Use `checkout_release_branch` from `a8c-ci-toolkit` by AliSoftware · Pull Request #4472 · Automattic/studio

AliSoftware · 2026-08-06T20:09:37Z

Related issues

Related to AINFRA-2828
Follow-up to AINFRA-2725

How AI was used in this PR

Written with Claude Code, and reviewed by me. The mechanical part — swapping call sites and deleting the script — was scripted and applied identically across the 13 repos that carried this file. The Docker-specific part below was hand-written and is the piece worth a careful look.

Proposed Changes

.buildkite/commands/checkout-release-branch.sh existed as a byte-identical copy in 13 repos, so any fix to it had to be made 13 times. It now lives in a8c-ci-toolkit as the checkout_release_branch command, and this repo calls that instead. No behaviour change: the command is a straight port of the deleted script.

Studio needed one thing the other repos didn't. The Linux release build runs inside a container via the docker plugin, and toolkit commands reach a job by being added to the host's $PATH — which a container doesn't inherit. That step now also loads the toolkit plugin, which exports $A8C_CI_TOOLKIT_PLUGIN_DIR, bind-mounts that directory into the container read-only, and puts its bin/ on the $PATH inside. expand-volume-vars is what makes the docker plugin interpolate the variable, and the $$ defers it to run time rather than pipeline upload time.

The Windows step keeps invoking through bash, which resolves a slash-less filename against $PATH, so no change was needed there.

The toolkit pin moves from 6.1.1 to 6.3.0. I checked the toolkit's CHANGELOG.md for breaking changes between those versions; none apply here.

Testing Instructions

Not exercisable before the toolkit release. Once 6.3.0 is out, the release pipeline covers all three shapes: the Mac steps (plain host $PATH), the Windows step (bash checkout_release_branch), and the Linux step (mounted into the container) should each check out the release branch as before.

Pre-merge Checklist

Have you checked for TypeScript, React or other console errors?

Merge only after toolkit release

Important

Do not merge until a8c-ci-toolkit 6.3.0 is released — the pin doesn't resolve before then, so CI will keep failing until it is.

AliSoftware · 2026-08-06T20:17:30Z

@@ -127,10 +131,16 @@ steps:
          # Same Docker-on-default-queue pattern as the dev Linux build group
          # (see .buildkite/pipeline.yml): Amazon Linux on `default` lacks
          # `dpkg`/`fakeroot`, so we build inside the Debian Node image.
+          # The toolkit is listed so its `environment` hook sets $A8C_CI_TOOLKIT_PLUGIN_DIR
+          # before the `docker` plugin resolves the volume below.
+          - $CI_TOOLKIT_PLUGIN
          - $DOCKER_PLUGIN:
              image: "$NODE_DOCKER_IMAGE"
              propagate-environment: true
              mount-buildkite-agent: true
+              expand-volume-vars: true
+              volumes:
+                - "$$A8C_CI_TOOLKIT_PLUGIN_DIR:/a8c-ci-toolkit:ro"


⚠️ This is the main thing that differs from other repo's implementation, and the first time we'd be testing that idea of mounting the plugin's dir inside the Docker container to access the a8c-ci-toolkit plugin from there.

I think that should work in theory, but it might be worth double-checking with some dummy test once a8c-ci-toolkit version 6.3.0 ships. For example, by creating a temporary commit that would use this trick on a dummy step that would use the docker plugin + calls a benign command provided by a8c-ci-toolkit (like hash_file) from within its container.

Validated via 977fd2b — see #4472 (comment)

AliSoftware · 2026-08-07T19:42:00Z

Docker mount trick validated on CI ✅

The one part of this PR that CI can't exercise on its own is the Linux release build, since the release pipeline only runs at code freeze. So I validated the mechanism directly instead.

Temporary commit 977fd2b (reverted in the commit right after) pointed CI_TOOLKIT_VERSION at the head of the toolkit's ainfra-2828-expose-plugin-dir branch and added a throwaway step to .buildkite/pipeline.yml using the same $CI_TOOLKIT_PLUGIN + expand-volume-vars + export PATH combination the Linux release step now uses.

The job passed on the default queue in node:24.15.0-bookworm — the same image the Linux release build uses:

--- :file_folder: What got mounted
total 232
-rwxr-xr-x. 1 root nogroup  583 Aug  7 19:24 add_host_to_ssh_known_hosts
-rwxr-xr-x. 1 root nogroup  365 Aug  7 19:24 add_ssh_key_to_agent
-rwxr-xr-x. 1 root nogroup 8511 Aug  7 19:24 annotate_test_failures
-rwxr-xr-x. 1 root nogroup  669 Aug  7 19:24 build_and_test_pod
--- :mag: Resolve a toolkit command from inside the container
/a8c-ci-toolkit/bin/hash_file
--- :abacus: Run it
dc9f87cd7360d7e25772a1e391e36f011f39b4d62d5f685df4a72dbc18e757e5

And the docker run the plugin assembled shows the variable resolving at run time to the toolkit's checkout on the host:

--volume /var/lib/buildkite-agent/plugins/ci-default-i-0b3106c025cc50991-1/github-com-automattic-a8c-ci-toolkit-buildkite-plugin-e425b6287bfe8c1635a14f9ec6c276a4dfcc4c10:/a8c-ci-toolkit:ro

The branch is back to normal — the pin reads 6.3.0 again and the throwaway step is gone.

This reverts commit 977fd2b.

mokagio

Re-run CI after releasing CI toolkit 6.3.0. All green, however... we are lacking two required steps that don't seem to have been resolved during the pipeline upload

mokagio · 2026-08-10T06:13:25Z

          set -eu

+          # The toolkit's commands are on the host's PATH, not the container's; the plugin
+          # directory is bind-mounted at /a8c-ci-toolkit by the `volumes` entry below.
+          export PATH="$$PATH:/a8c-ci-toolkit/bin"
+
          # The container has no SSH keys / known_hosts, use anonymous HTTPS
          git remote set-url origin https://github.com/Automattic/studio.git

-          bash .buildkite/commands/checkout-release-branch.sh "${RELEASE_VERSION}"
+          checkout_release_branch "${RELEASE_VERSION}"

          apt-get -o Acquire::Retries=3 update
          apt-get install -y --no-install-recommends fakeroot

          # `--maxsockets 1` works around npm/cli#4652 (ECONNRESETs on Linux);
          # see install-node-dependencies.sh for the original rationale.
          npm ci --unsafe-perm --no-audit --no-progress --maxsockets 1

          echo "--- :node: Building DEB"
          npm run make:linux-{{matrix}}

          echo "--- :package: Building standalone CLI bundle"
          npm run cli:bundle -- linux {{matrix}}


Wonder if we could benefit from pushing this into a script that takes ARCHITECTURE x64|arm64 as input (and maybe ${RELEASE_VERSION} too, although that could be resolved from the env internally as others do).

…anch

Use checkout_release_branch from a8c-ci-toolkit

0698ed3

AliSoftware commented Aug 6, 2026

View reviewed changes

AliSoftware added the tooling label Aug 6, 2026

🚧 [TO REVERT] Smoke-test a8c-ci-toolkit inside a Docker step

977fd2b

Revert "🚧 [TO REVERT] Smoke-test a8c-ci-toolkit inside a Docker step"

dfcd3d5

This reverts commit 977fd2b.

AliSoftware marked this pull request as ready for review August 7, 2026 19:59

AliSoftware requested a review from a team as a code owner August 7, 2026 19:59

mokagio enabled auto-merge (squash) August 10, 2026 06:11

mokagio approved these changes Aug 10, 2026

View reviewed changes

Merge branch 'trunk' into ainfra-2828-use-toolkit-checkout-release-br…

8e1b46f

…anch

mokagio assigned AliSoftware Aug 10, 2026

mokagio merged commit 16f8861 into trunk Aug 10, 2026
13 checks passed

mokagio deleted the ainfra-2828-use-toolkit-checkout-release-branch branch August 10, 2026 06:17

Navigation Menu

Uh oh!

Use `checkout_release_branch` from `a8c-ci-toolkit` - #4472

Use `checkout_release_branch` from `a8c-ci-toolkit`#4472
mokagio merged 4 commits into
trunkfrom
ainfra-2828-use-toolkit-checkout-release-branch

AliSoftware commented Aug 6, 2026 •

edited

Loading

Uh oh!

AliSoftware Aug 6, 2026 •

edited

Loading

Uh oh!

AliSoftware Aug 7, 2026 •

edited

Loading

Uh oh!

AliSoftware commented Aug 7, 2026

Uh oh!

mokagio left a comment

Uh oh!

mokagio Aug 10, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

AliSoftware commented Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Related issues

How AI was used in this PR

Proposed Changes

Testing Instructions

Pre-merge Checklist

Merge only after toolkit release

Uh oh!

AliSoftware Aug 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AliSoftware Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

AliSoftware commented Aug 7, 2026

Docker mount trick validated on CI ✅

Uh oh!

mokagio left a comment

Choose a reason for hiding this comment

Uh oh!

mokagio Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AliSoftware commented Aug 6, 2026 •

edited

Loading

AliSoftware Aug 6, 2026 •

edited

Loading

AliSoftware Aug 7, 2026 •

edited

Loading