From 415df3104f04b10b46bc1d077ec4eefe903f86a7 Mon Sep 17 00:00:00 2001 From: "renovate-sh-app[bot]" <219655108+renovate-sh-app[bot]@users.noreply.github.com> Date: Mon, 28 Sep 2026 15:16:07 +0000 Subject: [PATCH 1/2] chore(ci): update grafana/shared-workflows/get-vault-secrets action to v2.1 --- .github/workflows/ci.yml | 8 ++++---- .github/workflows/deploy-to-developer-portal-dev.yml | 2 +- .github/workflows/deploy-to-developer-portal-prod.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7446681dd7..a6bf2d2b3b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -24,7 +24,7 @@ jobs: steps: - id: get-secrets if: ${{ github.event.pull_request.head.repo.fork != true }} - uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1 + uses: grafana/shared-workflows/actions/get-vault-secrets@2f1ddaf3ce1aa677356243d0dd584be33cfa35e3 # get-vault-secrets/v2.1 with: # Secrets placed in the ci/repo/grafana/plugin-tools in vault repo_secrets: | @@ -93,7 +93,7 @@ jobs: steps: - id: get-secrets if: ${{ github.event.pull_request.head.repo.fork != true }} - uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1 + uses: grafana/shared-workflows/actions/get-vault-secrets@2f1ddaf3ce1aa677356243d0dd584be33cfa35e3 # get-vault-secrets/v2.1 with: # Secrets placed in the ci/repo/grafana/plugin-tools in vault repo_secrets: | @@ -287,7 +287,7 @@ jobs: steps: - id: get-secrets if: ${{ github.event.pull_request.head.repo.fork != true }} - uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1 + uses: grafana/shared-workflows/actions/get-vault-secrets@2f1ddaf3ce1aa677356243d0dd584be33cfa35e3 # get-vault-secrets/v2.1 with: # Secrets placed in the ci/repo/grafana/plugin-tools in vault repo_secrets: | @@ -296,7 +296,7 @@ jobs: - name: Get secrets for DockerHub login if: ${{ github.event.pull_request.head.repo.fork != true }} - uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1 + uses: grafana/shared-workflows/actions/get-vault-secrets@2f1ddaf3ce1aa677356243d0dd584be33cfa35e3 # get-vault-secrets/v2.1 with: common_secrets: | DOCKERHUB_USERNAME=dockerhub:username diff --git a/.github/workflows/deploy-to-developer-portal-dev.yml b/.github/workflows/deploy-to-developer-portal-dev.yml index 8bd5c6ca20..1c23d416b7 100644 --- a/.github/workflows/deploy-to-developer-portal-dev.yml +++ b/.github/workflows/deploy-to-developer-portal-dev.yml @@ -21,7 +21,7 @@ jobs: NX_BRANCH: ${{ github.event.number || github.ref_name }} steps: - id: get-secrets - uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1 + uses: grafana/shared-workflows/actions/get-vault-secrets@2f1ddaf3ce1aa677356243d0dd584be33cfa35e3 # get-vault-secrets/v2.1 with: # Secrets placed in the ci/repo/grafana/plugin-tools in vault repo_secrets: | diff --git a/.github/workflows/deploy-to-developer-portal-prod.yml b/.github/workflows/deploy-to-developer-portal-prod.yml index f5b2c4b844..073ffe58ab 100644 --- a/.github/workflows/deploy-to-developer-portal-prod.yml +++ b/.github/workflows/deploy-to-developer-portal-prod.yml @@ -22,7 +22,7 @@ jobs: NX_BRANCH: ${{ github.event.number || github.ref_name }} steps: - id: get-secrets - uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1 + uses: grafana/shared-workflows/actions/get-vault-secrets@2f1ddaf3ce1aa677356243d0dd584be33cfa35e3 # get-vault-secrets/v2.1 with: # Secrets placed in the ci/repo/grafana/plugin-tools in vault repo_secrets: | From 589a7b290017605e6ceef3e0552d4d14ef913533 Mon Sep 17 00:00:00 2001 From: Timur Olzhabayev Date: Mon, 28 Sep 2026 17:20:34 +0200 Subject: [PATCH 2/2] fix(ci): read vault secrets from json output for get-vault-secrets v2 --- .github/workflows/ci.yml | 14 ++++++++++---- .../workflows/deploy-to-developer-portal-dev.yml | 6 ++++++ .../workflows/deploy-to-developer-portal-prod.yml | 6 ++++++ 3 files changed, 22 insertions(+), 4 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index a6bf2d2b3b..35c9106bb9 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -30,6 +30,13 @@ jobs: repo_secrets: | NX_CLOUD_ACCESS_TOKEN=nx_token:nx_token + # get-vault-secrets v2 no longer exports env vars, and Nx reads the token from the environment. + - name: Export Nx Cloud token + if: ${{ github.event.pull_request.head.repo.fork != true }} + env: + NX_CLOUD_ACCESS_TOKEN: ${{ fromJSON(steps.get-secrets.outputs.secrets).NX_CLOUD_ACCESS_TOKEN }} + run: echo "NX_CLOUD_ACCESS_TOKEN=${NX_CLOUD_ACCESS_TOKEN}" >> "$GITHUB_ENV" + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: @@ -98,7 +105,6 @@ jobs: # Secrets placed in the ci/repo/grafana/plugin-tools in vault repo_secrets: | GRAFANA_ACCESS_POLICY_TOKEN=gcom_access_policy_token:gcom_access_policy_token - export_env: false - name: Setup nodejs uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0 @@ -292,9 +298,9 @@ jobs: # Secrets placed in the ci/repo/grafana/plugin-tools in vault repo_secrets: | GRAFANA_ACCESS_POLICY_TOKEN=gcom_access_policy_token:gcom_access_policy_token - export_env: false - name: Get secrets for DockerHub login + id: get-dockerhub-secrets if: ${{ github.event.pull_request.head.repo.fork != true }} uses: grafana/shared-workflows/actions/get-vault-secrets@2f1ddaf3ce1aa677356243d0dd584be33cfa35e3 # get-vault-secrets/v2.1 with: @@ -390,8 +396,8 @@ jobs: if: ${{ github.event.pull_request.head.repo.fork != true }} uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0 with: - username: ${{ env.DOCKERHUB_USERNAME }} - password: ${{ env.DOCKERHUB_PASSWORD }} + username: ${{ fromJSON(steps.get-dockerhub-secrets.outputs.secrets).DOCKERHUB_USERNAME }} + password: ${{ fromJSON(steps.get-dockerhub-secrets.outputs.secrets).DOCKERHUB_PASSWORD }} - name: Start grafana server for e2e tests (latest) run: ANONYMOUS_AUTH_ENABLED=false GRAFANA_VERSION=latest docker compose up -d diff --git a/.github/workflows/deploy-to-developer-portal-dev.yml b/.github/workflows/deploy-to-developer-portal-dev.yml index 1c23d416b7..70fb31e10b 100644 --- a/.github/workflows/deploy-to-developer-portal-dev.yml +++ b/.github/workflows/deploy-to-developer-portal-dev.yml @@ -27,6 +27,12 @@ jobs: repo_secrets: | NX_CLOUD_ACCESS_TOKEN=nx_token:nx_token + # get-vault-secrets v2 no longer exports env vars, and Nx reads the token from the environment. + - name: Export Nx Cloud token + env: + NX_CLOUD_ACCESS_TOKEN: ${{ fromJSON(steps.get-secrets.outputs.secrets).NX_CLOUD_ACCESS_TOKEN }} + run: echo "NX_CLOUD_ACCESS_TOKEN=${NX_CLOUD_ACCESS_TOKEN}" >> "$GITHUB_ENV" + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: diff --git a/.github/workflows/deploy-to-developer-portal-prod.yml b/.github/workflows/deploy-to-developer-portal-prod.yml index 073ffe58ab..c79d9acbe6 100644 --- a/.github/workflows/deploy-to-developer-portal-prod.yml +++ b/.github/workflows/deploy-to-developer-portal-prod.yml @@ -28,6 +28,12 @@ jobs: repo_secrets: | NX_CLOUD_ACCESS_TOKEN=nx_token:nx_token + # get-vault-secrets v2 no longer exports env vars, and Nx reads the token from the environment. + - name: Export Nx Cloud token + env: + NX_CLOUD_ACCESS_TOKEN: ${{ fromJSON(steps.get-secrets.outputs.secrets).NX_CLOUD_ACCESS_TOKEN }} + run: echo "NX_CLOUD_ACCESS_TOKEN=${NX_CLOUD_ACCESS_TOKEN}" >> "$GITHUB_ENV" + - name: Checkout repository uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: