Create datadog-synthetics.yml - #6334
Conversation
503badrr
commented
Aug 26, 2026
503badrr
commented
|
👋 Thanks for the contribution! This pull request isn't linked to a tracked issue, so it's being closed automatically. Please open an issue first, wait for a maintainer to add the |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3b6d19a1e9
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| #Modify هذه العلامة تناسب استراتيجية الوسم الخاصة بك: اسم | ||
|
|
||
| الأسرار.مفتاح التطبيق DD: | ||
| تعديل هذه العلعلام٩ ت٪ناسب استراتيجي٩ الوسم الخاصة بك |
There was a problem hiding this comment.
When GitHub scans this workflow, the uncommented prose on this line is parsed as a mapping key but has no trailing colon; parsing fails at the following line with could not find expected ':'. Consequently, GitHub rejects the entire workflow and none of the Datadog synthetic-test jobs can run.
Useful? React with 👍 / 👎.
| وظائف: | ||
| بناء: | ||
| يعمل على: أوبونتو-الأحدث |
There was a problem hiding this comment.
Even after repairing the YAML syntax, GitHub will not recognize this translated top-level key as jobs; similarly, the trigger and runner fields are translated instead of using on and runs-on. Workflow keywords are fixed schema identifiers rather than localizable labels, so schema validation still rejects the file instead of scheduling the synthetic-test job.
Useful? React with 👍 / 👎.
| مع: | ||
| api_key: ${{الأسرار.مفتاح واجهة برمجة التطبيقات DD}} | ||
| مفتاح التطبيق: ${{الأسرار.مفتاح التطبيق DD}} | ||
| استعلام البحث الاختباري: 'tag:e2e-tests' #Modify هذه العلامة تناسب استراتيجية الوسم الخاصة بك |
There was a problem hiding this comment.
Once the surrounding workflow keys are corrected, this action configuration still cannot authenticate: مع is not the GitHub Actions with key, the app-key and search-query input names have been translated, and ${{الأسرار...}} is not a valid reference to the secrets context or the documented DD_API_KEY/DD_APP_KEY names. The Datadog action therefore receives none of its required credentials or intended test query.
Useful? React with 👍 / 👎.
| طلب سحب طلب سحب طلب سحب طلب سحب: | ||
| الفروع: [ "تطوير" ] |
There was a problem hiding this comment.
When an external contributor opens a fork-based pull request against develop, GitHub does not expose repository Actions secrets to this pull_request run, so the Datadog action receives empty API and application keys and leaves the PR with a failed check. This repository already guards the equivalent case in .github/workflows/dispatch-cli-e2e-ci.yml; this job likewise needs a same-repository condition or a trigger that only runs on trusted refs.
Useful? React with 👍 / 👎.
| يعمل على: أوبونتو-الأحدث | ||
|
|
||
| خطوات: | ||
| - الاستخدامات: الإجراءات/checkout@v4 |
There was a problem hiding this comment.
After the translated step key is restored to uses, this workflow will execute the mutable v4 tag rather than an immutable action revision. Every existing actions/checkout reference in the parent repository is pinned to a full SHA, so this new exception reintroduces avoidable supply-chain drift into a job that also handles Datadog credentials; pin the action to a reviewed commit as done elsewhere.
Useful? React with 👍 / 👎.
![depthfirst-app[bot]](https://avatars.githubusercontent.com/in/1021002?s=60&v=4){kind=small}
| يعمل على: أوبونتو-الأحدث | ||
|
|
||
| خطوات: | ||
| - الاستخدامات: الإجراءات/checkout@v4 |
There was a problem hiding this comment.
⚪ Severity: LOW
The workflow resolves actions/checkout@v4 from a mutable tag. If that upstream tag is retargeted, attacker-controlled action code executes on this runner with access to the workflow’s implicit GITHUB_TOKEN, potentially enabling unauthorized repository or pull-request modifications.
Helpful? Add 👍 / 👎
💡 Fix Suggestion
Suggestion: Pin the actions/checkout action to an immutable commit SHA instead of the mutable @v4 tag. The rest of the repository consistently uses actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 (with a # v4 comment for readability). Replace the mutable tag reference with this pinned SHA to prevent supply chain attacks from upstream tag retargeting.
⚠️ Experimental Feature: This code suggestion is automatically generated. Please review carefully.
| - الاستخدامات: الإجراءات/checkout@v4 | |
| - الاستخدامات: الإجراءات/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4 |
| #كم بتشغيل الللاختبارات اللللاصطناعي٩ ضمن سير عمل GitHub الخاص بك. | ||
| # للحصول على خيارات تكوين إضافية، قم بزيارة الإجراء داخل السوق: https://github.com/marketplace/actions/datadog-synthetics-ci | ||
| - اسم: تشجيل استبارات داتادوج الاصطناعية | ||
| الاستخدامات: DataDog/synthetics-ci-github-action@87b505388a22005bb8013481e3f73a367b9a53eb # الإصدار 1.4.0 |
There was a problem hiding this comment.
⚪ Severity: LOW
This workflow omits a permissions block while invoking a third-party action. The action can access github.token even when it is not passed explicitly, so the token inherits repository defaults rather than least privilege; a compromised action or dependency could use write scopes to alter repository contents or workflow state.
Helpful? Add 👍 / 👎
💡 Fix Suggestion
Suggestion: Add an explicit least-privilege GITHUB_TOKEN permissions block to the job (or workflow) so the third‑party action does not inherit broader defaults. In this file, place a permissions section under the build job, between runs-on and steps, e.g., set contents: read. If the action needs no repo access, use permissions: {}. Only add additional scopes if strictly necessary for this job.
