[AI-6502] migrate test-target to dd-sts (#24025)

sarah-witt · web-flow · commit a9550b449f15 · 2026-07-15T20:05:21.000Z
* migrate test-target to dd-sts

* add permissions

* fix

* add to callers
diff --git a/.github/workflows/flaky-tests-windows.yml b/.github/workflows/flaky-tests-windows.yml
@@ -34,6 +34,8 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts in test-target.yml
+       id-token: write
 
   publish-test-results:
     needs:
diff --git a/.github/workflows/flaky-tests.yml b/.github/workflows/flaky-tests.yml
@@ -38,6 +38,8 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts in test-target.yml
+       id-token: write
 
   publish-test-results:
     needs:
diff --git a/.github/workflows/master-windows.yml b/.github/workflows/master-windows.yml
@@ -52,6 +52,8 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts in test-target.yml
+       id-token: write
 
   publish-test-results:
 
diff --git a/.github/workflows/master.yml b/.github/workflows/master.yml
@@ -50,6 +50,8 @@ jobs:
     permissions:
       # needed for compute-matrix in test-target.yml
       contents: read
+      # needed for dd-sts in test-target.yml
+      id-token: write
 
   publish-test-results:
     needs:
diff --git a/.github/workflows/nightly-base-package-windows.yml b/.github/workflows/nightly-base-package-windows.yml
@@ -19,6 +19,8 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts in test-target.yml
+       id-token: write
 
     with:
       repo: core
diff --git a/.github/workflows/nightly-base-package.yml b/.github/workflows/nightly-base-package.yml
@@ -17,6 +17,8 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts in test-target.yml
+       id-token: write
 
     with:
       repo: core
diff --git a/.github/workflows/pr-all-windows.yml b/.github/workflows/pr-all-windows.yml
@@ -28,6 +28,8 @@ jobs:
     permissions:
       # needed for compute-matrix in test-target.yml
       contents: read
+      # needed for dd-sts in test-target.yml
+      id-token: write
 
     with:
       repo: core
diff --git a/.github/workflows/pr-all.yml b/.github/workflows/pr-all.yml
@@ -29,6 +29,8 @@ jobs:
     permissions:
       # needed for compute-matrix in test-target.yml
       contents: read
+      # needed for dd-sts in test-target.yml
+      id-token: write
 
     with:
       repo: core
diff --git a/.github/workflows/pr-test.yml b/.github/workflows/pr-test.yml
@@ -61,6 +61,11 @@ jobs:
       python-version: "${{ inputs.python-version }}"
       pytest-args: ${{ inputs.pytest-args }}
     secrets: inherit
+    permissions:
+      # needed for compute-matrix in test-target.yml
+      contents: read
+      # needed for dd-sts in test-target.yml
+      id-token: write
 
   test-minimum-base-package:
     needs:
@@ -93,6 +98,11 @@ jobs:
       pytest-args: ${{ inputs.pytest-args }}
       context: "pr"
     secrets: inherit
+    permissions:
+      # needed for compute-matrix in test-target.yml
+      contents: read
+      # needed for dd-sts in test-target.yml
+      id-token: write
 
   save-event:
     needs:
diff --git a/.github/workflows/test-agent-target.yml b/.github/workflows/test-agent-target.yml
@@ -65,3 +65,5 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts in test-target.yml
+       id-token: write
diff --git a/.github/workflows/test-agent-windows.yml b/.github/workflows/test-agent-windows.yml
@@ -53,3 +53,5 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts in test-target.yml
+       id-token: write
diff --git a/.github/workflows/test-agent.yml b/.github/workflows/test-agent.yml
@@ -53,3 +53,5 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts in test-target.yml
+       id-token: write
diff --git a/.github/workflows/test-all-windows.yml b/.github/workflows/test-all-windows.yml
@@ -63,6 +63,12 @@ on:
         default: "standard"
         type: string
 
+permissions:
+  # needed for compute-matrix in test-target.yml
+  contents: read
+  # needed for dd-sts in test-target.yml
+  id-token: write
+
 jobs:
   j6712d43:
     uses: ./.github/workflows/test-target.yml
diff --git a/.github/workflows/test-all.yml b/.github/workflows/test-all.yml
@@ -61,6 +61,12 @@ on:
         default: "standard"
         type: string
 
+permissions:
+  # needed for compute-matrix in test-target.yml
+  contents: read
+  # needed for dd-sts in test-target.yml
+  id-token: write
+
 jobs:
   jd316aba:
     uses: ./.github/workflows/test-target.yml
diff --git a/.github/workflows/test-target.yml b/.github/workflows/test-target.yml
@@ -102,6 +102,8 @@ jobs:
     permissions:
        # needed for compute-matrix in test-target.yml
        contents: read
+       # needed for dd-sts to fetch a temporary API key via OIDC
+       id-token: write
     steps:
 
     - name: Set up Windows
@@ -159,6 +161,13 @@ jobs:
         # Use a specific sub-folder
         path: core-temp
 
+    - name: Get Datadog credentials
+      if: github.event.pull_request.head.repo.fork != true
+      id: dd-sts
+      uses: DataDog/dd-sts-action@2e8187910199bd93129520183c093e19aa585c75 # v1.0.0
+      with:
+        policy: integrations-test-target-api-key
+
     - name: Install workflow scripts (core)
       if: inputs.repo == 'core'
       uses: ./.github/actions/setup-test-target-scripts
@@ -220,7 +229,7 @@ jobs:
         INPUT_JOB_NAME: "${{ inputs.job-name }}${{ inputs.target-env && format('-{0}', inputs.target-env) || '' }}"
         INPUT_PYTEST_ARGS: ${{ inputs.pytest-args }}
         INPUT_IS_FORK: ${{ github.event.pull_request.head.repo.fork || false }}
-        DD_API_KEY_SECRET: ${{ secrets.DD_API_KEY }}
+        DD_API_KEY_SECRET: ${{ steps.dd-sts.outputs.api_key }}
         SETUP_ENV_VARS: ${{ inputs.setup-env-vars }}
         DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
         DOCKER_ACCESS_TOKEN: ${{ secrets.DOCKER_ACCESS_TOKEN }}
@@ -230,12 +239,12 @@ jobs:
         DD_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Tag job for CI Visibility
-      # Skip on fork PRs and non-core repos since secrets won't be available
+      # Skip on fork PRs and non-core repos since dd-sts credentials won't be available
       if: env.INPUT_IS_FORK != 'true' && env.INPUT_REPO == 'core'
       uses: ./.github/actions/tag-job
       with:
         tags: ${{ env.DD_TAGS }}
-        dd_api_key: ${{ secrets.DD_API_KEY }}
+        dd_api_key: ${{ steps.dd-sts.outputs.api_key }}
         dd_site: ${{ env.DD_SITE }}
 
     - name: Set up Python 2.7
diff --git a/.github/workflows/weekly-latest-windows.yml b/.github/workflows/weekly-latest-windows.yml
@@ -20,3 +20,5 @@ jobs:
     permissions:
       # needed for compute-matrix in test-target.yml
       contents: read
+      # needed for dd-sts in test-target.yml
+      id-token: write
diff --git a/.github/workflows/weekly-latest.yml b/.github/workflows/weekly-latest.yml
@@ -18,3 +18,5 @@ jobs:
     permissions:
       # needed for compute-matrix in test-target.yml
       contents: read
+      # needed for dd-sts in test-target.yml
+      id-token: write
