From 7f3371e4d2624b86f644c0f23e2687b33d866c89 Mon Sep 17 00:00:00 2001 From: Dimitris Sotirakis Date: Mon, 15 May 2023 18:00:14 +0300 Subject: [PATCH] [v9.5.x] CI: Add delivery bot secrets to publish images step (#68467) (#68472) CI: Add delivery bot secrets to publish images step (#68467) Add delivery bot secrets (cherry picked from commit 55622615ded8205ddeb466f14d6e5efd41a165bd) # Conflicts: # .drone.yml # scripts/drone/vault.star --- .drone.yml | 68 +++++++++++++++++++++++++++++++++++- scripts/drone/steps/lib.star | 3 ++ scripts/drone/vault.star | 16 +++++++++ 3 files changed, 86 insertions(+), 1 deletion(-) diff --git a/.drone.yml b/.drone.yml index 875613c3007..27a8ce9cf7f 100644 --- a/.drone.yml +++ b/.drone.yml @@ -1674,6 +1674,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana volumes: @@ -1694,6 +1700,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-oss volumes: @@ -3379,6 +3391,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key_hg + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-enterprise2 volumes: @@ -3479,6 +3497,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana volumes: @@ -3496,6 +3520,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-oss volumes: @@ -3575,6 +3605,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-enterprise volumes: @@ -3654,6 +3690,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-enterprise volumes: @@ -5884,6 +5926,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key_hg + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-enterprise2 volumes: @@ -6538,7 +6586,25 @@ get: kind: secret name: enterprise2_security_prefix --- +get: + name: app-id + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-id +--- +get: + name: app-installation-id + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-installation-id +--- +get: + name: app-private-key + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-private-key +--- kind: signature -hmac: ca432f305ce9d0d043e397927150d119651d732d6e6018429f215a7c510e83bd +hmac: 91534a7349b2cc7d167e119f6c1a028e66b94853e60c6f837d0168205772d235 ... diff --git a/scripts/drone/steps/lib.star b/scripts/drone/steps/lib.star index 37152b1109b..2aee59e2466 100644 --- a/scripts/drone/steps/lib.star +++ b/scripts/drone/steps/lib.star @@ -1124,6 +1124,9 @@ def publish_images_step(edition, ver_mode, mode, docker_repo, trigger = None): "GCP_KEY": from_secret("gcp_key"), "DOCKER_USER": from_secret("docker_username"), "DOCKER_PASSWORD": from_secret("docker_password"), + "GITHUB_APP_ID": from_secret("delivery-bot-app-id"), + "GITHUB_APP_INSTALLATION_ID": from_secret("delivery-bot-app-installation-id"), + "GITHUB_APP_PRIVATE_KEY": from_secret("delivery-bot-app-private-key"), } cmd = "./bin/grabpl artifacts docker publish {}--dockerhub-repo {}".format( diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star index be4a4be0c70..94c0ff7b861 100644 --- a/scripts/drone/vault.star +++ b/scripts/drone/vault.star @@ -119,4 +119,20 @@ def secrets(): "infra/data/ci/grafana-release-eng/enterprise2", "security_prefix", ), + # grafana-delivery-bot secrets + vault_secret( + "delivery-bot-app-id", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-id", + ), + vault_secret( + "delivery-bot-app-installation-id", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-installation-id", + ), + vault_secret( + "delivery-bot-app-private-key", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-private-key", + ), ]