ci: migrate release workflow to grafana/plugin-actions/build-plugin#205
Conversation
Replaces the hand-rolled release steps (which were an older copy of the same upstream scaffold) with the maintained Grafana action. It performs the identical build/test/package/draft-release flow, plus: - signed build provenance attestation on the plugin zip - signing via a Grafana access policy token instead of the deprecated API key (requires a new GRAFANA_ACCESS_POLICY_TOKEN repo secret) - sha1 checksum instead of md5, matching the current submission form Signed-off-by: Patrik Cyvoct <patrik@ptrk.io>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
|
||
| - name: Create Github release | ||
| uses: softprops/action-gh-release@v1 | ||
| - uses: grafana/plugin-actions/build-plugin@build-plugin/v1.2.0 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0afcd1871b
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| - Paste this [.zip.md5 link](https://github.com/${{ github.repository }}/releases/download/v${{ steps.metadata.outputs.plugin-version }}/${{ steps.metadata.outputs.archive-checksum }}) in the MD5 field | ||
|
|
||
| Once done please remove these instructions and publish this release. | ||
| policy_token: ${{ secrets.GRAFANA_API_KEY }} |
There was a problem hiding this comment.
The new build-plugin action treats policy_token as the Grafana Access Policy Token, and the migration notes for this commit say to create GRAFANA_ACCESS_POLICY_TOKEN; pointing it at the old GRAFANA_API_KEY secret means repositories that follow the migration will pass an empty token here, causing the action to skip signing and publish an unsigned release archive. Wire this input to the new access-policy-token secret instead.
Useful? React with 👍 / 👎.
2 participants
Replaces the hand-rolled release steps (which were an older copy of the same upstream scaffold) with the maintained Grafana action. It performs the identical build/test/package/draft-release flow, plus: