Replace our custom GitHub App Token with `dd-octo-sts` by andrewlock · Pull Request #8318 · DataDog/dd-trace-dotnet

andrewlock · 2026-03-17T11:15:33Z

Summary of changes

Replaces our use of actions/create-github-app-token with dd-octo-sts

Reason for change

It was recommended by sdlc-security that we make the shift

Implementation details

They have a claude plugin to do it, so I poked the bot with a stick until it did this. Looks OK to me best I can understand, and I'm definitely happier having 🤖 write the various "patterns" 😅

Test coverage

Unfortunately, no... this isn't an easy one to test.

The AAS deploy is just one we will have to keep an eye on, as it's non critical and we can temporarily revert if necessary.

The release one is more problematic - I left the "fallback" create_draft_release workflow "as-is" for now, as we know it works, and we want to make sure we have an escape hatch for the first run

Other details

Requires DataDog/datadog-aas-extension#438 to be merged first.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 05ffe4fcb2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Copilot

Pull request overview

This PR migrates several GitHub Actions workflows from generating GitHub App installation tokens (actions/create-github-app-token) to using dd-octo-sts (OIDC-based) tokens, aligning with the recommendation from sdlc-security.

Changes:

Add dd-octo-sts token minting steps (and required id-token: write permissions) to AAS deploy/release workflows.
Update the deploy-aas-dev-apps composite action to accept a pre-minted github_token instead of GitHub App credentials.
Update the reusable draft release workflow to use dd-octo-sts and introduce a corresponding Chainguard STS policy file.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
.github/workflows/scheduled_aas_deploy.yml	Adds OIDC permission + `dd-octo-sts` token step; passes minted token into deploy composite action.
.github/workflows/code_freeze_start.yml	Adds OIDC permission + `dd-octo-sts` token step; passes minted token into deploy composite action.
.github/workflows/auto_deploy_aas_test_apps.yml	Adds OIDC permission + `dd-octo-sts` token step; passes minted token into deploy composite action.
.github/workflows/auto-trigger-aas-release.yml	Replaces GitHub App token creation with `dd-octo-sts` token for repository dispatch call.
.github/actions/deploy-aas-dev-apps/action.yml	Removes GitHub App token generation; requires caller-provided `github_token`.
.github/workflows/_create_draft_release.yml	Replaces GitHub App token creation with `dd-octo-sts` for release-related GitHub API operations.
.github/chainguard/self.github.create-draft-release.sts.yaml	Adds STS policy intended to allow `dd-octo-sts` to mint a token for the draft release workflow.
.github/workflows/create_normal_draft_release.yml	Stops passing GitHub App secrets into the reusable draft release workflow.
.github/workflows/create_hotfix_draft_release.yml	Stops passing GitHub App secrets into the reusable draft release workflow.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

andrewlock · 2026-03-17T13:27:41Z

+subject_pattern: repo:DataDog/dd-trace-dotnet:ref:refs/heads/(master|hotfix/.+)
+
+claim_pattern:
+  event_name: workflow_dispatch


From Claude, with the dd-octo-sts plugin:

The reviewer's concern is understandable, but actually the policy is correct as-is. From the dd-octo-sts guide's claim format for workflow_call:
▎ Note: workflow_call does not exist in isolation but only with a triggering context (e.g. workflow_dispatch). The job_workflow_ref reflects the reusable workflow, not the caller.

The example claims for a workflow_call show:

{ "event_name": "workflow_dispatch", // ← the triggering event, NOT "workflow_call" "job_workflow_ref": ".../.github/workflows/workflow-call-demo.yml@refs/heads/main" }

So the OIDC token's event_name claim will be workflow_dispatch (the caller's trigger), not workflow_call. And job_workflow_ref will correctly point to _create_draft_release.yml (the reusable workflow). The policy as written should work.

NachoEchevarria · 2026-03-17T11:46:04Z

          echo "Push succeeded, cleaning up"
          rm Datadog.Trace.Annotations.1.0.0.nupkg

-      - name: Generate GitHub App Token


Do we need id-token: write here?

Yes, I believe so, but we already have it 🙂

NachoEchevarria

LGTM, thanks. Just a comment/question.

pr-commenter · 2026-03-17T12:21:24Z

Benchmarks

Benchmark execution time: 2026-03-17 12:21:21

Comparing candidate commit 1a6d29d in PR branch andrew/replace-custom-bot-with-octo with baseline commit 67477d1 in branch master.

Found 8 performance improvements and 5 performance regressions! Performance is the same for 165 metrics, 14 unstable metrics.

scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild netcoreapp3.1

🟩 execution_time [-111.776ms; -109.185ms] or [-56.078%; -54.779%]

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

🟥 execution_time [+84.993ms; +85.099ms] or [+69.889%; +69.976%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody netcoreapp3.1

🟥 execution_time [+10.391ms; +16.680ms] or [+5.192%; +8.335%]
🟩 throughput [+49757.298op/s; +72522.611op/s] or [+7.325%; +10.677%]

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody netcoreapp3.1

🟩 execution_time [-19.928ms; -14.308ms] or [-9.260%; -6.649%]

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs netcoreapp3.1

🟩 execution_time [-21.212ms; -20.463ms] or [-10.519%; -10.148%]

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net6.0

🟥 execution_time [+12.791ms; +14.426ms] or [+16.433%; +18.534%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net472

🟥 execution_time [+16.180ms; +20.389ms] or [+7.475%; +9.420%]
🟥 throughput [-95.959op/s; -76.641op/s] or [-8.653%; -6.911%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces netcoreapp3.1

🟩 execution_time [-39.855ms; -37.600ms] or [-19.122%; -18.041%]

scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice netcoreapp3.1

🟩 execution_time [-212.196µs; -202.830µs] or [-7.050%; -6.739%]
🟩 throughput [+24.037op/s; +25.170op/s] or [+7.235%; +7.576%]

scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net6.0

🟩 throughput [+25.079op/s; +26.583op/s] or [+5.157%; +5.467%]

bouwkast

👍

andrewlock added 2 commits March 17, 2026 10:58

Update to use dd-octo-sts instead of create-github-app-token

3424c59

Switch to dd-octo-sts for deploying to AAS

05ffe4f

andrewlock requested a review from a team as a code owner March 17, 2026 11:15

andrewlock added area:builds project files, build scripts, pipelines, versioning, releases, packages AI Generated Largely based on code generated by an AI or LLM. This label is the same across all dd-trace-* repos labels Mar 17, 2026

chatgpt-codex-connector Bot reviewed Mar 17, 2026

View reviewed changes

Comment thread .github/chainguard/self.github.create-draft-release.sts.yaml

Apply suggestion from @andrewlock

1a6d29d

andrewlock requested a review from Copilot March 17, 2026 11:39

Copilot started reviewing on behalf of andrewlock March 17, 2026 11:40 View session

Copilot AI reviewed Mar 17, 2026

View reviewed changes

NachoEchevarria reviewed Mar 17, 2026

View reviewed changes

NachoEchevarria approved these changes Mar 17, 2026

View reviewed changes

bouwkast approved these changes Mar 17, 2026

View reviewed changes

andrewlock merged commit 9e60d38 into master Mar 17, 2026
103 of 106 checks passed

andrewlock deleted the andrew/replace-custom-bot-with-octo branch March 17, 2026 15:45

github-actions Bot added this to the vNext-v3 milestone Mar 17, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Replace our custom GitHub App Token with `dd-octo-sts`#8318

Replace our custom GitHub App Token with `dd-octo-sts`#8318
andrewlock merged 3 commits into
masterfrom
andrew/replace-custom-bot-with-octo

andrewlock commented Mar 17, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

andrewlock Mar 17, 2026

Uh oh!

NachoEchevarria Mar 17, 2026

Uh oh!

andrewlock Mar 17, 2026

Uh oh!

NachoEchevarria left a comment

Uh oh!

pr-commenter Bot commented Mar 17, 2026

Uh oh!

bouwkast left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

andrewlock commented Mar 17, 2026

Summary of changes

Reason for change

Implementation details

Test coverage

Other details

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

andrewlock Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

NachoEchevarria Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

andrewlock Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

NachoEchevarria left a comment

Choose a reason for hiding this comment

Uh oh!

pr-commenter Bot commented Mar 17, 2026

Benchmarks

scenario:Benchmarks.Trace.ActivityBenchmark.StartStopWithChild netcoreapp3.1

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.AllCycleSimpleBody netcoreapp3.1

scenario:Benchmarks.Trace.Asm.AppSecBodyBenchmark.ObjectExtractorSimpleBody netcoreapp3.1

scenario:Benchmarks.Trace.Asm.AppSecEncoderBenchmark.EncodeLegacyArgs netcoreapp3.1

scenario:Benchmarks.Trace.AspNetCoreBenchmark.SendRequest net6.0

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net472

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces netcoreapp3.1

scenario:Benchmarks.Trace.CharSliceBenchmark.OptimizedCharSlice netcoreapp3.1

scenario:Benchmarks.Trace.CharSliceBenchmark.OriginalCharSlice net6.0

Uh oh!

bouwkast left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants