mrodm · Sep 8, 2026 · Jul 31, 2026 · Jul 31, 2026 · Sep 7, 2026 · Sep 7, 2026
@@ -0,0 +1,43 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+
+env:
+  SETUP_GVM_VERSION: "v0.6.0"
+  LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
+  YQ_VERSION: 'v4.35.2'
+  GH_CLI_VERSION: "2.29.0"
+  NOTIFY_TO: "ecosystem-team@elastic.co"
+
+steps:
+  - label: ":ballot_box_with_check: Backports inventory validation"
+    key: "check-backports-inventory"
+    command: ".buildkite/scripts/check_backports_inventory.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    if_changed:
+      - ".backports.yml"
+      - ".buildkite/scripts/run_dev_scripts_tests.sh"
+      - "dev/scripts/**.sh"
+      - "cmd/backport/**"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') == "false" && build.branch == "main"
+
+  - label: ":git: Create backport branches for new entries"
+    key: "trigger-backport-create"
+    command: ".buildkite/scripts/trigger_backport.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-backports-inventory"
+        allow_failure: false
+    if_changed:
+      - ".backports.yml"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') == "false" &&
+      build.branch == "main" &&
+      build.env('BUILDKITE_PIPELINE_SLUG') == "integrations-backport-dispatch"
+
+notify:
+  - email: "$NOTIFY_TO"
+    if: "build.state == 'failed' && build.env('BUILDKITE_PULL_REQUEST') == 'false'"
@@ -5,20 +5,31 @@ name: "integrations-backport"
 env:
   SETUP_GVM_VERSION: "v0.6.0"
   YQ_VERSION: 'v4.35.2'
+  GH_CLI_VERSION: "2.29.0"
   # Agent images used in pipeline steps
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
+  NOTIFY_TO: "ecosystem-team@elastic.co"
 
 steps:
 
   - label: "Check that it runs from UI"
     key: "check-ui"
     command:
-      - "buildkite-agent annotate \"The $BUILDKITE_PIPELINE_SLUG is used only for running from UI!\" --style 'warning'"
+      - "buildkite-agent annotate \"The $${BUILDKITE_PIPELINE_SLUG} pipeline can only be triggered from the UI by members of the 'ecosystem' team, or via a trigger step from the 'integrations' or 'integrations-backport-dispatch' pipeline. For the recommended workflow see the [documentation](https://www.elastic.co/guide/en/integrations-developer/current/developer-workflow-support-old-package.html).\" --style 'warning'"
       - "exit 1"
-    if: "build.source != 'ui'"
+    if: |
+      !(
+        (build.source == 'ui' && build.creator.teams includes "ecosystem") ||
+        (build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations') ||
+        (build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations-backport-dispatch')
+      )
+
+  # Ensure that the check-ui step runs before any other step
+  - wait: ~
 
   - input: "Input values for the variables"
     key: "input-variables"
+    if: "build.source != 'trigger_job'"
     fields:
     - select: "DRY_RUN"
       key: "DRY_RUN"
@@ -47,7 +58,15 @@ steps:
           value: "true"
         - label: "False"
           value: "false"
-      default: "false"
+      default: "true"
+    - text: "Backport branch name (optional, defaults to backport-<package>-<major>.<minor>)"
+      key: "BACKPORT_BRANCH_NAME"
+      required: false
+      default: ""
+    - text: "PR number to notify on completion (optional)"
+      key: "PR_NUMBER"
+      required: false
+      default: ""
 
   - label: "Creating the backport branch"
     key: "create-backport-branch"
@@ -62,3 +81,30 @@ steps:
     depends_on:
       - step: "input-variables"
         allow_failure: false
+
+  - label: ":github: Notify PR"
+    key: "notify-pr"
+    command: |
+      if ! outcome=$$(buildkite-agent step get "outcome" --step "create-backport-branch"); then
+        echo "Failed to retrieve step outcome, skipping PR notification"
+        exit 0
+      fi
+      if [[ "$${outcome}" == "passed" ]]; then
+        NOTIFY_STATUS=success .buildkite/scripts/notify_backport_pr.sh
+      else
+        NOTIFY_STATUS=failure .buildkite/scripts/notify_backport_pr.sh
+      fi
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "create-backport-branch"
+        allow_failure: true
+
+notify:
+  # Only notify for automated backport creation failures (triggered by integrations-backport-dispatch).
+  # Dry-run failures from PR builds (triggered by integrations) are already surfaced as a failing
+  # CI status on the PR itself and do not warrant a team email.
+  - email: "$NOTIFY_TO"
+    if: "build.state == 'failed' && build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations-backport-dispatch'"
@@ -34,7 +34,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.16-SNAPSHOT
+        STACK_VERSION: 8.19.21-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "true"
     depends_on:
       - step: "check"
@@ -48,7 +48,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.16-SNAPSHOT
+        STACK_VERSION: 8.19.21-SNAPSHOT
         STACK_LOGSDB_ENABLED: "true"
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:
@@ -86,13 +86,13 @@ steps:
     if: |
       build.env('TEST_PACKAGES_BASIC_SUBSCRIPTION') == "true"
 
-  - label: "Check integrations local stacks - Stack Version v9.5"
+  - label: "Check integrations local stacks - Stack Version v9.6"
     trigger: "integrations"
     build:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 9.5.0-SNAPSHOT
+        STACK_VERSION: 9.6.0-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:
       - step: "check"

@@ -21,20 +21,20 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.16-SNAPSHOT
+        STACK_VERSION: 8.19.21-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:
       - step: "check"
         allow_failure: false
 
-  - label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.5"
+  - label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.6"
     trigger: "integrations"
     build:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 9.5.0-SNAPSHOT
+        STACK_VERSION: 9.6.0-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:

@@ -73,6 +73,43 @@ steps:
     key: "check-dev-scripts"
     command: ".buildkite/scripts/run_dev_scripts_tests.sh"
 
+  - label: ":golang: Backport tool tests"
+    key: "check-backport-tool"
+    command: ".buildkite/scripts/check_backport_tool.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    if_changed:
+      - "cmd/backport/**"
+
+  - label: ":ballot_box_with_check: Backports inventory validation"
+    key: "check-backports-inventory"
+    command: ".buildkite/scripts/check_backports_inventory.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    if_changed:
+      - ".backports.yml"
+      - ".buildkite/scripts/run_dev_scripts_tests.sh"
+      - "dev/scripts/**.sh"
+      - "cmd/backport/**"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') == "main"
+
+  - label: ":git: Trigger backport dry-runs"
+    key: "trigger-backport-dryrun"
+    command: ".buildkite/scripts/trigger_backport.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    depends_on:
+      - step: "check-backports-inventory"
+        allow_failure: false
+    if_changed:
+      - ".backports.yml"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PIPELINE_SLUG') == "integrations" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') == "main"
+
   - label: ":junit: Sources Junit annotate"
     agents:
       # requires at least "bash", "curl" and "git"
@@ -89,10 +126,24 @@ steps:
           run-in-docker: false
           context: junit-sources
 
+  - label: ":scroll: Check changelog versions not in main"
+    key: "check-changelog-versions-in-main"
+    command: ".buildkite/scripts/check_changelog_versions_in_main.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+      cpu: "2"
+      memory: "1G"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') =~ /^backport-/
+    if_changed:
+      - "**/changelog.yml"
+
   - label: ":scroll: Check changelog PR links"
     key: "check-changelog-pr-links"
     command: ".buildkite/scripts/check_changelog_entries.sh"
-    soft_fail: true
+    soft_fail:
+      - exit_status: 2
     agents:
       image: "${LINUX_AGENT_IMAGE}"
       cpu: "2"
@@ -111,6 +162,25 @@ steps:
     if_changed:
       - "**/changelog.yml"
 
+  - label: ":busts_in_silhouette: Check backport package owners"
+    key: "check-backport-owners"
+    command: ".buildkite/scripts/check_backport_owners.sh"
+    soft_fail: true
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+      cpu: "2"
+      memory: "1G"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-buildkite-scripts"
+        allow_failure: false
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') != "false" &&
+      build.env('BUILDKITE_PULL_REQUEST_BASE_BRANCH') =~ /^backport-/
+    if_changed:
+      - "packages/**"
+      - ".github/CODEOWNERS"
 
   - label: "Trigger integrations"
     key: "test-integrations"

@@ -14,26 +14,31 @@
       "skip_ci_labels": [],
       "skip_target_branches": [],
       "skip_ci_on_only_changed": [
+        "^.agents/skills/",
         "^.buildkite/pipeline.backport.yml$",
+        "^.buildkite/pipeline.backport-dispatch.yml$",
         "^.buildkite/pipeline.publish.yml$",
         "^.buildkite/pipeline.serverless.yml$",
         "^.buildkite/pipeline.schedule-daily.yml$",
         "^.buildkite/pipeline.schedule-weekly.yml$",
         "^.buildkite/pull-requests.json$",
         "^.buildkite/scripts/backport_branch.sh$",
         "^.buildkite/scripts/build_packages.sh$",
+        "^.buildkite/scripts/check_backport_tool.sh$",
+        "^.buildkite/scripts/notify_backport_pr.sh$",
+        "^.github/actions/",
         "^.github/dependabot.yml$",
         "^.github/workflows/",
         "^.github/stale.yml$",
         "^.github/ISSUE_TEMPLATE/",
         "^.github/PULL_REQUEST_TEMPLATE.md$",
+        "^.gitignore",
         "^.mergify.yml$",
         "^catalog-info.yaml$",
         "^docs/",
         "^CODE_OF_CONDUCT.md$",
         "^CONTRIBUTING.md$",
-        "^README.md$",
-        "^.agents/skills/"
+        "^README.md$"
       ],
       "always_require_ci_on_changed": []
     },
@@ -85,6 +90,22 @@
       "skip_ci_on_only_changed": [],
       "always_require_ci_on_changed": []
     },
+    {
+      "enabled": false,
+      "pipelineSlug": "integrations-backport-dispatch",
+      "allow_org_users": true,
+      "allowed_repo_permissions": ["admin", "write"],
+      "allowed_list": [],
+      "set_commit_status": false,
+      "build_on_commit": false,
+      "build_on_comment": false,
+      "trigger_comment_regex": "",
+      "always_trigger_comment_regex": "",
+      "skip_ci_labels": [],
+      "skip_target_branches": [],
+      "skip_ci_on_only_changed": [],
+      "always_require_ci_on_changed": []
+    },
     {
       "enabled": false,
       "pipelineSlug": "integrations-publish",