chore: Update release scripts to use Trampoline V2 and Secret Manager (…

…googleapis#3649)

.kokoro/populate-secrets.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+# Copyright 2020 Google LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This file is called in the early stage of `trampoline_v2.sh` to
+# populate secrets needed for the CI builds.
+
+set -eo pipefail
+
+function now { date +"%Y-%m-%d %H:%M:%S" | tr -d '\n' ;}
+function msg { println "$*" >&2 ;}
+function println { printf '%s\n' "$(now) $*" ;}
+
+# Populates requested secrets set in SECRET_MANAGER_KEYS
+
+# In Kokoro CI builds, we use the service account attached to the
+# Kokoro VM. This means we need to setup auth on other CI systems.
+# For local run, we just use the gcloud command for retrieving the
+# secrets.
+
+if [[ "${RUNNING_IN_CI:-}" == "true" ]]; then
+    GCLOUD_COMMANDS=(
+        "docker"
+        "run"
+        "--entrypoint=gcloud"
+        "--volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR}"
+        "gcr.io/google.com/cloudsdktool/cloud-sdk"
+    )
+    if [[ "${TRAMPOLINE_CI:-}" == "kokoro" ]]; then
+        SECRET_LOCATION="${KOKORO_GFILE_DIR}/secret_manager"
+    else
+        echo "Authentication for this CI system is not implemented yet."
+        exit 2
+        # TODO: Determine appropriate SECRET_LOCATION and the GCLOUD_COMMANDS.
+    fi
+else
+    # For local run, use /dev/shm or temporary directory for
+    # KOKORO_GFILE_DIR.
+    if [[ -d "/dev/shm" ]]; then
+        export KOKORO_GFILE_DIR=/dev/shm
+    else
+        export KOKORO_GFILE_DIR=$(mktemp -d -t ci-XXXXXXXX)
+    fi
+    SECRET_LOCATION="${KOKORO_GFILE_DIR}/secret_manager"
+    GCLOUD_COMMANDS=("gcloud")
+fi
+
+msg "Creating folder on disk for secrets: ${SECRET_LOCATION}"
+mkdir -p ${SECRET_LOCATION}
+
+for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g")
+do
+    msg "Retrieving secret ${key}"
+    "${GCLOUD_COMMANDS[@]}" \
+        secrets versions access latest \
+        --project cloud-devrel-kokoro-resources \
+        --secret $key > \
+        "$SECRET_LOCATION/$key"
+    if [[ $? == 0 ]]; then
+        msg "Secret written to ${SECRET_LOCATION}/${key}"
+    else
+        msg "Error retrieving secret ${key}"
+        exit 2
+    fi
+done

.kokoro/release.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+
+set -eo pipefail
+
+# Install gems in the user directory because the default install directory
+# is in a read-only location.
+export GEM_HOME=$HOME/.gem
+export PATH=$GEM_HOME/bin:$PATH
+
+python3 -m pip install git+https://github.com/googleapis/releasetool
+python3 -m pip install gcp-docuploader
+gem install --no-document toys
+bundle install
+
+if [ "$PACKAGE" = "ALL_GENERATED" ]; then
+    # This is not called from autorelease, so don't run publish-reporter-script
+    toys kokoro release-all-generated < /dev/null
+else
+    python3 -m releasetool publish-reporter-script > /tmp/publisher-script; source /tmp/publisher-script
+    toys kokoro release "$PACKAGE" < /dev/null
+fi

.kokoro/release/common.cfg

@@ -17,28 +17,6 @@ before_action {
   }
 }
 
-# Fetch magictoken to use with Magic Github Proxy 
-before_action {
-  fetch_keystore {
-    keystore_resource {
-      keystore_config_id: 73713
-      keyname: "releasetool-magictoken"
-      backend_type: FASTCONFIGPUSH
-    }
-  }
-}
-
-# Fetch api key to use with Magic Github Proxy 
-before_action {
-  fetch_keystore {
-    keystore_resource {
-      keystore_config_id: 73713
-      keyname: "magic-github-proxy-api-key"
-      backend_type: FASTCONFIGPUSH
-    }
-  }
-}
-
 before_action {
   fetch_keystore {
     keystore_resource {
@@ -55,35 +33,20 @@ gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/google-cloud-ruby"
 gfile_resources: "/bigstore/cloud-devrel-kokoro-resources/trampoline"
 
 # Use the trampoline script to run in docker.
-build_file: "google-api-ruby-client/.kokoro/trampoline.sh"
+build_file: "google-api-ruby-client/.kokoro/trampoline_v2.sh"
 
 # Configure the docker image for kokoro-trampoline.
 env_vars: {
-    key: "TRAMPOLINE_IMAGE"
-    value: "gcr.io/cloud-devrel-kokoro-resources/yoshi-ruby/release"
-}
-
-env_vars: {
-    key: "TRAMPOLINE_BUILD_FILE"
-    value: "github/google-api-ruby-client/.kokoro/build.sh"
-}
-
-env_vars: {
-    key: "TRAMPOLINE_SCRIPT"
-    value: "trampoline_v1.py"
-}
-
-env_vars: {
-    key: "JOB_TYPE"
-    value: "release"
+  key: "TRAMPOLINE_IMAGE"
+  value: "gcr.io/cloud-devrel-kokoro-resources/yoshi-ruby/release"
 }
 
 env_vars: {
-    key: "OS"
-    value: "linux"
+  key: "TRAMPOLINE_BUILD_FILE"
+  value: ".kokoro/release.sh"
 }
 
 env_vars: {
-    key: "REPO_DIR"
-    value: "github/google-api-ruby-client"
+  key: "SECRET_MANAGER_KEYS"
+  value: "releasetool-publish-reporter-app,releasetool-publish-reporter-googleapis-installation,releasetool-publish-reporter-pem"
 }