Use checkout_release_branch from a8c-ci-toolkit

[AliSoftware]

Related issues

• Related to AINFRA-2828
• Follow-up to AINFRA-2725

How AI was used in this PR

Written with Claude Code, and reviewed by me. The mechanical part — swapping call sites and deleting the script — was scripted and applied identically across the 13 repos that carried this file. The Docker-specific part below was hand-written and is the piece worth a careful look.

Proposed Changes

.buildkite/commands/checkout-release-branch.sh existed as a byte-identical copy in 13 repos, so any fix to it had to be made 13 times. It now lives in a8c-ci-toolkit as the checkout_release_branch command, and this repo calls that instead. No behaviour change: the command is a straight port of the deleted script.

Studio needed one thing the other repos didn't. The Linux release build runs inside a container via the docker plugin, and toolkit commands reach a job by being added to the host's $PATH — which a container doesn't inherit. That step now also loads the toolkit plugin, which exports $A8C_CI_TOOLKIT_PLUGIN_DIR, bind-mounts that directory into the container read-only, and puts its bin/ on the $PATH inside. expand-volume-vars is what makes the docker plugin interpolate the variable, and the $$ defers it to run time rather than pipeline upload time.

The Windows step keeps invoking through bash, which resolves a slash-less filename against $PATH, so no change was needed there.

The toolkit pin moves from 6.1.1 to 6.3.0. I checked the toolkit's CHANGELOG.md for breaking changes between those versions; none apply here.

Testing Instructions

Not exercisable before the toolkit release. Once 6.3.0 is out, the release pipeline covers all three shapes: the Mac steps (plain host $PATH), the Windows step (bash checkout_release_branch), and the Linux step (mounted into the container) should each check out the release branch as before.

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?

Merge only after toolkit release

Important

Do not merge until a8c-ci-toolkit 6.3.0 is released — the pin doesn't resolve before then, so CI will keep failing until it is.

[AliSoftware]

⚠️ This is the main thing that differs from other repo's implementation, and the first time we'd be testing that idea of mounting the plugin's dir inside the Docker container to access the a8c-ci-toolkit plugin from there.

I think that should work in theory, but it might be worth double-checking with some dummy test once a8c-ci-toolkit version 6.3.0 ships. For example, by creating a temporary commit that would use this trick on a dummy step that would use the docker plugin + calls a benign command provided by a8c-ci-toolkit (like hash_file) from within its container.

[AliSoftware]

Validated via 977fd2b — see #4472 (comment)

[AliSoftware]

Docker mount trick validated on CI ✅

The one part of this PR that CI can't exercise on its own is the Linux release build, since the release pipeline only runs at code freeze. So I validated the mechanism directly instead.

Temporary commit 977fd2b (reverted in the commit right after) pointed CI_TOOLKIT_VERSION at the head of the toolkit's ainfra-2828-expose-plugin-dir branch and added a throwaway step to .buildkite/pipeline.yml using the same $CI_TOOLKIT_PLUGIN + expand-volume-vars + export PATH combination the Linux release step now uses.

The job passed on the default queue in node:24.15.0-bookworm — the same image the Linux release build uses:

--- :file_folder: What got mounted
total 232
-rwxr-xr-x. 1 root nogroup  583 Aug  7 19:24 add_host_to_ssh_known_hosts
-rwxr-xr-x. 1 root nogroup  365 Aug  7 19:24 add_ssh_key_to_agent
-rwxr-xr-x. 1 root nogroup 8511 Aug  7 19:24 annotate_test_failures
-rwxr-xr-x. 1 root nogroup  669 Aug  7 19:24 build_and_test_pod
--- :mag: Resolve a toolkit command from inside the container
/a8c-ci-toolkit/bin/hash_file
--- :abacus: Run it
dc9f87cd7360d7e25772a1e391e36f011f39b4d62d5f685df4a72dbc18e757e5

And the docker run the plugin assembled shows the variable resolving at run time to the toolkit's checkout on the host:

--volume /var/lib/buildkite-agent/plugins/ci-default-i-0b3106c025cc50991-1/github-com-automattic-a8c-ci-toolkit-buildkite-plugin-e425b6287bfe8c1635a14f9ec6c276a4dfcc4c10:/a8c-ci-toolkit:ro

The branch is back to normal — the pin reads 6.3.0 again and the throwaway step is gone.