Migrate integration tests from static API key to dd-sts - #981
Open
chouetz wants to merge 1 commit into
Open
Conversation
Replace DD_TEST_CLIENT_API_KEY and DD_TEST_CLIENT_APP_KEY secrets with short-lived credentials from dd-sts-action, and switch DD_TEST_CLIENT_USER to a repo variable (non-secret).
chouetz
marked this pull request as ready for review
August 20, 2026 16:00
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 20f9d69df5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| DD_TEST_CLIENT_USER: "${{ secrets.DD_TEST_CLIENT_USER }}" | ||
| DD_TEST_CLIENT_API_KEY: ${{ steps.dd-sts.outputs.api_key }} | ||
| DD_TEST_CLIENT_APP_KEY: ${{ steps.dd-sts.outputs.app_key }} | ||
| DD_TEST_CLIENT_USER: ${{ vars.DD_TEST_CLIENT_USER }} |
There was a problem hiding this comment.
When DD_TEST_CLIENT_USER has not yet been configured as a repository variable—as the commit's unchecked setup step indicates—GitHub expands this expression to an empty string. Both integration commands use --vcr-record=all, and tests/integration/conftest.py passes that empty value through its is not None check to the comment API tests, causing every labeled integration run to fail. Provision the variable before merging or retain a temporary fallback to the existing secret.
Useful? React with 👍 / 👎.
chouetz
added a commit
to DataDog/code-review-action
that referenced
this pull request
Aug 25, 2026
The reusable workflow's `telemetry` job no longer has any dd-sts/OIDC surface; it only accepts an optional `datadog_api_key` secret. Internal callers that want a short-lived key now mint it themselves in a dedicated job (see ai-review.yml's new `dd_sts` job) and pass it in via `needs.dd_sts.outputs.api_key`, matching the pattern used in DataDog/datadogpy#981. This accepts that GitHub job outputs aren't masked, which matters for public-repo callers; README.md documents the tradeoff and the fail-open, continue-on-error setup. Environment: Datadog workspace Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
chouetz
added a commit
to DataDog/code-review-action
that referenced
this pull request
Aug 25, 2026
* Add optional Datadog telemetry with dd-sts credential minting Consolidates telemetry into a single finish-time metrics submission from an isolated job, drops the datadog_environment gate (this workflow runs on pull_request/issue_comment, so a GitHub environment can't protect the secret), and adds an optional dd-sts path so internal callers can mint a short-lived Datadog API key at runtime instead of storing one. Enables telemetry on this repo's own ai-review.yml to dogfood the feature. Environment: Datadog workspace Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Move dd-sts credential minting to the caller workflow The reusable workflow's `telemetry` job no longer has any dd-sts/OIDC surface; it only accepts an optional `datadog_api_key` secret. Internal callers that want a short-lived key now mint it themselves in a dedicated job (see ai-review.yml's new `dd_sts` job) and pass it in via `needs.dd_sts.outputs.api_key`, matching the pattern used in DataDog/datadogpy#981. This accepts that GitHub job outputs aren't masked, which matters for public-repo callers; README.md documents the tradeoff and the fail-open, continue-on-error setup. Environment: Datadog workspace Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Correct README's dd-sts job-output exposure warning dd-sts-action calls ::add-mask:: on the key before writing it to GITHUB_OUTPUT, so GitHub redacts it from logs for the rest of the run, and there's no REST API exposing raw job outputs. The prior wording overstated the exposure risk without checking the action's source. Environment: Datadog workspace Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * less wording --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
https://datadoghq.atlassian.net/browse/ACIX-1817
Summary
DD_TEST_CLIENT_API_KEYandDD_TEST_CLIENT_APP_KEYsecrets with short-lived credentials fetched viadd-sts-actionid-token: writepermission required for OIDC token federationDD_TEST_CLIENT_USERfrom a secret to a repo variable (vars.DD_TEST_CLIENT_USER)This depends on the dd-source policy
datadogpy-integration-testsbeing merged and deployed before this workflow is enabled.Test plan
DD_TEST_CLIENT_USERas a repo variable in GitHub settingsDD_TEST_CLIENT_API_KEYandDD_TEST_CLIENT_APP_KEYsecrets from repo settings once confirmed workingci/integrationslabel to a PR and verify credentials are fetched successfully🤖 Generated with Claude Code