Rely on dd-octo-sts for GITHUB token instead - #2848
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2013162319
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| # Set GITHUB_TOKEN to avoid getting rate-limited when pulumi sdk downloads the kubernetes provider | ||
| - export GITHUB_TOKEN=$(aws ssm get-parameter --region us-east-1 --name ci.helm-charts.github_token --with-decryption --query "Parameter.Value" --out text) | ||
| - export GITHUB_TOKEN=$(dd-octo-sts token --scope DataDog/datadog-agent --policy self.gitlab.read)) |
There was a problem hiding this comment.
When the E2E job requests a token, --scope identifies the repository whose .github/chainguard policy is evaluated, but self.gitlab.read is introduced in DataDog/helm-charts while this command requests it from DataDog/datadog-agent. Every existing workflow pairs these local policies with scope: DataDog/helm-charts (for example .github/workflows/release.yaml:29-30), so this request cannot use the new policy and leaves GITHUB_TOKEN empty; because export VAR=$(...) masks the substitution's failure status, the job continues unauthenticated and can still hit the GitHub rate limit this change is intended to prevent.
Useful? React with 👍 / 👎.
1 participant
What this PR does / why we need it:
Update CI configuration to rely on dd-octo-sts to get a Github token
Which issue this PR fixes
(optional, in
fixes #<issue number>(, fixes #<issue_number>, ...)format, will close that issue when PR gets merged)Special notes for your reviewer:
Checklist
[Place an '[x]' (no spaces) in all applicable fields. Please remove unrelated fields.]
<chartName>/minor-version,<chartName>/patch-version, or<chartName>/no-version-bump)datadogordatadog-operatorchart or value changes, update the test baselines (run:make update-test-baselines)datadogchart changes, received ✅ from a member of your teamGitHub CI takes care of the below, but are still required:
.github/helm-docs.sh)CHANGELOG.mdhas been updatedREADME.md