Move secrets fetching to pre-command hook

.buildkite/air_gapped_pipeline.yml

@@ -1,5 +1,6 @@
 steps:
-  - label: ":white_check_mark: Build air-gapped"
+  - key: "publish-air-gapped-doc"
+    label: ":white_check_mark: Build and publish air-gapped doc"
     command: ".buildkite/scripts/publish_air_gapped_docs.sh"
     env:
       AIR_GAPPED: "docker.elastic.co/docs-private/bk_air_gapped:latest"

.buildkite/hooks/pre-command

@@ -37,4 +37,7 @@ elif [[ "$BUILDKITE_PIPELINE_SLUG" == "docs-preview-cleaner" ]];then
     export GITHUB_TOKEN=$(retry 5 vault kv get -field=value secret/ci/elastic-docs/docs_preview_cleaner)
 elif [[ "$BUILDKITE_PIPELINE_SLUG" == "docs-build" ]];then
     export BUILD_MACHINE_TYPE="n2-highcpu-32"
+elif [[ "$BUILDKITE_PIPELINE_SLUG" == "docs-build-air-gapped" ]] && [[ "$BUILDKITE_STEP_KEY" == "publish-air-gapped-doc" ]]; then
+    export DOCKER_USERNAME=$(retry 5 vault kv get -field=username secret/ci/elastic-docs/docker.elastic.co)
+    export DOCKER_PASSWORD=$(retry 5 vault kv get -field=password secret/ci/elastic-docs/docker.elastic.co)
 fi

.buildkite/scripts/publish_air_gapped_docs.sh

@@ -1,15 +1,7 @@
 #!/bin/bash
 set -eo pipefail
 
-# Log in to docker.elastic.co.
-set +x
-DOCKER_USERNAME=$(vault kv get -field=username secret/ci/elastic-docs/docker.elastic.co)
-DOCKER_PASSWORD=$(vault kv get -field=password secret/ci/elastic-docs/docker.elastic.co)
-source .buildkite/scripts/retry.sh
-retry 5 docker login -u $DOCKER_USERNAME -p $DOCKER_PASSWORD docker.elastic.co
-unset DOCKER_USERNAME
-unset DOCKER_PASSWORD
-set -x
-
 source ./air_gapped/build_bk.sh
+echo $DOCKER_PASSWORD |  docker login --username $DOCKER_USERNAME --password-stdin docker.elastic.co
+echo "Pushing doc to $AIR_GAPPED"
 docker push "$AIR_GAPPED"

air_gapped/build_bk.sh

@@ -3,7 +3,6 @@
 # Build the docker image for the air gapped docs.
 
 set -eo pipefail
-
 cd $(git rev-parse --show-toplevel)
 
 if [[ ! -d /opt/git-mirrors/built-docs.git ]]; then