Fix permissions for packaging (#39218)

This commit fixes the release-manager error

> # > java.io.FileNotFoundException: /artifacts/build/distributions/... (Permission denied)

by adjusting the permissions of parent directories.
Additionally there are a few logging enhancements to improve debugging, as well as the introduction
of a new optional `DRA_BRANCH` environment variable, to help running and debugging via PRs.

Relates elastic/ingest-dev#3095

---------

Signed-off-by: Alexandros Sapranidis <[email protected]>
Co-authored-by: Dimitrios Liappis <[email protected]>

.buildkite/scripts/dra.sh

@@ -1,16 +1,29 @@
 #!/usr/bin/env bash
 
-## TODO: Set to empty string when Jenkins is disabled
-if [[ "$DRY_RUN" == "false" ]]; then echo "--- Running in publish mode"; DRY_RUN=""; else echo "--- Running in dry-run mode"; DRY_RUN="--dry-run"; fi
-set -euo pipefail
-BRANCH="${BUILDKITE_BRANCH}"
+# TODO: uncomment out below when Jenkins packaging has been stopped
+# if [[ "$DRY_RUN" == "true" ]]; then
+#     echo "~~~ Running in dry-run mode -- will NOT publish artifacts"
+#     DRY_RUN="--dry-run"
+# else
+#     echo "~~~ Running in publish mode"
+#     DRY_RUN=""
+# fi
 
-if [[ "${BUILDKITE_PULL_REQUEST:="false"}" != "false" ]]; then
-    BRANCH=main
+# TODO: delete the conditional below (and replace it with the above, uncommented out, section) after Jenkins packaging has been stopped
+if [[ "$DRY_RUN" == "false" ]]; then
+    echo "~~~ Running in publish mode"
+    DRY_RUN=""
+else
+    echo "~~~ Running in dry-run mode -- will NOT publish artifacts"
     DRY_RUN="--dry-run"
-    echo "+++ Running in PR and setting branch main and --dry-run"
 fi
 
+set -euo pipefail
+
+# DRA_BRANCH can be used for manually testing packaging with PRs
+# e.g. define `DRA_BRANCH="main"` and `RUN_SNAPSHOT="true"` under Options/Environment Variables in the Buildkite UI after clicking new Build
+BRANCH="${DRA_BRANCH:="${BUILDKITE_BRANCH:=""}"}"
+
 BEAT_VERSION=$(make get-version)
 
 CI_DRA_ROLE_PATH="kv/ci-shared/release/dra-role"
@@ -23,12 +36,16 @@ function release_manager_login {
   export VAULT_ADDR_SECRET VAULT_ROLE_ID_SECRET VAULT_SECRET
 }
 
+set +x
 release_manager_login
 
-echo "+++ Changing permissions for the BK API commands"
-sudo chown -R :1000 build/distributions/
+# required by the release-manager docker image, otherwise we hit:
+# > java.io.FileNotFoundException: /artifacts/build/distributions/agentbeat/agentbeat-8.15.0-SNAPSHOT-darwin-x86_64.tar.gz.sha512 (Permission denied)
+chmod -R a+r build/*
+chmod -R a+w build
 
-echo "+++ :hammer_and_pick: Listing $BRANCH $DRA_WORKFLOW DRA artifacts..."
+echo "+++ :clipboard: Listing DRA artifacts for version [$BEAT_VERSION], branch [$BRANCH] and workflow [$DRA_WORKFLOW]"
+set +x
 docker run --rm \
         --name release-manager \
         -e VAULT_ADDR="${VAULT_ADDR_SECRET}" \
@@ -44,7 +61,9 @@ docker run --rm \
         --version "${BEAT_VERSION}" \
         --artifact-set "main"
 
-echo "+++ :hammer_and_pick: Publishing $BRANCH $DRA_WORKFLOW DRA artifacts..."
+echo "+++ :hammer_and_pick: Publishing DRA artifacts for version [$BEAT_VERSION], branch [$BRANCH], workflow [$DRA_WORKFLOW] and DRY_RUN: [$DRY_RUN]"
+
+set +x
 docker run --rm \
         --name release-manager \
         -e VAULT_ADDR="${VAULT_ADDR_SECRET}" \
@@ -59,4 +78,13 @@ docker run --rm \
         --workflow "${DRA_WORKFLOW}" \
         --version "${BEAT_VERSION}" \
         --artifact-set "main" \
-        ${DRY_RUN}
+        ${DRY_RUN} | tee rm-output.txt
+
+# extract the summary URL from a release manager output line like:
+# Report summary-18.22.0.html can be found at https://artifacts-staging.elastic.co/beats/18.22.0-ABCDEFGH/summary-18.22.0.html
+
+SUMMARY_URL=$(grep -E '^Report summary-.* can be found at ' rm-output.txt | grep -oP 'https://\S+' | awk '{print $1}')
+rm rm-output.txt
+
+# and make it easily clickable as a Builkite annotation
+printf "**Summary link:** [${SUMMARY_URL}](${SUMMARY_URL})\n" | buildkite-agent annotate --style=success