From 711770642a96af6525c059dca4f7269d946a5fb4 Mon Sep 17 00:00:00 2001
From: Adin Scannell <ascannell@google.com>
Date: Mon, 28 Feb 2022 14:56:09 -0800
Subject: [PATCH] Add release commands to BuildKite.

PiperOrigin-RevId: 431532954
---
 .buildkite/hooks/post-command |  3 +++
 .buildkite/hooks/pre-command  | 12 ++++++++++++
 .buildkite/pipeline.yaml      | 14 ++++++++------
 .buildkite/release.yaml       | 35 +++++++++++++++++++++++++++++++++++
 4 files changed, 58 insertions(+), 6 deletions(-)
 create mode 100644 .buildkite/release.yaml

diff --git a/.buildkite/hooks/post-command b/.buildkite/hooks/post-command
index 5e6db407a..6a84bbdb2 100644
--- a/.buildkite/hooks/post-command
+++ b/.buildkite/hooks/post-command
@@ -1,3 +1,6 @@
+# Clear any downloaded credentials.
+rm -f repo.key
+
 # Upload all relevant test failures.
 make -s testlogs 2>/dev/null | grep // | sort | uniq | (
   declare log_count=0
diff --git a/.buildkite/hooks/pre-command b/.buildkite/hooks/pre-command
index ce7c2cff8..83304fdaa 100644
--- a/.buildkite/hooks/pre-command
+++ b/.buildkite/hooks/pre-command
@@ -39,3 +39,15 @@ fi
 
 # Clear existing profiles.
 sudo rm -rf /tmp/profile
+
+# Download credentials, if a release agent.
+if test "${BUILDKITE_AGENT_META_DATA_QUEUE}" = "release"; then
+  # Update gcloud components.
+  gcloud components update -q
+
+  # Pull down secrets.
+  gcloud secrets versions access --secret="repo-key" > repo.key
+
+  # Configure the Docker credential helper (to push images).
+  gcloud auth configure-docker -q
+fi
diff --git a/.buildkite/pipeline.yaml b/.buildkite/pipeline.yaml
index d26c5c6a6..ab894f899 100644
--- a/.buildkite/pipeline.yaml
+++ b/.buildkite/pipeline.yaml
@@ -46,7 +46,9 @@ steps:
     label: ":fire: Smoke race tests"
     command: make smoke-race-tests
 
-  # Check that the Go branch builds.
+  # Check that the Go branch builds. This is not technically required, as this build is maintained
+  # as a GitHub action in order to preserve this maintaince across forks. However, providing the
+  # action here may provide easier debuggability and diagnosis on failure.
   - <<: *common
     label: ":golang: Go branch"
     commands:
@@ -118,7 +120,7 @@ steps:
     label: ":test_tube: Unit tests (cgroupv2)"
     command: make unit-tests
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
   - <<: *common
     label: ":test_tube: Container tests"
     command: make container-tests
@@ -126,7 +128,7 @@ steps:
     label: ":test_tube: Container tests (cgroupv2)"
     command: make container-tests
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
 
   # All system call tests.
   - <<: *common
@@ -142,7 +144,7 @@ steps:
     label: ":docker: Docker tests (cgroupv2)"
     command: make docker-tests
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
   - <<: *common
     label: ":goggles: Overlay tests"
     command: make overlay-tests
@@ -174,7 +176,7 @@ steps:
     label: ":docker: Containerd 1.5.4 tests (cgroupv2)"
     command: make containerd-test-1.5.4
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
   - <<: *common
     label: ":docker: Containerd 1.6.0-rc.4 tests"
     command: make containerd-test-1.6.0-rc.4
@@ -182,7 +184,7 @@ steps:
     label: ":docker: Containerd 1.6.0-rc.4 tests (cgroupv2)"
     command: make containerd-test-1.6.0-rc.4
     agents:
-            queue: "cgroupv2"
+      queue: "cgroupv2"
 
   # Check the website builds.
   - <<: *common
diff --git a/.buildkite/release.yaml b/.buildkite/release.yaml
new file mode 100644
index 000000000..4de0da4fc
--- /dev/null
+++ b/.buildkite/release.yaml
@@ -0,0 +1,35 @@
+agents:
+  queue: release
+_templates:
+  common: &common
+    timeout_in_minutes: 120
+    retry:
+      automatic:
+        - exit_status: -1
+          limit: 10
+        - exit_status: "*"
+          limit: 2
+    # This is enforced by the environment hooks on the release agents
+    # as well, only the master branch may be built there.
+    if: build.branch == "master" || build.tag != null
+
+steps:
+  - <<: *common
+    label: ":ship: Push all images (x86_64)"
+    commands:
+      - make push-all-images
+  - <<: *common
+    label: "ship: Push all images (aarch64)"
+    commands:
+      - make ARCH=aarch64 push-all-images
+  - <<: *common
+    label: ":ship: Release"
+    commands:
+      - make artifacts/x86_64
+      - make BAZEL_OPTIONS=--config=cross-aarch64 artifacts/aarch64
+      - make release RELEASE_NIGHTLY=$$RELEASE_NIGHTLY
+      - cd repo && gsutil cp -r . gs://gvisor/releases/
+  - <<: *common
+    label: ":ship: Website Deploy"
+    commands:
+      - make website-deploy