elastic · mrodm · Aug 4, 2026
@@ -0,0 +1,43 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+
+env:
+  SETUP_GVM_VERSION: "v0.6.0"
+  LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
+  YQ_VERSION: 'v4.35.2'
+  GH_CLI_VERSION: "2.29.0"
+  NOTIFY_TO: "ecosystem-team@elastic.co"
+
+steps:
+  - label: ":ballot_box_with_check: Backports inventory validation"
+    key: "check-backports-inventory"
+    command: ".buildkite/scripts/check_backports_inventory.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    if_changed:
+      - ".backports.yml"
+      - ".buildkite/scripts/run_dev_scripts_tests.sh"
+      - "dev/scripts/**.sh"
+      - "dev/backports/**"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') == "false" && build.branch == "main"
+
+  - label: ":git: Create backport branches for new entries"
+    key: "trigger-backport-create"
+    command: ".buildkite/scripts/trigger_backport.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-backports-inventory"
+        allow_failure: false
+    if_changed:
+      - ".backports.yml"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') == "false" &&
+      build.branch == "main" &&
+      build.env('BUILDKITE_PIPELINE_SLUG') == "integrations-backport-dispatch"
+
+notify:
+  - email: "$NOTIFY_TO"
+    if: "build.state == 'failed' && build.env('BUILDKITE_PULL_REQUEST') == 'false'"
@@ -3,21 +3,33 @@
 name: "integrations-backport"
 
 env:
+  SETUP_GVM_VERSION: "v0.6.0"
   YQ_VERSION: 'v4.35.2'
+  GH_CLI_VERSION: "2.29.0"
   # Agent images used in pipeline steps
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
+  NOTIFY_TO: "ecosystem-team@elastic.co"
 
 steps:
 
   - label: "Check that it runs from UI"
     key: "check-ui"
     command:
-      - "buildkite-agent annotate \"The $BUILDKITE_PIPELINE_SLUG is used only for running from UI!\" --style 'warning'"
+      - "buildkite-agent annotate \"The $${BUILDKITE_PIPELINE_SLUG} pipeline can only be triggered from the UI by members of the 'ecosystem' team, or via a trigger step from the 'integrations' or 'integrations-backport-dispatch' pipeline. For the recommended workflow see the [documentation](https://www.elastic.co/guide/en/integrations-developer/current/developer-workflow-support-old-package.html).\" --style 'warning'"
       - "exit 1"
-    if: "build.source != 'ui'"
+    if: |
+      !(
+        (build.source == 'ui' && build.creator.teams includes "ecosystem") ||
+        (build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations') ||
+        (build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations-backport-dispatch')
+      )
+
+  # Ensure that the check-ui step runs before any other step
+  - wait: ~
 
   - input: "Input values for the variables"
     key: "input-variables"
+    if: "build.source != 'trigger_job'"
     fields:
     - select: "DRY_RUN"
       key: "DRY_RUN"
@@ -35,10 +47,6 @@ steps:
       key: "PACKAGE_NAME"
       required: true
       default: ""
-    - text: "Enter name of the folder for the package (in most cases coincides with PACKAGE_NAME)"
-      key: "PACKAGE_FOLDER_NAME"
-      required: true
-      default: ""
     - text: "Enter package version (examples: 1.5.7, 1.0.0-beta1)"
       key: "PACKAGE_VERSION"
       required: true
@@ -50,7 +58,15 @@ steps:
           value: "true"
         - label: "False"
           value: "false"
-      default: "false"
+      default: "true"
+    - text: "Backport branch name (optional, defaults to backport-<package>-<major>.<minor>)"
+      key: "BACKPORT_BRANCH_NAME"
+      required: false
+      default: ""
+    - text: "PR number to notify on completion (optional)"
+      key: "PR_NUMBER"
+      required: false
+      default: ""
 
   - label: "Creating the backport branch"
     key: "create-backport-branch"
@@ -65,3 +81,30 @@ steps:
     depends_on:
       - step: "input-variables"
         allow_failure: false
+
+  - label: ":github: Notify PR"
+    key: "notify-pr"
+    command: |
+      if ! outcome=$$(buildkite-agent step get "outcome" --step "create-backport-branch"); then
+        echo "Failed to retrieve step outcome, skipping PR notification"
+        exit 0
+      fi
+      if [[ "$${outcome}" == "passed" ]]; then
+        NOTIFY_STATUS=success .buildkite/scripts/notify_backport_pr.sh
+      else
+        NOTIFY_STATUS=failure .buildkite/scripts/notify_backport_pr.sh
+      fi
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "create-backport-branch"
+        allow_failure: true
+
+notify:
+  # Only notify for automated backport creation failures (triggered by integrations-backport-dispatch).
+  # Dry-run failures from PR builds (triggered by integrations) are already surfaced as a failing
+  # CI status on the PR itself and do not warrant a team email.
+  - email: "$NOTIFY_TO"
+    if: "build.state == 'failed' && build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations-backport-dispatch'"
@@ -38,6 +38,9 @@ steps:
       ARTIFACTS_FOLDER: "artifacts-to-sign"
       # by default it will publish packages
       DRY_RUN: "${DRY_RUN:-false}"
+      # Comma-separated list of package zip filenames to skip (e.g. "foo-1.0.0.zip,bar-2.0.0.zip")
+      # kubeletstats_input_otel-0.1.0 was deleted but it is kept in the repository for now, in case it is needed to release a new version if needed
+      SKIP_PACKAGES: "kubeletstats_input_otel-0.1.0.zip"
     depends_on:
       - step: "check"
         allow_failure: false

@@ -34,7 +34,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.11-SNAPSHOT
+        STACK_VERSION: 8.19.20-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "true"
     depends_on:
       - step: "check"
@@ -48,7 +48,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.11-SNAPSHOT
+        STACK_VERSION: 8.19.20-SNAPSHOT
         STACK_LOGSDB_ENABLED: "true"
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:
@@ -86,13 +86,13 @@ steps:
     if: |
       build.env('TEST_PACKAGES_BASIC_SUBSCRIPTION') == "true"
 
-  - label: "Check integrations local stacks - Stack Version v9.4"
+  - label: "Check integrations local stacks - Stack Version v9.6"
     trigger: "integrations"
     build:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 9.4.0-SNAPSHOT
+        STACK_VERSION: 9.6.0-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:
       - step: "check"

@@ -21,20 +21,20 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.11-SNAPSHOT
+        STACK_VERSION: 8.19.20-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:
       - step: "check"
         allow_failure: false
 
-  - label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.4"
+  - label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.6"
     trigger: "integrations"
     build:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 9.4.0-SNAPSHOT
+        STACK_VERSION: 9.6.0-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:

@@ -5,10 +5,10 @@ env:
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
   DOCKER_COMPOSE_VERSION: "v2.24.1"
   DOCKER_VERSION: "false" # not required to set since system tests are not running yet
-  KIND_VERSION: 'v0.27.0'
-  K8S_VERSION: 'v1.33.0'
+  KIND_VERSION: 'v0.32.0'
+  K8S_VERSION: 'v1.36.1'
   YQ_VERSION: 'v4.35.2'
-  IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
+  IMAGE_UBUNTU_X86_64: "family/platform-obs-integrations-ubuntu-2204"
   GH_CLI_VERSION: "2.29.0"
   # This pipeline is intended to test packages with Elastic Serverless
   SERVERLESS: true
@@ -71,14 +71,13 @@ steps:
       # See https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/integrations/01-aws-buildkite-oidc.tf
       # This plugin creates the environment variables required by the service deployer (AWS_SECRET_ACCESS_KEY and AWS_SECRET_KEY_ID)
       - elastic/oblt-aws-auth#v0.1.0:
-          duration: 10800 # seconds
+          duration: 21600 # seconds
       # See https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/integrations/01-gcp-buildkite-oidc.tf
       # This plugin authenticates to CI Google Cloud using the OIDC token.
       - elastic/oblt-google-auth#v1.3.0:
-          lifetime: 10800 # seconds
+          lifetime: 21600 # seconds
           project-id: "elastic-observability-ci"
           project-number: "911195782929"
-          lifetime: 10800 # seconds
       - avaly/gcp-secret-manager#v1.2.0:
           env:
             EC_API_KEY: elastic-cloud-observability-team-qa-api-key

@@ -8,10 +8,11 @@ env:
   YQ_VERSION: 'v4.35.2'
   JQ_VERSION: '1.7'
   GH_CLI_VERSION: "2.29.0"
+  CHANGELOG_SKIP_LABEL: "changelog-link-check:skip"
 
   # Agent images used in pipeline steps
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
-  IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
+  IMAGE_UBUNTU_X86_64: "family/platform-obs-integrations-ubuntu-2204"
 
   # Elastic package settings
   # Manage docker output/logs
@@ -60,6 +61,47 @@ steps:
     artifact_paths:
       - tests-report.xml
 
+  - label: ":bash: :snake: Buildkite scripts unit tests"
+    key: "check-buildkite-scripts"
+    command: ".buildkite/scripts/run_buildkite_scripts_tests.sh"
+    agents:
+      # GCP VM used to match the same Python 3 version available in the steps that test packages
+      provider: gcp
+      image: "${IMAGE_UBUNTU_X86_64}"
+
+  - label: ":bash: Dev scripts unit tests"
+    key: "check-dev-scripts"
+    command: ".buildkite/scripts/run_dev_scripts_tests.sh"
+
+  - label: ":ballot_box_with_check: Backports inventory validation"
+    key: "check-backports-inventory"
+    command: ".buildkite/scripts/check_backports_inventory.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    if_changed:
+      - ".backports.yml"
+      - ".buildkite/scripts/run_dev_scripts_tests.sh"
+      - "dev/scripts/**.sh"
+      - "dev/backports/**"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') == "main"
+
+  - label: ":git: Trigger backport dry-runs"
+    key: "trigger-backport-dryrun"
+    command: ".buildkite/scripts/trigger_backport.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    depends_on:
+      - step: "check-backports-inventory"
+        allow_failure: false
+    if_changed:
+      - ".backports.yml"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PIPELINE_SLUG') == "integrations" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') == "main"
+
   - label: ":junit: Sources Junit annotate"
     agents:
       # requires at least "bash", "curl" and "git"
@@ -76,6 +118,62 @@ steps:
           run-in-docker: false
           context: junit-sources
 
+  - label: ":scroll: Check changelog versions not in main"
+    key: "check-changelog-versions-in-main"
+    command: ".buildkite/scripts/check_changelog_versions_in_main.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+      cpu: "2"
+      memory: "1G"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') =~ /^backport-/
+    if_changed:
+      - "**/changelog.yml"
+
+  - label: ":scroll: Check changelog PR links"
+    key: "check-changelog-pr-links"
+    command: ".buildkite/scripts/check_changelog_entries.sh"
+    soft_fail:
+      - exit_status: 2
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+      cpu: "2"
+      memory: "1G"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-buildkite-scripts"
+        allow_failure: false
+    # CHANGELOG_SKIP_LABEL is substituted into the regex at pipeline upload time.
+    # This works because the variable is defined in the global env section above;
+    # step-level env vars are not available at upload time and cannot be used here.
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      !(build.env("GITHUB_PR_LABELS") =~ /${CHANGELOG_SKIP_LABEL}/)
+    if_changed:
+      - "**/changelog.yml"
+
+  - label: ":busts_in_silhouette: Check backport package owners"
+    key: "check-backport-owners"
+    command: ".buildkite/scripts/check_backport_owners.sh"
+    soft_fail: true
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+      cpu: "2"
+      memory: "1G"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-buildkite-scripts"
+        allow_failure: false
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') =~ /^backport-/
+    if_changed:
+      - "packages/**"
+      - ".github/CODEOWNERS"
+
   - label: "Trigger integrations"
     key: "test-integrations"
     command: ".buildkite/scripts/trigger_integrations_in_parallel.sh"
@@ -84,6 +182,8 @@ steps:
     depends_on:
       - step: "check"
         allow_failure: false
+      - step: "check-buildkite-scripts"
+        allow_failure: false
 
   - wait: ~
     continue_on_failure: true