Release oldstable from v3, edge from v4

[DrJosh9000]

Description

Create a new "codename" oldstable (like Debian's oldstable), and release v3 to it.
Also push to edge from v4 instead of v3, so that we can dogfood v4 more.

Context

v4 is coming - #3807

Changes

• Create an oldstable release pipeline.yml. (Depends on creating the pipeline and setting up the OIDC permissions ✅ Done)
  • Skip GitHub and Homebrew releases from oldstable for the moment, because v3 is still stable and will do those.
• Update scripts to accept oldstable as a codename.
• Only push version tags (e.g. 3, 3.123) as container image tags from oldstable, and not e.g. latest
• Various shell style tweaks in touched files, mainly $FOO -> ${FOO} and changing consecutive if...fi blocks into case...esac

Testing

• Tests have run locally (with go test ./...). Buildkite employees may check this if the pipeline has run automatically.
• Code is formatted (with go tool gofumpt -extra -w .)

Disclosures / Credits

I did not use AI tools at all... until getting buildsworth to review.

[DrJosh9000]

@buildsworth-bk review

[buildsworth-bk-app]

Adds the new oldstable release pipeline and updates upload-release-steps.sh to route v3 final releases through oldstable (in addition to stable, until v4 takes over) and edge builds through v4. Most of the diff is shell-quoting cleanup plus an if-block-to-case refactor in publish-docker-image.sh and upload-release-steps.sh, and that's where the issues are concentrated.

Three blocking findings below: a missing ;; in the new case in publish-docker-image.sh that makes the script fail to parse, a stray quote in publish-rpm-package.sh that turns the dependency install into a no-op assignment, and what looks like a concurrent-write race once v3 releases trigger both stable and oldstable pipelines in parallel.

Want to dig deeper? The full session log is attached to this Buildkite build. Download the session file and open a new pi session with it:

Download the buildsworth logs from build 312, then answer my questions about the findings.

[DrJosh9000]

@buildsworth-bk review

Previous concerns have been addressed.

[buildsworth-bk-app]

Previous three concerns are resolved: the missing ;; in publish-docker-image.sh is in place (bash -n clean), the stray quote in publish-rpm-package.sh is fixed, and the github-release/homebrew race is no longer reachable — pipeline.release-oldstable.yml skips both of those steps, and the additions in github-release.sh ((stable || oldstable) && IS_PRERELEASE==1 skip, --latest=false for oldstable) set things up cleanly for when the skips come off.

One new blocking finding from a closer look at upload-release-steps.sh: the v3 skip arm in edge_steps_yaml echoes a plain log line into the YAML stream that's piped into buildkite-agent pipeline upload, which I think breaks v3 releases. Details inline.

Want to dig deeper? The full session log is attached to this Buildkite build. Download the session file and open a new pi session with it:

Download the buildsworth logs from build 315, then answer my questions about the findings.

[buildkite-systems]

@buildsworth-bk review

Previous concerns have been addressed.

[buildsworth-bk-app]

Previous round's blocking concern on edge_steps_yaml (the echo corrupting the YAML stream piped into buildkite-agent pipeline upload) and the v4 fallthrough question are both resolved — edge_steps_yaml now emits a properly-formed skipped trigger step for non-v4 versions (parses cleanly), and output_steps_yaml has an explicit 4.*) arm. No new findings.

Not approving on risk:l1, though: the change rewires release pipeline orchestration — new pipeline.release-oldstable.yml, new IAM role and package registries, new v3/v4/edge routing logic in upload-release-steps.sh — which is the "Deployment configuration" L3 example in the risk taxonomy. Previous rounds also caught real production-impact bugs in this same code (YAML corruption, missing ;;, github-release race), and upload-release-steps.sh isn't exercised by CI on this branch, so an additional pair of eyes on the v3/v4 routing is worth the cost.

Want to dig deeper? The full session log is attached to this Buildkite build. Download the session file and open a new pi session with it:

Download the buildsworth logs from build 318, then answer my questions about the findings.

[CerealBoy]

LGTM 🚀 🚀