[backport-cloud_security_posture-3.0] Sync CI configuration with main branch

[mrodm]

TL;DR

Syncs .buildkite and .github CI configuration from main to the
backport-cloud_security_posture-3.0 backport branch.

This brings automated backport workflows, new CI scripts, Go tooling, and
GitHub Actions that only work when they are present on the target branch itself.

Proposed commit message

```
Sync CI configuration with main branch for backport-cloud_security_posture-3.0.

Keep CI pipelines, GitHub Actions, and tooling consistent between active backport
branches and `main`, so that automated backport workflows and tooling improvements
land on all supported branches.

WHY:
GitHub Actions resolves workflow files from the branch where the event occurs,
not from `main`. Backport-branch workflows (changelog sync, post-backport
checklist, owner checks, auto-backport) must be present on the backport branch
itself to fire correctly.
```

Author's Checklist

• CI configuration files have been synced verbatim from `main`.

How to test this PR locally

No functional changes — CI-only file sync. Verify that pipelines trigger
correctly after merge.

Related issues

• Relates backport: deploy backport-branch automation workflows to active backport branches #19262

---

This PR was generated with the assistance of Claude (claude-sonnet-4-6).

[infra-vault-gh-plugin-prod]

⏳ Build in-progress, with failures

• Buildkite Build
• Commit: 42e37d6

Failed CI Steps

• Check integrations activemq
• Check integrations aws
• Check integrations aws_bedrock
• Check integrations aws_logs
• Check integrations canva
• Check integrations cisco_umbrella
• Check integrations crowdstrike
• Check integrations cyberarkpas
• Check integrations elastic_security
• Check integrations etcd
• Check integrations github
• Check integrations haproxy
• Check integrations imperva_cloud_waf
• Check integrations jolokia
• Check integrations netskope
• Check integrations php_fpm
• Check integrations pps
• Check integrations rapid7_insightvm
• Check integrations sentinel_one_cloud_funnel
• Check integrations sublime_security
• Check integrations symantec_endpoint_security
• Check integrations trellix_edr_cloud
• Check integrations trendmicro
• Check integrations watchguard_firebox
• Check integrations zscaler_zia
• :junit: Junit annotate

History

cc @mrodm

[Copilot]

🟡 Changes recommended

Unresolved critical and moderate findings affect workflow security, backport automation, CI enforcement, reporting, and tooling correctness.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This pull request synchronizes CI configuration, Go tooling, and backport automation from main onto backport-cloud_security_posture-3.0.

Changes:

• Updates Buildkite and GitHub Actions workflows.
• Adds standalone backport, changelog, ownership, and package tooling.
• Updates Go/Mage tooling and removes legacy test-reporter files and fixtures.

Final findings:

• .buildkite/pipeline.yml:168 — The owner-sync check is soft-failed and cannot enforce synchronization (moderate, 2 votes).
• .buildkite/scripts/backport_branch.sh:224 — Removing dev/testsreporter leaves failed-test reporting broken (moderate, 1 vote).
• .buildkite/scripts/packages/security_detection_engine.sh:98 — Empty or failed version lookups can silently skip OOM checks (moderate, 2 votes).
• .buildkite/scripts/test_integrations_with_serverless.sh:97 — grep -q with pipefail can omit affected packages (moderate, 1 vote).
• .buildkite/scripts/trigger_integrations_in_parallel.sh:66 — grep -q with pipefail can omit affected packages (moderate, 1 vote).
• .github/workflows/auto-backport.yml:177 — The referenced process-checked-branches.sh script is missing (critical, 2 votes).
• .github/workflows/docs-deploy.yml:14 — Deployment is not gated on successful documentation builds (moderate, 1 vote).
• .github/workflows/post-backport-checklist.yml:63 — Untrusted artifact data can control the pull request comment target (critical, 1 vote).
• .github/workflows/post-backport-checklist.yml:105 — Stale checklist comments are not deleted when the body becomes empty (moderate, 1 vote).
• .github/workflows/vale-report.yml:21 — Missing actions: read permission prevents artifact downloads (moderate, 1 vote).
• cmd/backport/backports/apply/apply.go:66 — Valid inventory branch names are rejected (moderate, 1 vote).
• cmd/backport/backports/changelog/extract.go:55 — Multi-hunk diffs can mix unrelated YAML into changelog entries (moderate, 1 vote).
• cmd/backport/main.go:249 — Two-endpoint diffs can include changes from the advanced base branch (moderate, 1 vote).
• dev/scripts/backport_apply.sh:53 — The documented --help option exits unsuccessfully (moderate, 1 vote).
• dev/scripts/backport_bootstrap_inventory.sh:49 — The documented -h option exits unsuccessfully (moderate, 1 vote).
• dev/scripts/backport_bootstrap_inventory.sh:324 — Valid nonnumeric backport branches are filtered out (moderate, 1 vote).
• dev/scripts/get_release_commit.sh:20 — The documented -h option exits unsuccessfully (moderate, 1 vote).
• dev/scripts/get_release_commit.sh:67 — Sorting reorders release commits and can select an older commit (moderate, 1 vote).
• magefile.go:149 — Removing ReportFailedTests breaks the daily failed-test reporting step (moderate, 2 votes).

File summaries

File	Summary
tools.go	Go tooling dependencies.
magefile.go	Mage tasks and test execution.
go.mod	Go module dependencies.
dev/testsreporter/xunit.go	Legacy test reporter implementation.
dev/testsreporter/testdata/sql_system_1718901944954979316.xml	Legacy reporter fixture.
dev/testsreporter/testdata/nats_1718676056733968706.xml	Legacy reporter fixture.
dev/testsreporter/testdata/fortinet_fortigate_1718675058322143368.xml	Legacy reporter fixture.
dev/testsreporter/testdata/fortinet_fortigate_1718675052813006253.xml	Legacy reporter fixture.
dev/testsreporter/testdata/elastic_package_registry_1718676502022628094.xml	Legacy reporter fixture.
dev/testsreporter/testdata/CODEOWNERS-default-tests	Reporter ownership fixture.
dev/testsreporter/testdata/cisco_umbrella_1718676502022628093.xml	Legacy reporter fixture.
dev/testsreporter/testdata/cisco_umbrella_1718675095255991383.xml	Legacy reporter fixture.
dev/testsreporter/testdata/cisco_umbrella_1718675095080627646.xml	Legacy reporter fixture.
dev/testsreporter/testdata/cisco_umbrella_1718675092421310216.xml	Legacy reporter fixture.
dev/testsreporter/packageerror.go	Reporter package error handling.
dev/testsreporter/packageerror_test.go	Reporter error tests.
dev/testsreporter/githubissue.go	GitHub issue reporting.
dev/testsreporter/github.go	GitHub integration.
dev/testsreporter/format.go	Reporter formatting.
dev/testsreporter/errorlinks.go	Error link generation.
dev/testsreporter/dataerror.go	Data error handling.
dev/testsreporter/builderror.go	Build error handling.
dev/testsreporter/builderror_test.go	Build error tests.
dev/testsreporter/_static/summary.tmpl	Issue summary template.
dev/testsreporter/_static/description.tmpl	Issue description template.
dev/scripts/README.md	Development script documentation.
dev/scripts/get_release_commit.sh	Release commit lookup.
dev/scripts/backport_apply.sh	Backport application wrapper.
dev/packagenames/testdata/no_duplicates/p2/manifest.yml	Package-name validation fixture.
dev/packagenames/testdata/no_duplicates/p1/manifest.yml	Package-name validation fixture.
dev/packagenames/testdata/nested/no_duplicates/technology/p2/manifest.yml	Nested package validation fixture.
dev/packagenames/testdata/nested/no_duplicates/technology/p1/manifest.yml	Nested package validation fixture.
dev/packagenames/testdata/nested/no_duplicates/p3/manifest.yml	Nested package validation fixture.
dev/packagenames/testdata/nested/duplicates/technology/p2/manifest.yml	Duplicate package validation fixture.
dev/packagenames/testdata/nested/duplicates/technology/p1/manifest.yml	Duplicate package validation fixture.
dev/packagenames/testdata/nested/duplicates/p3/manifest.yml	Duplicate package validation fixture.
dev/packagenames/testdata/invalid_manifests/p2/manifest.yml	Invalid manifest fixture.
dev/packagenames/testdata/invalid_manifests/p1/manifest.yml	Invalid manifest fixture.
dev/packagenames/testdata/duplicates/p2/manifest.yml	Duplicate package fixture.
dev/packagenames/testdata/duplicates/p1/manifest.yml	Duplicate package fixture.
dev/packagenames/packagenames.go	Package-name validation logic.
dev/packagenames/packagenames_test.go	Package-name validation tests.
dev/import-beats/README.md	Import tooling documentation.
dev/gitutil/git.go	Git utility helpers.
dev/codeowners/testdata/test_packages/package_1/manifest.yml	CODEOWNERS package fixture.
dev/codeowners/testdata/nested_packages/package_top/manifest.yml	Nested ownership fixture.
dev/codeowners/testdata/nested_packages/category/package_nested_2/manifest.yml	Nested ownership fixture.
dev/codeowners/testdata/nested_packages/category/package_nested_1/manifest.yml	Nested ownership fixture.
dev/codeowners/testdata/nested_packages/category/package_nested_1/data_stream/stream_2/.keep	Data stream fixture.
dev/codeowners/testdata/nested_packages/category/package_nested_1/data_stream/stream_1/.keep	Data stream fixture.
dev/codeowners/testdata/devexp/manifest.yml	Development ownership fixture.
dev/codeowners/testdata/CODEOWNERS-owners-trailing-slash	CODEOWNERS validation fixture.
dev/codeowners/testdata/CODEOWNERS-nested-valid	CODEOWNERS validation fixture.
dev/codeowners/testdata/CODEOWNERS-nested-streams-valid	CODEOWNERS validation fixture.
dev/codeowners/testdata/CODEOWNERS-nested-streams-missing-owners	CODEOWNERS validation fixture.
dev/codeowners/testdata/CODEOWNERS-nested-missing-owner	CODEOWNERS validation fixture.
dev/codeowners/testdata/CODEOWNERS-nested-category-owner	CODEOWNERS validation fixture.
dev/citools/subscription.go	CI subscription helpers.
dev/citools/packages.go	Package discovery helpers.
dev/citools/packagemanifest.go	Package manifest parsing.
dev/citools/logsdb.go	Logs database integration.
dev/citools/logsdb_test.go	Logs database tests.
dev/citools/kibana.go	Kibana integration.
dev/citools/kibana_test.go	Kibana integration tests.
dev/citools/gomod.go	Go module helpers.
dev/citools/gomod_test.go	Go module helper tests.
cmd/backport/tools.go	Backport tool dependencies.
cmd/backport/magefile.go	Backport Mage tasks.
cmd/backport/go.mod	Backport module configuration.
cmd/backport/gitutil/git.go	Backport Git helpers.
cmd/backport/citools/packages.go	Backport package helpers.
cmd/backport/citools/packagemanifest.go	Backport manifest parsing.
cmd/backport/backports/packages/detect.go	Changed-package detection.
cmd/backport/backports/owners/check.go	Backport ownership checks.
cmd/backport/backports/owners/check_test.go	Ownership check tests.
cmd/backport/backports/changelog/update.go	Changelog updates.
cmd/backport/backports/changelog/update_test.go	Changelog update tests.
cmd/backport/backports/changelog/sync_test.go	Changelog sync tests.
cmd/backport/backports/changelog/resolve.go	Changelog resolution.
cmd/backport/backports/changelog/resolve_test.go	Changelog resolution tests.
cmd/backport/backports/changelog/insert.go	Changelog insertion.
cmd/backport/backports/changelog/insert_test.go	Changelog insertion tests.
cmd/backport/backports/changelog/extract.go	Changelog extraction.
cmd/backport/backports/changelog/extract_test.go	Changelog extraction tests.
cmd/backport/backports/changelog/comment.go	Changelog comments.
cmd/backport/.go-version	Backport Go version.
.gitignore	Ignore rules.
.github/workflows/validate-yaml-dashboards.requirements.txt	Dashboard validation requirements.
.github/workflows/validate-package-docs.yml	Package documentation validation.
.github/workflows/vale-report.yml	Vale report workflow.
.github/workflows/vale-lint.yml	Vale lint workflow.
.github/workflows/updatecli/updatecli.d/sync-packages-to-bug-issue-template.yml	Issue-template synchronization.
.github/workflows/trigger-text-auditor.yml	Text-auditor trigger.
.github/workflows/trigger-stale-issues.yml	Stale-issue trigger.
.github/workflows/trigger-pr-review.yml	Pull-request review trigger.
.github/workflows/trigger-pr-actions-detective.yml	Actions-detective trigger.
.github/workflows/trigger-package-tests-security-ml.yml	Package-test trigger.
.github/workflows/trigger-newbie-contributor-patrol.yml	Contributor-patrol trigger.
.github/workflows/trigger-mention-in-pr.yml	Pull-request mention trigger.
.github/workflows/trigger-mention-in-issue.yml	Issue mention trigger.
.github/workflows/trigger-issue-triage.yml	Issue-triage trigger.
.github/workflows/trigger-duplicate-issue-detector.yml	Duplicate-issue trigger.
.github/workflows/trigger-docs-patrol.yml	Documentation-patrol trigger.
.github/workflows/trigger-bug-hunter.yml	Bug-hunter trigger.
.github/workflows/trigger-breaking-change-detector.yml	Breaking-change trigger.
.github/workflows/sweep-ingest-pipeline-safety.yml	Ingest safety sweep.
.github/workflows/sweep-httpjson-pagination.yml	HTTP JSON pagination sweep.
.github/workflows/sweep-field-mapping-conflicts.yml	Field-mapping conflict sweep.
.github/workflows/sweep-dashboard-data-scope.yml	Dashboard data-scope sweep.
.github/workflows/requires-update.yml	Update requirement workflow.
.github/workflows/pr-buildkite-detective.yml	Buildkite detective workflow.
.github/workflows/post-backport-checklist.yml	Backport checklist workflow.
.github/workflows/notify-package-docs-failure.yml	Documentation failure notification.
.github/workflows/docs-preview-cleanup.yml	Documentation preview cleanup.
.github/workflows/docs-deploy.yml	Documentation deployment.
.github/workflows/docs-build.yml	Documentation build.
.github/workflows/ci-comment.yml	CI comment workflow.
.github/workflows/catalog-info.yml	Catalog metadata workflow.
.github/workflows/bump-elastic-stack-version.yml	Stack-version update workflow.
.github/workflows/backport-packages-detect.yml	Backport package detection.
.github/actions/sync-backport-changelog/action.yml	Changelog synchronization action.
.buildkite/scripts/trigger_integrations_in_parallel.sh	Parallel integration triggering.
.buildkite/scripts/trigger_backport.sh	Backport triggering.
.buildkite/scripts/test_one_package.sh	Single-package testing.
.buildkite/scripts/test_integrations_with_serverless.sh	Serverless integration testing.
.buildkite/scripts/test_helpers.sh	Buildkite test helpers.
.buildkite/scripts/test_check_backport_owners.sh	Backport ownership checks.
.buildkite/scripts/run_dev_scripts_tests.sh	Development script tests.
.buildkite/scripts/run_buildkite_scripts_tests.sh	Buildkite script tests.
.buildkite/scripts/requirements-ci-python-scripts.txt	CI Python requirements.
.buildkite/scripts/process_benchmarks.sh	Benchmark processing.
.buildkite/scripts/packages/security_detection_engine.sh	Security detection engine tests.
.buildkite/scripts/packages/crowdstrike.sh	CrowdStrike package tests.
.buildkite/scripts/notify_backport_pr.sh	Backport PR notifications.
.buildkite/scripts/non_package_patterns.txt	Non-package path patterns.
.buildkite/scripts/check_sources.sh	Source checks.
.buildkite/scripts/check_changelog_versions_in_main.sh	Changelog version checks.
.buildkite/scripts/check_backports_inventory.sh	Backport inventory checks.
.buildkite/scripts/check_backport_tool.sh	Backport tool checks.
.buildkite/scripts/build_packages.sh	Package builds.
.buildkite/scripts/backport_branch_lib.sh	Backport branch helpers.
.buildkite/pull-requests.json	Pull-request pipeline configuration.
.buildkite/pipeline.serverless.yml	Serverless pipeline.
.buildkite/pipeline.schedule-weekly.yml	Weekly scheduled pipeline.
.buildkite/pipeline.schedule-daily.yml	Daily scheduled pipeline.
.buildkite/pipeline.publish.yml	Publishing pipeline.
.buildkite/pipeline.backport.yml	Backport pipeline.
.buildkite/pipeline.backport-dispatch.yml	Backport dispatch pipeline.
.buildkite/hooks/pre-exit	Buildkite exit hook.
.buildkite/hooks/pre-command	Buildkite command hook.

Review details

Suppressed comments (14)

.buildkite/scripts/backport_branch.sh:225

• The backport branch setup removes dev/testsreporter while .buildkite/scripts/report_issues.sh still runs mage -v ReportFailedTests build/test-results, and the copied magefile.go no longer defines that target. Daily report steps will therefore fail and, because the step is soft-failed, silently stop creating GitHub issues for failed tests; keep the reporter or update/remove its caller together with this cleanup.
  .buildkite/scripts/test_integrations_with_serverless.sh:100
• These lookups use grep -q in a pipeline while pipefail is enabled. For a sufficiently large changed_files value, grep can exit after its first match, causing echo to receive SIGPIPE and making the if condition false; the affected package is then omitted from the serverless test loop. This contradicts the existing warning and non--q implementation in .buildkite/scripts/common.sh:762-770; use grep ... > /dev/null so the producer is allowed to finish.
  .buildkite/scripts/trigger_integrations_in_parallel.sh:69
• These lookups use grep -q in a pipeline while pipefail is enabled. For a sufficiently large changed_files value, grep can exit after its first match, causing echo to receive SIGPIPE and making the if condition false; the affected package is then omitted from selective testing. This contradicts the existing warning and non--q implementation in .buildkite/scripts/common.sh:762-770; use grep ... > /dev/null so the producer is allowed to finish.
  .github/workflows/docs-deploy.yml:14
• workflow_run fires for every completed docs-build, including failures and cancellations, but this deployment job has no conclusion guard. The reusable deployment workflow is therefore invoked for unsuccessful builds, risking publication of incomplete documentation and unnecessary use of deployment credentials. Gate the job on github.event.workflow_run.conclusion == 'success'.
  .github/workflows/post-backport-checklist.yml:108
• When the current diff no longer touches a package, or all its branches become inactive, BuildComment returns an empty body. This path exits without deleting COMMENT_ID, so the old checklist—including checked branches—remains on the PR and can drive backport automation for packages no longer in the current diff. Delete the existing checklist comment before exiting when COMMENT_ID is set.
  .github/workflows/vale-report.yml:22
• This permission block omits actions: read, although the report action downloads the Vale artifact from the triggering workflow run. Since specifying permissions sets unspecified scopes to none, the artifact download will be denied and no report comment will be posted.
  cmd/backport/backports/apply/apply.go:66
• This regex rejects valid inventory branch names such as backport-aws-2024-hotfix, even though backports/inventory.go accepts that suffix format and Target is documented to accept a full branch name. backport apply therefore fails before fetching those branches; use the same suffix pattern as the inventory validator.
  cmd/backport/backports/changelog/extract.go:55
• This collects every added line from the entire unified diff, so it loses hunk/context boundaries. If a PR adds a version entry and also edits an existing later entry (for example, changing its link), the later added line is appended to entryBlock because its unchanged version header is not in added; the sync PR then inserts unrelated YAML into the new entry. Parse the selected hunk or reconstruct the file context so extraction stops at the next actual version header, and cover the multi-hunk case.
  cmd/backport/main.go:249
• detect-packages is called with the PR's base.sha and head.sha, but git diff A..B compares the two endpoint trees rather than the PR's merge-base to head. If the base branch advanced after the PR was created, files changed only on the base side can be reported as packages touched by the PR and added to the checklist. Use a three-dot diff (or compute the merge-base) for this shared helper.
  dev/scripts/backport_apply.sh:53
• --help invokes usage, but usage always exits 1. This makes the wrapper's documented help option fail instead of returning successfully; separate the help path from the error usage path or let the helper accept a status.
  dev/scripts/backport_bootstrap_inventory.sh:49
• The -h option calls usage, which unconditionally exits with status 1, so the following exit 0 is unreachable and help is reported as a failure. Make the usage helper accept a status or use a success-specific help path.
  dev/scripts/backport_bootstrap_inventory.sh:325
• The bootstrap's final ref filter only accepts numeric major.minor[.patch] suffixes, but the backport inventory validation accepts branches such as backport-aws-6.x and backport-aws-6.14.x. Those valid active branches are filtered out before the loop and will be missing from the generated inventory; align this filter (and the earlier suffix parser) with the accepted branch forms.
  dev/scripts/get_release_commit.sh:21
• The -h option never succeeds: usage unconditionally exits with status 1, so execution cannot reach the following exit 0. As a result, the advertised help option is reported as an error; print the usage text without calling the error path or let usage accept a success status.
  dev/scripts/get_release_commit.sh:67
• git log already returns matching commits newest-first, but sort -u reorders them lexicographically. If a version is removed and later reintroduced, the loop can select an arbitrary older addition instead of the latest release commit, so the inventory's base commit is wrong. Preserve the order from git log here.

• Files reviewed: 174/195 changed files
• Comments generated: 5
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

Package 1password 👍(1) 💚(0) 💔(2)

Expand to view

Data stream	Previous EPS	New EPS	Diff (%)	Result
audit_events	5952.38	4587.16	-1365.22 (-22.94%)	💔
signin_attempts	13333.33	4405.29	-8928.04 (-66.96%)	💔

To see the full report comment with /test benchmark fullreport

[github-actions]

Changelog sync skipped — all changelog versions are already present on main.