Add release commands to BuildKite.

PiperOrigin-RevId: 431532954

.buildkite/hooks/post-command

@@ -1,3 +1,6 @@
+# Clear any downloaded credentials.
+rm -f repo.key
+
 # Upload all relevant test failures.
 make -s testlogs 2>/dev/null | grep // | sort | uniq | (
   declare log_count=0

.buildkite/hooks/pre-command

@@ -39,3 +39,15 @@ fi
 
 # Clear existing profiles.
 sudo rm -rf /tmp/profile
+
+# Download credentials, if a release agent.
+if test "${BUILDKITE_AGENT_META_DATA_QUEUE}" = "release"; then
+  # Update gcloud components.
+  gcloud components update -q
+
+  # Pull down secrets.
+  gcloud secrets versions access --secret="repo-key" > repo.key
+
+  # Configure the Docker credential helper (to push images).
+  gcloud auth configure-docker -q
+fi

.buildkite/pipeline.yaml

@@ -46,7 +46,9 @@ steps:
     label: ":fire: Smoke race tests"
     command: make smoke-race-tests
 
-  # Check that the Go branch builds.
+  # Check that the Go branch builds. This is not technically required, as this build is maintained
+  # as a GitHub action in order to preserve this maintaince across forks. However, providing the
+  # action here may provide easier debuggability and diagnosis on failure.
   - <<: *common
     label: ":golang: Go branch"
     commands:
@@ -118,7 +120,7 @@ steps:
     label: ":test_tube: Unit tests (cgroupv2)"
     command: make unit-tests
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
   - <<: *common
     label: ":test_tube: Container tests"
     command: make container-tests
@@ -126,7 +128,7 @@ steps:
     label: ":test_tube: Container tests (cgroupv2)"
     command: make container-tests
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
 
   # All system call tests.
   - <<: *common
@@ -142,7 +144,7 @@ steps:
     label: ":docker: Docker tests (cgroupv2)"
     command: make docker-tests
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
   - <<: *common
     label: ":goggles: Overlay tests"
     command: make overlay-tests
@@ -174,7 +176,7 @@ steps:
     label: ":docker: Containerd 1.5.4 tests (cgroupv2)"
     command: make containerd-test-1.5.4
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
   - <<: *common
     label: ":docker: Containerd 1.6.0-rc.4 tests"
     command: make containerd-test-1.6.0-rc.4
@@ -182,7 +184,7 @@ steps:
     label: ":docker: Containerd 1.6.0-rc.4 tests (cgroupv2)"
     command: make containerd-test-1.6.0-rc.4
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
 
   # Check the website builds.
   - <<: *common

.buildkite/release.yaml

@@ -0,0 +1,35 @@
+agents:
+  queue: release
+_templates:
+  common: &common
+    timeout_in_minutes: 120
+    retry:
+      automatic:
+        - exit_status: -1
+          limit: 10
+        - exit_status: "*"
+          limit: 2
+    # This is enforced by the environment hooks on the release agents
+    # as well, only the master branch may be built there.
+    if: build.branch == "master" || build.tag != null
+
+steps:
+  - <<: *common
+    label: ":ship: Push all images (x86_64)"
+    commands:
+      - make push-all-images
+  - <<: *common
+    label: "ship: Push all images (aarch64)"
+    commands:
+      - make ARCH=aarch64 push-all-images
+  - <<: *common
+    label: ":ship: Release"
+    commands:
+      - make artifacts/x86_64
+      - make BAZEL_OPTIONS=--config=cross-aarch64 artifacts/aarch64
+      - make release RELEASE_NIGHTLY=$$RELEASE_NIGHTLY
+      - cd repo && gsutil cp -r . gs://gvisor/releases/
+  - <<: *common
+    label: ":ship: Website Deploy"
+    commands:
+      - make website-deploy