Skip to content

Commit ac22420

Browse files
omeheganomehegan
committed
Merge remote-tracking branch 'origin/main' into owen/SUP-6535
2 parents e44caae + 64a29d0 commit ac22420

106 files changed

Lines changed: 9243 additions & 5041 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.agents/skills/buildkite-agent-release/SKILL.md‎

Lines changed: 20 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -20,68 +20,38 @@ Find the latest Buildkite Agent version using `gh`: `gh release view --repo buil
2020

2121
Ask user to decide whether it's a minor version bump or patch version bump.
2222

23-
### 3. Generate a list of changes
23+
### 3. Update the agent version file
2424

25-
Use [ghch](https://github.com/buildkite/ghch) to generate our changelogs, and
26-
then human brains to edit them down into something other humans will
27-
want to read.
28-
29-
To preview the changes run:
30-
31-
```
32-
ghch --format=markdown --from=v3.xx.yy --next-version=v3.xx.yy+1
33-
```
34-
35-
This will print a list of all the changes that are ready to go out. Looking at
36-
the list. You can re-run
37-
the `ghch` command with a different version number if you decide to change it
38-
before releasing.
39-
40-
41-
Edit [CHANGELOG.md](https://github.com/buildkite/agent/blob/main/CHANGELOG.md) file with paste in the list from the `ghch` output. This will likely need some cleaning up and editing as it only lists the names of the PRs.
42-
43-
Try to make each line short but descriptive - we want people to be able to understand the general gist of the change without having to read paragraphs or go into the PR itself.
44-
45-
The changelog should be split up into sections:
46-
47-
- Security
48-
- e.g. “Updated to new version of go-yellow to fix YellowToad CVE”
49-
- Changed
50-
- e.g. “Logs are now all printed in yellow to be easier on the eyes”
51-
- If the `go.mod` Go version or toolchan version changed, and it’s not already
52-
listed under Security, be sure to list it here!
53-
- Added
54-
- e.g. “Added the buildkite-agent ‘yellow’ subcommand”,
55-
- Fixed
56-
- e.g. “Fixed bug causing all logs to be printed in yellow”
57-
- Internal
58-
- e.g. “Reformatted the pipeline.yml”
59-
60-
Use your best judgement when it comes to putting things in the right section,
61-
and if a section doesn’t have any PRs in it, get rid of the heading.
25+
Edit the `version/VERSION` to update the value to the new version number. Use the bare semver (e.g. `3.75.0`), not a `v`-prefixed tag (e.g. not `v3.75.0`).
6226

63-
Conventionally, we lump all the Dependabot updates into a single line in the
64-
Internal section, since they tend to be invisibile to customers. But if a
65-
dependency was updated that fixes a big security issue or changes some important
66-
behaviour (for example), then it should be called out separately!
27+
### 4. Preview the auto-generated release notes
6728

68-
Also ensure the date is the date the release is being made.
29+
Generate the same notes GitHub will publish at release time, so they can be reviewed in the PR description:
6930

70-
As an example, see the example_changelog for v3.74.0 in the skill folder.
31+
```bash
32+
mkdir -p tmp
33+
gh api -X POST repos/buildkite/agent/releases/generate-notes \
34+
-f tag_name=v3.75.0 \
35+
-f target_commitish=main \
36+
--jq .body > tmp/release-notes.md
37+
```
7138

72-
### 4. Update the agent version file
39+
This is a read-only API call — it does not create a release or tag. GitHub auto-detects the previous stable release and applies the categorisation from [.github/release.yml](../../../.github/release.yml). The `tmp/` directory is gitignored, so the file won't be committed.
7340

74-
Edit the `version/VERSION` to update the value to the new version number. Use the bare semver (e.g. `3.75.0`), not a `v`-prefixed tag (e.g. not `v3.75.0`).
41+
Inspect `tmp/release-notes.md`. If any PRs are mis-categorised (e.g. landed under 🏠 Internal because they had no labels), fix the labels on those PRs and re-run the command.
7542

7643
### 5. Create the release PR
7744

7845
* Create a new branch for the release (e.g. `release/v3.75.0`).
79-
* Commit the `CHANGELOG.md` and `version/VERSION` changes.
46+
* Commit the `version/VERSION` change.
8047
* Push the branch and open a PR using `gh pr create` against `main`:
8148
* Title: `release: v3.75.0` (matching the convention from previous release PRs).
82-
* Body: paste the same changelog section that was added to `CHANGELOG.md` for this release (header line, Full Changelog link, and all sections). See [PR #3823](https://github.com/buildkite/agent/pull/3823) for an example.
49+
* Body: contents of `tmp/release-notes.md` from the previous step.
50+
* Label: `release` — required so the PR-labels workflow passes, and so the release PR itself is excluded from its own auto-generated notes (configured in [.github/release.yml](../../../.github/release.yml)).
51+
* Example: `gh pr create --title "release: v3.75.0" --body-file tmp/release-notes.md --label release`.
52+
53+
The PR body is for human review only; the actual release notes are regenerated by `gh release create --generate-notes` in [.buildkite/steps/github-release.sh](../../../.buildkite/steps/github-release.sh) when the release pipeline runs, so they will reflect any label fixes made between PR creation and release.
8354

8455
### 6. Done
8556

86-
* Remind user to unblock the release.
87-
* Remind user to update Github Release.
57+
* No manual GitHub release editing is required, but the user may want to review the auto-generated notes after the release publishes.

‎.agents/skills/buildkite-agent-release/example_changelog.md‎

Lines changed: 0 additions & 24 deletions
This file was deleted.

‎.bk.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
selected_org: buildkite

‎.buildkite/Dockerfile-compile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM public.ecr.aws/docker/library/golang:1.25.9@sha256:8a7adc288b77e9b787cd2695029eb54d10ae80571b21d44fed68d067ad0a9c96
1+
FROM public.ecr.aws/docker/library/golang:1.25.10@sha256:c0a2bd0756d92462a0d449124b039100ce447ebf69dc6c80a6d877503b36935e
22
COPY build/ssh.conf /etc/ssh/ssh_config.d/
33

44
RUN go install github.com/google/go-licenses@latest

‎.buildkite/Dockerfile-e2e‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
FROM public.ecr.aws/docker/library/golang:1.25.9@sha256:8a7adc288b77e9b787cd2695029eb54d10ae80571b21d44fed68d067ad0a9c96
1+
FROM public.ecr.aws/docker/library/golang:1.25.10@sha256:c0a2bd0756d92462a0d449124b039100ce447ebf69dc6c80a6d877503b36935e
22

33
RUN apt-get update && apt-get install -y --no-install-recommends \
44
unzip \

‎.buildkite/Dockerfile-lint‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
FROM golangci/golangci-lint:v2.12-alpine@sha256:25cd0933d1a4ced61e907aabac044cfc0182ab067c09c25d568e15750e9695aa
1+
FROM golangci/golangci-lint:v2.12-alpine@sha256:91b27804074a0bacea298707f016911e60cf0cdbc6c7bf5ccacb5f0606d18d60

‎.buildkite/Dockerfile-ruby‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
FROM ruby:4.0.3@sha256:5e3c937aeac53f58a84bf212f7762aecf69221af0159451845ac9b67b79ff234
1+
FROM ruby:4.0.3@sha256:ae7837a8c6b75077eae4bf7142022993b499305c455f4d53ba7053c875889e26

‎.buildkite/pipeline.release-oldstable.yml‎

Lines changed: 233 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,233 @@
1+
steps:
2+
- wait
3+
4+
- name: ":s3: Upload Oldstable Binaries to S3"
5+
command: ".buildkite/steps/publish-to-s3.sh"
6+
env:
7+
CODENAME: "oldstable"
8+
plugins:
9+
- aws-assume-role-with-web-identity#v1.4.0:
10+
role-arn: arn:aws:iam::032379705303:role/pipeline-buildkite-agent-release-oldstable
11+
session-tags:
12+
- organization_slug
13+
- organization_id
14+
- pipeline_slug
15+
- build_branch
16+
- ecr#v2.7.0:
17+
login: true
18+
account-ids: "032379705303"
19+
- docker#v5.8.0:
20+
environment:
21+
- "AWS_ACCESS_KEY_ID"
22+
- "AWS_SECRET_ACCESS_KEY"
23+
- "AWS_SESSION_TOKEN"
24+
image: "032379705303.dkr.ecr.us-east-1.amazonaws.com/deploytools:2022.07"
25+
propagate-environment: true
26+
mount-buildkite-agent: true
27+
28+
- name: ":octocat: :rocket: Create Github Release (if necessary)"
29+
skip: "TODO(v4 release): unskip when v3 no longer stable"
30+
command: ".buildkite/steps/github-release.sh"
31+
env:
32+
CODENAME: "oldstable"
33+
plugins:
34+
- aws-assume-role-with-web-identity#v1.4.0:
35+
role-arn: arn:aws:iam::032379705303:role/pipeline-buildkite-agent-release-oldstable
36+
session-tags:
37+
- organization_slug
38+
- organization_id
39+
- pipeline_slug
40+
- build_branch
41+
- ecr#v2.7.0:
42+
login: true
43+
account-ids: "032379705303"
44+
- docker#v5.8.0:
45+
environment:
46+
- "AWS_ACCESS_KEY_ID"
47+
- "AWS_SECRET_ACCESS_KEY"
48+
- "AWS_SESSION_TOKEN"
49+
image: "032379705303.dkr.ecr.us-east-1.amazonaws.com/deploytools:2022.07"
50+
propagate-environment: true
51+
mount-buildkite-agent: true
52+
53+
- name: ":redhat: Publish Oldstable RPM Package"
54+
command: ".buildkite/steps/publish-rpm-package.sh"
55+
env:
56+
CODENAME: "oldstable"
57+
RPM_S3_BUCKET: "yum.buildkite.com"
58+
plugins:
59+
- aws-assume-role-with-web-identity#v1.4.0:
60+
role-arn: arn:aws:iam::032379705303:role/pipeline-buildkite-agent-release-oldstable
61+
session-tags:
62+
- organization_slug
63+
- organization_id
64+
- pipeline_slug
65+
- build_branch
66+
- docker#v5.8.0:
67+
environment:
68+
- "AWS_ACCESS_KEY_ID"
69+
- "AWS_SECRET_ACCESS_KEY"
70+
- "AWS_SESSION_TOKEN"
71+
image: "buildkite/agent:3.55.0-ubuntu"
72+
entrypoint: bash
73+
propagate-environment: true
74+
mount-buildkite-agent: true
75+
volumes:
76+
- "/yum.buildkite.com"
77+
retry:
78+
automatic:
79+
- exit_status: 1
80+
limit: 3
81+
82+
- group: ":redhat: Publish Oldstable RPM Package to Buildkite Packages"
83+
steps:
84+
- name: ":redhat: Publish Oldstable {{matrix.pkg_arch}} RPM Package to Buildkite Packages"
85+
plugins:
86+
- publish-to-packages#v2.2.0:
87+
artifacts: "rpm/buildkite-agent_*_{{matrix.pkg_arch}}.rpm"
88+
registry: "buildkite/agent-rpm-oldstable"
89+
artifact_build_id: "${BUILDKITE_TRIGGERED_FROM_BUILD_ID}"
90+
attestations:
91+
- "buildkite-agent-linux-{{matrix.go_arch}}.build-attestation.json"
92+
- "buildkite-agent-rpm-packages.package-attestation.json"
93+
soft_fail: true
94+
matrix:
95+
setup:
96+
go_arch:
97+
- "amd64"
98+
- "386"
99+
- "arm64"
100+
- "ppc64"
101+
- "ppc64le"
102+
- "riscv64"
103+
pkg_arch:
104+
- "SKIP_FAKE_ARCH"
105+
adjustments:
106+
- with: { go_arch: "amd64", pkg_arch: "x86_64" }
107+
- with: { go_arch: "386", pkg_arch: "i386" }
108+
- with: { go_arch: "arm64", pkg_arch: "aarch64" }
109+
- with: { go_arch: "ppc64", pkg_arch: "ppc64" }
110+
- with: { go_arch: "ppc64le", pkg_arch: "ppc64le" }
111+
- with: { go_arch: "riscv64", pkg_arch: "riscv64" }
112+
- with: { pkg_arch: "SKIP_FAKE_ARCH" }
113+
skip: true
114+
115+
- name: ":debian: Publish Oldstable Debian Package"
116+
command: ".buildkite/steps/publish-debian-package.sh"
117+
env:
118+
CODENAME: "oldstable"
119+
DEB_S3_BUCKET: "apt.buildkite.com/buildkite-agent"
120+
plugins:
121+
- aws-assume-role-with-web-identity#v1.4.0:
122+
role-arn: arn:aws:iam::032379705303:role/pipeline-buildkite-agent-release-oldstable
123+
session-tags:
124+
- organization_slug
125+
- organization_id
126+
- pipeline_slug
127+
- build_branch
128+
- ecr#v2.7.0:
129+
login: true
130+
account-ids: "032379705303"
131+
- docker#v5.8.0:
132+
environment:
133+
- "AWS_ACCESS_KEY_ID"
134+
- "AWS_SECRET_ACCESS_KEY"
135+
- "AWS_SESSION_TOKEN"
136+
image: "032379705303.dkr.ecr.us-east-1.amazonaws.com/deploytools:2022.07"
137+
propagate-environment: true
138+
mount-buildkite-agent: true
139+
tmpfs:
140+
- "/root/.gnupg"
141+
142+
- group: ":debian: Publish Oldstable Debian Package to Buildkite Packages"
143+
steps:
144+
- name: ":debian: Publish Oldstable {{matrix.pkg_arch}} Debian Package to Buildkite Packages"
145+
plugins:
146+
- publish-to-packages#v2.2.0:
147+
artifacts: "deb/buildkite-agent_*_{{matrix.pkg_arch}}.deb"
148+
registry: "buildkite/agent-deb-oldstable"
149+
artifact_build_id: "${BUILDKITE_TRIGGERED_FROM_BUILD_ID}"
150+
attestations:
151+
- "buildkite-agent-linux-{{matrix.go_arch}}.build-attestation.json"
152+
- "buildkite-agent-debian-packages.package-attestation.json"
153+
soft_fail: true
154+
matrix:
155+
setup:
156+
go_arch:
157+
- "amd64"
158+
- "386"
159+
- "arm"
160+
- "armhf"
161+
- "arm64"
162+
- "ppc64"
163+
- "ppc64le"
164+
- "riscv64"
165+
pkg_arch:
166+
- "SKIP_FAKE_ARCH"
167+
adjustments:
168+
- with: { go_arch: "amd64", pkg_arch: "x86_64" }
169+
- with: { go_arch: "386", pkg_arch: "i386" }
170+
- with: { go_arch: "arm", pkg_arch: "arm" }
171+
- with: { go_arch: "armhf", pkg_arch: "armhf" }
172+
- with: { go_arch: "arm64", pkg_arch: "arm64" }
173+
- with: { go_arch: "ppc64", pkg_arch: "ppc64" }
174+
- with: { go_arch: "ppc64le", pkg_arch: "ppc64el" }
175+
- with: { go_arch: "riscv64", pkg_arch: "riscv64" }
176+
- with: { pkg_arch: "SKIP_FAKE_ARCH" }
177+
skip: true
178+
179+
- group: ":docker: Publish Oldstable Docker Images"
180+
steps:
181+
- name: ":docker: Publish Oldstable Images to {{matrix.registry}}"
182+
command: ".buildkite/steps/publish-docker-images.sh"
183+
env:
184+
CODENAME: "oldstable"
185+
REGISTRY: "{{matrix.registry}}"
186+
plugins:
187+
- aws-assume-role-with-web-identity#v1.4.0:
188+
role-arn: arn:aws:iam::032379705303:role/pipeline-buildkite-agent-release-oldstable
189+
session-tags:
190+
- organization_slug
191+
- organization_id
192+
- pipeline_slug
193+
- build_branch
194+
- ecr#v2.7.0:
195+
login: true
196+
account-ids: "445615400570"
197+
matrix:
198+
setup:
199+
registry:
200+
- docker.io
201+
- ghcr.io
202+
- packages.buildkite.com
203+
adjustments:
204+
- with: { registry: "packages.buildkite.com" }
205+
soft_fail: true
206+
207+
- wait
208+
209+
- name: ":beer: Publish Oldstable Homebrew Package"
210+
skip: "TODO(v4 release): unskip when v3 no longer stable"
211+
command: ".buildkite/steps/release-homebrew.sh"
212+
artifact_paths: "pkg/*.rb;pkg/*.json"
213+
env:
214+
CODENAME: "oldstable"
215+
plugins:
216+
- aws-assume-role-with-web-identity#v1.4.0:
217+
role-arn: arn:aws:iam::032379705303:role/pipeline-buildkite-agent-release-oldstable
218+
session-tags:
219+
- organization_slug
220+
- organization_id
221+
- pipeline_slug
222+
- build_branch
223+
- ecr#v2.7.0:
224+
login: true
225+
account-ids: "032379705303"
226+
- docker#v5.8.0:
227+
environment:
228+
- "AWS_ACCESS_KEY_ID"
229+
- "AWS_SECRET_ACCESS_KEY"
230+
- "AWS_SESSION_TOKEN"
231+
image: "032379705303.dkr.ecr.us-east-1.amazonaws.com/deploytools:2022.07"
232+
propagate-environment: true
233+
mount-buildkite-agent: true

‎.buildkite/pipeline.release-stable.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,6 @@
11
steps:
22
- wait
33

4-
- name: ":spiral_note_pad: Check Changelog"
5-
command: ".buildkite/steps/check-changelog.sh"
6-
7-
- wait
8-
94
- name: ":s3: Upload Binaries to S3"
105
command: ".buildkite/steps/publish-to-s3.sh"
116
env:

‎.buildkite/pipeline.release-unstable.yml‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,6 @@
11
steps:
22
- wait
33

4-
- name: ":spiral_note_pad: Check Changelog"
5-
command: ".buildkite/steps/check-changelog.sh"
6-
7-
- wait
8-
94
- name: ":s3: Upload Unstable Binaries to S3"
105
command: ".buildkite/steps/publish-to-s3.sh"
116
env:

0 commit comments

Comments
 (0)