From a235642c77ac99ef1af9ecdd66b0b2ba817fe402 Mon Sep 17 00:00:00 2001 From: Dimitris Sotirakis Date: Mon, 15 May 2023 18:00:01 +0300 Subject: [PATCH] [v9.3.x] CI: Add delivery bot secrets to publish images step (#68467) (#68470) CI: Add delivery bot secrets to publish images step (#68467) Add delivery bot secrets (cherry picked from commit 55622615ded8205ddeb466f14d6e5efd41a165bd) # Conflicts: # .drone.yml # scripts/drone/vault.star --- .drone.yml | 68 +++++++++++++++++++++++++++++++++++- scripts/drone/steps/lib.star | 3 ++ scripts/drone/vault.star | 16 +++++++++ 3 files changed, 86 insertions(+), 1 deletion(-) diff --git a/.drone.yml b/.drone.yml index 9f4c5d5fa1e..1ae9a6925fe 100644 --- a/.drone.yml +++ b/.drone.yml @@ -1674,6 +1674,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana volumes: @@ -1694,6 +1700,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-oss volumes: @@ -3379,6 +3391,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key_hg + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-enterprise2 volumes: @@ -3479,6 +3497,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana volumes: @@ -3496,6 +3520,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-oss volumes: @@ -3575,6 +3605,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-enterprise volumes: @@ -3654,6 +3690,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-enterprise volumes: @@ -5884,6 +5926,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key_hg + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-enterprise2 volumes: @@ -6538,7 +6586,25 @@ get: kind: secret name: enterprise2_security_prefix --- +get: + name: app-id + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-id +--- +get: + name: app-installation-id + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-installation-id +--- +get: + name: app-private-key + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-private-key +--- kind: signature -hmac: 1602fdaebd9a7772096bc2237e67e4de1f814b7a5a56783e2facf04ff77fb6f2 +hmac: 607991ca52cd443cc9dc4e7774c0d80c7f4b0572dab0695289c0790bc844207b ... diff --git a/scripts/drone/steps/lib.star b/scripts/drone/steps/lib.star index a62b5d73a4a..33b4a429407 100644 --- a/scripts/drone/steps/lib.star +++ b/scripts/drone/steps/lib.star @@ -1124,6 +1124,9 @@ def publish_images_step(edition, ver_mode, mode, docker_repo, trigger = None): "GCP_KEY": from_secret("gcp_key"), "DOCKER_USER": from_secret("docker_username"), "DOCKER_PASSWORD": from_secret("docker_password"), + "GITHUB_APP_ID": from_secret("delivery-bot-app-id"), + "GITHUB_APP_INSTALLATION_ID": from_secret("delivery-bot-app-installation-id"), + "GITHUB_APP_PRIVATE_KEY": from_secret("delivery-bot-app-private-key"), } cmd = "./bin/grabpl artifacts docker publish {}--dockerhub-repo {}".format( diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star index be4a4be0c70..94c0ff7b861 100644 --- a/scripts/drone/vault.star +++ b/scripts/drone/vault.star @@ -119,4 +119,20 @@ def secrets(): "infra/data/ci/grafana-release-eng/enterprise2", "security_prefix", ), + # grafana-delivery-bot secrets + vault_secret( + "delivery-bot-app-id", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-id", + ), + vault_secret( + "delivery-bot-app-installation-id", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-installation-id", + ), + vault_secret( + "delivery-bot-app-private-key", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-private-key", + ), ]