ci: add least-privilege STS policy for benchmarking-platform PR comments#608
Merged
Conversation
![dd-octo-sts[bot]](https://avatars.githubusercontent.com/in/1157446?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9cf8cd8d88
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The benchmarking-platform reliability pipeline back-reports results as a PR comment on java-profiler, but dd-octo-sts reads trust policies from the default branch, so the BP project's OIDC subject had no matching policy and the token exchange failed with HTTP 403. Rather than widen async-profiler-build.ci (which grants contents: write) to the separate BP project, add a dedicated policy scoped to that project with only the permissions needed to upsert a comment: issues: write + pull_requests: read, no contents access. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
jbachorik
force-pushed
the
jb/sts-allow-bp-comments
branch
from
9cf8cd8 to
c1cb565
Compare
jbachorik
changed the title
Contributor
CI Test ResultsRun: #27849984672 | Commit:
Status Overview
Legend: ✅ passed | ❌ failed | ⚪ skipped | 🚫 cancelled Summary: Total: 32 | Passed: 32 | Failed: 0 Updated: 2026-06-19 22:10:29 UTC |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?:
Adds a dedicated, least-privilege dd-octo-sts trust policy
(
benchmarking-platform-reports.ci) that lets the benchmarking-platform GitLab CIproject mint a short-lived token to upsert a result comment on a java-profiler PR.
The new policy grants only
issues: write+pull_requests: read— no contents access.Motivation:
dd-octo-sts reads trust policies from the repository's default branch, not the PR
branch. The reliability benchmark pipeline runs in the benchmarking-platform GitLab
project, whose OIDC subject (
project_path:DataDog/apm-reliability/benchmarking-platform:...)had no matching policy, so the token exchange failed with
HTTP 403 permission deniedand the results comment was silently skipped.
The obvious shortcut — adding the BP project to the existing
async-profiler-build.cipolicy — was rejected because that policy grants
contents: write. Matching theseparate BP repository there would let any BP branch pipeline mint a token able to
modify java-profiler repository contents, far beyond posting a comment. Instead this
PR adds a separate policy scoped to the BP project with only the comment permissions.
Additional Notes:
Permissions are the minimum the comment script needs:
GET /pulls(pull_requests:read)to resolve the open PR, and
GET/POST/PATCHon issue comments (issues:write) toupsert the comment.
async-profiler-build.ciis left unchanged.How to test the change?:
Trigger the reliability benchmark pipeline from a java-profiler PR. Once this policy is
on
main, the benchmarking-platformpost-pr-commentjob exchanges its OIDC token viabenchmarking-platform-reports.ciand upserts the benchmark-results comment instead oflogging the 403.
For Datadog employees:
credentials of any kind, I've requested a security review (run the
dd:platform-security-reviewskill, or file a request via the PSEC review form).
bewairealso runs automatically on every PR.Unsure? Have a question? Request a review!