Review summary — #4304

Change reviewed

PR #4304 backports the three commits from merged PR #4290 onto v3:

• .buildkite/steps/upload-release-steps.sh now routes final v3 releases only to agent-release-oldstable, routes final v4 releases to stable, recognizes alpha releases as prereleases, and checks for an existing tag by querying the exact refs/tags/v<version> ref.
• .buildkite/pipeline.release-oldstable.yml enables the existing GitHub Release and Homebrew publication steps for oldstable releases.
• The experimental, unstable, stable, and oldstable release pipelines remove their soft-failing Debian/RPM uploads to Buildkite Packages.
• .buildkite/pipeline.yml removes the Debian/RPM package-level provenance attestations that were consumed only by those removed Buildkite Packages upload steps.

No Linear issue was associated with the change. The branch's PR-4290 text refers to the source GitHub pull request; an attempted Linear lookup for PR-4290 found no issue.

What I examined

I read the complete 439-line PR diff and the full contents of all six changed files. I traced the release-step uploader from .buildkite/pipeline.yml through .buildkite/steps/extract-agent-version-metadata.sh, then inspected the oldstable publication consumers in:

• .buildkite/steps/github-release.sh
• .buildkite/steps/release-homebrew.sh
• .buildkite/steps/publish-to-s3.sh
• .buildkite/steps/publish-debian-package.sh
• .buildkite/steps/publish-rpm-package.sh

The GitHub and Homebrew scripts already distinguish oldstable correctly: oldstable final releases are non-prereleases, GitHub marks them as not-latest, and Homebrew updates the major-version formula. The package publication scripts consume the same artifact-build metadata forwarded by the trigger.

I also reviewed the source PR's description and conversation. On #4290, the earlier exact-tag concern was fixed, the author confirmed that the release changes were intended to be backported to v3, and a human reviewer approved the final revision. Comparing commits with stable patch IDs showed that each of the three backport commits is patch-identical to its source commit. The only aggregate diff differences are expected file index and line-offset metadata from applying the patches to v3.

A repository search found no remaining references to the removed Debian/RPM package-attestation artifact names or publish-to-packages release steps.

Checks run

• git diff --check origin/v3...HEAD passed.
• bash -n passed for the changed release-step uploader and the related publication/metadata scripts inspected during call-path tracing.
• Buildkite Agent's native pipeline parser accepted all five affected YAML pipelines in dry-run mode with parse warnings rejected.
• A mocked metadata/dry-run harness exercised 3.138.0, 3.138.0-rc.1, 4.0.0, and 4.0.0-alpha.1. The generated steps parsed successfully. In particular, a final v3 version produced a skipped edge step and exactly one active agent-release-oldstable trigger, while the v3 release candidate went to beta.
• Live git ls-remote checks confirmed that the exact-ref query does not match the repository's existing v4.0.0-beta.* tags, while it does match an existing exact v3 tag.

Ruby, PyYAML, and ShellCheck were unavailable in the review environment, so those alternate validators were not run. The native Buildkite pipeline parser and Bash syntax checks covered the changed formats. I did not run the Go test suite because the PR changes only release pipeline configuration and shell routing.

At submission time, the GitHub label and Socket checks had passed. Buildkite Agent build #14167 was still pending/started. Direct Buildkite CLI build inspection was unavailable to the configured token, so its state was verified through the GitHub commit status instead.

Findings and verdict

I found no actionable correctness, security, or backport-specific issues and submitted no inline comments. The review was submitted as COMMENT, rather than approval, because this change directly controls stable/oldstable release routing and publication and therefore has a high operational blast radius requiring human sign-off.

Submitted review: #4304 (review)

Trigger source: automatic.