fix(intergral/ci): stop false 403 log flood and gate latest to -REL tags

[jhawksley-intergral]

Three small fixes for the 12.4.8-B update (GFN-134).

GFN-130 — false 403 log flood. The datasource proxy logged plugin route is not covered by RBAC and disabled default falling back to 403 at error level above the method checks, so it fired on every Prometheus proxy GET while the request was then allowed through. This is the bulk of a log flood that started when 12.4.8 REL reached production and forced a log-flood alarm to be disabled. Deleted, matching what upstream did in Grafana 13 (main and release-13.2.1 have no log there at all).

The Loki gating and the DELETE/PUT/POST blocks are deliberately untouched — that part of the hunk is the fix for GL-Vuln VUL-2026-0084 and must stay.

GFN-133 — latest moved by pre-release tags. on_release.yml applied intergral/grafana:latest on any tag push, so cutting an RC repointed the public tag at a release candidate; RC0 held latest for 9 days. Now only tags ending -REL move it.

GFN-129 — BUILD_BRANCH hardcoded. Release images reported branch: main regardless of stream. Now passes the tag.

Neither workflow change is exercised by CI — they only take effect on a tag push, and B-RC0 is the first exercise of the non-REL path. Verification is tracked in GFN-135.

[codehub-agent]

What this PR does

What this PR does

Removes a mis-placed error-level log call in the datasource proxy's route validation and tightens two release-workflow behaviors so latest and BUILD_BRANCH only reflect actual REL tags.

• pkg/api/pluginproxy/ds_proxy.go: deletes the ctxLogger.Error(...) call that fired on every Prometheus/Loki/Amazon-Prometheus/Azure-Prometheus proxy request (including allowed GETs) before the method-based DELETE/PUT/POST checks; those checks and Loki gating (VUL-2026-0084 fix) are unchanged.
• on_release.yml: intergral/grafana:latest is now only applied when the pushed tag ends in -REL; other tags (e.g. RC tags) publish only their own tag, no longer clobbering latest.
• on_release.yml: BUILD_BRANCH build-arg now uses ${{ github.ref_name }} instead of a hardcoded main, so release images report the actual tag/branch.

Risk: Low — validateRequest has 3 call sites and is part of a proxy chain with high fan-in (NewDataSourceProxy×3, director×2), but the change only removes a log statement, no control flow. Transitive reach is 0.03% of production symbols (contained). Workflow changes are untested by CI and only take effect on the next tag push (first non-REL exercise is B-RC0, tracked in GFN-135).

Flagged because it touches a contract (httpClient) — callers elsewhere may be affected.

⚡ Blast radius

2 files · 11 symbols touched · 28 call sites elsewhere in the codebase

symbol	kind	fan-in	file
NewDataSourceProxy	Function	3	pkg/api/pluginproxy/ds_proxy.go
validateRequest	Method	3	pkg/api/pluginproxy/ds_proxy.go
director	Method	2	pkg/api/pluginproxy/ds_proxy.go
newHTTPClient	Function	1	pkg/api/pluginproxy/ds_proxy.go
HandleRequest	Method	1	pkg/api/pluginproxy/ds_proxy.go
addTraceFromHeaderValue	Method	1	pkg/api/pluginproxy/ds_proxy.go

⚠️ Contracts touched (interfaces or fan-in ≥ 10): httpClient — callers elsewhere may be affected.

Explore this PR's blast radius → · graph: workspace c3075765a84f · by CodeHub

💰 Agent economics

no agent sessions have reported to this workspace in the last 30 days, so there is no spend to attribute. Set up agent telemetry →

Full economics → · by CodeHub