From 56a1bf85ea0a247059b8c8a353c38c6447ba8bbc Mon Sep 17 00:00:00 2001
From: Julien Duchesne <julien.duchesne@grafana.com>
Date: Fri, 8 Sep 2023 01:31:35 -0400
Subject: [PATCH] [v9.4.x] CI: Get Github Token and Docker username/password
 from Vault (#74570)

CI: Get Github Token and Docker username/password from Vault (#74555)

CI: Get Docker username/password from Vault
Not Drone secrets

(cherry picked from commit 566215c22c1cac523ade21b62605a086350e0749)
---
 .drone.yml                   | 30 ++++++++++++++++++------------
 scripts/drone/steps/lib.star |  8 ++++----
 scripts/drone/vault.star     | 10 +++++-----
 3 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index df758882e0e..25abc41b86f 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -522,7 +522,7 @@ steps:
     $${TEST_TAG}
   environment:
     GITHUB_TOKEN:
-      from_secret: github_token_pr
+      from_secret: github_token
     TEST_TAG: v0.0.0-test
   failure: ignore
   image: grafana/build-container:1.7.4
@@ -655,7 +655,7 @@ steps:
       from_secret: azure_tenant
     CYPRESS_CI: "true"
     GITHUB_TOKEN:
-      from_secret: github_token_pr
+      from_secret: github_token
     HOST: grafana-server
   image: us-docker.pkg.dev/grafanalabs-dev/cloud-data-sources/e2e:latest
   name: end-to-end-tests-cloud-plugins-suite-azure
@@ -765,9 +765,9 @@ steps:
   - build-docker-images-ubuntu
   environment:
     DOCKER_PASSWORD:
-      from_secret: docker_password_pr
+      from_secret: docker_password
     DOCKER_USER:
-      from_secret: docker_username_pr
+      from_secret: docker_username
     GITHUB_APP_ID:
       from_secret: delivery-bot-app-id
     GITHUB_APP_INSTALLATION_ID:
@@ -1554,7 +1554,7 @@ steps:
       from_secret: azure_tenant
     CYPRESS_CI: "true"
     GITHUB_TOKEN:
-      from_secret: github_token_pr
+      from_secret: github_token
     HOST: grafana-server
   image: us-docker.pkg.dev/grafanalabs-dev/cloud-data-sources/e2e:latest
   name: end-to-end-tests-cloud-plugins-suite-azure
@@ -4066,6 +4066,18 @@ get:
 kind: secret
 name: prerelease_bucket
 ---
+get:
+  name: username
+  path: infra/data/ci/grafanaci-docker-hub
+kind: secret
+name: docker_username
+---
+get:
+  name: password
+  path: infra/data/ci/grafanaci-docker-hub
+kind: secret
+name: docker_password
+---
 get:
   name: credentials.json
   path: infra/data/ci/grafana/releng/artifacts-uploader-service-account
@@ -4168,12 +4180,6 @@ get:
 kind: secret
 name: dagger_token
 ---
-get:
-  name: pat
-  path: infra/data/ci/github/grafanabot
-kind: secret
-name: github_token
----
 get:
   name: app-id
   path: infra/data/ci/grafana-release-eng/grafana-delivery-bot
@@ -4217,6 +4223,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 02f793b4c9aa5845d933c61b88a0405e4dd168ff4ce2a5b49cd8058dc30b516e
+hmac: 7b1430302204101d4d4ce1200c4bad598c18a9042a39d71e8bda7f12a7071157
 
 ...
diff --git a/scripts/drone/steps/lib.star b/scripts/drone/steps/lib.star
index 364d7d82331..64d656a164c 100644
--- a/scripts/drone/steps/lib.star
+++ b/scripts/drone/steps/lib.star
@@ -843,7 +843,7 @@ def cloud_plugins_e2e_tests_step(suite, cloud, trigger = None):
         environment = {
             "CYPRESS_CI": "true",
             "HOST": "grafana-server",
-            "GITHUB_TOKEN": from_secret("github_token_pr"),
+            "GITHUB_TOKEN": from_secret("github_token"),
             "AZURE_SP_APP_ID": from_secret("azure_sp_app_id"),
             "AZURE_SP_PASSWORD": from_secret("azure_sp_app_pw"),
             "AZURE_TENANT": from_secret("azure_tenant"),
@@ -989,8 +989,8 @@ def publish_images_step(ver_mode, docker_repo, trigger = None):
 
     if ver_mode == "pr":
         environment = {
-            "DOCKER_USER": from_secret("docker_username_pr"),
-            "DOCKER_PASSWORD": from_secret("docker_password_pr"),
+            "DOCKER_USER": from_secret("docker_username"),
+            "DOCKER_PASSWORD": from_secret("docker_password"),
             "GITHUB_APP_ID": from_secret("delivery-bot-app-id"),
             "GITHUB_APP_INSTALLATION_ID": from_secret("delivery-bot-app-installation-id"),
             "GITHUB_APP_PRIVATE_KEY": from_secret("delivery-bot-app-private-key"),
@@ -1348,7 +1348,7 @@ def trigger_test_release():
         "name": "trigger-test-release",
         "image": images["build_image"],
         "environment": {
-            "GITHUB_TOKEN": from_secret("github_token_pr"),
+            "GITHUB_TOKEN": from_secret("github_token"),
             "TEST_TAG": "v0.0.0-test",
         },
         "commands": [
diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star
index 908299a66d0..b0e2bd2e1ec 100644
--- a/scripts/drone/vault.star
+++ b/scripts/drone/vault.star
@@ -17,6 +17,9 @@ rgm_destination = "destination"
 rgm_github_token = "github_token"
 rgm_dagger_token = "dagger_token"
 
+docker_username = "docker_username"
+docker_password = "docker_password"
+
 npm_token = "npm_token"
 
 def from_secret(secret):
@@ -41,6 +44,8 @@ def secrets():
         vault_secret("github_token", "infra/data/ci/github/grafanabot", "pat"),
         vault_secret(drone_token, "infra/data/ci/drone", "machine-user-token"),
         vault_secret(prerelease_bucket, "infra/data/ci/grafana/prerelease", "bucket"),
+        vault_secret(docker_username, "infra/data/ci/grafanaci-docker-hub", "username"),
+        vault_secret(docker_password, "infra/data/ci/grafanaci-docker-hub", "password"),
         vault_secret(
             gcp_upload_artifacts_key,
             "infra/data/ci/grafana/releng/artifacts-uploader-service-account",
@@ -127,11 +132,6 @@ def secrets():
             "infra/data/ci/grafana-release-eng/rgm",
             "dagger_token",
         ),
-        vault_secret(
-            rgm_github_token,
-            "infra/data/ci/github/grafanabot",
-            "pat",
-        ),
         # grafana-delivery-bot secrets
         vault_secret(
             "delivery-bot-app-id",