From 185023cb6eeab13a55b2531f7ecd9d1c76d93082 Mon Sep 17 00:00:00 2001 From: Xavier Lamorlette Date: Thu, 20 Aug 2026 13:04:29 +0200 Subject: [PATCH 1/3] Replace DD_CI_VIS_API_KEY secret by dd-sts-action --- .github/actions/dd-sts-credentials/action.yml | 15 ++++++++ .github/workflows/dev.yml | 35 +++++++++++++------ 2 files changed, 39 insertions(+), 11 deletions(-) create mode 100644 .github/actions/dd-sts-credentials/action.yml diff --git a/.github/actions/dd-sts-credentials/action.yml b/.github/actions/dd-sts-credentials/action.yml new file mode 100644 index 000000000..930a62cf3 --- /dev/null +++ b/.github/actions/dd-sts-credentials/action.yml @@ -0,0 +1,15 @@ +name: "Get Datadog credentials" +description: "Exchange the workflow's OIDC token for a short-lived Datadog API key via dd-sts" + +outputs: + api_key: + description: "Datadog API key" + value: ${{ steps.dd-sts-action.outputs.api_key }} + +runs: + using: "composite" + steps: + - id: dd-sts-action + uses: DataDog/dd-sts-action@639d841c72f15e4e77747bd726ef8105ce971da2 # v1.0.5 + with: + policy: public-datadog-dd-trace-cpp diff --git a/.github/workflows/dev.yml b/.github/workflows/dev.yml index 2420f2401..9394c52b4 100644 --- a/.github/workflows/dev.yml +++ b/.github/workflows/dev.yml @@ -53,9 +53,9 @@ jobs: permissions: contents: read packages: read + id-token: write env: BUILD_DIR: .build - HAS_DD_API_KEY: ${{ secrets.DD_CI_VIS_API_KEY != '' }} steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Configure @@ -66,10 +66,15 @@ jobs: run: cd ${BUILD_DIR} && test/tests -r junit -o report.xml env: ASAN_OPTIONS: alloc_dealloc_mismatch=0 + - name: Get Datadog credentials + uses: ./.github/actions/dd-sts-credentials + id: dd-sts-credentials + if: success() || failure() + continue-on-error: true - name: Upload test report to Datadog - if: (success() || failure()) && env.HAS_DD_API_KEY == 'true' + if: (success() || failure()) && steps.dd-sts-credentials.outcome == 'success' env: - DD_API_KEY: ${{ secrets.DD_CI_VIS_API_KEY }} + DD_API_KEY: ${{ steps.dd-sts-credentials.outputs.api_key }} run: | curl -L --fail "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_linux-${{ matrix.arch }}" --output "/usr/local/bin/datadog-ci" && chmod +x /usr/local/bin/datadog-ci datadog-ci junit upload --service dd-trace-cpp --tags test.source.file:test/*.cpp .build/report.xml @@ -138,8 +143,7 @@ jobs: permissions: contents: read packages: read - env: - HAS_DD_API_KEY: ${{ secrets.DD_CI_VIS_API_KEY != '' }} + id-token: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - name: Install Dependency Manager (scoop) @@ -158,10 +162,15 @@ jobs: run: | & 'C:\\Program Files\\Microsoft Visual Studio\\2022\\Enterprise\\Common7\\Tools\\Launch-VsDevShell.ps1' -arch ${{ matrix.arch }} .\build\test\tests.exe -r junit -o report.xml + - name: Get Datadog credentials + uses: ./.github/actions/dd-sts-credentials + id: dd-sts-credentials + if: success() || failure() + continue-on-error: true - name: Upload test report to Datadog - if: (success() || failure()) && env.HAS_DD_API_KEY == 'true' + if: (success() || failure()) && steps.dd-sts-credentials.outcome == 'success' env: - DD_API_KEY: ${{ secrets.DD_CI_VIS_API_KEY }} + DD_API_KEY: ${{ steps.dd-sts-credentials.outputs.api_key }} run: | Invoke-WebRequest -Uri "https://github.com/DataDog/datadog-ci/releases/latest/download/datadog-ci_win-x64" -OutFile "datadog-ci.exe" ./datadog-ci.exe junit upload --service dd-trace-cpp --tags test.source.file:test/*.cpp report.xml @@ -176,17 +185,21 @@ jobs: permissions: contents: read packages: read - env: - HAS_DD_API_KEY: ${{ secrets.DD_CI_VIS_API_KEY != '' }} + id-token: write steps: - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - run: bin/test --coverage --verbose + - name: Get Datadog credentials + uses: ./.github/actions/dd-sts-credentials + id: dd-sts-credentials + if: success() + continue-on-error: true - name: Upload code coverage report to Datadog - if: success() && env.HAS_DD_API_KEY == 'true' + if: success() && steps.dd-sts-credentials.outcome == 'success' # See https://github.com/DataDog/coverage-upload-github-action/releases uses: DataDog/coverage-upload-github-action@d9548b1c3c4ab639d5d3ab29a1508af188975f77 # v1.0.5 with: - api_key: ${{ secrets.DD_CI_VIS_API_KEY }} + api_key: ${{ steps.dd-sts-credentials.outputs.api_key }} files: .coverage/filtered.info format: lcov From 489acc4bcbb13da9d9906de4a1d9c58afe1174c3 Mon Sep 17 00:00:00 2001 From: Xavier Lamorlette Date: Thu, 20 Aug 2026 13:26:33 +0200 Subject: [PATCH 2/3] Replace CLAUDE.md by a link to AGENTS.md --- CLAUDE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) mode change 100644 => 120000 CLAUDE.md diff --git a/CLAUDE.md b/CLAUDE.md deleted file mode 100644 index c3969d899..000000000 --- a/CLAUDE.md +++ /dev/null @@ -1 +0,0 @@ -Follow [AGENTS.md](AGENTS.md). diff --git a/CLAUDE.md b/CLAUDE.md new file mode 120000 index 000000000..47dc3e3d8 --- /dev/null +++ b/CLAUDE.md @@ -0,0 +1 @@ +AGENTS.md \ No newline at end of file From f9fa8997f8565b82e2fe54b40441d45023cc929d Mon Sep 17 00:00:00 2001 From: Xavier Lamorlette Date: Thu, 20 Aug 2026 13:27:30 +0200 Subject: [PATCH 3/3] Add Agent-Only Instructions --- AGENTS.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/AGENTS.md b/AGENTS.md index bb38bbfbf..efeb79ac1 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -11,3 +11,7 @@ See [docs/development.md](docs/development.md) for build, test, and formatting i ## Architecture See [docs/design.md](docs/design.md) for the library's architecture and design rationale. + +## Agent-Only Instructions + +Write short comments, with simple words and short sentences.