Migrate API key to environment secrets

[PerfectSlayer]

What Does This Do

This PR moves the DD API key to a protected environment.

Motivation

SDLC recommendations

Additional Notes

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

Jira ticket: APMLP-1687

[datadog-prod-us1-4]

More details

The change only scopes the Trivy job to protected-main-env while preserving its existing Datadog secret expression and leaving CodeQL unchanged. YAML parsing, trigger coverage, environment scope, and secret-resolution scenarios passed; environment protection rules could not be independently read because the repository API returned 403.

Was this helpful? React 👍 or 👎

_{📊 Validated against 4 scenarios · Open Bits AI session}

_{🤖 Datadog Autotest · Commit 14a5f53 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}

[datadog-prod-us1-4]

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 57.89% (-0.04%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 14a5f53 | Docs | Datadog PR Page | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.89 s	13.99 s	[-1.4%; -0.1%] (maybe better)
startup:insecure-bank:tracing:Agent	12.97 s	12.96 s	[-0.7%; +0.8%] (no difference)
startup:petclinic:appsec:Agent	16.96 s	16.77 s	[+0.1%; +2.2%] (maybe worse)
startup:petclinic:iast:Agent	17.03 s	16.98 s	[-0.6%; +1.2%] (no difference)
startup:petclinic:profiling:Agent	16.77 s	16.86 s	[-1.4%; +0.4%] (no difference)
startup:petclinic:sca:Agent	16.73 s	16.63 s	[-0.3%; +1.5%] (no difference)
startup:petclinic:tracing:Agent	15.69 s	16.10 s	[-6.7%; +1.5%] (no difference)

Commit: 14a5f531 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[PerfectSlayer]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-08-03 12:52:12 UTC ℹ️ Start processing command /merge

---

2026-08-03 12:52:15 UTC ❌ MergeQueue

PR already in the queue with status in_progress

[sarahchen6]

/merge

[gh-worker-devflow-routing-ef8351]

View all feedbacks in Devflow UI.

2026-08-03 13:21:35 UTC ℹ️ Start processing command /merge

---

2026-08-03 13:21:39 UTC ℹ️ MergeQueue: pull request added to the queue

The expected merge time in master is approximately 1h (p90).

---

2026-08-03 14:14:30 UTC ℹ️ MergeQueue: This merge request was merged

[PerfectSlayer]

In fact, you can add the PR to MQ using DDCI UI… But you got no feedback. So I guess it was in queue but stuck…
In short, no idea what's happening and going to spend hours on trying to get a 2l change merged that's not even related to GitLab 😮‍💨

[sarahchen6]

Hm I didn't know you could add a PR to MQ directly from DDCI UI... Maybe that somehow caused a double add to the MQ and the error from above "PR already in the queue with status in_progress" despite there being nothing in the MQ.

[PerfectSlayer]

Yes, I did comment "/merge" to try to get the status and it failed as already in queue. Let's wait for Today and check later if it moved 🤷