From da1a53ebb16ba3b71d5c206fe95c9607fb033ea1 Mon Sep 17 00:00:00 2001
From: Andres Martinez Gotor <andres.martinez@grafana.com>
Date: Tue, 31 Oct 2023 16:53:39 +0100
Subject: [PATCH] Chore: Build and release GH action: Use vault secrets
 (#77448)

---
 .../core-plugins-build-and-release.yml        | 21 +++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/core-plugins-build-and-release.yml b/.github/workflows/core-plugins-build-and-release.yml
index a1a18cc2621..6ae5f37d3f4 100644
--- a/.github/workflows/core-plugins-build-and-release.yml
+++ b/.github/workflows/core-plugins-build-and-release.yml
@@ -17,6 +17,11 @@ env:
   GCP_BUCKET: integration-artifacts # Dev: plugins-community-staging
   GCOM_API: https://grafana.com # Dev: https://grafana-dev.com
 
+# These permissions are needed to assume roles from Github's OIDC.
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
   build-and-publish:
     name: Build and publish ${{ inputs.plugin_id }}
@@ -31,10 +36,18 @@ jobs:
       - name: Verify inputs
         run: |
           if [ -z ${{ inputs.plugin_id }} ]; then echo "Missing plugin ID"; exit 1; fi
+      - id: get-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@main
+        with:
+          # Secrets placed in the ci/repo/grafana/<repo>/<path> path in Vault
+          repo_secrets: |
+            PLUGINS_GOOGLE_CREDENTIALS=core-plugins-build-and-release:PLUGINS_GOOGLE_CREDENTIALS
+            PLUGINS_GRAFANA_API_KEY=core-plugins-build-and-release:PLUGINS_GRAFANA_API_KEY
+            PLUGINS_GCOM_TOKEN=core-plugins-build-and-release:PLUGINS_GCOM_TOKEN
       - name: 'Authenticate to Google Cloud'
         uses: 'google-github-actions/auth@v1'
         with:
-          credentials_json: '${{ secrets.PLUGINS_GOOGLE_CREDENTIALS }}'
+          credentials_json: '${{ env.PLUGINS_GOOGLE_CREDENTIALS }}'
       - name: 'Set up Cloud SDK'
         uses: 'google-github-actions/setup-gcloud@v1'
       - name: Setup nodejs environment
@@ -140,11 +153,11 @@ jobs:
           mkdir -p ci/jobs/package
           bin/grabpl plugin package
         env:
-          GRAFANA_API_KEY: ${{ secrets.PLUGINS_GRAFANA_API_KEY }}
+          GRAFANA_API_KEY: ${{ env.PLUGINS_GRAFANA_API_KEY }}
           PLUGIN_SIGNATURE_TYPE: grafana
       - name: Check existing release
         env:
-          GCOM_TOKEN: ${{ secrets.PLUGINS_GCOM_TOKEN }}
+          GCOM_TOKEN: ${{ env.PLUGINS_GCOM_TOKEN }}
           VERSION: ${{ steps.build_frontend.outputs.version }}  
         run: |
           api_res=$(curl -X 'GET' -H "Authorization: Bearer $GCOM_TOKEN" \
@@ -177,7 +190,7 @@ jobs:
       - name: Publish new plugin version on grafana.com
         working-directory: ${{ steps.get_dir.outputs.dir }}
         env:
-          GCOM_TOKEN: ${{ secrets.PLUGINS_GCOM_TOKEN }}
+          GCOM_TOKEN: ${{ env.PLUGINS_GCOM_TOKEN }}
           VERSION: ${{ steps.build_frontend.outputs.version }}  
         run: |
           echo "Publish new plugin version on grafana.com:"