[SECRES-5300] Add documentation for SCFW GitHub Action by ikretz · Pull Request #38033 · DataDog/documentation

ikretz · 2026-07-08T11:29:54Z

What does this PR do? What is the motivation?

This PR adds documentation for Datadog's recently released GitHub Action for Supply Chain Firewall.

Merge readiness

Ready for merge

For Datadog employees:

⚠️ Your branch name MUST follow the <name>/<description> convention and include the forward slash (/). If you've already created your PR with an incorrect branch name, please rename your branch and open a fresh PR.
🤖 New: Comment with /review to run an automated check that catches common issues before a Documentation team member reviews your PR.

AI assistance

Additional notes

ikretz · 2026-07-08T11:39:44Z

/review

github-actions · 2026-07-08T11:40:46Z

Preview links (active after the `build_preview` check completes)

New or renamed files

https://docs-staging.datadoghq.com/ikretz/scfw-gh-action/security/code_security/dev_tool_int/scfw_github_action/

Modified Files

https://docs-staging.datadoghq.com/ikretz/scfw-gh-action/security/code_security/

github-actions

🤖 Automated review by Claude. AI-generated; verify before acting.

Overall the new SCFW GitHub Action page is well-structured and useful. A few things to address:

Blocker:

The new page has not been added to config/_default/menus/main.en.yaml. Since it is a public page (no private: true), it won't appear in the side-nav under dev_tool_int. Please add an entry alongside dev_tool_int_mcp_server / dev_tool_int_git_hooks (around line 8039).
The further_reading entry with link: "/scfw_github_action" is a broken self-reference — that path doesn't resolve to this page and, even if it did, the page shouldn't link to itself.

Style nits: a few Vale-flagged terms (currently, via, ensures, ensure) and a version-example inconsistency between the Usage snippet and the version row of the Inputs table. See inline comments.

_{Reviewed 2fffe1083443aa87cafba14d74e971e827accfd7 — workflow run}

buraizu · 2026-07-08T16:20:46Z

Thanks for the PR! I've created DOCS-15056 for documentation team review.

drichards-87

Left some feedback from Docs.

drichards-87 · 2026-07-13T23:00:25Z

+      identifier: dev_tool_int_scfw_github_action
+      url: /security/code_security/dev_tool_int/scfw_github_action/
+      parent: dev_tool_int
+      weight: 5


Suggested change

weight: 5

weight: 6

drichards-87 · 2026-07-13T23:02:02Z

      url: /security/code_security/dev_tool_int/mcp_server/
      parent: dev_tool_int
      weight: 5
+    - name: SCFW GitHub Action


Could we move the new left nav entry for the SCFW GitHub Action doc so it appears below line 8058, after the Troubleshooting topic nested under MCP Server in the left nav? The ordering works as far as how it renders on the docs site, but for maintainability, it would be better if the menu items match the order shown in the left nav.

drichards-87 · 2026-07-13T23:02:38Z

 [17]: /security/code_security/iac_security/setup/?tab=github
 [18]: /security/cloud_security_management/
 [19]: /security/code_security/dev_tool_int/mcp_server/
+[20]: /security/code_security/dev_tool_int/scfw_github_action/


Suggested change

[20]: /security/code_security/dev_tool_int/scfw_github_action/

[20]: /security/code_security/dev_tool_int/scfw_github_action/

[21]: https://github.com/DataDog/guarddog

drichards-87 · 2026-07-13T23:03:08Z

 Unlike SCA, which scans dependencies already in your codebase, the Datadog Supply Chain Firewall (SCFW) intercepts package manager commands (`npm`, `pip`, `poetry`) in real time and blocks malicious or recently published packages before they are installed.

-Supply Chain Security evaluates every package install against Datadog's malicious package feed (powered by GuardDog), known vulnerability advisories, and configurable recency thresholds. When it flags a package, it blocks installation immediately with a clear, actionable message (on both developer laptops and CI runners).
+Supply Chain Security evaluates every package install against Datadog's malicious package feed (powered by [GuardDog](https://github.com/DataDog/guarddog)), known vulnerability advisories, and configurable recency thresholds. SCFW immediately blocks installation of flagged packages with a clear, actionable message on both developer laptops and [CI runners][20].


Suggested change

Supply Chain Security evaluates every package install against Datadog's malicious package feed (powered by [GuardDog](https://github.com/DataDog/guarddog)), known vulnerability advisories, and configurable recency thresholds. SCFW immediately blocks installation of flagged packages with a clear, actionable message on both developer laptops and [CI runners][20].

Supply Chain Security evaluates every package install against Datadog's malicious package feed (powered by [GuardDog][21]), known vulnerability advisories, and configurable recency thresholds. If a package matches one of these checks, SCFW immediately blocks the installation and displays a clear, actionable message on developer laptops and [CI runners][20].

drichards-87 · 2026-07-13T23:06:30Z

+
+| Output | Description |
+|--------|-------------|
+| `scfw-version` | The installed version of Supply Chain Firewall. |


Suggested change

| `scfw-version` | The installed version of Supply Chain Firewall. |

| `scfw-version` | The installed version of Supply Chain Firewall. |

## Further reading

{{< partial name="whats-next/whats-next.html" >}}

[1]: https://github.com/DataDog/supply-chain-firewall

drichards-87 · 2026-07-13T23:32:11Z

+
+| Input | Description | Default |
+|-------|-------------|---------|
+| `version` | The version of SCFW to install. Use `"latest"` or pin to a specific release (e.g., `"3.1.0"`). | `latest` |


drichards-87 · 2026-07-13T23:33:50Z

+|-------|-------------|---------|
+| `version` | The version of SCFW to install. Use `"latest"` or pin to a specific release (e.g., `"3.1.0"`). | `latest` |
+| `package-managers` | Comma-separated list of package managers to intercept. Supported: `npm`, `pip`, `poetry`. | `npm,pip,poetry` |
+| `error-on-block` | Exit with a non-zero code when an installation is blocked, failing the workflow step. | `true` |


drichards-87 · 2026-07-13T23:34:42Z

+| `on-warning` | Action that SCFW should take on warning-level findings: `ALLOW` or `BLOCK`. Defaults to `BLOCK` in non-interactive environments. | — |
+| `package-minimum-age` | Minimum age in hours a package must have before installation is allowed. | `24` |
+| `dd-env` | Datadog environment tag attached to all forwarded firewall events. | `ci` |
+| `dd-log-attributes` | A JSON object of custom attributes to attach to all forwarded Datadog log events (e.g., `'{"team":"security"}'`). | — |


Suggested change

| `dd-log-attributes` | A JSON object of custom attributes to attach to all forwarded Datadog log events (e.g., `'{"team":"security"}'`). | — |

| `dd-log-attributes` | A JSON object of custom attributes to attach to all forwarded Datadog log events (for example, `'{"team":"security"}'`). | — |

drichards-87 · 2026-07-13T23:34:53Z

+| `dd-log-level` | Controls which firewall events are forwarded to Datadog. `ALLOW` logs all events; `BLOCK` logs only blocked events. | `ALLOW` |
+| `scfw-home` | Directory for SCFW's local cache. Point this at a cached directory to speed up verifier data fetches across runs. | — |
+| `on-warning` | Action that SCFW should take on warning-level findings: `ALLOW` or `BLOCK`. Defaults to `BLOCK` in non-interactive environments. | — |
+| `package-minimum-age` | Minimum age in hours a package must have before installation is allowed. | `24` |


drichards-87 · 2026-07-13T23:36:52Z

+| `dd-app-key` | Datadog application key for forwarding firewall events to the Datadog Code Security API. Use `${{ secrets.DD_APP_KEY }}`. | — |
+| `dd-api-logger` | When `"true"`, enables SCFW's Datadog HTTP API logger. Requires `dd-api-key`. | `false` |
+| `dd-codesec-logger` | When `"true"`, enables SCFW's Datadog Code Security logger. Requires `dd-api-key` and `dd-app-key`. | `false` |
+| `dd-site` | Datadog site (e.g., `datadoghq.com`, `datadoghq.eu`, `us3.datadoghq.com`). Used by both `dd-api-logger` and `dd-codesec-logger`. | `datadoghq.com` |


Suggested change

| `dd-site` | Datadog site (e.g., `datadoghq.com`, `datadoghq.eu`, `us3.datadoghq.com`). Used by both `dd-api-logger` and `dd-codesec-logger`. | `datadoghq.com` |

| `dd-site` | Your Datadog site ({{< region-param key="dd_site" code="true" >}}). Used by both `dd-api-logger` and `dd-codesec-logger`. | `datadoghq.com` |

Add documentation for SCFW GitHub Action

2fffe10

github-actions Bot reviewed Jul 8, 2026

View reviewed changes

Respond to review feedback

4ce86e6

github-actions Bot added the Architecture Everything related to the Doc backend label Jul 8, 2026

ikretz marked this pull request as ready for review July 8, 2026 12:51

ikretz requested a review from a team as a code owner July 8, 2026 12:51

ikretz added 2 commits July 8, 2026 14:53

Remove unsupported emojis

5fed1a4

Shorten sidebar text

dc4efd7

buraizu added the editorial review Waiting on a more in-depth review label Jul 8, 2026

drichards-87 self-requested a review July 13, 2026 22:53

drichards-87 requested changes Jul 13, 2026

View reviewed changes

	[20]: /security/code_security/dev_tool_int/scfw_github_action/
	[20]: /security/code_security/dev_tool_int/scfw_github_action/
	[21]: https://github.com/DataDog/guarddog

	Supply Chain Security evaluates every package install against Datadog's malicious package feed (powered by [GuardDog](https://github.com/DataDog/guarddog)), known vulnerability advisories, and configurable recency thresholds. SCFW immediately blocks installation of flagged packages with a clear, actionable message on both developer laptops and [CI runners][20].
	Supply Chain Security evaluates every package install against Datadog's malicious package feed (powered by [GuardDog][21]), known vulnerability advisories, and configurable recency thresholds. If a package matches one of these checks, SCFW immediately blocks the installation and displays a clear, actionable message on developer laptops and [CI runners][20].

-| `scfw-version` | The installed version of Supply Chain Firewall. |
+| `scfw-version` | The installed version of Supply Chain Firewall. |
+## Further reading
+{{< partial name="whats-next/whats-next.html" >}}
+[1]: https://github.com/DataDog/supply-chain-firewall

	\| `version` \| The version of SCFW to install. Use `"latest"` or pin to a specific release (e.g., `"3.1.0"`). \| `latest` \|
	\| `version` \| The version of SCFW to install. Use `"latest"` or pin to a specific release (for example, `"3.1.0"`). \| `latest` \|

	\| `error-on-block` \| Exit with a non-zero code when an installation is blocked, failing the workflow step. \| `true` \|
	\| `error-on-block` \| Fail the workflow step with a non-zero exit code when an installation is blocked. \| `true` \|

	\| `dd-log-attributes` \| A JSON object of custom attributes to attach to all forwarded Datadog log events (e.g., `'{"team":"security"}'`). \| — \|
	\| `dd-log-attributes` \| A JSON object of custom attributes to attach to all forwarded Datadog log events (for example, `'{"team":"security"}'`). \| — \|

	\| `package-minimum-age` \| Minimum age in hours a package must have before installation is allowed. \| `24` \|
	\| `package-minimum-age` \| Minimum age, in hours, that a package version must reach before installation is allowed. \| `24` \|

	\| `dd-site` \| Datadog site (e.g., `datadoghq.com`, `datadoghq.eu`, `us3.datadoghq.com`). Used by both `dd-api-logger` and `dd-codesec-logger`. \| `datadoghq.com` \|
	\| `dd-site` \| Your Datadog site ({{< region-param key="dd_site" code="true" >}}). Used by both `dd-api-logger` and `dd-codesec-logger`. \| `datadoghq.com` \|

Uh oh!

Conversation

ikretz commented Jul 8, 2026

What does this PR do? What is the motivation?

Merge readiness

For Datadog employees:

AI assistance

Additional notes

Uh oh!

ikretz commented Jul 8, 2026

Uh oh!

github-actions Bot commented Jul 8, 2026

Preview links (active after the build_preview check completes)

New or renamed files

Modified Files

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

buraizu commented Jul 8, 2026

Uh oh!

drichards-87 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

drichards-87 Jul 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Preview links (active after the `build_preview` check completes)

drichards-87 Jul 13, 2026 •

edited

Loading