nccatoni/dd-sts-migration
nccatoni Apr 7, 2026
c289262
Cleanup
nccatoni Apr 8, 2026
d4a2f58
Merge branch 'main' into nccatoni/dd-sts-migration
nccatoni Apr 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions .github/actions/push_to_test_optim/action.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,13 @@ inputs:
default: datadoghq.com
datadog_api_key:
description: "A valid DD_API_KEY"
default: ""
ci_environment:
description: "CI environment running the tests (dev/prod/custom), used for Test Optimization tagging"
default: ""
dd_sts_policy:
description: "dd-sts policy to use to get a datadog API key (required if datadog_api_key is not set)"
default: ""

runs:
using: composite
Expand All @@ -19,19 +23,26 @@ runs:
run: echo "Skipping TestOptim push for dependabot PRs"

- name: Install datadog-ci
if: github.event.pull_request.user.login != 'dependabot[bot]' && inputs.datadog_api_key != ''
if: github.event.pull_request.user.login != 'dependabot[bot]'
shell: bash
run: npm install -g @datadog/datadog-ci || sleep 60 && npm install -g @datadog/datadog-ci

- name: checkout owner repo
if: github.event.pull_request.user.login != 'dependabot[bot]' && inputs.datadog_api_key != ''
if: github.event.pull_request.user.login != 'dependabot[bot]'
uses: actions/checkout@0c366fd6a839edf440554fa01a7085ccba70ac98
with:
path: repo

- name: Get Datadog credentials
id: dd-sts
if: inputs.dd_sts_policy != ''
uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
with:
policy: ${{ inputs.dd_sts_policy }}

# https://docs.datadoghq.com/tests/setup/junit_xml/?tab=linux
- name: Push results
if: github.event.pull_request.user.login != 'dependabot[bot]' && inputs.datadog_api_key != ''
if: github.event.pull_request.user.login != 'dependabot[bot]'
Copy link
Copy Markdown

@chatgpt-codex-connector chatgpt-codex-connector bot Apr 9, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Skip upload when no Datadog credentials are configured

The Push results step now runs for every non-Dependabot execution, even when both credential sources are empty. If inputs.datadog_api_key is '' and inputs.dd_sts_policy is also '', the dd-sts step is skipped and DATADOG_API_KEY resolves to an empty value, so datadog-ci junit upload is still invoked without auth and can fail the job. This is a regression from the previous guard and affects callers that enable push_to_test_optimization without passing either credential source (for example workflows that rely on system-tests.yml defaults).

Useful? React with 👍 / 👎.

shell: bash
run: |
cd repo
Expand All @@ -43,5 +54,5 @@ runs:
--xpath-tag "test.codeowners=/testcase/properties/property[@name='test.codeowners']"
env:
DATADOG_SITE: ${{ inputs.datadog_site }}
DATADOG_API_KEY: ${{ inputs.datadog_api_key }}
DATADOG_API_KEY: ${{ inputs.datadog_api_key != '' && inputs.datadog_api_key || steps.dd-sts.outputs.api_key }}
DD_TAGS: ${{ inputs.ci_environment != '' && format('test.configuration.ci_environment:{0}', inputs.ci_environment) || '' }}
2 changes: 2 additions & 0 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ jobs:
permissions:
contents: read
packages: write
id-token: write
secrets:
DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }}
DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
Expand All @@ -92,6 +93,7 @@ jobs:
_system_tests_dev_mode: ${{ matrix.version == 'dev' }}
_system_tests_library_target_branch_map: ${{ needs.compute_libraries_and_scenarios.outputs.target-branch-map }}
push_to_test_optimization: true
dd_sts_policy: system-tests

exotics:
name: Exotics scenarios
Expand Down
6 changes: 6 additions & 0 deletions .github/workflows/run-end-to-end.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,6 +101,11 @@ on:
default: "datadoghq.com"
required: false
type: string
dd_sts_policy:
description: "dd-sts policy to use to get a Datadog API key for Test Optimization"
default: ""
required: false
type: string

jobs:
main:
Expand Down Expand Up @@ -546,3 +551,4 @@ jobs:
datadog_api_key: ${{ secrets.TEST_OPTIMIZATION_API_KEY }}
datadog_site: ${{ inputs.test_optimization_datadog_site }}
ci_environment: ${{ inputs.ci_environment }}
dd_sts_policy: ${{ inputs.dd_sts_policy }}
6 changes: 6 additions & 0 deletions .github/workflows/run-parametric.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,11 @@ on:
default: "datadoghq.com"
required: false
type: string
dd_sts_policy:
description: "dd-sts policy to use to get a Datadog API key for Test Optimization"
default: ""
required: false
type: string
secrets:
TEST_OPTIMIZATION_API_KEY:
description: "API key for pushing test results to DataDog Test Optimization"
Expand Down Expand Up @@ -166,3 +171,4 @@ jobs:
datadog_api_key: ${{ secrets.TEST_OPTIMIZATION_API_KEY }}
datadog_site: ${{ inputs.test_optimization_datadog_site }}
ci_environment: ${{ inputs.ci_environment }}
dd_sts_policy: ${{ inputs.dd_sts_policy }}
11 changes: 11 additions & 0 deletions .github/workflows/system-tests.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,11 @@ on:
default: "datadoghq.com"
required: false
type: string
dd_sts_policy:
description: "dd-sts policy to use to get a Datadog API key for Test Optimization"
default: ""
required: false
type: string

secrets:
DOCKERHUB_USERNAME:
Expand Down Expand Up @@ -170,6 +175,8 @@ jobs:
if: needs.compute_parameters.outputs.parametric_enable == 'true'
uses: ./.github/workflows/run-parametric.yml
secrets: inherit
permissions:
id-token: write
with:
library: ${{ inputs.library }}
ref: ${{ inputs.ref }}
Expand All @@ -182,6 +189,7 @@ jobs:
unique_id: ${{ needs.compute_parameters.outputs.unique_id }}
push_to_test_optimization: ${{ inputs.push_to_test_optimization }}
test_optimization_datadog_site: ${{ inputs.test_optimization_datadog_site }}
dd_sts_policy: ${{ inputs.dd_sts_policy }}

build_end_to_end:
name: Build end-to-end (${{ matrix.weblog.name }})
Expand Down Expand Up @@ -256,6 +264,8 @@ jobs:
fail-fast: false
uses: ./.github/workflows/run-end-to-end.yml
secrets: inherit
permissions:
id-token: write
with:
runs_on: ${{ matrix.job.runs_on }}
library: ${{ matrix.job.library }}
Expand All @@ -272,6 +282,7 @@ jobs:
artifact_retention_days: ${{ inputs.artifact_retention_days }}
push_to_test_optimization: ${{ inputs.push_to_test_optimization }}
test_optimization_datadog_site: ${{ inputs.test_optimization_datadog_site }}
dd_sts_policy: ${{ inputs.dd_sts_policy }}
_build_buddies_images: ${{ inputs._build_buddies_images }}
_build_proxy_image: ${{ inputs._build_proxy_image }}
_build_lambda_proxy_image: ${{ inputs._build_lambda_proxy_image }}
Expand Down
Loading