[v9.5.x] CI: Add GPG keys to rgm, don't clone RGM just use the docker image (#71233)

* CI: Add rgm to drone (#66991)

* add drone stub that build grafana using 'grafana/build' (dagger)

---------

Co-authored-by: Ricky Whitaker <ricky.whitaker@grafana.com>
(cherry picked from commit 768efe9748)

* Add dagger token to rgm builds (#68651)

(cherry picked from commit a870b227db)

* CI: Add GPG keys to rgm, don't clone RGM just use the docker image (#71143)

(cherry picked from commit d5a4c81fa1)

scripts/drone/events/release.star

@@ -799,7 +799,7 @@ def verify_release_pipeline(
             "apt-get update && apt-get install -yq gettext",
             "printenv GCP_KEY | base64 -d > /tmp/key.json",
             "gcloud auth activate-service-account --key-file=/tmp/key.json",
-            "./scripts/list-release-artifacts.sh {} | xargs -n1 gsutil stat".format(version),
+            "./scripts/list-release-artifacts.sh {} | xargs -n1 gsutil stat | grep \"No URLs matched\"".format(version),
         ],
     }
     return pipeline(

scripts/drone/rgm.star

@@ -0,0 +1,114 @@
+"""
+rgm uses 'github.com/grafana/grafana-build' to build Grafana on the following events:
+* A merge to main
+* A tag that begins with a 'v'
+"""
+
+load(
+    "scripts/drone/utils/utils.star",
+    "pipeline",
+)
+load(
+    "scripts/drone/events/release.star",
+    "verify_release_pipeline",
+)
+load(
+    "scripts/drone/vault.star",
+    "from_secret",
+    "rgm_dagger_token",
+    "rgm_destination",
+    "rgm_gcp_key_base64",
+    "rgm_github_token",
+)
+
+rgm_env_secrets = {
+    "GCP_KEY_BASE64": from_secret(rgm_gcp_key_base64),
+    "DESTINATION": from_secret(rgm_destination),
+    "GITHUB_TOKEN": from_secret(rgm_github_token),
+    "_EXPERIMENTAL_DAGGER_CLOUD_TOKEN": from_secret(rgm_dagger_token),
+    "GPG_PRIVATE_KEY": from_secret("packages_gpg_private_key"),
+    "GPG_PUBLIC_KEY": from_secret("packages_gpg_public_key"),
+    "GPG_PASSPHRASE": from_secret("packages_gpg_passphrase"),
+}
+
+def rgm_build(script = "drone_publish_main.sh"):
+    rgm_build_step = {
+        "name": "rgm-build",
+        "image": "grafana/grafana-build:main",
+        "commands": [
+            "export GRAFANA_DIR=$$(pwd)",
+            "cd /src && ./scripts/{}".format(script),
+        ],
+        "environment": rgm_env_secrets,
+        # The docker socket is a requirement for running dagger programs
+        # In the future we should find a way to use dagger without mounting the docker socket.
+        "volumes": [{"name": "docker", "path": "/var/run/docker.sock"}],
+        "failure": "ignore",
+    }
+
+    return [
+        rgm_build_step,
+    ]
+
+docs_paths = {
+    "exclude": [
+        "*.md",
+        "docs/**",
+        "packages/**/*.md",
+        "latest.json",
+    ],
+}
+
+def rgm_main():
+    trigger = {
+        "event": [
+            "push",
+        ],
+        "branch": "main",
+        "paths": docs_paths,
+    }
+
+    return pipeline(
+        name = "rgm-main-prerelease",
+        edition = "all",
+        trigger = trigger,
+        steps = rgm_build(),
+        depends_on = ["main-test-backend", "main-test-frontend"],
+    )
+
+tag_trigger = {
+    "event": {
+        "exclude": [
+            "promote",
+        ],
+    },
+    "ref": {
+        "include": [
+            "refs/tags/v*",
+        ],
+        "exclude": [
+            "refs/tags/*-cloud*",
+        ],
+    },
+}
+
+def rgm_tag():
+    return pipeline(
+        name = "rgm-tag-prerelease",
+        edition = "all",
+        trigger = tag_trigger,
+        steps = rgm_build(script = "drone_publish_tag.sh"),
+        depends_on = [],
+    )
+
+def rgm():
+    return [
+        rgm_main(),
+        rgm_tag(),
+        verify_release_pipeline(
+            name = "rgm-tag-verify-prerelease-assets",
+            trigger = tag_trigger,
+            depends_on = ["rgm-tag-prerelease"],
+            bucket = "grafana-prerelease-dev",
+        ),
+    ]

scripts/drone/vault.star

@@ -9,6 +9,11 @@ azure_sp_app_id = "azure_sp_app_id"
 azure_sp_app_pw = "azure_sp_app_pw"
 azure_tenant = "azure_tenant"
 
+rgm_gcp_key_base64 = "gcp_key_base64"
+rgm_destination = "destination"
+rgm_github_token = "github_token"
+rgm_dagger_token = "dagger_token"
+
 def from_secret(secret):
     return {"from_secret": secret}
 
@@ -104,6 +109,31 @@ def secrets():
             "infra/data/ci/grafana-release-eng/enterprise2",
             "cdn_path",
         ),
+        vault_secret(
+            "enterprise2_security_prefix",
+            "infra/data/ci/grafana-release-eng/enterprise2",
+            "security_prefix",
+        ),
+        vault_secret(
+            rgm_gcp_key_base64,
+            "infra/data/ci/grafana-release-eng/rgm",
+            "gcp_service_account_base64",
+        ),
+        vault_secret(
+            rgm_destination,
+            "infra/data/ci/grafana-release-eng/rgm",
+            "destination",
+        ),
+        vault_secret(
+            rgm_dagger_token,
+            "infra/data/ci/grafana-release-eng/rgm",
+            "dagger_token",
+        ),
+        vault_secret(
+            rgm_github_token,
+            "infra/data/ci/github/grafanabot",
+            "pat",
+        ),
         # grafana-delivery-bot secrets
         vault_secret(
             "delivery-bot-app-id",
@@ -120,4 +150,19 @@ def secrets():
             "infra/data/ci/grafana-release-eng/grafana-delivery-bot",
             "app-private-key",
         ),
+        vault_secret(
+            rgm_gcp_key_base64,
+            "infra/data/ci/grafana-release-eng/rgm",
+            "gcp_service_account_base64",
+        ),
+        vault_secret(
+            rgm_destination,
+            "infra/data/ci/grafana-release-eng/rgm",
+            "destination",
+        ),
+        vault_secret(
+            rgm_github_token,
+            "infra/data/ci/github/grafanabot",
+            "pat",
+        ),
     ]