From b31c0b78970d2b58facf2feac57e39ff6f028b9d Mon Sep 17 00:00:00 2001 From: Dimitris Sotirakis Date: Mon, 15 May 2023 18:18:09 +0300 Subject: [PATCH] [v9.4.x] CI: Add delivery bot secrets to publish images step (#68467) (#68471) CI: Add delivery bot secrets to publish images step (#68467) Add delivery bot secrets (cherry picked from commit 55622615ded8205ddeb466f14d6e5efd41a165bd) # Conflicts: # .drone.yml # scripts/drone/vault.star --- .drone.yml | 68 +++++++++++++++++++++++++++++++++++- scripts/drone/steps/lib.star | 3 ++ scripts/drone/vault.star | 16 +++++++++ 3 files changed, 86 insertions(+), 1 deletion(-) diff --git a/.drone.yml b/.drone.yml index 7d0e05c2a7e..e78d2e84cc0 100644 --- a/.drone.yml +++ b/.drone.yml @@ -1567,6 +1567,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana volumes: @@ -1587,6 +1593,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-oss volumes: @@ -3272,6 +3284,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key_hg + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-enterprise2 volumes: @@ -3372,6 +3390,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana volumes: @@ -3389,6 +3413,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-oss volumes: @@ -3468,6 +3498,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-enterprise volumes: @@ -3547,6 +3583,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-grafana-enterprise volumes: @@ -5777,6 +5819,12 @@ steps: from_secret: docker_username GCP_KEY: from_secret: gcp_key_hg + GITHUB_APP_ID: + from_secret: delivery-bot-app-id + GITHUB_APP_INSTALLATION_ID: + from_secret: delivery-bot-app-installation-id + GITHUB_APP_PRIVATE_KEY: + from_secret: delivery-bot-app-private-key image: google/cloud-sdk name: publish-images-enterprise2 volumes: @@ -6431,7 +6479,25 @@ get: kind: secret name: enterprise2_security_prefix --- +get: + name: app-id + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-id +--- +get: + name: app-installation-id + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-installation-id +--- +get: + name: app-private-key + path: infra/data/ci/grafana-release-eng/grafana-delivery-bot +kind: secret +name: delivery-bot-app-private-key +--- kind: signature -hmac: 76a18c197130db261f5986fdfbdd4c9d2ce4f93c8fe03e4c49414b893ec18e5f +hmac: dc87e832b20fa1ec789dbb2837fc9c6d333070d66dcf2a6ec67b2fe6a1bbccb4 ... diff --git a/scripts/drone/steps/lib.star b/scripts/drone/steps/lib.star index 117ffe28f4a..bab4129f94f 100644 --- a/scripts/drone/steps/lib.star +++ b/scripts/drone/steps/lib.star @@ -1081,6 +1081,9 @@ def publish_images_step(edition, ver_mode, mode, docker_repo, trigger = None): "GCP_KEY": from_secret("gcp_key"), "DOCKER_USER": from_secret("docker_username"), "DOCKER_PASSWORD": from_secret("docker_password"), + "GITHUB_APP_ID": from_secret("delivery-bot-app-id"), + "GITHUB_APP_INSTALLATION_ID": from_secret("delivery-bot-app-installation-id"), + "GITHUB_APP_PRIVATE_KEY": from_secret("delivery-bot-app-private-key"), } cmd = "./bin/grabpl artifacts docker publish {}--dockerhub-repo {}".format( diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star index be4a4be0c70..94c0ff7b861 100644 --- a/scripts/drone/vault.star +++ b/scripts/drone/vault.star @@ -119,4 +119,20 @@ def secrets(): "infra/data/ci/grafana-release-eng/enterprise2", "security_prefix", ), + # grafana-delivery-bot secrets + vault_secret( + "delivery-bot-app-id", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-id", + ), + vault_secret( + "delivery-bot-app-installation-id", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-installation-id", + ), + vault_secret( + "delivery-bot-app-private-key", + "infra/data/ci/grafana-release-eng/grafana-delivery-bot", + "app-private-key", + ), ]