[gztong666]

Description

Assign APT_GPG_KEY_ID before exporting it so that set -e observes a failed Secret Manager lookup.

Motivation

export APT_GPG_KEY_ID=$(...) reports the status of the export builtin, which can mask a nonzero exit from gcloud. The release script can therefore continue with an empty key ID after a permissions, network, or Secret Manager failure.

The separate assignment returns gcloud's status and stops the script immediately.

Testing

Verified with a fake gcloud returning a nonzero status that the original form continues and the updated form exits before subsequent release setup.

Build API Changes

No

Checklist

• I have added tests for the new use cases (manual regression test; this release helper has no unit-test target).
• I have updated the documentation (not applicable).

Release Notes

RELNOTES: None

Related issue

Fixes #31337

[gztong666]

@bazelbuild/triage Hi, this PR is ready for review and linked to its tracking issue. Could you please help route it to an appropriate reviewer when time permits? Thank you.

I missed the 7-business-day guidance when I posted this. Sorry for the premature ping; I'll wait until the recommended time.

[meisterT]

Making this fail at top-level will break anyone sourcing scripts/ci/build.sh (e.g. for bazel_build) without bazel-public Secret Manager permissions.

Please resolve APT_GPG_KEY_ID lazily inside ensure_gpg_secret_key_imported() instead (similar to how github_token is fetched in bazel_release on line 153), e.g.:

if [[ -z "${APT_GPG_KEY_ID:-}" ]]; then
  APT_GPG_KEY_ID="$(gcloud secrets versions access latest --secret="release-key-gpg-id" --project="bazel-public")"
  export APT_GPG_KEY_ID
fi

[gztong666]

Thanks — addressed in 3d938f9. APT_GPG_KEY_ID is now resolved lazily inside ensure_gpg_secret_key_imported() only when it is unset, and it is exported after the Secret Manager lookup succeeds. Sourcing scripts/ci/build.sh no longer requires access to the bazel-public secret.