Merge branch 'nacho/dotnet10Test' of https://github.com/DataDog/dd-trace-dotnet into nacho/dotnet10Test

Author: NachoEchevarria

.github/chainguard/self.auto_bump_test_package_versions.create-pr.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: repo:DataDog/dd-trace-dotnet:.*
+
+claim_pattern:
+  event_name: (schedule|workflow_dispatch|pull_request_target)
+  ref: refs/heads/master
+  ref_protected: "true"
+  job_workflow_ref: DataDog/dd-trace-dotnet/\.github/workflows/auto_bump_test_package_versions\.yml@refs/heads/master
+
+permissions:
+  contents: write
+  pull_requests: write

.github/chainguard/self.auto_create_version_bump_pr.create-pr.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject_pattern: repo:DataDog/dd-trace-dotnet:ref:refs/tags/.*
+
+claim_pattern:
+  event_name: release
+  ref: refs/tags/.*
+  job_workflow_ref: DataDog/dd-trace-dotnet/.github/workflows/auto_create_version_bump_pr.yml@refs/tags/.*
+
+permissions:
+  contents: write
+  pull_requests: write
+

.github/chainguard/self.force_manual_version_bump.create-pr.sts.yaml

@@ -0,0 +1,13 @@
+issuer: https://token.actions.githubusercontent.com
+
+subject: repo:DataDog/dd-trace-dotnet:ref:refs/heads/master
+
+claim_pattern:
+  event_name: workflow_dispatch
+  ref: refs/heads/master
+  ref_protected: "true"
+  job_workflow_ref: DataDog/dd-trace-dotnet/.github/workflows/force_manual_version_bump.yml@refs/heads/master
+
+permissions:
+  contents: write
+  pull_requests: write 

.github/workflows/auto_bump_test_package_versions.yml

@@ -2,9 +2,9 @@ name: Auto bump test package versions
 
 on:
   schedule:
-    - cron: '0 0 * * 0' # Every Sunday at midnight
+    - cron: "0 0 * * 0" # Every Sunday at midnight
   pull_request_target:
-    branches: [master, main]
+    branches: [master]
   workflow_dispatch:
 
 jobs:
@@ -13,23 +13,29 @@ jobs:
     runs-on: windows-latest
     permissions:
       actions: read # read secrets
-      contents: write # Creates a branch
-      pull-requests: write # Creates a PR
+      id-token: write # Required for dd-octo-sts authentication
     env:
       GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
     steps:
       - name: Support longpaths
         run: git config --system core.longpaths true
 
+      - name: Get dd-octo-sts token
+        uses: DataDog/dd-octo-sts-action@08f2144903ced3254a3dafec2592563409ba2aa0 # v1.0.1
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-dotnet
+          policy: self.auto_bump_test_package_versions.create-pr
+
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.event.pull_request.base.sha }}
 
       - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
-          dotnet-version: '10.0.100-preview.6.25358.103'
+          dotnet-version: "10.0.100-preview.6.25358.103"
 
       - name: "Regenerating package versions"
         run: .\tracer\build.ps1 GeneratePackageVersions
@@ -38,7 +44,7 @@ jobs:
         id: pr
         uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
           branch: "bot/test-package-versions-bump"
           commit-message: "[Test Package Versions Bump]"
           delete-branch: true
@@ -47,7 +53,7 @@ jobs:
           milestone: "${{steps.rename.outputs.milestone}}"
           body: |
             Updates the package versions for integration tests.
-            
+
       - name: Send Slack notification about generating failure
         if: failure()
         uses: slackapi/slack-github-action@b0fa283ad8fea605de13dc3f449259339835fc52 # v2.1.0

.github/workflows/auto_create_version_bump_pr.yml

@@ -10,20 +10,27 @@ jobs:
     # If this is a 1.x release, do the version bump in the release/1.x branch
     # If this is a 2.x release, do the version bump in the release/2.x branch
     # If this is a 3.x.0 release, do the version bump on master
-    
+
     if: endsWith(github.event.release.tag_name, '.0') || endsWith(github.event.release.tag_name, '.0-prerelease')
     runs-on: windows-latest
     permissions:
       contents: write # Creates a branch
-      pull-requests: write # Creates a PR
       issues: write # Closes milestones
+      id-token: write # Required for dd-octo-sts authentication
     env:
       GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
     steps:
       - name: Support longpaths
         run: git config --system core.longpaths true
 
+      - name: Get dd-octo-sts token
+        uses: DataDog/dd-octo-sts-action@08f2144903ced3254a3dafec2592563409ba2aa0 # v1.0.1
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-dotnet
+          policy: self.auto_create_version_bump_pr.create-pr
+
       - name: "Select branch"
         id: select_branch
         run: |
@@ -47,7 +54,7 @@ jobs:
 
       - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
-          dotnet-version: '10.0.100-preview.6.25358.103'
+          dotnet-version: "10.0.100-preview.6.25358.103"
 
       - name: "Update Changelog"
         run: .\tracer\build.ps1 UpdateChangeLog
@@ -72,7 +79,7 @@ jobs:
         id: pr
         uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
           branch: "version-bump-${{steps.versions.outputs.full_version}}"
           commit-message: "[Version Bump] ${{steps.versions.outputs.full_version}}"
           delete-branch: true

.github/workflows/force_manual_version_bump.yml

@@ -7,17 +7,16 @@ on:
         description: 'Next Version Number (x.y.z). On master, other workflows expect only versions of the form x.y.0. Consider using the "create hotfix branch" workflow for patch version bumps.'
         required: true
       is_prerelease:
-        description: 'Is Prerelease version? (true/false)'
-        default: 'false'
+        description: "Is Prerelease version? (true/false)"
+        default: "false"
         required: true
 
 jobs:
   bump_version:
     runs-on: windows-latest
     permissions:
-      contents: write # Creates a branch
-      pull-requests: write # Creates a PR
       issues: write # Closes milestones
+      id-token: write # Required for dd-octo-sts authentication
     env:
       GITHUB_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
       NewVersion: "${{ github.event.inputs.version }}"
@@ -27,12 +26,19 @@ jobs:
       - name: Support longpaths
         run: git config --system core.longpaths true
 
+      - name: Get dd-octo-sts token
+        uses: DataDog/dd-octo-sts-action@08f2144903ced3254a3dafec2592563409ba2aa0 # v1.0.1
+        id: octo-sts
+        with:
+          scope: DataDog/dd-trace-dotnet
+          policy: self.force_manual_version_bump.create-pr
+
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
-          dotnet-version: '10.0.100-preview.6.25358.103'
+          dotnet-version: "10.0.100-preview.6.25358.103"
 
       - name: "Bump Version"
         run: .\tracer\build.ps1 UpdateVersion
@@ -49,7 +55,7 @@ jobs:
         id: pr
         uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+          token: ${{ steps.octo-sts.outputs.token }}
           branch: "version-bump-${{steps.versions.outputs.full_version}}"
           commit-message: "[Version Bump] ${{steps.versions.outputs.full_version}}"
           delete-branch: true