Use dd-octo-sts for Python version upgrades to enable workflow file modifications
#21850
Conversation
AAraKKe
left a comment
AAraKKe
left a comment
There was a problem hiding this comment.
Thanks a lot @Kyle-Neale!! So cool we are starting to use octo-sts 😁. This looks pretty nice, just a couple of small comments.
| event_name: (schedule|workflow_dispatch) | ||
| ref: refs/heads/master | ||
| ref_protected: "true" | ||
| job_workflow_ref: DataDog/integrations-core/.github/workflows/upgrade-python-version.yml@refs/heads/master |
There was a problem hiding this comment.
request: While we are using the policy for this particular workflow, this policy is valid for creating PR if the workflow runs from master. I would probably allow any workflow to from this repo running from master to use it. Then we can migrate all workflows we create pull-requests from to use octo-sts and avoid the static app credentials we store in the repo.
I am guessing we can write something like DataDog/integrations-core/\.github/workflows/.*\.yml@refs/heads/master
Note: these are regexes (is this the plural of regex? XD). Make sure to add the \ before the ..
There was a problem hiding this comment.
request: can we rename the policy following the same format they propose? It makes a lot of sense because these policies can be used from different places. Maybe naming it self.create-pull-requests.schedule.sts.yaml.
self: only this repo has access to this policycreate-pull-request: grants permissions to create pull requestsschedule: only for workflows running on schedule. The dispatch is there to ensure we can execute it outside of schedule.
I would also adds some comment to the file explaining what is the intention. I.e. intended to be us ed with the peter-evans/create-pull-request action.
|
This PR does not modify any files shipped with the agent. To help streamline the release process, please consider adding the |
What does this PR do?
Integrates dd-octo-sts to obtain GitHub tokens with
workflowspermission, enabling fully automated Python version upgrades including modifications to workflow files.Motivation
.github/chainguard/self.create-pull-requests.schedule.sts.yamlwithworkflows: writepermission.github/workflows/upgrade-python-version.ymlto useDataDog/dd-octo-sts-actioninstead ofactions/create-github-app-tokenReview checklist (to be filled by reviewers)
qa/skip-qalabel if the PR doesn't need to be tested during QA.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged