Rework workflow again

Author: sarahchen6

.gitlab-ci.yml

@@ -802,10 +802,8 @@ deploy_to_maven_central:
 
 deploy_artifacts_to_github:
   stage: publish
-  image: registry.ddbuild.io/github-cli:v27480869-eafb11d-2.43.0
-  tags: [ "docker-in-docker:amd64" ]
-  services:
-    - docker:dind
+  image: registry.ddbuild.io/images/dd-octo-sts-ci-base:2025.06-1
+  tags: [ "arch:amd64" ]
 
   id_tokens:
     DDOCTOSTS_ID_TOKEN:
@@ -824,18 +822,13 @@ deploy_artifacts_to_github:
 #      # The deploy_to_maven_central job is not run for release candidate versions
 #      optional: true
 
-  script:
-    # Get GitHub token using dd-octo-sts in a container
-    - docker run --rm 
-        -e DDOCTOSTS_ID_TOKEN 
-        -v $(pwd):/workspace 
-        registry.ddbuild.io/images/dd-octo-sts-ci-base:v68058725-73f34e7-2025.06-1 
-        sh -c "
-          dd-octo-sts version &&
-          dd-octo-sts debug --scope DataDog/dd-trace-java --policy self.gitlab.release &&
-          dd-octo-sts token --scope DataDog/dd-trace-java --policy self.gitlab.release > /workspace/github-token.txt
-        "
+  before_script:
+    # Get a token
+    - dd-octo-sts version
+    - dd-octo-sts debug --scope DataDog/dd-trace-java --policy self.gitlab.release
+    - dd-octo-sts token --scope DataDog/dd-trace-java --policy self.gitlab.release > github-token.txt
 
+  script:
     # Verify token was generated
     - echo "Token file exists:" $(test -f github-token.txt && echo "YES" || echo "NO")
     - echo "Token file size:" $(wc -c < github-token.txt) "bytes"
@@ -850,8 +843,9 @@ deploy_artifacts_to_github:
     # - gh release upload --clobber --repo DataDog/dd-trace-java $CI_COMMIT_TAG workspace/dd-trace-api/build/libs/dd-trace-api-${VERSION}.jar
     # - gh release upload --clobber --repo DataDog/dd-trace-java $CI_COMMIT_TAG workspace/dd-trace-ot/build/libs/dd-trace-ot-${VERSION}.jar
 
-    # Clean up token file
-    - rm -f github-token.txt
+  after_script:
+    # Revoke the token after usage
+    - dd-octo-sts revoke -t $(cat github-token.txt)
 
   retry:
     max: 2