fix: bring in latest release code for packaging

.github/jsonnetfile.lock.json

@@ -8,8 +8,8 @@
           "subdir": ""
         }
       },
-      "version": "f2ecd4b9e440db32204d56ea3fa464528791dfb7",
-      "sum": "kwWkJCH7fQrx+taP3aG6DbSSogKZJUOJH+zg90LKJk4="
+      "version": "f72257799328f71b176977c0d153b07cc9d3fed8",
+      "sum": "6yBogVNQP6DztYZgvE7Bbuen9Dvn+v8jk70QPYM0HS0="
     }
   ],
   "legacyImports": false

.github/workflows/minor-release-pr.yml

@@ -139,8 +139,6 @@ jobs:
       shell: "bash"
       working-directory: "lib"
   dist:
-    container:
-      image: "grafana/loki-build-image:0.33.0"
     needs:
     - "version"
     runs-on: "ubuntu-latest"
@@ -154,13 +152,36 @@ jobs:
       uses: "google-github-actions/auth@v2"
       with:
         credentials_json: "${{ secrets.GCS_SERVICE_ACCOUNT_KEY }}"
+    - id: "get-secrets"
+      name: "get nfpm signing keys"
+      uses: "grafana/shared-workflows/actions/get-vault-secrets@main"
+      with:
+        common_secrets: |
+          NFPM_SIGNING_KEY=packages-gpg:private-key
+          NFPM_PASSPHRASE=packages-gpg:passphrase
     - env:
         BUILD_IN_CONTAINER: false
         DRONE_TAG: "${{ needs.version.outputs.version }}"
         IMAGE_TAG: "${{ needs.version.outputs.version }}"
+        NFPM_SIGNING_KEY_FILE: "nfpm-private-key.key"
         SKIP_ARM: true
       name: "build artifacts"
-      run: "make dist packages"
+      run: |
+        cat <<EOF | docker run \
+          --interactive \
+          --env BUILD_IN_CONTAINER \
+          --env DRONE_TAG \
+          --env IMAGE_TAG \
+          --env NFPM_PASSPHRASE \
+          --env NFPM_SIGNING_KEY \
+          --env NFPM_SIGNING_KEY_FILE \
+          --env SKIP_ARM \
+          --volume .:/src/loki \
+          --workdir /src/loki \
+          --entrypoint /bin/sh "grafana/loki-build-image:0.33.0"
+          echo "${NFPM_SIGNING_KEY}" > $NFPM_SIGNING_KEY_FILE
+          make dist packages
+        EOF
       shell: "bash"
       working-directory: "release"
     - name: "upload build artifacts"
@@ -921,4 +942,5 @@ name: "create release PR"
     - "k[0-9]+"
 permissions:
   contents: "write"
+  id-token: "write"
   pull-requests: "write"

.github/workflows/patch-release-pr.yml

@@ -139,8 +139,6 @@ jobs:
       shell: "bash"
       working-directory: "lib"
   dist:
-    container:
-      image: "grafana/loki-build-image:0.33.0"
     needs:
     - "version"
     runs-on: "ubuntu-latest"
@@ -154,13 +152,36 @@ jobs:
       uses: "google-github-actions/auth@v2"
       with:
         credentials_json: "${{ secrets.GCS_SERVICE_ACCOUNT_KEY }}"
+    - id: "get-secrets"
+      name: "get nfpm signing keys"
+      uses: "grafana/shared-workflows/actions/get-vault-secrets@main"
+      with:
+        common_secrets: |
+          NFPM_SIGNING_KEY=packages-gpg:private-key
+          NFPM_PASSPHRASE=packages-gpg:passphrase
     - env:
         BUILD_IN_CONTAINER: false
         DRONE_TAG: "${{ needs.version.outputs.version }}"
         IMAGE_TAG: "${{ needs.version.outputs.version }}"
+        NFPM_SIGNING_KEY_FILE: "nfpm-private-key.key"
         SKIP_ARM: false
       name: "build artifacts"
-      run: "make dist packages"
+      run: |
+        cat <<EOF | docker run \
+          --interactive \
+          --env BUILD_IN_CONTAINER \
+          --env DRONE_TAG \
+          --env IMAGE_TAG \
+          --env NFPM_PASSPHRASE \
+          --env NFPM_SIGNING_KEY \
+          --env NFPM_SIGNING_KEY_FILE \
+          --env SKIP_ARM \
+          --volume .:/src/loki \
+          --workdir /src/loki \
+          --entrypoint /bin/sh "grafana/loki-build-image:0.33.0"
+          echo "${NFPM_SIGNING_KEY}" > $NFPM_SIGNING_KEY_FILE
+          make dist packages
+        EOF
       shell: "bash"
       working-directory: "release"
     - name: "upload build artifacts"
@@ -922,4 +943,5 @@ name: "create release PR"
     - "fix-action-names-in-main"
 permissions:
   contents: "write"
+  id-token: "write"
   pull-requests: "write"