Merge branch 'main' into dax/rollout_the_frontend_on_conf_change

Author: daxmc99

dev/ci/scripts/wolfi/build-package.sh

@@ -4,6 +4,10 @@ set -euf -o pipefail
 
 cd "$(dirname "${BASH_SOURCE[0]}")/../../../.."
 
+MAIN_BRANCH="main"
+BRANCH="${BUILDKITE_BRANCH:-'default-branch'}"
+IS_MAIN=$([ "$BRANCH" = "$MAIN_BRANCH" ] && echo "true" || echo "false")
+
 tmpdir=$(mktemp -d -t melange-bin.XXXXXXXX)
 # shellcheck disable=SC2317
 # false positive by shellcheck https://github.com/koalaman/shellcheck/issues/2660
@@ -61,8 +65,15 @@ fi
 
 echo " * Building melange package '$name'"
 
+# Sign index, using separate keys from GCS for staging and prod repos
+if [[ "$IS_MAIN" == "true" ]]; then
+  key_path="/keys/sourcegraph-melange-prod.rsa"
+else
+  key_path="/keys/sourcegraph-melange-dev.rsa"
+fi
+
 # Build package
-melange build "$name.yaml" --arch x86_64 --generate-index false
+melange build "$name.yaml" --arch x86_64 --generate-index false --signing-key "$key_path"
 
 # Upload package as build artifact
 buildkite-agent artifact upload packages/*/*