chore(buildkite): add pipeline definition for release QA

Adds a definition for release QA pipeline to also define it as code in
our repository.

This also adds a test mode when VERSION=dev where "make_release" is used
to generate the artifacts instead of downloading them from S3.

Signed-off-by: Riccardo Mancini <[email protected]>

Author: Manciukic

.buildkite/common.py

@@ -275,8 +275,8 @@ def __init__(self, with_build_step=True, **kwargs):
         self.per_arch["instances"] = ["m6i.metal", "m7g.metal"]
         self.per_arch["platforms"] = [("al2023", "linux_6.1")]
         self.binary_dir = args.binary_dir
-        # Build sharing
-        if with_build_step:
+        # Build sharing, if a binary dir wasn't already supplied
+        if not args.binary_dir and with_build_step:
             build_cmds, self.shared_build = shared_build()
             self.build_group_per_arch(
                 "🏗️ Build", build_cmds, depends_on_build=False, set_key=self.shared_build

.buildkite/pipeline_release_qa.py

@@ -0,0 +1,76 @@
+#!/usr/bin/env python3
+# Copyright 2025 Amazon.com, Inc. or its affiliates. All Rights Reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+"""
+Buildkite pipeline for release QA
+"""
+
+from common import BKPipeline
+
+pipeline = BKPipeline(with_build_step=False)
+
+# NOTE: we need to escape $ using $$ otherwise buildkite tries to replace it instead of the shell
+
+pipeline.add_step(
+    {
+        "label": "Download release",
+        "if": 'build.env("VERSION") != "dev"',
+        "command": [
+            "aws s3 sync --no-sign-request s3://spec.ccfc.min/firecracker-ci/firecracker/$$VERSION release-$$VERSION",
+            'buildkite-agent artifact upload "release-$$VERSION/**/*"',
+        ],
+    },
+    depends_on_build=False,
+)
+
+pipeline.build_group_per_arch(
+    ":building_construction: Make release",
+    # if is a keyword for python, so we need this workaround to expand it as a kwarg
+    **{"if": 'build.env("VERSION") == "dev"'},
+    command=[
+        "./tools/devtool -y make_release",
+        "RELEASE_DIR=$$(echo release-*dev-$$(uname -m))",
+        "RELEASE_SUFFIX=$${{RELEASE_DIR#release}}",
+        "OUT_DIR=release-$$VERSION/$$(uname -m)",
+        "mkdir -p $$OUT_DIR",
+        (
+            "for f in $$RELEASE_DIR/*-$$(uname -m); do"
+            "  mv $$f $$OUT_DIR/$$(basename $$f $$RELEASE_SUFFIX);"
+            "  mv $$f.debug $$OUT_DIR/$$(basename $$f $$RELEASE_SUFFIX).debug;"
+            "done"
+        ),
+        'buildkite-agent artifact upload "release-$$VERSION/**/*"',
+    ],
+    depends_on_build=False,
+)
+
+# The devtool expects the examples to be in the same folder as the binaries to run some tests
+# (for example, uffd handler tests). Build them and upload them in the same folder.
+pipeline.build_group_per_arch(
+    ":hammer_and_wrench: Build examples",
+    command=[
+        "CARGO_TARGET=$$(uname -m)-unknown-linux-musl",
+        "./tools/devtool -y sh cargo build --target $$CARGO_TARGET --release --examples",
+        "mkdir -p release-$$VERSION/$$(uname -m)/",
+        "cp -R build/cargo_target/$$CARGO_TARGET/release/examples release-$$VERSION/$$(uname -m)/",
+        'buildkite-agent artifact upload "release-$$VERSION/**/*"',
+    ],
+    depends_on_build=False,
+)
+
+pipeline.add_step("wait", depends_on_build=False)
+
+pipeline.add_step(
+    {
+        "label": ":pipeline: PR",
+        "command": (
+            ".buildkite/pipeline_pr.py --binary-dir release-$$VERSION "
+            "| jq '(..|select(.priority? != null).priority) += 100' "
+            "| buildkite-agent pipeline upload"
+        ),
+    },
+    depends_on_build=False,
+)
+
+print(pipeline.to_json())