From d043692913f7b869131fe4c19804b6c220b5d0f9 Mon Sep 17 00:00:00 2001
From: Kemal Akkoyun <kemal.akkoyun@datadoghq.com>
Date: Thu, 26 Mar 2026 11:50:22 +0100
Subject: [PATCH 1/3] ci: harden GitHub Actions against supply chain attacks

Add `persist-credentials: false` to all 56 actions/checkout steps across
22 workflow files and the test-apps.cue template (regenerated test-apps.yml).
This prevents GITHUB_TOKEN from being stored in .git/config after checkout,
eliminating the primary vector used in supply chain attacks like the
tj-actions/changed-files incident.

sync-cue-actions.yml still performs a git push; it now injects credentials
via `git remote set-url` scoped only to that step rather than persisting
them for all subsequent steps.

Also add explicit `permissions:` blocks to 6 workflows that were inheriting
repo defaults, and fix two stale/missing version comments on checkout steps.
---
 .github/workflows/api-check.yml               |  5 ++
 .github/workflows/appsec.yml                  |  4 +
 .github/workflows/code_freeze_end.yml         |  2 +
 .github/workflows/code_freeze_start.yml       |  2 +
 .github/workflows/codeql-analysis.yml         |  1 +
 .github/workflows/datadog-static-analysis.yml |  2 +
 .github/workflows/docker-build-and-push.yml   |  5 ++
 .github/workflows/dynamic-checks.yml          |  3 +-
 .github/workflows/generate.yml                |  1 +
 .github/workflows/gotip-testing.yml           |  4 +
 .github/workflows/govulncheck.yml             |  1 +
 .../workflows/lambda-integration-tests.yml    |  2 +
 .github/workflows/main-branch-tests.yml       |  2 +
 .github/workflows/multios-unit-tests.yml      |  1 +
 .github/workflows/orchestrion.yml             |  7 ++
 .github/workflows/outdated-integrations.yml   |  4 +-
 .github/workflows/parametric-tests.yml        |  2 +
 .../pull-request-title-validation.yml         |  2 +
 .github/workflows/pull-request.yml            |  4 +
 .github/workflows/smoke-tests.yml             |  5 ++
 .github/workflows/static-checks.yml           |  7 ++
 .github/workflows/sync-cue-actions.yml        |  5 +-
 .github/workflows/system-tests.yml            |  4 +
 .github/workflows/test-apps-schedule.yml      |  3 +
 .github/workflows/test-apps.cue               |  5 +-
 .github/workflows/test-apps.yml               | 78 +++++++++++--------
 .github/workflows/unit-integration-tests.yml  |  3 +
 .../update-supported-versions-doc.yml         |  2 +
 28 files changed, 128 insertions(+), 38 deletions(-)

diff --git a/.github/workflows/api-check.yml b/.github/workflows/api-check.yml
index 82aa5b5852b..0ad58582dae 100644
--- a/.github/workflows/api-check.yml
+++ b/.github/workflows/api-check.yml
@@ -7,11 +7,16 @@ on:
       - 'scripts/apiextractor/**'
       - '.github/workflows/api-check.yml'
 
+permissions:
+  contents: read
+
 jobs:
   check-api-stability:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
diff --git a/.github/workflows/appsec.yml b/.github/workflows/appsec.yml
index 3c657255dda..e9fdf00fdbc 100644
--- a/.github/workflows/appsec.yml
+++ b/.github/workflows/appsec.yml
@@ -74,6 +74,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Compute cache configuration
@@ -114,6 +115,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Restore Go modules cache
@@ -219,6 +221,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Restore Go modules cache
@@ -305,6 +308,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
 
       - name: Restore Go modules cache
diff --git a/.github/workflows/code_freeze_end.yml b/.github/workflows/code_freeze_end.yml
index 7e9a3a229b5..ff841ec134e 100644
--- a/.github/workflows/code_freeze_end.yml
+++ b/.github/workflows/code_freeze_end.yml
@@ -35,6 +35,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Check for remaining freeze milestones
         id: check_remaining
diff --git a/.github/workflows/code_freeze_start.yml b/.github/workflows/code_freeze_start.yml
index 7571d023a63..ac2b23158fe 100644
--- a/.github/workflows/code_freeze_start.yml
+++ b/.github/workflows/code_freeze_start.yml
@@ -43,6 +43,8 @@ jobs:
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Freeze PRs
         uses: ./.github/actions/pr-status-updater
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 5d1b9b28944..815c3240e24 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -31,6 +31,7 @@ jobs:
     - name: Checkout repository
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
+        persist-credentials: false
         ref: ${{ inputs.ref || github.ref }}
 
     # Initializes the CodeQL tools for scanning.
diff --git a/.github/workflows/datadog-static-analysis.yml b/.github/workflows/datadog-static-analysis.yml
index 93f13cd0171..d81aa4dafd4 100644
--- a/.github/workflows/datadog-static-analysis.yml
+++ b/.github/workflows/datadog-static-analysis.yml
@@ -13,6 +13,8 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
     - name: Check code meets quality and security standards
       id: datadog-static-analysis
       uses: DataDog/datadog-static-analyzer-github-action@8340f18875fcefca86844b5f947ce2431387e552 # v3.0.0
diff --git a/.github/workflows/docker-build-and-push.yml b/.github/workflows/docker-build-and-push.yml
index f8bb6cd8870..733468e74eb 100644
--- a/.github/workflows/docker-build-and-push.yml
+++ b/.github/workflows/docker-build-and-push.yml
@@ -39,6 +39,10 @@ on:
         type: string
         default: ''
 
+permissions:
+  contents: read
+  packages: write
+
 jobs:
   build-images:
     runs-on: ${{ matrix.platform == 'linux/amd64' && 'ubuntu-latest' || 'ubuntu-24.04-arm' }}
@@ -54,6 +58,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.commit_sha }}
 
       - name: Set up Docker Buildx
diff --git a/.github/workflows/dynamic-checks.yml b/.github/workflows/dynamic-checks.yml
index a46a0f387b1..e648543cb79 100644
--- a/.github/workflows/dynamic-checks.yml
+++ b/.github/workflows/dynamic-checks.yml
@@ -60,8 +60,9 @@ jobs:
       TEST_RESULT_PATH: /tmp/test-results
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ github.ref }}
 
       - name: Setup Go and development tools
diff --git a/.github/workflows/generate.yml b/.github/workflows/generate.yml
index 07758f96650..661ba54a970 100644
--- a/.github/workflows/generate.yml
+++ b/.github/workflows/generate.yml
@@ -34,6 +34,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
diff --git a/.github/workflows/gotip-testing.yml b/.github/workflows/gotip-testing.yml
index 42091289d01..7ec7bc68ae8 100644
--- a/.github/workflows/gotip-testing.yml
+++ b/.github/workflows/gotip-testing.yml
@@ -8,6 +8,9 @@ on:
 env:
   TEST_RESULTS: /tmp/tip-results # path to where test results will be saved
 
+permissions:
+  contents: read
+
 jobs:
   test-tip:
     runs-on: ubuntu-latest
@@ -25,6 +28,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ github.ref }}
           repository: DataDog/dd-trace-go
 
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index 0ccddc955ae..8af87e28fdb 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -29,6 +29,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
diff --git a/.github/workflows/lambda-integration-tests.yml b/.github/workflows/lambda-integration-tests.yml
index dba0bcc6a80..8ba975b4570 100644
--- a/.github/workflows/lambda-integration-tests.yml
+++ b/.github/workflows/lambda-integration-tests.yml
@@ -16,6 +16,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Configure AWS Credentials via OIDC (Build-Stable)
         uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
diff --git a/.github/workflows/main-branch-tests.yml b/.github/workflows/main-branch-tests.yml
index 4edeb466365..a0e3bd26bf9 100644
--- a/.github/workflows/main-branch-tests.yml
+++ b/.github/workflows/main-branch-tests.yml
@@ -34,6 +34,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Cache
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
diff --git a/.github/workflows/multios-unit-tests.yml b/.github/workflows/multios-unit-tests.yml
index 778b3c3efc4..d4784eca2c2 100644
--- a/.github/workflows/multios-unit-tests.yml
+++ b/.github/workflows/multios-unit-tests.yml
@@ -53,6 +53,7 @@ jobs:
         if: always()
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ github.sha }}
           clean: false
       - name: Setup Go and development tools
diff --git a/.github/workflows/orchestrion.yml b/.github/workflows/orchestrion.yml
index 032250766ea..a8183552f55 100644
--- a/.github/workflows/orchestrion.yml
+++ b/.github/workflows/orchestrion.yml
@@ -45,6 +45,8 @@ jobs:
     steps:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
         with:
@@ -67,6 +69,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: ${{ inputs.orchestrion-version != '' && 'DataDog/dd-trace-go' || github.repository }}
           ref: ${{ inputs.orchestrion-version != '' && 'main' || github.sha }}
       - name: Setup Go
@@ -90,6 +93,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: ${{ inputs.orchestrion-version != '' && 'DataDog/dd-trace-go' || github.repository }}
           ref: ${{ inputs.orchestrion-version != '' && 'main' || github.sha }}
       - name: Define Services JSON
@@ -132,6 +136,7 @@ jobs:
       - name: Checkout Code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           path: ${{ github.workspace }}/dd-trace-go
           repository: ${{ inputs.orchestrion-version != '' && 'DataDog/dd-trace-go' || github.repository }}
           ref: ${{ inputs.orchestrion-version != '' && 'main' || github.sha }}
@@ -141,6 +146,7 @@ jobs:
         id: checkout-orchestrion
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           path: ${{ github.workspace }}/orchestrion
           repository: DataDog/orchestrion
           ref: ${{ inputs.orchestrion-version }}
@@ -302,6 +308,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: always()
         with:
+          persist-credentials: false
           ref: ${{ inputs.orchestrion-version != '' && 'main' || github.sha }}
           clean: false
       - name: Upload the results to Datadog CI App
diff --git a/.github/workflows/outdated-integrations.yml b/.github/workflows/outdated-integrations.yml
index d7c91212480..e3b8196581f 100644
--- a/.github/workflows/outdated-integrations.yml
+++ b/.github/workflows/outdated-integrations.yml
@@ -27,7 +27,9 @@ jobs:
           policy: self.outdated-integrations
           scope: DataDog/dd-trace-go
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      
+        with:
+          persist-credentials: false
+
       - run: go clean -modcache
       
       - name: Add dependencies
diff --git a/.github/workflows/parametric-tests.yml b/.github/workflows/parametric-tests.yml
index cc467f0dfd8..5c76b783fff 100644
--- a/.github/workflows/parametric-tests.yml
+++ b/.github/workflows/parametric-tests.yml
@@ -42,12 +42,14 @@ jobs:
       - name: Checkout system tests
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: 'DataDog/system-tests'
           ref: ${{ inputs.ref }}
 
       - name: Checkout dd-trace-go
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.branch_ref || github.ref }}
           path: 'binaries/dd-trace-go'
 
diff --git a/.github/workflows/pull-request-title-validation.yml b/.github/workflows/pull-request-title-validation.yml
index f78166d16b0..b182fa53d15 100644
--- a/.github/workflows/pull-request-title-validation.yml
+++ b/.github/workflows/pull-request-title-validation.yml
@@ -9,6 +9,8 @@ on:
       - reopened
       - synchronize
 
+permissions: {}
+
 jobs:
   check-title:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index f165968077b..2186d7a7bef 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -7,6 +7,9 @@ concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   warm-repo-cache:
     runs-on: ubuntu-latest
@@ -14,6 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Cache
         uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
diff --git a/.github/workflows/smoke-tests.yml b/.github/workflows/smoke-tests.yml
index e4585d3bbbd..ba53d181b90 100644
--- a/.github/workflows/smoke-tests.yml
+++ b/.github/workflows/smoke-tests.yml
@@ -42,6 +42,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
           repository: DataDog/dd-trace-go
 
@@ -92,6 +93,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
           # Manually specify the repository, which is necessary in the workflow_call situation, as the default is
           # otherwise the repository where the caller workflow started from. In this case, we need to check out the
@@ -132,6 +134,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
           repository: DataDog/dd-trace-go
       - name: Setup Go and development tools
@@ -178,6 +181,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
@@ -269,6 +273,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
           # Manually specify the repository, which is necessary in the workflow_call situation, as the default is
           # otherwise the repository where the caller workflow started from. In this case, we need to check out the
diff --git a/.github/workflows/static-checks.yml b/.github/workflows/static-checks.yml
index 3df4fc630e5..831b81b80ba 100644
--- a/.github/workflows/static-checks.yml
+++ b/.github/workflows/static-checks.yml
@@ -44,6 +44,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
@@ -65,6 +66,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
@@ -83,6 +85,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
@@ -103,6 +106,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
@@ -123,6 +127,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
@@ -144,6 +149,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
 
       - name: golangci-lint
@@ -183,6 +189,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Setup Go and development tools
         uses: ./.github/actions/setup-go
diff --git a/.github/workflows/sync-cue-actions.yml b/.github/workflows/sync-cue-actions.yml
index 3362af63a4f..34d944cae47 100644
--- a/.github/workflows/sync-cue-actions.yml
+++ b/.github/workflows/sync-cue-actions.yml
@@ -15,7 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     if: github.actor == 'dependabot[bot]'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Sync action SHAs to CUE template
         run: |
@@ -37,6 +39,7 @@ jobs:
         run: |
           git config user.name "github-actions[bot]"
           git config user.email "github-actions[bot]@users.noreply.github.com"
+          git remote set-url origin "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git"
           git add .github/workflows/test-apps.cue
           if git diff --cached --quiet; then
             echo "No CUE changes needed"
diff --git a/.github/workflows/system-tests.yml b/.github/workflows/system-tests.yml
index 2b1bd3d5270..6daf60dab34 100644
--- a/.github/workflows/system-tests.yml
+++ b/.github/workflows/system-tests.yml
@@ -41,6 +41,7 @@ jobs:
       - name: Checkout system-tests
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: 'DataDog/system-tests'
           ref: ${{ inputs.ref }}
       - name: Pin exact commit SHA for system-tests
@@ -164,6 +165,7 @@ jobs:
       - name: Checkout dd-trace-go
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.branch_ref || github.ref }}
           path: 'binaries/dd-trace-go'
 
@@ -270,6 +272,7 @@ jobs:
       - name: Checkout system tests
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           repository: 'DataDog/system-tests'
           ref: ${{ inputs.ref }}
 
@@ -279,6 +282,7 @@ jobs:
       - name: Checkout dd-trace-go
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ inputs.branch_ref || github.ref }}
           path: 'binaries/dd-trace-go'
 
diff --git a/.github/workflows/test-apps-schedule.yml b/.github/workflows/test-apps-schedule.yml
index fba9c472ee2..4a587137992 100644
--- a/.github/workflows/test-apps-schedule.yml
+++ b/.github/workflows/test-apps-schedule.yml
@@ -6,6 +6,9 @@ on:
     - cron: "0 0 * * *" # nightly
     - cron: "0 0 * * 2" # weekly (tuesdays)
 
+permissions:
+  contents: read
+
 jobs:
   nightly:
     if: github.event.schedule == '0 0 * * *'
diff --git a/.github/workflows/test-apps.cue b/.github/workflows/test-apps.cue
index 270932ea5f5..faa7993f10b 100644
--- a/.github/workflows/test-apps.cue
+++ b/.github/workflows/test-apps.cue
@@ -134,7 +134,10 @@ jobs: {
                     {
                         name: "Checkout Code",
                         uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd",
-                        with: {ref: "${{ inputs.ref || github.ref }}"},
+                        with: {
+                        "persist-credentials": false,
+                        ref:                   "${{ inputs.ref || github.ref }}",
+                    },
                     },
                     {
                         name: "Start Agent",
diff --git a/.github/workflows/test-apps.yml b/.github/workflows/test-apps.yml
index 296ef4e4301..4e9415939a6 100644
--- a/.github/workflows/test-apps.yml
+++ b/.github/workflows/test-apps.yml
@@ -7,10 +7,6 @@ name: Test Apps
         type: string
         default: '["unit-of-work/v1","unit-of-work/v2","memory-leak/goroutine","memory-leak/heap","memory-leak/goroutine-heap"]'
         description: Scenarios to run
-      ref:
-        description: The branch to run the workflow on
-        required: false
-        type: string
       'env: prod':
         type: boolean
         default: true
@@ -33,6 +29,10 @@ name: Test Apps
         type: string
         default: trigger:manual
         description: Extra DD_TAGS
+      ref:
+        description: The branch to run the workflow on
+        required: false
+        type: string
   workflow_dispatch:
     inputs:
       scenarios:
@@ -73,16 +73,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''unit-of-work/v1'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -99,16 +100,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''unit-of-work/v1'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -125,16 +127,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''unit-of-work/v2'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -151,16 +154,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''unit-of-work/v2'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -177,16 +181,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/goroutine'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -203,16 +208,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/goroutine'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -229,16 +235,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/heap'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -255,16 +262,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/heap'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -281,16 +289,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/goroutine-heap'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
@@ -307,16 +316,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/goroutine-heap'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
         with:
+          persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
         with:
           go-version: stable
           check-latest: true
diff --git a/.github/workflows/unit-integration-tests.yml b/.github/workflows/unit-integration-tests.yml
index a03a21e3d68..2a3196b78d6 100644
--- a/.github/workflows/unit-integration-tests.yml
+++ b/.github/workflows/unit-integration-tests.yml
@@ -40,6 +40,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ github.sha }}
           clean: false
       - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
@@ -223,6 +224,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
+          persist-credentials: false
           ref: ${{ github.sha }}
           clean: false
 
@@ -397,6 +399,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: always()
         with:
+          persist-credentials: false
           ref: ${{ github.sha }}
           clean: false
       - name: Setup Go and development tools
diff --git a/.github/workflows/update-supported-versions-doc.yml b/.github/workflows/update-supported-versions-doc.yml
index 331d0c9f1cd..2a4821b2480 100644
--- a/.github/workflows/update-supported-versions-doc.yml
+++ b/.github/workflows/update-supported-versions-doc.yml
@@ -23,6 +23,8 @@ jobs:
     if: ${{ github.event.workflow_run.conclusion == 'success' }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - run: echo 'Smoke Tests workflow passed'
       - run: go run ./scripts/gen_integrations_doc.go
       - run: git diff

From 6c44e3c98d252f7e71244fbda263efd32365f1c3 Mon Sep 17 00:00:00 2001
From: Kemal Akkoyun <kemal.akkoyun@datadoghq.com>
Date: Thu, 26 Mar 2026 12:41:30 +0100
Subject: [PATCH 2/3] ci(cue): inject version comments into generated
 test-apps.yml

Add inline // vX.Y.Z comments to the three pinned action uses: lines in
test-apps.cue. The Makefile generation step now post-processes cue export
output with a Python one-liner that reads those comments and appends them
as # vX.Y.Z annotations in the generated YAML, matching the convention
used in all handwritten workflow files.

Extend sync-cue-actions.yml to also extract the version comment from
Dependabot's test-apps.yml update and sync it back into the test-apps.cue
comment, so the annotation stays correct after each Dependabot bump.
---
 .github/workflows/Makefile             |  5 ++-
 .github/workflows/sync-cue-actions.yml |  9 +++-
 .github/workflows/test-apps.cue        |  6 +--
 .github/workflows/test-apps.yml        | 60 +++++++++++++-------------
 4 files changed, 45 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/Makefile b/.github/workflows/Makefile
index 78c7fc7129b..e73a1d5bc35 100644
--- a/.github/workflows/Makefile
+++ b/.github/workflows/Makefile
@@ -8,4 +8,7 @@ clean:
 	rm -rf test-apps.yml
 
 test-apps.yml: test-apps.cue
-	cat <(echo "# Code generated via \`make test-apps.yml\`; DO NOT EDIT.") <(cue export --out=yaml $<) > $@
\ No newline at end of file
+	{ echo "# Code generated via \`make test-apps.yml\`; DO NOT EDIT."; \
+	  cue export --out=yaml $< | python3 -c \
+	    'import sys,re; v={m.group(1):m.group(2) for l in open("test-apps.cue") for m in [re.search(r"\"([^@\"]+@[a-f0-9]{40})\"[^/]*/+\s*(v\S+)",l)] if m}; sys.stdout.writelines(re.sub(r"(uses: )(\S+@[a-f0-9]{40})",lambda m:m.group(1)+m.group(2)+" # "+v[m.group(2)] if m.group(2) in v else m.group(),l) for l in sys.stdin)'; \
+	} > $@
\ No newline at end of file
diff --git a/.github/workflows/sync-cue-actions.yml b/.github/workflows/sync-cue-actions.yml
index 34d944cae47..71eb2bcdc05 100644
--- a/.github/workflows/sync-cue-actions.yml
+++ b/.github/workflows/sync-cue-actions.yml
@@ -30,9 +30,16 @@ jobs:
               echo "WARNING: ${action} not found in test-apps.yml"
               continue
             fi
-            # Replace everything between @ and closing " in CUE string
+            # Replace SHA in CUE string
             sed -i -E "s|${action}@[^\"]+|${action}@${sha}|g" test-apps.cue
             echo "Synced ${action} -> ${sha:0:12}..."
+            # Sync version comment if Dependabot included one
+            ver=$(grep -m1 "uses: ${action}@" test-apps.yml \
+              | grep -oE '#[[:space:]]*v[0-9][^[:space:]]*' | sed 's/^#[[:space:]]*//')
+            if [[ -n "${ver}" ]]; then
+              sed -i -E "/${action}@/s|//[[:space:]]*v[^[:space:]]+[[:space:]]*$|// ${ver}|" test-apps.cue
+              echo "  version comment: ${ver}"
+            fi
           done
 
       - name: Commit and push if changed
diff --git a/.github/workflows/test-apps.cue b/.github/workflows/test-apps.cue
index faa7993f10b..4bacf919a8f 100644
--- a/.github/workflows/test-apps.cue
+++ b/.github/workflows/test-apps.cue
@@ -133,7 +133,7 @@ jobs: {
                 steps: [
                     {
                         name: "Checkout Code",
-                        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd",
+                        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd", // v6.0.2
                         with: {
                         "persist-credentials": false,
                         ref:                   "${{ inputs.ref || github.ref }}",
@@ -141,7 +141,7 @@ jobs: {
                     },
                     {
                         name: "Start Agent",
-                        uses: "datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a",
+                        uses: "datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a", // v1.3.1
                         with: {
                             api_key: "${{ secrets['\(env.key)'] }}",
                             datadog_site: "\(env.site)",
@@ -149,7 +149,7 @@ jobs: {
                     },
                     {
                         name: "Setup Go"
-                        uses: "actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417",
+                        uses: "actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417", // v6.3.0
                         with: {
                             "go-version": "stable",
                             "check-latest": true,
diff --git a/.github/workflows/test-apps.yml b/.github/workflows/test-apps.yml
index 4e9415939a6..ce51ac637bc 100644
--- a/.github/workflows/test-apps.yml
+++ b/.github/workflows/test-apps.yml
@@ -73,17 +73,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''unit-of-work/v1'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -100,17 +100,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''unit-of-work/v1'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -127,17 +127,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''unit-of-work/v2'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -154,17 +154,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''unit-of-work/v2'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -181,17 +181,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/goroutine'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -208,17 +208,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/goroutine'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -235,17 +235,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/heap'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -262,17 +262,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/heap'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -289,17 +289,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/goroutine-heap'') && inputs[''env: prod'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_APP_API_KEY'] }}
           datadog_site: datadoghq.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true
@@ -316,17 +316,17 @@ jobs:
     if: 'contains(fromJSON(inputs[''scenarios'']), ''memory-leak/goroutine-heap'') && inputs[''env: staging'']'
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
           ref: ${{ inputs.ref || github.ref }}
       - name: Start Agent
-        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a
+        uses: datadog/agent-github-action@8240b406d73cb84cd5085a3919a78f59c258da3a # v1.3.1
         with:
           api_key: ${{ secrets['DD_TEST_AND_DEMO_API_KEY'] }}
           datadog_site: datad0g.com
       - name: Setup Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version: stable
           check-latest: true

From 868ecd25e01a8e5fab6c1efc7fcf80cfc12108a0 Mon Sep 17 00:00:00 2001
From: Kemal Akkoyun <kemal.akkoyun@datadoghq.com>
Date: Thu, 26 Mar 2026 12:53:23 +0100
Subject: [PATCH 3/3] ci(cue): fix version comment sed to avoid / address
 pattern issue

The previous sed used an address pattern /${action}@/ to scope the
substitution, but action names like actions/checkout contain literal
slashes that break both GNU and BSD sed's address parsing. Replace it
with an inline match in the substitute expression using | as delimiter,
which handles slashes in action names correctly.

Verified with a local Dependabot simulation: SHA and version comment
in test-apps.cue both update correctly after a Dependabot bump.
---
 .github/workflows/sync-cue-actions.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sync-cue-actions.yml b/.github/workflows/sync-cue-actions.yml
index 71eb2bcdc05..2aae84f1a9d 100644
--- a/.github/workflows/sync-cue-actions.yml
+++ b/.github/workflows/sync-cue-actions.yml
@@ -37,7 +37,7 @@ jobs:
             ver=$(grep -m1 "uses: ${action}@" test-apps.yml \
               | grep -oE '#[[:space:]]*v[0-9][^[:space:]]*' | sed 's/^#[[:space:]]*//')
             if [[ -n "${ver}" ]]; then
-              sed -i -E "/${action}@/s|//[[:space:]]*v[^[:space:]]+[[:space:]]*$|// ${ver}|" test-apps.cue
+              sed -i -E "s|(\"${action}@[a-f0-9]+\")[^/]*(// v[^[:space:]]+)?[[:space:]]*$|\1, \/\/ ${ver}|" test-apps.cue
               echo "  version comment: ${ver}"
             fi
           done