From 2902e9551be9d2f878205c940f538da28ed8ea45 Mon Sep 17 00:00:00 2001
From: Horst Gutmann <horst.gutmann@grafana.com>
Date: Tue, 29 Aug 2023 10:05:26 +0200
Subject: [PATCH] [v10.0.x] CI: Different secret for verification and do not
 ignore build failures (#73616)

CI: Different secret for verification and do not ignore build failures (#73613)

(cherry picked from commit 8fc3be6b5a1919100f8e8408d2b06c48be6b0707)
---
 .drone.yml                        | 6 ++----
 scripts/drone/events/release.star | 4 ++--
 scripts/drone/rgm.star            | 9 +++++----
 3 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index e73b268ef12..7787f03a2c4 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -2748,7 +2748,6 @@ steps:
       from_secret: packages_gpg_private_key
     GPG_PUBLIC_KEY:
       from_secret: packages_gpg_public_key
-  failure: ignore
   image: grafana/grafana-build:main
   name: rgm-build
   volumes:
@@ -2862,8 +2861,7 @@ steps:
   environment:
     BUCKET: grafana-prerelease
     GCP_KEY:
-      from_secret: gcp_grafanauploads_base64
-  failure: ignore
+      from_secret: gcp_key_base64
   image: google/cloud-sdk:431.0.0
   name: gsutil-stat
 trigger:
@@ -4322,6 +4320,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: c835b2804679a3207697c8dc1b515ffbdcad5c12b4b0aabd1eb3ee01902c1223
+hmac: 39fac391717124335cb454514c2c4757de5b19b17ac051192cd6bb62b89a50fe
 
 ...
diff --git a/scripts/drone/events/release.star b/scripts/drone/events/release.star
index 3f0b9a88566..f93dc30e0b1 100644
--- a/scripts/drone/events/release.star
+++ b/scripts/drone/events/release.star
@@ -57,6 +57,7 @@ load(
     "gcp_grafanauploads_base64",
     "npm_token",
     "prerelease_bucket",
+    "rgm_gcp_key_base64",
 )
 load(
     "scripts/drone/utils/images.star",
@@ -437,7 +438,7 @@ def integration_test_pipelines():
 def verify_release_pipeline(
         name = "verify-prerelease-assets",
         bucket = from_secret(prerelease_bucket),
-        gcp_key = from_secret(gcp_grafanauploads_base64),
+        gcp_key = from_secret(rgm_gcp_key_base64),
         version = "${DRONE_TAG}",
         trigger = release_trigger,
         depends_on = [
@@ -465,7 +466,6 @@ def verify_release_pipeline(
             "./scripts/list-release-artifacts.sh {} | xargs -n1 gsutil stat >> /tmp/stat.log".format(version),
             "! cat /tmp/stat.log | grep \"No URLs matched\"",
         ],
-        "failure": "ignore",
     }
     return pipeline(
         depends_on = depends_on,
diff --git a/scripts/drone/rgm.star b/scripts/drone/rgm.star
index e6851373103..0721f76b32b 100644
--- a/scripts/drone/rgm.star
+++ b/scripts/drone/rgm.star
@@ -73,7 +73,7 @@ tag_trigger = {
     },
 }
 
-def rgm_build(script = "drone_publish_main.sh"):
+def rgm_build(script = "drone_publish_main.sh", canFail = True):
     rgm_build_step = {
         "name": "rgm-build",
         "image": "grafana/grafana-build:main",
@@ -85,8 +85,9 @@ def rgm_build(script = "drone_publish_main.sh"):
         # The docker socket is a requirement for running dagger programs
         # In the future we should find a way to use dagger without mounting the docker socket.
         "volumes": [{"name": "docker", "path": "/var/run/docker.sock"}],
-        "failure": "ignore",
     }
+    if canFail:
+        rgm_build_step["failure"] = "ignore"
 
     return [
         rgm_build_step,
@@ -107,7 +108,7 @@ def rgm_main():
     return pipeline(
         name = "rgm-main-prerelease",
         trigger = trigger,
-        steps = rgm_build(),
+        steps = rgm_build(canFail = True),
         depends_on = ["main-test-backend", "main-test-frontend"],
     )
 
@@ -115,7 +116,7 @@ def rgm_tag():
     return pipeline(
         name = "rgm-tag-prerelease",
         trigger = tag_trigger,
-        steps = rgm_build(script = "drone_publish_tag_grafana.sh"),
+        steps = rgm_build(script = "drone_publish_tag_grafana.sh", canFail = False),
         depends_on = ["release-test-backend", "release-test-frontend"],
     )