[v9.4.x] CI: Move npm token to Vault (#73457)

CI: Move npm token to Vault (#73407)

(cherry picked from commit c86a73c794)

.drone.yml

@@ -3964,6 +3964,12 @@ get:
 kind: secret
 name: azure_tenant
 ---
+get:
+  name: token
+  path: infra/data/ci/grafana-release-eng/npm
+kind: secret
+name: npm_token
+---
 get:
   name: public-key-b64
   path: infra/data/ci/packages-publish/gpg
@@ -4079,6 +4085,6 @@ kind: secret
 name: github_token
 ---
 kind: signature
-hmac: 422025d1ee9f0377ebd0a14b0eea0379459a68f7aa8820269a932519a1bf8275
+hmac: 8b1f8284085a24cc4cf1db90b30c0bccac09cc7121fc853787a9ee70c10bc3b4
 
 ...

scripts/drone/events/release.star

@@ -53,6 +53,7 @@ load(
     "scripts/drone/vault.star",
     "from_secret",
     "gcp_upload_artifacts_key",
+    "npm_token",
     "prerelease_bucket",
 )
 load(
@@ -122,7 +123,7 @@ def release_npm_packages_step():
         ],
         "failure": "ignore",
         "environment": {
-            "NPM_TOKEN": from_secret("npm_token"),
+            "NPM_TOKEN": from_secret(npm_token),
         },
         "commands": ["./bin/build artifacts npm release --tag ${DRONE_TAG}"],
     }

scripts/drone/steps/lib.star

@@ -8,6 +8,7 @@ load(
     "gcp_grafanauploads",
     "gcp_grafanauploads_base64",
     "gcp_upload_artifacts_key",
+    "npm_token",
     "prerelease_bucket",
 )
 load(
@@ -1099,7 +1100,7 @@ def release_canary_npm_packages_step(trigger = None):
         "image": images["build_image"],
         "depends_on": end_to_end_tests_deps(),
         "environment": {
-            "NPM_TOKEN": from_secret("npm_token"),
+            "NPM_TOKEN": from_secret(npm_token),
         },
         "commands": [
             "./scripts/circle-release-canary-packages.sh",

scripts/drone/vault.star

@@ -17,6 +17,8 @@ rgm_destination = "destination"
 rgm_github_token = "github_token"
 rgm_dagger_token = "dagger_token"
 
+npm_token = "npm_token"
+
 def from_secret(secret):
     return {"from_secret": secret}
 
@@ -64,6 +66,11 @@ def secrets():
             "infra/data/ci/datasources/cpp-azure-resourcemanager-credentials",
             "tenant_id",
         ),
+        vault_secret(
+            npm_token,
+            "infra/data/ci/grafana-release-eng/npm",
+            "token",
+        ),
         # Package publishing
         vault_secret(
             "packages_gpg_public_key",