👷 sign chrome-bump commits with commit-headless

[thomas-lebeau]

Motivation

The chrome-bump CI job pushed its version-bump commit directly with git push, producing an unverified commit on the created branch. This currently works because we have admin rights to bypass the signed-commit policy on the repo, but we're about to lose that bypass — so CI-generated commits need to be properly signed (Verified) going forward.

Changes

• Add a commit OctoSTS scope (main branch only) and a chainguard policy (self.gitlab.commit.sts.yaml) authorizing it for the GitLab CI job
• Install commit-headless in the CI image (Dockerfile) to create signed (Verified) commits through the GitHub API
• Add pushSignedCommit() in gitUtils.ts, which pushes HEAD as a new remote branch via commit-headless push and points the local branch at it, so a later gh pr create doesn't attempt its own unsigned push
• Use pushSignedCommit() in bump-chrome-version.ts instead of git push
• Bump CURRENT_CI_IMAGE to 117 for the updated Dockerfile

Test instructions

It's hard to test before merging, but when it's merged we can:

• Manually run the bump-chrome-version-scheduled GitLab CI job with CHROME_PACKAGE_VERSION overridden to an old version (e.g. a version with a lower major than what's currently released), so the job detects a newer Chrome version and creates a bump PR
• Verify the job pushes a Verified commit on the new bump-chrome-version-to-<major> branch
• Verify the resulting PR is opened correctly against main
• Close the test PR/branch afterwards (no need to merge it)

Checklist

• Tested locally
• Tested on staging
• Added unit tests for this change.
• Added e2e/integration tests for this change.
• Updated documentation and/or relevant AGENTS.md file

[datadog-prod-us1-4]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 77.20% (+0.00%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: e748071 | Docs | Datadog PR Page | Give us feedback!}

[cit-pr-commenter-54b7da]

Bundles Sizes Evolution

📦 Bundle Name	Base Size	Local Size	𝚫	𝚫%	Status
Rum	172.69 KiB	172.69 KiB	0 B	0.00%	✅
Rum Profiler	8.22 KiB	8.22 KiB	0 B	0.00%	✅
Rum Recorder	21.14 KiB	21.14 KiB	0 B	0.00%	✅
Logs	54.58 KiB	54.58 KiB	0 B	0.00%	✅
Rum Slim	130.52 KiB	130.52 KiB	0 B	0.00%	✅
Worker	22.96 KiB	22.96 KiB	0 B	0.00%	✅

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f0850a28d9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".