Move secrets declaration inside reusable wf

Author: cristianoventura

.github/workflows/e2e-build-test.yml

@@ -7,7 +7,7 @@ on:
         description: Version suffix to apply before building
         required: false
         type: string
-        default: ""
+        default: "e2e"
       build-command:
         description: npm script to execute (publish/package)
         required: true
@@ -59,15 +59,34 @@ jobs:
     env:
       BUILD_COMMAND: ${{ inputs.build-command }}
     steps:
+      - id: get-secrets
+        uses: grafana/shared-workflows/actions/get-vault-secrets@5d7e361bc7e0a183cde8afe9899fb7b596d2659b # v1.2.0
+        with:
+          repo_secrets: |
+            APPLE_CERTIFICATE_P12=apple-certificates:APPLE_CERTIFICATE_P12
+            CERTIFICATE_PASSWORD=apple-certificates:APPLE_CERTIFICATE_P12_PASSWORD
+            APPLE_API_KEY_ID=apple-certificates:APPLE_API_KEY_ID
+            APPLE_API_ISSUER=apple-certificates:APPLE_API_ISSUER
+            APPLE_API_KEY=apple-certificates:APPLE_API_KEY
+            SENTRY_DSN=sentry:SENTRY_DSN
+            SENTRY_AUTH_TOKEN=sentry:SENTRY_AUTH_TOKEN
+
       - uses: actions/checkout@v4
         with:
           persist-credentials: false
 
+      - name: Set version for test release
+        env:
+          PACKAGE_VERSION: ${{ inputs.version }}
+        run: python update_version.py
+
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
 
+      # try earlier python version for appdmg
+      # https://github.com/electron/forge/issues/3371#issuecomment-2105195302
       - name: Install Python 3.11.4
         uses: actions/setup-python@v4
         with:

.github/workflows/release-please-e2e-tests.yml

@@ -16,14 +16,3 @@ jobs:
     uses: ./.github/workflows/e2e-build-test.yml
     with:
       build-command: package
-    secrets:
-      APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
-      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
-      APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-      TRUSTED_SIGNING_ACCOUNT: grafana-premium-eastus
-      TRUSTED_SIGNING_ENDPOINT: https://eus.codesigning.azure.net/
-      TRUSTED_SIGNING_PROFILE: grafana-production

.github/workflows/release-test-version.yml

@@ -20,14 +20,3 @@ jobs:
     with:
       version: ${{ inputs.version }}
       build-command: publish
-    secrets:
-      APPLE_CERTIFICATE_P12: ${{ secrets.APPLE_CERTIFICATE_P12 }}
-      CERTIFICATE_PASSWORD: ${{ secrets.CERTIFICATE_PASSWORD }}
-      APPLE_API_KEY: ${{ secrets.APPLE_API_KEY }}
-      APPLE_API_KEY_ID: ${{ secrets.APPLE_API_KEY_ID }}
-      APPLE_API_ISSUER: ${{ secrets.APPLE_API_ISSUER }}
-      SENTRY_DSN: ${{ secrets.SENTRY_DSN }}
-      SENTRY_AUTH_TOKEN: ${{ secrets.SENTRY_AUTH_TOKEN }}
-      TRUSTED_SIGNING_ACCOUNT: grafana-premium-eastus
-      TRUSTED_SIGNING_ENDPOINT: https://eus.codesigning.azure.net/
-      TRUSTED_SIGNING_PROFILE: grafana-production