CI: run release-build on a schedule; also send source-event input to GE (#108726)

* run release-build on a schedule; also send source-event input to GE

* remove cron pipelines from drone

.drone.star

@@ -7,7 +7,6 @@
 This module returns a Drone configuration including pipelines and secrets.
 """
 
-load("scripts/drone/events/cron.star", "cronjobs")
 load("scripts/drone/events/main.star", "main_pipelines")
 load("scripts/drone/events/pr.star", "pr_pipelines")
 load(
@@ -37,6 +36,5 @@ def main(_ctx):
         publish_npm_pipelines() +
         publish_packages_pipeline() +
         rgm() +
-        cronjobs() +
         secrets()
     )

.drone.yml

@@ -2426,367 +2426,6 @@ volumes:
 - name: github-app
   temp: {}
 ---
-clone:
-  retries: 3
-kind: pipeline
-name: scan-grafana/grafana:latest-image
-platform:
-  arch: amd64
-  os: linux
-steps:
-- commands:
-  - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io
-  environment:
-    GCR_CREDENTIALS:
-      from_secret: gcr_credentials
-  image: docker:dind
-  name: authenticate-gcr
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy image --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana:latest
-  depends_on:
-  - authenticate-gcr
-  image: aquasec/trivy:0.21.0
-  name: scan-unknown-low-medium-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy image --exit-code 1 --severity HIGH,CRITICAL grafana/grafana:latest
-  depends_on:
-  - authenticate-gcr
-  environment:
-    GOOGLE_APPLICATION_CREDENTIALS:
-      from_secret: gcr_credentials_json
-  image: aquasec/trivy:0.21.0
-  name: scan-high-critical-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- image: plugins/slack
-  name: slack-notify-failure
-  settings:
-    channel: grafana-backend-ops
-    template: 'Nightly docker image scan job for grafana/grafana:latest failed: {{build.link}}'
-    webhook:
-      from_secret: slack_webhook_backend
-  when:
-    status: failure
-trigger:
-  cron: nightly
-  event: cron
-type: docker
-volumes:
-- host:
-    path: /var/run/docker.sock
-  name: docker
-- name: config
-  temp: {}
----
-clone:
-  retries: 3
-kind: pipeline
-name: scan-grafana/grafana:main-image
-platform:
-  arch: amd64
-  os: linux
-steps:
-- commands:
-  - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io
-  environment:
-    GCR_CREDENTIALS:
-      from_secret: gcr_credentials
-  image: docker:dind
-  name: authenticate-gcr
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy image --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana:main
-  depends_on:
-  - authenticate-gcr
-  image: aquasec/trivy:0.21.0
-  name: scan-unknown-low-medium-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy image --exit-code 1 --severity HIGH,CRITICAL grafana/grafana:main
-  depends_on:
-  - authenticate-gcr
-  environment:
-    GOOGLE_APPLICATION_CREDENTIALS:
-      from_secret: gcr_credentials_json
-  image: aquasec/trivy:0.21.0
-  name: scan-high-critical-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- image: plugins/slack
-  name: slack-notify-failure
-  settings:
-    channel: grafana-backend-ops
-    template: 'Nightly docker image scan job for grafana/grafana:main failed: {{build.link}}'
-    webhook:
-      from_secret: slack_webhook_backend
-  when:
-    status: failure
-trigger:
-  cron: nightly
-  event: cron
-type: docker
-volumes:
-- host:
-    path: /var/run/docker.sock
-  name: docker
-- name: config
-  temp: {}
----
-clone:
-  retries: 3
-kind: pipeline
-name: scan-grafana/grafana:latest-ubuntu-image
-platform:
-  arch: amd64
-  os: linux
-steps:
-- commands:
-  - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io
-  environment:
-    GCR_CREDENTIALS:
-      from_secret: gcr_credentials
-  image: docker:dind
-  name: authenticate-gcr
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy image --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana:latest-ubuntu
-  depends_on:
-  - authenticate-gcr
-  image: aquasec/trivy:0.21.0
-  name: scan-unknown-low-medium-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy image --exit-code 1 --severity HIGH,CRITICAL grafana/grafana:latest-ubuntu
-  depends_on:
-  - authenticate-gcr
-  environment:
-    GOOGLE_APPLICATION_CREDENTIALS:
-      from_secret: gcr_credentials_json
-  image: aquasec/trivy:0.21.0
-  name: scan-high-critical-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- image: plugins/slack
-  name: slack-notify-failure
-  settings:
-    channel: grafana-backend-ops
-    template: 'Nightly docker image scan job for grafana/grafana:latest-ubuntu failed:
-      {{build.link}}'
-    webhook:
-      from_secret: slack_webhook_backend
-  when:
-    status: failure
-trigger:
-  cron: nightly
-  event: cron
-type: docker
-volumes:
-- host:
-    path: /var/run/docker.sock
-  name: docker
-- name: config
-  temp: {}
----
-clone:
-  retries: 3
-kind: pipeline
-name: scan-grafana/grafana:main-ubuntu-image
-platform:
-  arch: amd64
-  os: linux
-steps:
-- commands:
-  - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io
-  environment:
-    GCR_CREDENTIALS:
-      from_secret: gcr_credentials
-  image: docker:dind
-  name: authenticate-gcr
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy image --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana:main-ubuntu
-  depends_on:
-  - authenticate-gcr
-  image: aquasec/trivy:0.21.0
-  name: scan-unknown-low-medium-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy image --exit-code 1 --severity HIGH,CRITICAL grafana/grafana:main-ubuntu
-  depends_on:
-  - authenticate-gcr
-  environment:
-    GOOGLE_APPLICATION_CREDENTIALS:
-      from_secret: gcr_credentials_json
-  image: aquasec/trivy:0.21.0
-  name: scan-high-critical-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- image: plugins/slack
-  name: slack-notify-failure
-  settings:
-    channel: grafana-backend-ops
-    template: 'Nightly docker image scan job for grafana/grafana:main-ubuntu failed:
-      {{build.link}}'
-    webhook:
-      from_secret: slack_webhook_backend
-  when:
-    status: failure
-trigger:
-  cron: nightly
-  event: cron
-type: docker
-volumes:
-- host:
-    path: /var/run/docker.sock
-  name: docker
-- name: config
-  temp: {}
----
-clone:
-  retries: 3
-kind: pipeline
-name: scan-build-test-and-publish-docker-images
-platform:
-  arch: amd64
-  os: linux
-steps:
-- commands:
-  - echo $${GCR_CREDENTIALS} | docker login -u _json_key --password-stdin https://us.gcr.io
-  environment:
-    GCR_CREDENTIALS:
-      from_secret: gcr_credentials
-  image: docker:dind
-  name: authenticate-gcr
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM docker:27-cli
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine/git:2.40.1
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.24.5-alpine
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:22.16.0-alpine
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:22-bookworm
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM google/cloud-sdk:431.0.0
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/grafana-ci-deploy:1.3.3
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine:3.21.3
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM ubuntu:22.04
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM byrnedo/alpine-curl:0.1.8
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM plugins/slack
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM us.gcr.io/kubernetes-dev/package-publish:latest
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/drone-downstream
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/docker-puppeteer:1.1.0
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM grafana/docs-base:latest
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM cypress/included:14.3.2
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM jwilder/dockerize:0.6.1
-  - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59
-  depends_on:
-  - authenticate-gcr
-  image: aquasec/trivy:0.21.0
-  name: scan-unknown-low-medium-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- commands:
-  - trivy --exit-code 1 --severity HIGH,CRITICAL docker:27-cli
-  - trivy --exit-code 1 --severity HIGH,CRITICAL alpine/git:2.40.1
-  - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.24.5-alpine
-  - trivy --exit-code 1 --severity HIGH,CRITICAL node:22.16.0-alpine
-  - trivy --exit-code 1 --severity HIGH,CRITICAL node:22-bookworm
-  - trivy --exit-code 1 --severity HIGH,CRITICAL google/cloud-sdk:431.0.0
-  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/grafana-ci-deploy:1.3.3
-  - trivy --exit-code 1 --severity HIGH,CRITICAL alpine:3.21.3
-  - trivy --exit-code 1 --severity HIGH,CRITICAL ubuntu:22.04
-  - trivy --exit-code 1 --severity HIGH,CRITICAL byrnedo/alpine-curl:0.1.8
-  - trivy --exit-code 1 --severity HIGH,CRITICAL plugins/slack
-  - trivy --exit-code 1 --severity HIGH,CRITICAL us.gcr.io/kubernetes-dev/package-publish:latest
-  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/drone-downstream
-  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/docker-puppeteer:1.1.0
-  - trivy --exit-code 1 --severity HIGH,CRITICAL grafana/docs-base:latest
-  - trivy --exit-code 1 --severity HIGH,CRITICAL cypress/included:14.3.2
-  - trivy --exit-code 1 --severity HIGH,CRITICAL jwilder/dockerize:0.6.1
-  - trivy --exit-code 1 --severity HIGH,CRITICAL us-docker.pkg.dev/grafanalabs-global/docker-deployment-tools-prod/github-app-secret-writer:2024-11-05-v11688112090.1-83920c59
-  depends_on:
-  - authenticate-gcr
-  environment:
-    GOOGLE_APPLICATION_CREDENTIALS:
-      from_secret: gcr_credentials_json
-  image: aquasec/trivy:0.21.0
-  name: scan-high-critical-vulnerabilities
-  volumes:
-  - name: docker
-    path: /var/run/docker.sock
-  - name: config
-    path: /root/.docker/
-- image: plugins/slack
-  name: slack-notify-failure
-  settings:
-    channel: grafana-backend-ops
-    template: 'Nightly docker image scan job for build-images failed: {{build.link}}'
-    webhook:
-      from_secret: slack_webhook_backend
-  when:
-    status: failure
-trigger:
-  cron: nightly
-  event: cron
-type: docker
-volumes:
-- host:
-    path: /var/run/docker.sock
-  name: docker
-- name: config
-  temp: {}
----
 get:
   name: app-id
   path: ci/data/repo/grafana/grafana/github-app
@@ -2986,6 +2625,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: 30bdd468f35d41ca5594e5d13cf500ab4949ea875f6f88b5121a1254353e76b2
+hmac: aef043aae7394d3160a7147c8b57599bf1a2f4ba5c596ffb795a0e6a049c73a6
 
 ...

.github/workflows/release-build.yml

@@ -1,6 +1,10 @@
 name: Build Release Packages
 on:
   workflow_dispatch:
+  schedule:
+    # Every weeknight at midnight
+    # "Scheduled workflows will only run on the default branch." (docs.github.com)
+    - cron: "0 0 * * 1-5"
   push:
     branches:
       - release-*.*.*
@@ -96,8 +100,8 @@ jobs:
         with:
           github-token: ${{ steps.generate_token.outputs.token }}
           script: |
-            const {REF, VERSION, BUILD_ID, BUCKET, GRAFANA_COMMIT} = process.env;
-
+            const {REF, VERSION, BUILD_ID, BUCKET, GRAFANA_COMMIT, GITHUB_EVENT_NAME} = process.env;
+            
             await github.rest.actions.createWorkflowDispatch({
                 owner: 'grafana',
                 repo: 'grafana-enterprise',
@@ -108,6 +112,7 @@ jobs:
                   "build-id": String(BUILD_ID),
                   "bucket": BUCKET,
                   "grafana-commit": GRAFANA_COMMIT,
+                  "source-event": GITHUB_EVENT_NAME,
                 }
             })