From 693b373e682d1558fa408b31d7cb90f1e2ae7009 Mon Sep 17 00:00:00 2001
From: Jev Forsberg <46619047+baldm0mma@users.noreply.github.com>
Date: Wed, 30 Apr 2025 07:45:18 -0600
Subject: [PATCH] Chore: Migrate to Vault Secrets (#104701)

* baldm0mma/ use valut secrets

* baldm0mma/ rem zizmor annos
---
 .github/workflows/community-release.yml | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/community-release.yml b/.github/workflows/community-release.yml
index 73c72749baa..5b278c24da4 100644
--- a/.github/workflows/community-release.yml
+++ b/.github/workflows/community-release.yml
@@ -11,11 +11,6 @@ on:
         required: false
         default: false
         description: When enabled, this workflow will print a preview instead of creating an actual post.
-    secrets:
-      GRAFANA_MISC_STATS_API_KEY:
-        required: true
-      GRAFANABOT_FORUM_KEY:
-        required: true
   workflow_dispatch:
     inputs:
       version:
@@ -30,17 +25,27 @@ on:
 
 permissions:
   contents: read
+  id-token: write
 
 jobs:
   main:
     runs-on: ubuntu-latest
     steps:
+      - name: "Get vault secrets"
+        id: vault-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main
+        with:
+          # Secrets placed in the ci/repo/grafana/grafana/community_release path in Vault
+          repo_secrets: |
+            GRAFANA_MISC_STATS_API_KEY=community_release:GRAFANA_MISC_STATS_API_KEY
+            GRAFANABOT_FORUM_KEY=community_release:GRAFANABOT_FORUM_KEY
+
       - name: Run community-release (manually invoked)
-        uses: grafana/grafana-github-actions-go/community-release@main # zizmor: ignore[unpinned-uses]
+        uses: grafana/grafana-github-actions-go/community-release@main
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           version: ${{ inputs.version }}
-          metrics_api_key: ${{ secrets.GRAFANA_MISC_STATS_API_KEY }}
-          community_api_key: ${{ secrets.GRAFANABOT_FORUM_KEY }}
+          metrics_api_key: ${{ env.GRAFANA_MISC_STATS_API_KEY }}
+          community_api_key: ${{ env.GRAFANABOT_FORUM_KEY }}
           community_api_username: grafanabot
           dry_run: ${{ inputs.dry_run }}