From 5cfaa79a1a20b68941babf87f44889d8d7b65a68 Mon Sep 17 00:00:00 2001
From: Adin Scannell <ascannell@google.com>
Date: Tue, 1 Mar 2022 23:32:28 -0800
Subject: [PATCH] Fix gcloud secret access.

The secret access command apparently returns JSON (why!??) and the
payload is base64 encoded. Decode per the example provided in the
documentation [1].

[1] https://cloud.google.com/sdk/gcloud/reference/secrets/versions/access

PiperOrigin-RevId: 431862918
---
 .buildkite/hooks/pre-command | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index 4519c3e14..82204f0b4 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -43,7 +43,7 @@ sudo rm -rf /tmp/profile
 # Download credentials, if a release agent.
 if test "${BUILDKITE_AGENT_META_DATA_QUEUE}" = "release"; then
   # Pull down secrets.
-  gcloud secrets versions access --secret="repo-key" latest > repo.key
+  gcloud secrets versions access --secret="repo-key" --format='get(payload.data)' latest | tr '_-' '/+' | base64 -d  > repo.key
 
   # Configure the Docker credential helper (to push images).
   gcloud auth configure-docker -q