[backport-cloud_asset_inventory-1.3] Sync CI configuration with main branch

[mrodm]

TL;DR

Syncs .buildkite and .github CI configuration from main to the
backport-cloud_asset_inventory-1.3 backport branch.

This brings automated backport workflows, new CI scripts, Go tooling, and
GitHub Actions that only work when they are present on the target branch itself.

Proposed commit message

```
Sync CI configuration with main branch for backport-cloud_asset_inventory-1.3.

Keep CI pipelines, GitHub Actions, and tooling consistent between active backport
branches and `main`, so that automated backport workflows and tooling improvements
land on all supported branches.

WHY:
GitHub Actions resolves workflow files from the branch where the event occurs,
not from `main`. Backport-branch workflows (changelog sync, post-backport
checklist, owner checks, auto-backport) must be present on the backport branch
itself to fire correctly.
```

Author's Checklist

• CI configuration files have been synced verbatim from `main`.

Related issues

• Relates backport: deploy backport-branch automation workflows to active backport branches #19262

---

This PR was generated with the assistance of Claude (claude-sonnet-4-6).

[infra-vault-gh-plugin-prod]

💔 Build Failed

• Buildkite Build
• Commit: 1390987

Failed CI Steps

• Check integrations aws
• Check integrations aws_bedrock
• Check integrations aws_logs
• Check integrations canva
• Check integrations carbon_black_cloud
• Check integrations cisco_umbrella
• Check integrations cloudflare_logpush
• Check integrations crowdstrike
• Check integrations cyberarkpas
• Check integrations cyera
• Check integrations elastic_security
• Check integrations f5_bigip
• Check integrations github
• Check integrations haproxy
• Check integrations imperva_cloud_waf
• Check integrations jamf_protect
• Check integrations journald
• Check integrations netskope
• Check integrations php_fpm
• Check integrations pps
• Check integrations sentinel_one_cloud_funnel
• Check integrations servicenow
• Check integrations sublime_security
• Check integrations symantec_endpoint_security
• Check integrations tanium
• Check integrations trellix_edr_cloud
• Check integrations trendmicro
• Check integrations vsphere
• Check integrations watchguard_firebox
• Check integrations zscaler_zia
• :junit: Junit annotate

History

cc @mrodm

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package 1password 👍(1) 💚(0) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
audit_events	5952.38	4878.05	-1074.33 (-18.05%)	💔
signin_attempts	13333.33	9345.79	-3987.54 (-29.91%)	💔

To see the full report comment with /test benchmark fullreport

[Copilot]

🟡 Changes recommended

One or more issues must be addressed before approval.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Syncs backport-branch CI workflows, tooling, and automation with main.

Changes:

• Adds the standalone backport CLI for changelog, ownership, inventory, and checklist automation.
• Updates Buildkite and GitHub Actions workflows.
• Removes legacy test-reporting code and adds package-name validation.

File summaries

File	Description
magefile.go	Updated as part of this pull request.
go.mod	Updated as part of this pull request.
dev/testsreporter/xunit.go	Updated as part of this pull request.
dev/testsreporter/testdata/sql_system_1718901944954979316.xml	Updated as part of this pull request.
dev/testsreporter/testdata/nats_1718676056733968706.xml	Updated as part of this pull request.
dev/testsreporter/testdata/fortinet_fortigate_1718675058322143368.xml	Updated as part of this pull request.
dev/testsreporter/testdata/fortinet_fortigate_1718675052813006253.xml	Updated as part of this pull request.
dev/testsreporter/testdata/elastic_package_registry_1718676502022628094.xml	Updated as part of this pull request.
dev/testsreporter/testdata/CODEOWNERS-default-tests	Updated as part of this pull request.
dev/testsreporter/testdata/cisco_umbrella_1718676502022628093.xml	Updated as part of this pull request.
dev/testsreporter/testdata/cisco_umbrella_1718675095255991383.xml	Updated as part of this pull request.
dev/testsreporter/testdata/cisco_umbrella_1718675095080627646.xml	Updated as part of this pull request.
dev/testsreporter/testdata/cisco_umbrella_1718675092421310216.xml	Updated as part of this pull request.
dev/testsreporter/packageerror.go	Updated as part of this pull request.
dev/testsreporter/packageerror_test.go	Updated as part of this pull request.
dev/testsreporter/githubissue.go	Updated as part of this pull request.
dev/testsreporter/github.go	Updated as part of this pull request.
dev/testsreporter/format.go	Updated as part of this pull request.
dev/testsreporter/errorlinks.go	Updated as part of this pull request.
dev/testsreporter/dataerror.go	Updated as part of this pull request.
dev/testsreporter/builderror.go	Updated as part of this pull request.
dev/testsreporter/builderror_test.go	Updated as part of this pull request.
dev/testsreporter/_static/summary.tmpl	Updated as part of this pull request.
dev/testsreporter/_static/description.tmpl	Updated as part of this pull request.
dev/scripts/README.md	Updated as part of this pull request.
dev/scripts/get_release_commit.sh	Updated as part of this pull request.
dev/scripts/backport_apply.sh	Updated as part of this pull request.
dev/packagenames/testdata/no_duplicates/p2/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/no_duplicates/p1/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/nested/no_duplicates/technology/p2/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/nested/no_duplicates/technology/p1/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/nested/no_duplicates/p3/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/nested/duplicates/technology/p2/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/nested/duplicates/technology/p1/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/nested/duplicates/p3/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/invalid_manifests/p2/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/invalid_manifests/p1/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/duplicates/p2/manifest.yml	Updated as part of this pull request.
dev/packagenames/testdata/duplicates/p1/manifest.yml	Updated as part of this pull request.
dev/packagenames/packagenames.go	Updated as part of this pull request.
dev/packagenames/packagenames_test.go	Updated as part of this pull request.
dev/import-beats/README.md	Updated as part of this pull request.
dev/gitutil/git.go	Updated as part of this pull request.
dev/codeowners/testdata/test_packages/package_1/manifest.yml	Updated as part of this pull request.
dev/codeowners/testdata/nested_packages/package_top/manifest.yml	Updated as part of this pull request.
dev/codeowners/testdata/nested_packages/category/package_nested_2/manifest.yml	Updated as part of this pull request.
dev/codeowners/testdata/nested_packages/category/package_nested_1/manifest.yml	Updated as part of this pull request.
dev/codeowners/testdata/nested_packages/category/package_nested_1/data_stream/stream_2/.keep	Updated as part of this pull request.
dev/codeowners/testdata/nested_packages/category/package_nested_1/data_stream/stream_1/.keep	Updated as part of this pull request.
dev/codeowners/testdata/devexp/manifest.yml	Updated as part of this pull request.
dev/codeowners/testdata/CODEOWNERS-owners-trailing-slash	Updated as part of this pull request.
dev/codeowners/testdata/CODEOWNERS-nested-valid	Updated as part of this pull request.
dev/codeowners/testdata/CODEOWNERS-nested-streams-valid	Updated as part of this pull request.
dev/codeowners/testdata/CODEOWNERS-nested-streams-missing-owners	Updated as part of this pull request.
dev/codeowners/testdata/CODEOWNERS-nested-missing-owner	Updated as part of this pull request.
dev/codeowners/testdata/CODEOWNERS-nested-category-owner	Updated as part of this pull request.
dev/citools/subscription.go	Updated as part of this pull request.
dev/citools/packages.go	Updated as part of this pull request.
dev/citools/packagemanifest.go	Updated as part of this pull request.
dev/citools/logsdb.go	Updated as part of this pull request.
dev/citools/logsdb_test.go	Updated as part of this pull request.
dev/citools/kibana.go	Updated as part of this pull request.
dev/citools/kibana_test.go	Updated as part of this pull request.
dev/citools/gomod.go	Updated as part of this pull request.
dev/citools/gomod_test.go	Updated as part of this pull request.
cmd/backport/tools.go	Updated as part of this pull request.
cmd/backport/magefile.go	Updated as part of this pull request.
cmd/backport/go.mod	Updated as part of this pull request.
cmd/backport/gitutil/git.go	Updated as part of this pull request.
cmd/backport/citools/packages.go	Updated as part of this pull request.
cmd/backport/citools/packagemanifest.go	Updated as part of this pull request.
cmd/backport/backports/packages/detect.go	Updated as part of this pull request.
cmd/backport/backports/owners/compare_integration_test.go	Updated as part of this pull request.
cmd/backport/backports/owners/check.go	Updated as part of this pull request.
cmd/backport/backports/owners/check_test.go	Updated as part of this pull request.
cmd/backport/backports/changelog/update.go	Updated as part of this pull request.
cmd/backport/backports/changelog/update_test.go	Updated as part of this pull request.
cmd/backport/backports/changelog/sync_test.go	Updated as part of this pull request.
cmd/backport/backports/changelog/resolve.go	Updated as part of this pull request.
cmd/backport/backports/changelog/resolve_test.go	Updated as part of this pull request.
cmd/backport/backports/changelog/insert.go	Updated as part of this pull request.
cmd/backport/backports/changelog/insert_test.go	Updated as part of this pull request.
cmd/backport/backports/changelog/extract.go	Updated as part of this pull request.
cmd/backport/backports/changelog/extract_test.go	Updated as part of this pull request.
cmd/backport/backports/changelog/comment.go	Updated as part of this pull request.
cmd/backport/.go-version	Updated as part of this pull request.
.gitignore	Updated as part of this pull request.
.github/workflows/validate-yaml-dashboards.requirements.txt	Updated as part of this pull request.
.github/workflows/validate-package-docs.yml	Updated as part of this pull request.
.github/workflows/vale-report.yml	Updated as part of this pull request.
.github/workflows/vale-lint.yml	Updated as part of this pull request.
.github/workflows/updatecli/updatecli.d/sync-packages-to-bug-issue-template.yml	Updated as part of this pull request.
.github/workflows/trigger-text-auditor.yml	Updated as part of this pull request.
.github/workflows/trigger-stale-issues.yml	Updated as part of this pull request.
.github/workflows/trigger-pr-review.yml	Updated as part of this pull request.
.github/workflows/trigger-pr-actions-detective.yml	Updated as part of this pull request.
.github/workflows/trigger-package-tests-security-ml.yml	Updated as part of this pull request.
.github/workflows/trigger-newbie-contributor-patrol.yml	Updated as part of this pull request.
.github/workflows/trigger-mention-in-pr.yml	Updated as part of this pull request.
.github/workflows/trigger-mention-in-issue.yml	Updated as part of this pull request.
.github/workflows/trigger-issue-triage.yml	Updated as part of this pull request.
.github/workflows/trigger-duplicate-issue-detector.yml	Updated as part of this pull request.
.github/workflows/trigger-docs-patrol.yml	Updated as part of this pull request.
.github/workflows/trigger-bug-hunter.yml	Updated as part of this pull request.
.github/workflows/trigger-breaking-change-detector.yml	Updated as part of this pull request.
.github/workflows/sync-backport-changelog.yml	Updated as part of this pull request.
.github/workflows/sweep-ingest-pipeline-safety.yml	Updated as part of this pull request.
.github/workflows/sweep-httpjson-pagination.yml	Updated as part of this pull request.
.github/workflows/sweep-field-mapping-conflicts.yml	Updated as part of this pull request.
.github/workflows/sweep-dashboard-data-scope.yml	Updated as part of this pull request.
.github/workflows/requires-update.yml	Updated as part of this pull request.
.github/workflows/pr-buildkite-detective.yml	Updated as part of this pull request.
.github/workflows/post-backport-checklist.yml	Updated as part of this pull request.
.github/workflows/notify-package-docs-failure.yml	Updated as part of this pull request.
.github/workflows/docs-preview-cleanup.yml	Updated as part of this pull request.
.github/workflows/docs-edit-automation.yml	Updated as part of this pull request.
.github/workflows/docs-deploy.yml	Updated as part of this pull request.
.github/workflows/docs-build.yml	Updated as part of this pull request.
.github/workflows/ci-comment.yml	Updated as part of this pull request.
.github/workflows/catalog-info.yml	Updated as part of this pull request.
.github/workflows/bump-elastic-stack-version.yml	Updated as part of this pull request.
.github/workflows/backport-packages-detect.yml	Updated as part of this pull request.
.github/actions/sync-backport-changelog/action.yml	Updated as part of this pull request.
.buildkite/scripts/trigger_integrations_in_parallel.sh	Updated as part of this pull request.
.buildkite/scripts/trigger_backport.sh	Updated as part of this pull request.
.buildkite/scripts/test_one_package.sh	Updated as part of this pull request.
.buildkite/scripts/test_integrations_with_serverless.sh	Updated as part of this pull request.
.buildkite/scripts/test_helpers.sh	Updated as part of this pull request.
.buildkite/scripts/test_check_backport_owners.sh	Updated as part of this pull request.
.buildkite/scripts/run_dev_scripts_tests.sh	Updated as part of this pull request.
.buildkite/scripts/run_buildkite_scripts_tests.sh	Updated as part of this pull request.
.buildkite/scripts/requirements-ci-python-scripts.txt	Updated as part of this pull request.
.buildkite/scripts/process_benchmarks.sh	Updated as part of this pull request.
.buildkite/scripts/packages/crowdstrike.sh	Updated as part of this pull request.
.buildkite/scripts/notify_backport_pr.sh	Updated as part of this pull request.
.buildkite/scripts/non_package_patterns.txt	Updated as part of this pull request.
.buildkite/scripts/check_changelog_versions_in_main.sh	Updated as part of this pull request.
.buildkite/scripts/check_backports_inventory.sh	Updated as part of this pull request.
.buildkite/scripts/check_backport_tool.sh	Updated as part of this pull request.
.buildkite/scripts/build_packages.sh	Updated as part of this pull request.
.buildkite/scripts/backport_branch_lib.sh	Updated as part of this pull request.
.buildkite/pull-requests.json	Updated as part of this pull request.
.buildkite/pipeline.serverless.yml	Updated as part of this pull request.
.buildkite/pipeline.schedule-weekly.yml	Updated as part of this pull request.
.buildkite/pipeline.schedule-daily.yml	Updated as part of this pull request.
.buildkite/pipeline.publish.yml	Updated as part of this pull request.
.buildkite/pipeline.backport.yml	Updated as part of this pull request.
.buildkite/pipeline.backport-dispatch.yml	Updated as part of this pull request.

Review details

Suppressed comments (8)

.buildkite/scripts/test_integrations_with_serverless.sh:99

• These grep -q pipelines run under set -o pipefail; when a changed-file list is large enough for echo to block, grep can exit after the first match and leave echo with SIGPIPE. The pipeline then has a nonzero status and the matching package is incorrectly omitted from PACKAGE_LIST. Use the non-quiet form redirected to /dev/null, as the surrounding helpers do, so the producer is drained.
  .buildkite/scripts/trigger_integrations_in_parallel.sh:68
• These grep -q pipelines run under set -o pipefail; when a changed-file list is large enough for echo to block, grep can exit after the first match and leave echo with SIGPIPE. The pipeline then has a nonzero status and the matching package is incorrectly omitted from PACKAGE_LIST. Use the non-quiet form redirected to /dev/null, as the surrounding helpers do, so the producer is drained.
  .github/workflows/sync-backport-changelog.yml:108
• The retry path uses only parents[0] of the merge commit as BEFORE. For a rebase-merged PR with multiple commits, mergeCommit is the last rebased commit and its first parent is the preceding rebased commit, so this diff contains only the final PR commit and earlier changelog entries are never synchronized. Resolve the full PR range (for example, from the first rebased commit's parent or the PR's original base SHA) rather than knowingly narrowing it to one commit.
  .github/workflows/trigger-package-tests-security-ml.yml:56
• GitHub Actions runs these run blocks with pipefail; grep -q can exit after the first matching filename and cause the upstream echo to receive SIGPIPE. For a sufficiently large PR file list, a true match can therefore make the if condition false and omit the package dispatch. Replace these quiet pipelines with grep ... > /dev/null (or otherwise drain the input).
  .github/workflows/validate-yaml-dashboards.yml:172
• The nested-package support added to package discovery is not carried through here: for packages/<technology>/<package>/_dev/..., this extracts <technology> and compiles into packages/<technology>/kibana/dashboard instead of the actual package's output directory. A changed dashboard in any nested package will therefore be validated against the wrong path (or fail to find its JSON). Derive the package directory by stripping the /_dev/... suffix from input_dir.
  cmd/backport/backports/apply/apply.go:167
• When --open-pr is omitted (the default), this still replaces every source changelog link with .../pull/REPLACE_ME, but fixChangelogLink only runs after a PR URL is returned. The pushed backport branch therefore permanently contains a broken link in the normal manual-PR mode; the same happens for --dry-run --open-pr. Preserve the original link unless a PR will actually be opened, or reject those modes until a real URL is available.
  cmd/backport/backports/apply/apply.go:705
• If commitOwnerSync fails after either git add succeeds, this rollback only restores the worktree; it leaves the owner changes staged in the index. The subsequent push/branch restore then runs with a dirty index, and checkout can fail or a retry can inherit staged owner edits. Reset the paths in the index before checking them out.
  cmd/backport/backports/owners/compare.go:121
• Checking only source.Resolve(pkgPath) does not detect a package removed from main: the repository's /packages/ fallback rule resolves every package path. For a package left on a stale backport branch but absent from origin/main, this passes and parseManifestOwners then errors on the missing remote manifest instead of skipping the package as intended. Check remote manifest existence (while preserving real fetch/read errors) before parsing it, and cover the fallback-rule case in the integration test.

• Files reviewed: 181/190 changed files
• Comments generated: 10
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Changelog sync skipped — all changelog versions are already present on main.