From d5c915bb5f651c7fffdb59cc1e0f02b42a4db992 Mon Sep 17 00:00:00 2001
From: Guilherme Caulada <guilherme.caulada@grafana.com>
Date: Fri, 28 Jul 2023 16:00:29 -0300
Subject: [PATCH] [v10.0.x] CI: Update secret refs to vault ones; update
 downstream repo origin (#72549)

CI: Update secret refs to vault ones; update downstream repo origin (#72515)

Update secret refs to vault ones; update downstream repo origin

(cherry picked from commit 6669d0a704ecdd995dc970f51be390ac9d173e0a)

Co-authored-by: Kevin Minehart <kmineh0151@gmail.com>
---
 .drone.yml                                      | 14 ++++++++------
 scripts/drone/events/release.star               | 10 +++++-----
 scripts/drone/pipelines/trigger_downstream.star |  3 +++
 3 files changed, 16 insertions(+), 11 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 73fb10ff7e2..e0527896b32 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -2116,6 +2116,8 @@ trigger:
     - '*.md'
     - docs/**
     - latest.json
+  repo:
+  - grafana/grafana-security-mirror
 type: docker
 volumes:
 - host:
@@ -2294,7 +2296,7 @@ steps:
   - compile-build-cmd
   environment:
     GCP_KEY:
-      from_secret: gcp_key
+      from_secret: gcp_upload_artifacts_key
     PRERELEASE_BUCKET:
       from_secret: prerelease_bucket
   image: grafana/grafana-ci-deploy:1.3.3
@@ -2305,7 +2307,7 @@ steps:
   - compile-build-cmd
   environment:
     GCP_KEY:
-      from_secret: gcp_key
+      from_secret: gcp_upload_artifacts_key
     PRERELEASE_BUCKET:
       from_secret: prerelease_bucket
     STATIC_ASSET_EDITIONS:
@@ -2318,7 +2320,7 @@ steps:
   - compile-build-cmd
   environment:
     GCP_KEY:
-      from_secret: gcp_key
+      from_secret: gcp_upload_artifacts_key
     PRERELEASE_BUCKET:
       from_secret: prerelease_bucket
   image: grafana/grafana-ci-deploy:1.3.3
@@ -2369,7 +2371,7 @@ steps:
   - yarn-install
   environment:
     GCP_KEY:
-      from_secret: gcp_key
+      from_secret: gcp_upload_artifacts_key
     PRERELEASE_BUCKET:
       from_secret: prerelease_bucket
   failure: ignore
@@ -2876,7 +2878,7 @@ steps:
   environment:
     BUCKET: grafana-prerelease
     GCP_KEY:
-      from_secret: gcp_key
+      from_secret: gcp_upload_artifacts_key
   failure: ignore
   image: google/cloud-sdk:431.0.0
   name: gsutil-stat
@@ -4200,6 +4202,6 @@ kind: secret
 name: delivery-bot-app-private-key
 ---
 kind: signature
-hmac: 3da91b7343f684af1ea5189ebafc0730135dfb0a3f76e046a54d7462fa542129
+hmac: 31ebf70f6ac3ac5a65ba189843d00fdeeaec81c64cb2621ce247495e79045cce
 
 ...
diff --git a/scripts/drone/events/release.star b/scripts/drone/events/release.star
index 35660a5ac0c..5283c3e57a6 100644
--- a/scripts/drone/events/release.star
+++ b/scripts/drone/events/release.star
@@ -108,7 +108,7 @@ def retrieve_npm_packages_step():
         ],
         "failure": "ignore",
         "environment": {
-            "GCP_KEY": from_secret("gcp_key"),
+            "GCP_KEY": from_secret(gcp_upload_artifacts_key),
             "PRERELEASE_BUCKET": from_secret(prerelease_bucket),
         },
         "commands": ["./bin/build artifacts npm retrieve --tag ${DRONE_TAG}"],
@@ -269,7 +269,7 @@ def publish_artifacts_step():
         "name": "publish-artifacts",
         "image": images["publish_image"],
         "environment": {
-            "GCP_KEY": from_secret("gcp_key"),
+            "GCP_KEY": from_secret(gcp_upload_artifacts_key),
             "PRERELEASE_BUCKET": from_secret("prerelease_bucket"),
         },
         "commands": [
@@ -283,7 +283,7 @@ def publish_static_assets_step():
         "name": "publish-static-assets",
         "image": images["publish_image"],
         "environment": {
-            "GCP_KEY": from_secret("gcp_key"),
+            "GCP_KEY": from_secret(gcp_upload_artifacts_key),
             "PRERELEASE_BUCKET": from_secret("prerelease_bucket"),
             "STATIC_ASSET_EDITIONS": from_secret("static_asset_editions"),
         },
@@ -298,7 +298,7 @@ def publish_storybook_step():
         "name": "publish-storybook",
         "image": images["publish_image"],
         "environment": {
-            "GCP_KEY": from_secret("gcp_key"),
+            "GCP_KEY": from_secret(gcp_upload_artifacts_key),
             "PRERELEASE_BUCKET": from_secret("prerelease_bucket"),
         },
         "commands": [
@@ -436,7 +436,7 @@ def integration_test_pipelines():
 def verify_release_pipeline(
         name = "verify-prerelease-assets",
         bucket = from_secret(prerelease_bucket),
-        gcp_key = from_secret("gcp_key"),
+        gcp_key = from_secret(gcp_upload_artifacts_key),
         version = "${DRONE_TAG}",
         trigger = release_trigger,
         depends_on = [
diff --git a/scripts/drone/pipelines/trigger_downstream.star b/scripts/drone/pipelines/trigger_downstream.star
index d35e2ce090a..fdff59792ed 100644
--- a/scripts/drone/pipelines/trigger_downstream.star
+++ b/scripts/drone/pipelines/trigger_downstream.star
@@ -23,6 +23,9 @@ trigger = {
             "latest.json",
         ],
     },
+    "repo": [
+        "grafana/grafana-security-mirror",
+    ],
 }
 
 def enterprise_downstream_pipeline():