Migrate integration tests from static API key to dd-sts - #981
Conversation
Replace DD_TEST_CLIENT_API_KEY and DD_TEST_CLIENT_APP_KEY secrets with short-lived credentials from dd-sts-action, and switch DD_TEST_CLIENT_USER to a repo variable (non-secret).
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 20f9d69df5
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| DD_TEST_CLIENT_USER: "${{ secrets.DD_TEST_CLIENT_USER }}" | ||
| DD_TEST_CLIENT_API_KEY: ${{ steps.dd-sts.outputs.api_key }} | ||
| DD_TEST_CLIENT_APP_KEY: ${{ steps.dd-sts.outputs.app_key }} | ||
| DD_TEST_CLIENT_USER: ${{ vars.DD_TEST_CLIENT_USER }} |
There was a problem hiding this comment.
When DD_TEST_CLIENT_USER has not yet been configured as a repository variable—as the commit's unchecked setup step indicates—GitHub expands this expression to an empty string. Both integration commands use --vcr-record=all, and tests/integration/conftest.py passes that empty value through its is not None check to the comment API tests, causing every labeled integration run to fail. Provision the variable before merging or retain a temporary fallback to the existing secret.
Useful? React with 👍 / 👎.
1 participant
https://datadoghq.atlassian.net/browse/ACIX-1817
Summary
DD_TEST_CLIENT_API_KEYandDD_TEST_CLIENT_APP_KEYsecrets with short-lived credentials fetched viadd-sts-actionid-token: writepermission required for OIDC token federationDD_TEST_CLIENT_USERfrom a secret to a repo variable (vars.DD_TEST_CLIENT_USER)This depends on the dd-source policy
datadogpy-integration-testsbeing merged and deployed before this workflow is enabled.Test plan
DD_TEST_CLIENT_USERas a repo variable in GitHub settingsDD_TEST_CLIENT_API_KEYandDD_TEST_CLIENT_APP_KEYsecrets from repo settings once confirmed workingci/integrationslabel to a PR and verify credentials are fetched successfully🤖 Generated with Claude Code