⬆️(deps): Bump DataDog/datadog-static-analyzer-github-action from 2 to 3

[dependabot]

Bumps DataDog/datadog-static-analyzer-github-action from 2 to 3.

Release notes

Sourced from DataDog/datadog-static-analyzer-github-action's releases.

v3

No release notes provided.

v3.0

No release notes provided.

v3.0.0

This is a major release that converts the action from a container action to a composite action.

In practice, this will reduce the time the action takes to initialize from over 1 minute to under 10 seconds.

Upgrading from v2

TL;DR unless you are self-hosting runners, upgrading from v2 will work without issue.

GitHub-hosted Runners

If you're using Github's runners, you can upgrade without issue.

Side Effects

Note that with the move away from containerization, there are some net-new side effects to using the action that persist to following steps. These are not expected to cause behavior regressions but are listed below for transparency:

• $HOME/.local/bin/ will be created and added to $GITHUB_PATH
  • The datadog-static-analyzer binary will be written here
  • The datadog-ci binary might be written here
• git config --global --add safe.directory "$GITHUB_WORKSPACE" will be run
• git config --unset extensions.worktreeConfig might be run
• A temporary dir (mktemp -d) containing datadog-ci (semver ^4) might be written to $GITHUB_PATH

Self-hosted Runners

If you are using self-hosted runners you might need additional configuration, depending on your setup (firewalls, etc).

Net-new network calls

• npm view @datadog/datadog-ci is used
• GET https://github.com/DataDog/datadog-static-analyzer/releases/latest/download/*
• GET https://github.com/DataDog/datadog-ci/releases/download/*/*

Net-new required binaries in $PATH

• bash
• git
• curl (additionally, CA certificates)
• node
• npm
• unzip

The same "Side Effects" from the section above apply.

Commits

• 8340f18 Merge pull request #55 from DataDog/jf/K9VULN-10939
• 54d9d85 Add platform test
• b7fe6fb Implement as a composite action
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: github-actions. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

E2E Integration Test Summary

Workflow Run: 833
Commit: 5862b7f
Branch: 551/merge
Triggered by: pull_request
Timestamp: Mon Feb 2 06:27:23 UTC 2026

Test Results

End-to-End Tests

❌ E2E Tests: FAILED
⏸️ Security Scan: SKIPPED
⏸️ Performance Analysis: SKIPPED

Artifacts

• Test reports and logs available in workflow artifacts
• Artifacts retained for 7-30 days depending on type