public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[v9.4.x] CI: Add GPG keys to rgm, don't clone RGM just use the docker image (#71231)

Browse Source 
* CI: Add rgm to drone (#66991)

* add drone stub that build grafana using 'grafana/build' (dagger)

---------

Co-authored-by: Ricky Whitaker <ricky.whitaker@grafana.com>
(cherry picked from commit 768efe9748)

* Add dagger token to rgm builds (#68651)

(cherry picked from commit a870b227db)

* CI: Add GPG keys to rgm, don't clone RGM just use the docker image (#71143)

* Add GPG keys to rgm, dont' clone RGM just use the docker image

(cherry picked from commit d5a4c81fa1)
This commit is contained in:
Kevin Minehart
2023-07-07 20:23:39 +03:00
committed by GitHub
parent f09edce739
commit 19ea031bbd
6 changed files with 404 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/drone/events/release.star
+1 -1
View File
@@ -798,7 +798,7 @@ def verify_release_pipeline(
"apt-get update && apt-get install -yq gettext",
"printenv GCP_KEY | base64 -d > /tmp/key.json",
"gcloud auth activate-service-account --key-file=/tmp/key.json",
"./scripts/list-release-artifacts.sh {} | xargs -n1 gsutil stat".format(version),
"./scripts/list-release-artifacts.sh {} | xargs -n1 gsutil stat | grep \"No URLs matched\"".format(version),
],
}
return pipeline(
scripts/drone/rgm.star
+114
View File
@@ -0,0 +1,114 @@
"""
rgm uses 'github.com/grafana/grafana-build' to build Grafana on the following events:
* A merge to main
* A tag that begins with a 'v'
"""
load(
"scripts/drone/utils/utils.star",
"pipeline",
)
load(
"scripts/drone/events/release.star",
"verify_release_pipeline",
)
load(
"scripts/drone/vault.star",
"from_secret",
"rgm_dagger_token",
"rgm_destination",
"rgm_gcp_key_base64",
"rgm_github_token",
)
rgm_env_secrets = {
"GCP_KEY_BASE64": from_secret(rgm_gcp_key_base64),
"DESTINATION": from_secret(rgm_destination),
"GITHUB_TOKEN": from_secret(rgm_github_token),
"_EXPERIMENTAL_DAGGER_CLOUD_TOKEN": from_secret(rgm_dagger_token),
"GPG_PRIVATE_KEY": from_secret("packages_gpg_private_key"),
"GPG_PUBLIC_KEY": from_secret("packages_gpg_public_key"),
"GPG_PASSPHRASE": from_secret("packages_gpg_passphrase"),
}
def rgm_build(script = "drone_publish_main.sh"):
rgm_build_step = {
"name": "rgm-build",
"image": "grafana/grafana-build:main",
"commands": [
"export GRAFANA_DIR=$$(pwd)",
"cd /src && ./scripts/{}".format(script),
],
"environment": rgm_env_secrets,
# The docker socket is a requirement for running dagger programs
# In the future we should find a way to use dagger without mounting the docker socket.
"volumes": [{"name": "docker", "path": "/var/run/docker.sock"}],
"failure": "ignore",
}
return [
rgm_build_step,
]
docs_paths = {
"exclude": [
"*.md",
"docs/**",
"packages/**/*.md",
"latest.json",
],
}
def rgm_main():
trigger = {
"event": [
"push",
],
"branch": "main",
"paths": docs_paths,
}
return pipeline(
name = "rgm-main-prerelease",
edition = "all",
trigger = trigger,
steps = rgm_build(),
depends_on = ["main-test-backend", "main-test-frontend"],
)
tag_trigger = {
"event": {
"exclude": [
"promote",
],
},
"ref": {
"include": [
"refs/tags/v*",
],
"exclude": [
"refs/tags/*-cloud*",
],
},
}
def rgm_tag():
return pipeline(
name = "rgm-tag-prerelease",
edition = "all",
trigger = tag_trigger,
steps = rgm_build(script = "drone_publish_tag.sh"),
depends_on = [],
)
def rgm():
return [
rgm_main(),
rgm_tag(),
verify_release_pipeline(
name = "rgm-tag-verify-prerelease-assets",
trigger = tag_trigger,
depends_on = ["rgm-tag-prerelease"],
bucket = "grafana-prerelease-dev",
),
]
scripts/drone/vault.star
+45
View File
@@ -9,6 +9,11 @@ azure_sp_app_id = "azure_sp_app_id"
azure_sp_app_pw = "azure_sp_app_pw"
azure_tenant = "azure_tenant"
rgm_gcp_key_base64 = "gcp_key_base64"
rgm_destination = "destination"
rgm_github_token = "github_token"
rgm_dagger_token = "dagger_token"
def from_secret(secret):
return {"from_secret": secret}
@@ -104,6 +109,31 @@ def secrets():
"infra/data/ci/grafana-release-eng/enterprise2",
"cdn_path",
),
vault_secret(
"enterprise2_security_prefix",
"infra/data/ci/grafana-release-eng/enterprise2",
"security_prefix",
),
vault_secret(
rgm_gcp_key_base64,
"infra/data/ci/grafana-release-eng/rgm",
"gcp_service_account_base64",
),
vault_secret(
rgm_destination,
"infra/data/ci/grafana-release-eng/rgm",
"destination",
),
vault_secret(
rgm_dagger_token,
"infra/data/ci/grafana-release-eng/rgm",
"dagger_token",
),
vault_secret(
rgm_github_token,
"infra/data/ci/github/grafanabot",
"pat",
),
# grafana-delivery-bot secrets
vault_secret(
"delivery-bot-app-id",
@@ -120,4 +150,19 @@ def secrets():
"infra/data/ci/grafana-release-eng/grafana-delivery-bot",
"app-private-key",
),
vault_secret(
rgm_gcp_key_base64,
"infra/data/ci/grafana-release-eng/rgm",
"gcp_service_account_base64",
),
vault_secret(
rgm_destination,
"infra/data/ci/grafana-release-eng/rgm",
"destination",
),
vault_secret(
rgm_github_token,
"infra/data/ci/github/grafanabot",
"pat",
),
]
scripts/list-release-artifacts.sh
+35 -34
View File
@@ -3,17 +3,18 @@ set -e
VERSION="${1:-v9.5.2}"
ERSION="${VERSION#*v}"
ERSION_DEB="${ERSION//-/\~}"
ASSETS=$(cat << EOF
gs://${BUCKET}/artifacts/static-assets/grafana-oss/${ERSION}/public/robots.txt
gs://${BUCKET}/artifacts/static-assets/grafana/${ERSION}/public/robots.txt
gs://${BUCKET}/artifacts/static-assets/grafana-pro/${ERSION}/public/robots.txt
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}-1.aarch64.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}-1.aarch64.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}-1.armhfp.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}-1.armhfp.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}-1.x86_64.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}-1.x86_64.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION_DEB}-1.aarch64.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION_DEB}-1.aarch64.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION_DEB}-1.armhfp.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION_DEB}-1.armhfp.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION_DEB}-1.x86_64.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION_DEB}-1.x86_64.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}.darwin-amd64.tar.gz
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}.darwin-amd64.tar.gz.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}.linux-amd64-musl.tar.gz
@@ -34,20 +35,26 @@ gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}.wind
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}.windows-amd64.msi.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}.windows-amd64.zip
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-${ERSION}.windows-amd64.zip.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-rpi_${ERSION}_armhf.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-rpi_${ERSION}_armhf.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION}_amd64.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION}_amd64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION}_arm64.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION}_arm64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION}_armhf.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION}_armhf.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}-1.aarch64.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}-1.aarch64.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}-1.armhfp.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}-1.armhfp.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}-1.x86_64.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}-1.x86_64.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-rpi_${ERSION_DEB}_armhf.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana-rpi_${ERSION_DEB}_armhf.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION_DEB}_amd64.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION_DEB}_amd64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION_DEB}_arm64.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION_DEB}_arm64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION_DEB}_armhf.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/oss/release/grafana_${ERSION_DEB}_armhf.deb.sha256
gs://${BUCKET}/artifacts/downloads-enterprise2/${VERSION}/enterprise2/release/grafana-enterprise2-${ERSION}.linux-amd64.tar.gz
gs://${BUCKET}/artifacts/downloads-enterprise2/${VERSION}/enterprise2/release/grafana-enterprise2-${ERSION}.linux-amd64.tar.gz.sha256
gs://${BUCKET}/artifacts/downloads-enterprise2/${VERSION}/enterprise2/release/grafana-enterprise2-${ERSION}.linux-amd64-musl.tar.gz
gs://${BUCKET}/artifacts/downloads-enterprise2/${VERSION}/enterprise2/release/grafana-enterprise2-${ERSION}.linux-amd64-musl.tar.gz.sha256
gs://${BUCKET}/artifacts/downloads-enterprise2/${VERSION}/enterprise2/release/grafana-enterprise2_${ERSION_DEB}_amd64.deb
gs://${BUCKET}/artifacts/downloads-enterprise2/${VERSION}/enterprise2/release/grafana-enterprise2_${ERSION_DEB}_amd64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION_DEB}-1.aarch64.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION_DEB}-1.aarch64.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION_DEB}-1.armhfp.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION_DEB}-1.armhfp.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION_DEB}-1.x86_64.rpm
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION_DEB}-1.x86_64.rpm.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}.darwin-amd64.tar.gz
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}.darwin-amd64.tar.gz.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}.linux-amd64-musl.tar.gz
@@ -68,26 +75,20 @@ gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterpr
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}.windows-amd64.msi.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}.windows-amd64.zip
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-${ERSION}.windows-amd64.zip.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-rpi_${ERSION}_armhf.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-rpi_${ERSION}_armhf.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION}_amd64.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION}_amd64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION}_arm64.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION}_arm64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION}_armhf.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION}_armhf.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-rpi_${ERSION_DEB}_armhf.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise-rpi_${ERSION_DEB}_armhf.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION_DEB}_amd64.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION_DEB}_amd64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION_DEB}_arm64.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION_DEB}_arm64.deb.sha256
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION_DEB}_armhf.deb
gs://${BUCKET}/artifacts/downloads/${VERSION}/enterprise/release/grafana-enterprise_${ERSION_DEB}_armhf.deb.sha256
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise-${ERSION}-amd64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise-${ERSION}-arm64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise-${ERSION}-armv7.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise-${ERSION}-ubuntu-amd64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise-${ERSION}-ubuntu-arm64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise-${ERSION}-ubuntu-armv7.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise2-${ERSION}-amd64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise2-${ERSION}-arm64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise2-${ERSION}-armv7.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise2-${ERSION}-ubuntu-amd64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise2-${ERSION}-ubuntu-arm64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-enterprise2-${ERSION}-ubuntu-armv7.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-oss-${ERSION}-amd64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-oss-${ERSION}-arm64.img
gs://${BUCKET}/artifacts/docker/${ERSION}/grafana-oss-${ERSION}-armv7.img