From f2917477d656a670260c60a5886d0b4d674232a1 Mon Sep 17 00:00:00 2001
From: Julien Duchesne <julien.duchesne@grafana.com>
Date: Fri, 8 Sep 2023 01:32:37 -0400
Subject: [PATCH] [v10.1.x] CI: Get Github Token and Docker username/password
 from Vault (#74572)

CI: Get Github Token and Docker username/password from Vault (#74555)

CI: Get Docker username/password from Vault
Not Drone secrets

(cherry picked from commit 566215c22c1cac523ade21b62605a086350e0749)
---
 .drone.yml                   | 30 ++++++++++++++++++------------
 scripts/drone/steps/lib.star |  8 ++++----
 scripts/drone/vault.star     | 10 +++++-----
 3 files changed, 27 insertions(+), 21 deletions(-)

diff --git a/.drone.yml b/.drone.yml
index 389a753be3e..56a79de2bed 100644
--- a/.drone.yml
+++ b/.drone.yml
@@ -542,7 +542,7 @@ steps:
     $${TEST_TAG}
   environment:
     GITHUB_TOKEN:
-      from_secret: github_token_pr
+      from_secret: github_token
     TEST_TAG: v0.0.0-test
   failure: ignore
   image: grafana/build-container:1.7.5
@@ -677,7 +677,7 @@ steps:
       from_secret: azure_tenant
     CYPRESS_CI: "true"
     GITHUB_TOKEN:
-      from_secret: github_token_pr
+      from_secret: github_token
     HOST: grafana-server
   image: us-docker.pkg.dev/grafanalabs-dev/cloud-data-sources/e2e:latest
   name: end-to-end-tests-cloud-plugins-suite-azure
@@ -787,9 +787,9 @@ steps:
   - build-docker-images-ubuntu
   environment:
     DOCKER_PASSWORD:
-      from_secret: docker_password_pr
+      from_secret: docker_password
     DOCKER_USER:
-      from_secret: docker_username_pr
+      from_secret: docker_username
     GITHUB_APP_ID:
       from_secret: delivery-bot-app-id
     GITHUB_APP_INSTALLATION_ID:
@@ -1837,7 +1837,7 @@ steps:
       from_secret: azure_tenant
     CYPRESS_CI: "true"
     GITHUB_TOKEN:
-      from_secret: github_token_pr
+      from_secret: github_token
     HOST: grafana-server
   image: us-docker.pkg.dev/grafanalabs-dev/cloud-data-sources/e2e:latest
   name: end-to-end-tests-cloud-plugins-suite-azure
@@ -4553,6 +4553,18 @@ get:
 kind: secret
 name: prerelease_bucket
 ---
+get:
+  name: username
+  path: infra/data/ci/grafanaci-docker-hub
+kind: secret
+name: docker_username
+---
+get:
+  name: password
+  path: infra/data/ci/grafanaci-docker-hub
+kind: secret
+name: docker_password
+---
 get:
   name: credentials.json
   path: infra/data/ci/grafana/releng/artifacts-uploader-service-account
@@ -4655,12 +4667,6 @@ get:
 kind: secret
 name: dagger_token
 ---
-get:
-  name: pat
-  path: infra/data/ci/github/grafanabot
-kind: secret
-name: github_token
----
 get:
   name: app-id
   path: infra/data/ci/grafana-release-eng/grafana-delivery-bot
@@ -4686,6 +4692,6 @@ kind: secret
 name: gcr_credentials
 ---
 kind: signature
-hmac: aeae9ce425a35443ceb460a7bd475d151fbb74465ff121c6302817c1a10a0f37
+hmac: a49e733d21712d98fc2fbbf3accbe63e64d489144004c3f5e2fde9fee23e6e77
 
 ...
diff --git a/scripts/drone/steps/lib.star b/scripts/drone/steps/lib.star
index e2ab9df888d..dd0d845a8c1 100644
--- a/scripts/drone/steps/lib.star
+++ b/scripts/drone/steps/lib.star
@@ -875,7 +875,7 @@ def cloud_plugins_e2e_tests_step(suite, cloud, trigger = None):
         environment = {
             "CYPRESS_CI": "true",
             "HOST": "grafana-server",
-            "GITHUB_TOKEN": from_secret("github_token_pr"),
+            "GITHUB_TOKEN": from_secret("github_token"),
             "AZURE_SP_APP_ID": from_secret("azure_sp_app_id"),
             "AZURE_SP_PASSWORD": from_secret("azure_sp_app_pw"),
             "AZURE_TENANT": from_secret("azure_tenant"),
@@ -1021,8 +1021,8 @@ def publish_images_step(ver_mode, docker_repo, trigger = None):
 
     if ver_mode == "pr":
         environment = {
-            "DOCKER_USER": from_secret("docker_username_pr"),
-            "DOCKER_PASSWORD": from_secret("docker_password_pr"),
+            "DOCKER_USER": from_secret("docker_username"),
+            "DOCKER_PASSWORD": from_secret("docker_password"),
             "GITHUB_APP_ID": from_secret("delivery-bot-app-id"),
             "GITHUB_APP_INSTALLATION_ID": from_secret("delivery-bot-app-installation-id"),
             "GITHUB_APP_PRIVATE_KEY": from_secret("delivery-bot-app-private-key"),
@@ -1399,7 +1399,7 @@ def trigger_test_release():
         "name": "trigger-test-release",
         "image": images["build_image"],
         "environment": {
-            "GITHUB_TOKEN": from_secret("github_token_pr"),
+            "GITHUB_TOKEN": from_secret("github_token"),
             "TEST_TAG": "v0.0.0-test",
         },
         "commands": [
diff --git a/scripts/drone/vault.star b/scripts/drone/vault.star
index 31a7e9e50fe..8bfcc02cbfd 100644
--- a/scripts/drone/vault.star
+++ b/scripts/drone/vault.star
@@ -17,6 +17,9 @@ rgm_destination = "destination"
 rgm_github_token = "github_token"
 rgm_dagger_token = "dagger_token"
 
+docker_username = "docker_username"
+docker_password = "docker_password"
+
 npm_token = "npm_token"
 
 def from_secret(secret):
@@ -41,6 +44,8 @@ def secrets():
         vault_secret("github_token", "infra/data/ci/github/grafanabot", "pat"),
         vault_secret(drone_token, "infra/data/ci/drone", "machine-user-token"),
         vault_secret(prerelease_bucket, "infra/data/ci/grafana/prerelease", "bucket"),
+        vault_secret(docker_username, "infra/data/ci/grafanaci-docker-hub", "username"),
+        vault_secret(docker_password, "infra/data/ci/grafanaci-docker-hub", "password"),
         vault_secret(
             gcp_upload_artifacts_key,
             "infra/data/ci/grafana/releng/artifacts-uploader-service-account",
@@ -127,11 +132,6 @@ def secrets():
             "infra/data/ci/grafana-release-eng/rgm",
             "dagger_token",
         ),
-        vault_secret(
-            rgm_github_token,
-            "infra/data/ci/github/grafanabot",
-            "pat",
-        ),
         # grafana-delivery-bot secrets
         vault_secret(
             "delivery-bot-app-id",