Skip to content

Fix dd-octo-sts trust policy for create-draft-release workflow#8356

Merged
andrewlock merged 2 commits into
masterfrom
andrew/fix-release-trust-policy
Mar 24, 2026
Merged

Fix dd-octo-sts trust policy for create-draft-release workflow#8356
andrewlock merged 2 commits into
masterfrom
andrew/fix-release-trust-policy

Conversation

@andrewlock

@andrewlock andrewlock commented Mar 23, 2026 •
edited by lucaspimentel
Loading

Copy link
Copy Markdown
Member

Summary of changes

Fix the dd-octo-sts trust policy that blocked the release

Reason for change

The create_normal_draft_release workflow was failing at the "Get GitHub Token via dd-octo-sts" step with:

subject_pattern "repo:DataDog/dd-trace-dotnet:environment:publish-debug-symbols-env"
did not match "repo:DataDog/dd-trace-dotnet:ref:refs/heads/(master|hotfix/.+)"

See failed run: https://github.com/DataDog/dd-trace-dotnet/actions/runs/23446312090/job/68210958105

Implementation details

The root cause is that the _create_draft_release.yml reusable workflow specifies environment: publish-debug-symbols-env on the job, which is required to access environment-scoped secrets for publishing debug symbols. When a GitHub Actions job uses an environment, the OIDC token's sub claim uses the format:

  • repo:{owner}/{repo}:environment:{env}
  • instead of repo:{owner}/{repo}:ref:{ref}.

The trust policy's subject_pattern was matching against the ref-based format, so it never matched.

This fix:

  • Changes subject_pattern to an exact subject match on the environment-based subject (more secure than a pattern)
  • Adds environment: publish-debug-symbols-env to claim_pattern for defense in depth
  • Retains ref and job_workflow_ref claim patterns to continue enforcing the branch restriction (master|hotfix/*) via claims

Additionally, make sure the AAS trigger job if the curl fails (by adding -f)

Test coverage

I wish... we'll see how it goes next time

Other details

Need to make a fix on the AAS side too... incoming

andrewlock and others added 2 commits March 23, 2026 18:14
@andrewlock @claude
Fix dd-octo-sts trust policy for create-draft-release workflow
38c0ec4 
The `create_normal_draft_release` workflow was failing at the
"Get GitHub Token via dd-octo-sts" step with:

  subject_pattern "repo:DataDog/dd-trace-dotnet:environment:publish-debug-symbols-env"
  did not match "repo:DataDog/dd-trace-dotnet:ref:refs/heads/(master|hotfix/.+)"

The root cause is that the `_create_draft_release.yml` reusable workflow
specifies `environment: publish-debug-symbols-env` on the job (line 42),
which is required to access environment-scoped secrets for publishing
debug symbols. When a GitHub Actions job uses an environment, the OIDC
token's `sub` claim uses the format
`repo:{owner}/{repo}:environment:{env}` instead of
`repo:{owner}/{repo}:ref:{ref}`. The trust policy's `subject_pattern`
was matching against the ref-based format, so it never matched.

This fix:
- Changes `subject_pattern` to an exact `subject` match on the
  environment-based subject (more secure than a pattern)
- Adds `environment: publish-debug-symbols-env` to `claim_pattern`
  for defense in depth
- Retains `ref` and `job_workflow_ref` claim patterns to continue
  enforcing the branch restriction (master|hotfix/*) via claims

See failed run: https://github.com/DataDog/dd-trace-dotnet/actions/runs/23446312090/job/68210958105

Co-Authored-By: Claude Opus 4.6 (1M context) <[email protected]>
@andrewlock
Ensure stage fails when necessary
38b4c6c
@andrewlock andrewlock added the area:builds project files, build scripts, pipelines, versioning, releases, packages label Mar 23, 2026
@andrewlock
andrewlock requested a review from a team as a code owner March 23, 2026 18:28
@andrewlock andrewlock added the AI Generated Largely based on code generated by an AI or LLM. This label is the same across all dd-trace-* repos label Mar 23, 2026
@andrewlock andrewlock mentioned this pull request Mar 23, 2026
Merged
xopham
xopham approved these changes Mar 23, 2026
View reviewed changes

@xopham xopham left a comment •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ah, very curious. I see that the environment is set on the workflow call. Totally missed that before, but the fix here seems good.

I cannot comment on the -f why that is desired. But the rest looks good to me!

Took the extra moment to test the changes on this branch:

❯ DDOCTOSTS_ID_TOKEN='{"actor":"zacharycmontoya","actor_id":"13769665","aud":"dd-octo-sts","base_ref":"","check_run_id":"68210958105","enterprise":"datadog-inc","enterprise_id":"42","environment":"publish-debug-symbols-env","environment_node_id":"EN_kwDOBhLL288AAAACVOYJxQ","event_name":"workflow_dispatch","exp":1974281238,"head_ref":"","iat":1774280938,"iss":"https://token.actions.githubusercontent.com","job_workflow_ref":"DataDog/dd-trace-dotnet/.github/workflows/_create_draft_release.yml@refs/heads/master","job_workflow_sha":"6f4edac7a7e43fac17e0450d4d25d96e0dbfde05","jti":"c58aadaf-9d8b-4320-9965-12c17629d100","nbf":1774280638,"ref":"refs/heads/master","ref_protected":"true","ref_type":"branch","repository":"DataDog/dd-trace-dotnet","repository_id":"101895131","repository_owner":"DataDog","repository_owner_id":"365230","repository_visibility":"public","run_attempt":"1","run_id":"23446312090","run_number":"7","runner_environment":"github-hosted","sha":"6f4edac7a7e43fac17e0450d4d25d96e0dbfde05","sub":"repo:DataDog/dd-trace-dotnet:environment:publish-debug-symbols-env","workflow":"Create normal draft release","workflow_ref":"DataDog/dd-trace-dotnet/.github/workflows/create_normal_draft_release.yml@refs/heads/master","workflow_sha":"6f4edac7a7e43fac17e0450d4d25d96e0dbfde05"}' \
dd-octo-sts check -s DataDog/dd-trace-dotnet -p self.github.create-draft-release
🔍 Checking repository and policy location...
Assuming repository path "/Users/christoph.hamsen/go/src/github.com/DataDog/dd-trace-dotnet"
  Tip: Use --repo/-r to override.
✅ Policy is in a valid location.
   Location: .github/chainguard/self.github.create-draft-release.sts.yaml

🔍 Checking policy file...
✅ Policy is valid
   Permissions:
   - actions: read
   - contents: write
   - issues: write
   - statuses: read

🔍 Checking token...
⚠️  Fabricating a token out of claims.
   This token will not work in production, but is suitable for testing.
✅ Supplied token is valid for policy
   Matching claims:
   - job_workflow_ref: DataDog/dd-trace-dotnet/.github/workflows/_create_draft_release.yml@refs/heads/master
   - ref: refs/heads/master
   - repository: DataDog/dd-trace-dotnet
   - environment: publish-debug-symbols-env
   - event_name: workflow_dispatch

looks good! :)

@pr-commenter

pr-commenter Bot commented Mar 23, 2026

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2026-03-23 19:11:31

Comparing candidate commit 38b4c6c in PR branch andrew/fix-release-trust-policy with baseline commit 6f4edac in branch master.

Found 9 performance improvements and 5 performance regressions! Performance is the same for 257 metrics, 17 unstable metrics.

Explanation

This is an A/B test comparing a candidate commit's performance against that of a baseline commit. Performance changes are noted in the tables below as:

  • 🟩 = significantly better candidate vs. baseline
  • 🟥 = significantly worse candidate vs. baseline

We compute a confidence interval (CI) over the relative difference of means between metrics from the candidate and baseline commits, considering the baseline as the reference.

If the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD), the change is considered significant.

Feel free to reach out to #apm-benchmarking-platform on Slack if you have any questions.

More details about the CI and significant changes

You can imagine this CI as a range of values that is likely to contain the true difference of means between the candidate and baseline commits.

CIs of the difference of means are often centered around 0%, because often changes are not that big:

---------------------------------(------|---^--------)-------------------------------->
                              -0.6%    0%  0.3%     +1.2%
                                 |          |        |
         lower bound of the CI --'          |        |
sample mean (center of the CI) -------------'        |
         upper bound of the CI ----------------------'

As described above, a change is considered significant if the CI is entirely outside the configured SIGNIFICANT_IMPACT_THRESHOLD (or the deprecated UNCONFIDENCE_THRESHOLD).

For instance, for an execution time metric, this confidence interval indicates a significantly worse performance:

----------------------------------------|---------|---(---------^---------)---------->
                                       0%        1%  1.3%      2.2%      3.1%
                                                  |   |         |         |
       significant impact threshold --------------'   |         |         |
                      lower bound of CI --------------'         |         |
       sample mean (center of the CI) --------------------------'         |
                      upper bound of CI ----------------------------------'

scenario:Benchmarks.Trace.AgentWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

  • 🟥 execution_time [+81.130ms; +81.213ms] or [+66.631%; +66.699%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net472

  • 🟥 execution_time [+23.241ms; +28.880ms] or [+12.001%; +14.913%]
  • 🟩 throughput [+86.545op/s; +114.877op/s] or [+8.725%; +11.581%]

scenario:Benchmarks.Trace.CIVisibilityProtocolWriterBenchmark.WriteAndFlushEnrichedTraces net6.0

  • 🟩 execution_time [-23.545ms; -19.624ms] or [-12.382%; -10.320%]
  • 🟩 throughput [+72.153op/s; +108.837op/s] or [+5.044%; +7.608%]

scenario:Benchmarks.Trace.ILoggerBenchmark.EnrichedLog net6.0

  • 🟩 execution_time [-22.808ms; -17.221ms] or [-10.478%; -7.912%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark net6.0

  • 🟥 allocated_mem [+16.539KB; +16.578KB] or [+6.406%; +6.421%]

scenario:Benchmarks.Trace.Iast.StringAspectsBenchmark.StringConcatAspectBenchmark netcoreapp3.1

  • 🟩 allocated_mem [-17.676KB; -17.648KB] or [-6.371%; -6.360%]

scenario:Benchmarks.Trace.Log4netBenchmark.EnrichedLog netcoreapp3.1

  • 🟩 execution_time [-42.712ms; -36.469ms] or [-21.217%; -18.115%]

scenario:Benchmarks.Trace.RedisBenchmark.SendReceive net6.0

  • 🟥 execution_time [+10.639ms; +15.959ms] or [+5.384%; +8.077%]

scenario:Benchmarks.Trace.SingleSpanAspNetCoreBenchmark.SingleSpanAspNetCore net6.0

  • 🟩 execution_time [-21.314ms; -15.476ms] or [-20.381%; -14.798%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishScope netcoreapp3.1

  • 🟩 execution_time [-18.003ms; -11.932ms] or [-8.469%; -5.613%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishSpan net6.0

  • 🟩 execution_time [-16.974ms; -12.486ms] or [-7.976%; -5.867%]

scenario:Benchmarks.Trace.SpanBenchmark.StartFinishTwoScopes net6.0

  • 🟥 throughput [-30291.244op/s; -29524.376op/s] or [-5.353%; -5.218%]

@andrewlock
andrewlock merged commit 4e38cdd into master Mar 24, 2026
102 of 105 checks passed
@andrewlock
andrewlock deleted the andrew/fix-release-trust-policy branch March 24, 2026 08:55
@github-actions github-actions Bot added this to the vNext-v3 milestone Mar 24, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bouwkast bouwkast bouwkast approved these changes
@zacharycmontoya zacharycmontoya zacharycmontoya approved these changes
@xopham xopham xopham approved these changes

Assignees

No one assigned

Labels

AI Generated Largely based on code generated by an AI or LLM. This label is the same across all dd-trace-* repos area:builds project files, build scripts, pipelines, versioning, releases, packages

Projects

None yet

Milestone

3.41.0

Development

Successfully merging this pull request may close these issues.

4 participants

@andrewlock @bouwkast @zacharycmontoya @xopham