From 0b6c95b9d0511baebcaf53862300f30be88af483 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Wed, 27 May 2026 11:33:47 +0200 Subject: [PATCH 1/2] Pin reusable workflow actions to full commit SHAs datadog-api-spec enforces a policy requiring all actions to be pinned to full commit SHAs; tag references like @v3/@v4 are rejected at job setup, causing all test jobs to fail. --- .github/workflows/reusable-examples.yml | 4 ++-- .github/workflows/reusable-integration-test.yml | 12 ++++++------ .github/workflows/reusable-java-test.yml | 6 +++--- .github/workflows/reusable-javadoc.yml | 4 ++-- .github/workflows/reusable-pre-commit.yml | 8 ++++---- .github/workflows/reusable-shading.yml | 4 ++-- 6 files changed, 19 insertions(+), 19 deletions(-) diff --git a/.github/workflows/reusable-examples.yml b/.github/workflows/reusable-examples.yml index 62515d409f0..25e53a8702c 100644 --- a/.github/workflows/reusable-examples.yml +++ b/.github/workflows/reusable-examples.yml @@ -23,12 +23,12 @@ jobs: examples: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: DataDog/datadog-api-client-java ref: ${{ inputs.target-branch || github.ref }} - name: Install Java - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: java-version: ${{ inputs.java-version }} distribution: "temurin" diff --git a/.github/workflows/reusable-integration-test.yml b/.github/workflows/reusable-integration-test.yml index 2a5aad1b492..c12bd6ba615 100644 --- a/.github/workflows/reusable-integration-test.yml +++ b/.github/workflows/reusable-integration-test.yml @@ -89,26 +89,26 @@ jobs: scope: DataDog/datadog-api-spec policy: datadog-api-client-java.reusable-integration-test.post-status - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: DataDog/datadog-api-client-java ref: ${{ inputs.target-branch || github.ref }} - name: Post pending status check if: github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call') - uses: DataDog/github-actions/post-status-check@v2 + uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: ${{ inputs.target-repo || 'datadog-api-spec' }} status: pending context: ${{ inputs.status-context || 'integration' }} - name: Install Java - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: java-version: '16' distribution: 'temurin' cache: 'maven' - name: Configure Datadog Test Optimization - uses: datadog/test-visibility-github-action@v2 + uses: datadog/test-visibility-github-action@4e7afb05b464fd349275e41e65a7f4de83e7f46b # v2.10.0 with: languages: java api_key: ${{ secrets.DD_API_KEY }} @@ -128,7 +128,7 @@ jobs: SLEEP_AFTER_REQUEST: "${{ vars.SLEEP_AFTER_REQUEST }}" - name: Post failure status check if: failure() && github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call') - uses: DataDog/github-actions/post-status-check@v2 + uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: ${{ inputs.target-repo || 'datadog-api-spec' }} @@ -136,7 +136,7 @@ jobs: context: ${{ inputs.status-context || 'integration' }} - name: Post success status check if: "!failure() && github.event_name == 'pull_request' && contains(github.event.pull_request.head.ref, 'datadog-api-spec/generated/') && (inputs.enable-status-reporting || github.event_name != 'workflow_call')" - uses: DataDog/github-actions/post-status-check@v2 + uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: ${{ inputs.target-repo || 'datadog-api-spec' }} diff --git a/.github/workflows/reusable-java-test.yml b/.github/workflows/reusable-java-test.yml index 29cf7c518d2..f43595d1219 100644 --- a/.github/workflows/reusable-java-test.yml +++ b/.github/workflows/reusable-java-test.yml @@ -36,18 +36,18 @@ jobs: runs-on: ${{ matrix.platform }} steps: - name: Checkout code - uses: actions/checkout@v3 + uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: DataDog/datadog-api-client-java ref: ${{ inputs.target-branch || github.ref }} - name: Install Java - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: java-version: ${{ matrix.java-version }} distribution: "temurin" cache: "maven" - name: Configure Datadog Test Optimization - uses: datadog/test-visibility-github-action@v2 + uses: datadog/test-visibility-github-action@4e7afb05b464fd349275e41e65a7f4de83e7f46b # v2.10.0 with: languages: java api_key: ${{ secrets.DD_API_KEY }} diff --git a/.github/workflows/reusable-javadoc.yml b/.github/workflows/reusable-javadoc.yml index b852648db19..dabc0804f47 100644 --- a/.github/workflows/reusable-javadoc.yml +++ b/.github/workflows/reusable-javadoc.yml @@ -18,12 +18,12 @@ jobs: javadoc: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: DataDog/datadog-api-client-java ref: ${{ inputs.target-branch || github.ref }} - name: Install Java - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: java-version: ${{ inputs.java-version }} distribution: "temurin" diff --git a/.github/workflows/reusable-pre-commit.yml b/.github/workflows/reusable-pre-commit.yml index e4543acdd37..9bb7f426e7a 100644 --- a/.github/workflows/reusable-pre-commit.yml +++ b/.github/workflows/reusable-pre-commit.yml @@ -32,25 +32,25 @@ jobs: with: scope: DataDog/datadog-api-client-java policy: self.github.pre-commit.pull-requests - - uses: actions/checkout@v3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: fetch-depth: 0 repository: DataDog/datadog-api-client-java ref: ${{ inputs.target-branch || github.event.pull_request.head.sha || github.ref }} token: ${{ inputs.enable-commit-changes && steps.get_token.outputs.token || github.token }} - - uses: actions/setup-python@v4 + - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0 with: python-version: '3.11' - name: Install pre-commit run: python -m pip install pre-commit - name: set PY run: echo "PY=$(python -c 'import platform;print(platform.python_version())')" >> $GITHUB_ENV - - uses: actions/cache@v3 + - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2 with: path: ~/.cache/pre-commit key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }} - name: Install Java - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: java-version: "16" distribution: "temurin" diff --git a/.github/workflows/reusable-shading.yml b/.github/workflows/reusable-shading.yml index 7ba31046b2f..b90e12658b9 100644 --- a/.github/workflows/reusable-shading.yml +++ b/.github/workflows/reusable-shading.yml @@ -18,12 +18,12 @@ jobs: shading: runs-on: ubuntu-latest steps: - - uses: actions/checkout@v3 + - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 with: repository: DataDog/datadog-api-client-java ref: ${{ inputs.target-branch || github.ref }} - name: Install Java - uses: actions/setup-java@v3 + uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3 with: java-version: ${{ inputs.java-version }} distribution: "temurin" From 7840e38a2825dfdde1742cde61b494ad66ed4049 Mon Sep 17 00:00:00 2001 From: David Tapiador Date: Wed, 27 May 2026 11:44:11 +0200 Subject: [PATCH 2/2] Pin post-status-check action in test.yml to full commit SHA Co-Authored-By: Claude Sonnet 4.6 --- .github/workflows/test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index c9b50e898f2..19eaa2efd7c 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -92,7 +92,7 @@ jobs: scope: DataDog/datadog-api-spec policy: datadog-api-client-java.test.post-status - name: Post status check - uses: DataDog/github-actions/post-status-check@v2 + uses: DataDog/github-actions/post-status-check@65b4875f33ad773d7ba4b005a2cb5f35020295f3 # v2.3.0 with: github-token: ${{ steps.get_token.outputs.token }} repo: datadog-api-spec