Sync CI configuration with main branch

mrodm · Sep 9, 2026 · Aug 5, 2026 · Aug 5, 2026 · Aug 5, 2026 · Sep 7, 2026
commit de078bf41695ca682fe278a4ddf9fecd8a58305c
@@ -17,7 +17,7 @@ steps:
       - ".backports.yml"
       - ".buildkite/scripts/run_dev_scripts_tests.sh"
       - "dev/scripts/**.sh"
-      - "dev/backports/**"
+      - "cmd/backport/**"
     if: |
       build.env('BUILDKITE_PULL_REQUEST') == "false" && build.branch == "main"
 

@@ -34,7 +34,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.20-SNAPSHOT
+        STACK_VERSION: 8.19.21-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "true"
     depends_on:
       - step: "check"
@@ -48,7 +48,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.20-SNAPSHOT
+        STACK_VERSION: 8.19.21-SNAPSHOT
         STACK_LOGSDB_ENABLED: "true"
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:

@@ -21,7 +21,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.20-SNAPSHOT
+        STACK_VERSION: 8.19.21-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:

@@ -26,6 +26,7 @@
         "^.buildkite/scripts/build_packages.sh$",
         "^.buildkite/scripts/check_backport_tool.sh$",
         "^.buildkite/scripts/notify_backport_pr.sh$",
+        "^.github/actions/",
         "^.github/dependabot.yml$",
         "^.github/workflows/",
         "^.github/stale.yml$",

@@ -144,8 +144,35 @@ updateBackportBranchContents() {
   local files_cached_num=""
 
   git checkout "$BACKPORT_BRANCH_NAME"
+
+  # Preserve version pins that are specific to the backport branch (e.g. kubernetes
+  # packages pin K8S_VERSION/KIND_VERSION to whatever was compatible at release time).
+  # We capture the full line (including whitespace and quote style) so we can restore
+  # it with sed, which rewrites only that line and leaves blank lines intact — yq -i
+  # rewrites the whole file and strips empty lines as a side effect.
+  local pipeline_yml="${BUILDKITE_FOLDER_PATH}/pipeline.yml"
+  local k8s_version_line=""
+  local kind_version_line=""
+  if [ -f "${pipeline_yml}" ]; then
+    k8s_version_line=$(grep -E '^\s*K8S_VERSION:' "${pipeline_yml}" || true)
+    kind_version_line=$(grep -E '^\s*KIND_VERSION:' "${pipeline_yml}" || true)
+    echo "Preserving from backport branch: ${k8s_version_line}, ${kind_version_line}"
+  fi
+
   echo "--- Copying $BUILDKITE_FOLDER_PATH from $SOURCE_BRANCH..."
+  git rm -r --cached "${BUILDKITE_FOLDER_PATH}" 2>/dev/null || true
   git checkout $SOURCE_BRANCH -- $BUILDKITE_FOLDER_PATH
+
+  # Restore the version pins overwritten by the checkout above.
+  if [ -n "${k8s_version_line}" ]; then
+    echo "--- Restoring K8S_VERSION in ${pipeline_yml}..."
+    sed -i "s|^\s*K8S_VERSION:.*|${k8s_version_line}|" "${pipeline_yml}"
+  fi
+  if [ -n "${kind_version_line}" ]; then
+    echo "--- Restoring KIND_VERSION in ${pipeline_yml}..."
+    sed -i "s|^\s*KIND_VERSION:.*|${kind_version_line}|" "${pipeline_yml}"
+  fi
+
   git add $BUILDKITE_FOLDER_PATH
 
   if git ls-tree -d --name-only main:.ci >/dev/null 2>&1; then
@@ -167,17 +194,22 @@ updateBackportBranchContents() {
     # Copy the standalone backport CLI tool so backport branches always use the
     # version from main (same reason as copying .buildkite/ and dev/).
     echo "--- Copying cmd/backport from $SOURCE_BRANCH..."
+    git rm -r --cached "cmd/backport" 2>/dev/null || true
     git checkout "$SOURCE_BRANCH" -- "cmd/backport"
     git add cmd/backport
 
     echo "--- Copying $DEV_FOLDER from $SOURCE_BRANCH..."
+    git rm -r --cached "${DEV_FOLDER}" 2>/dev/null || true
     git checkout "$SOURCE_BRANCH" -- "${DEV_FOLDER}"
 
     # Remove packages that import go-gh/v2 — they are only needed on main-branch
     # pipelines and require a modern Go toolchain. Removing them lets go mod tidy
     # drop the go-gh/v2 dependency so backport branches keep their original Go version.
     echo "--- Removing dev/testsreporter and dev/requiresupdate (go-gh/v2 not needed on backport branches)..."
     rm -rf "${DEV_FOLDER}/testsreporter" "${DEV_FOLDER}/requiresupdate"
+    echo "--- Removing dev/backports (in favor of cmd/backport)..."
+    # Remove the previous backport code from dev/backport, it should be used from cmd/backport instead.
+    rm -rf "${DEV_FOLDER}/backports"
     git add "${DEV_FOLDER}"
 
     echo "--- Copying magefile.go from $SOURCE_BRANCH..."
@@ -193,14 +225,24 @@ updateBackportBranchContents() {
     # > error: GH013: Repository rule violations found for ...
     # > refusing to allow a GitHub App to create or update workflow `.github/workflows/bump-elastic-stack-version.yml` without `workflows` permission
     echo "--- Copying .github/workflows from $SOURCE_BRANCH..."
+    git rm -r --cached ".github/workflows" 2>/dev/null || true
     git checkout "$SOURCE_BRANCH" -- ".github/workflows"
     git add .github/workflows
 
+    echo "--- Copying .github/actions from $SOURCE_BRANCH..."
+    git rm -r --cached ".github/actions" 2>/dev/null || true
+    git checkout "$SOURCE_BRANCH" -- ".github/actions"
+    git add .github/actions
+
     # Copy tools.go so we have the dev scripts dependencies required
     echo "--- Copying tools.go from $SOURCE_BRANCH..."
     git checkout "$SOURCE_BRANCH" -- "tools.go"
     git add tools.go
 
+    echo "--- Copying .gitignore from $SOURCE_BRANCH..."
+    git checkout "$SOURCE_BRANCH" -- ".gitignore"
+    git add .gitignore
+
     # Run go mod tidy inside a subshell using the backport branch's own Go toolchain
     # so the version change does not leak to subsequent steps. File changes to
     # go.mod/go.sum persist after the subshell exits.
@@ -256,15 +298,15 @@ updateBackportBranchContents() {
   files_cached_num=$(git diff --name-only --cached | wc -l)
   if [ "${files_cached_num}" -gt 0 ]; then
     echo "--- Committing changes..."
-    git commit -m "Add $BUILDKITE_FOLDER_PATH and $JENKINS_FOLDER_PATH to backport branch: $BACKPORT_BRANCH_NAME from the $SOURCE_BRANCH branch"
+    git commit -m "[${BACKPORT_BRANCH_NAME}] Sync CI configuration with ${SOURCE_BRANCH} branch"
   else
     echo "+++ Nothing to commit, skip."
   fi
 
   if [ "$DRY_RUN" == "true" ];then
     echo "--- DRY_RUN mode, nothing will be pushed."
-    # Show just the relevant files diff (go.mod, go.sum, .buildkite, cmd/backport, dev, .github/CODEOWNERS and package to be backported)
-    git --no-pager diff "$SOURCE_BRANCH...$BACKPORT_BRANCH_NAME" .buildkite/ cmd/backport/ dev/ go.sum go.mod tools.go .github/CODEOWNERS "${PACKAGE_PATH}"
+    # Show just the relevant files diff (go.mod, go.sum, .buildkite, cmd/backport, dev, .github/CODEOWNERS, .github/actions, .github/workflows and package to be backported)
+    git --no-pager diff "$SOURCE_BRANCH...$BACKPORT_BRANCH_NAME" .buildkite/ cmd/backport/ dev/ go.sum go.mod tools.go .gitignore .github/CODEOWNERS .github/actions/ .github/workflows/ "${PACKAGE_PATH}"
   else
     echo "--- Pushing..."
     git push origin "$BACKPORT_BRANCH_NAME"
@@ -282,6 +324,8 @@ add_bin_path
 
 with_yq
 with_backport
+# mage is still required to get the full packages list 
+with_mage
 
 echo "--- Validating custom backport branch name"
 if ! backport validate-branch-name "${PACKAGE_NAME}" "${BACKPORT_BRANCH_NAME}"; then

@@ -807,7 +807,7 @@ is_pr_affected() {
         return 0
     fi
 
-    commit_merge=$(git merge-base "${from}" "${to}")
+    commit_merge="${COMMIT_MERGE:-$(git merge-base "${from}" "${to}")}"
     echoerr "[${package_name}] git-diff: check non-package files (${commit_merge}..${to})"
     # .github/CODEOWNERS must not be added to "skip_ci_on_only_changed" in ".buildkite/pull-requests.json".
     # When this file is updated, the Buildkite build must be triggered to run the "mage check" step.

@@ -34,6 +34,7 @@
 ^\.buildkite/scripts/test_non_package_patterns\.sh
 ^\.buildkite/scripts/test_trigger_backport\.sh
 ^\.claude/
+^\.github/actions/
 ^\.github/dependabot\.yml
 ^\.github/stale\.yml
 ^\.github/scripts/

@@ -0,0 +1,25 @@
+#!/bin/bash
+
+# Ensure the committed CrowdStrike FDR ingest pipelines stay in sync with the
+# Go generators under packages/crowdstrike/_dev/scripts/fdr-gen. If a pipeline
+# YAML is hand-edited without updating the generators (or vice versa), this
+# check fails so the drift is caught in CI instead of being silently reverted
+# by the next ./generate.sh run.
+set -euo pipefail
+
+GEN_DIR="packages/crowdstrike/_dev/scripts/fdr-gen"
+OUT_DIR="packages/crowdstrike/data_stream/fdr/elasticsearch/ingest_pipeline"
+
+echo "--- [crowdstrike] Regenerate FDR ingest pipelines into a temp directory"
+ORIG_DIR="$(mktemp -d)"
+cp "${OUT_DIR}"/*.yml "${ORIG_DIR}/"
+(cd "${GEN_DIR}" && ./generate.sh)
+
+echo "--- [crowdstrike] Check FDR pipelines match their generators"
+if ! diff -rq "${ORIG_DIR}" "${OUT_DIR}"; then
+  echo "^^^ +++"
+  echo "FDR ingest pipelines are out of sync with ${GEN_DIR}."
+  echo "Edit the generators, run ./generate.sh in that directory, and commit the result."
+  exit 1
+fi
+rm -rf "${ORIG_DIR}"
@@ -76,8 +76,35 @@ echo "Checking with commits: from: '${from}' to: '${to}'"
 
 any_package_failing=0
 
-echo "--- List all directories"
-PACKAGE_LIST=$(list_all_directories)
+echo "--- Compute affected packages from git diff"
+COMMIT_MERGE=$(git merge-base "${from}" "${to}")
+export COMMIT_MERGE
+changed_files=$(git diff --name-only "${COMMIT_MERGE}" "${to}")
+
+if [[ "${FORCE_CHECK_ALL}" == "true" ]] || echo "${changed_files}" | pr_has_package_related_files; then
+    echo "Non-package files changed or FORCE_CHECK_ALL set: scanning all packages"
+    PACKAGE_LIST=$(list_all_directories)
+else
+    PACKAGE_LIST=$(
+        {
+            # Use list_all_directories (mage listPackages) instead of grepping ^packages/[^/]+
+            # directly from the diff output: the regex would only capture the first path segment
+            # and break for nested packages (e.g. packages/technology/foo → packages/technology,
+            # which has no manifest.yml). mage listPackages discovers valid package roots at any
+            # depth via WalkDir, so we cross-reference its output against the changed files.
+            all_pkgs=$(list_all_directories)
+            while IFS= read -r pkg_path; do
+                if echo "${changed_files}" | grep -q "^${pkg_path}/"; then
+                    echo "${pkg_path}"
+                elif echo "${changed_files}" | grep -q "^\.buildkite/scripts/${pkg_path}\.sh$"; then
+                    echo "${pkg_path}"
+                fi
+            done <<< "${all_pkgs}"
+        } | sort -u | grep -v '^$' || true
+    )
+    echo "Packages affected by diff: $(echo "${PACKAGE_LIST}" | tr '\n' ' ')"
+fi
+
 for package_path in ${PACKAGE_LIST}; do
     echo "--- [$package_path] check if it is required to be tested"
     if ! should_test_package "${package_path}" "${from}" "${to}"; then

@@ -9,9 +9,6 @@ add_bin_path
 with_yq
 with_mage
 
-echo "--- List all directories"
-PACKAGE_LIST=$(list_all_directories)
-
 PIPELINE_FILE="packages_pipeline.yml"
 touch packages_pipeline.yml
 
@@ -48,6 +45,35 @@ if [[ "${BUILDKITE_PIPELINE_SLUG}" == "integrations-test-stack" && "${GITHUB_PR_
     echo "Use Elastic stack version from Github comment: ${STACK_VERSION}"
 fi
 
+echo "--- Compute affected packages from git diff"
+COMMIT_MERGE=$(git merge-base "${from}" "${to}")
+export COMMIT_MERGE
+changed_files=$(git diff --name-only "${COMMIT_MERGE}" "${to}")
+
+if [[ "${FORCE_CHECK_ALL}" == "true" ]] || echo "${changed_files}" | pr_has_package_related_files; then
+    echo "Non-package files changed or FORCE_CHECK_ALL set: scanning all packages"
+    PACKAGE_LIST=$(list_all_directories)
+else
+    PACKAGE_LIST=$(
+        {
+            # Use list_all_directories (mage listPackages) instead of grepping ^packages/[^/]+
+            # directly from the diff output: the regex would only capture the first path segment
+            # and break for nested packages (e.g. packages/technology/foo → packages/technology,
+            # which has no manifest.yml). mage listPackages discovers valid package roots at any
+            # depth via WalkDir, so we cross-reference its output against the changed files.
+            all_pkgs=$(list_all_directories)
+            while IFS= read -r pkg_path; do
+                if echo "${changed_files}" | grep -q "^${pkg_path}/"; then
+                    echo "${pkg_path}"
+                elif echo "${changed_files}" | grep -q "^\.buildkite/scripts/${pkg_path}\.sh$"; then
+                    echo "${pkg_path}"
+                fi
+            done <<< "${all_pkgs}"
+        } | sort -u | grep -v '^$' || true
+    )
+    echo "Packages affected by diff: $(echo "${PACKAGE_LIST}" | tr '\n' ' ')"
+fi
+
 packages_to_test=0
 
 for package_path in ${PACKAGE_LIST}; do

@@ -0,0 +1,72 @@
+---
+name: Sync backport changelog
+description: >
+  Builds the backport tool, configures git, runs the changelog sync,
+  and posts the result comment on the originating backport PR.
+
+inputs:
+  before:
+    description: 'SHA before the push (or first parent of the merge commit on retry)'
+    required: true
+  after:
+    description: 'SHA after the push (or merge commit SHA on retry)'
+    required: true
+  backport-branch:
+    description: 'Name of the backport branch (e.g. backport-8.x)'
+    required: true
+  pr-number:
+    description: 'Backport PR number; skips the merge-commit→PR lookup when provided'
+    required: false
+    default: ''
+  github-token:
+    description: 'GitHub token for gh CLI and API calls'
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Set up Go
+      uses: actions/setup-go@v7
+      with:
+        # Use the backport tool's own Go version (pinned to main's version)
+        # so it stays consistent regardless of which backport branch this runs on.
+        go-version-file: cmd/backport/.go-version
+
+    - name: Build backport tool
+      shell: bash
+      run: mkdir -p "$GITHUB_WORKSPACE/build" && go build -C cmd/backport -o "$GITHUB_WORKSPACE/build/backport" .
+
+    - name: Configure git
+      uses: elastic/oblt-actions/git/setup@v1
+      with:
+        username: 'github-actions[bot]'
+        email: '41898282+github-actions[bot]@users.noreply.github.com'
+
+    - name: Sync backport changelog
+      id: sync
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        BEFORE: ${{ inputs.before }}
+        AFTER: ${{ inputs.after }}
+        REPOSITORY: ${{ github.repository }}
+        BACKPORT_BRANCH: ${{ inputs.backport-branch }}
+        BACKPORT_PR_NUMBER: ${{ inputs.pr-number }}
+        PACKAGES_DIR: ${{ github.workspace }}/packages
+      run: |
+        "$GITHUB_WORKSPACE/build/backport" sync-changelog
+
+    - name: Comment on backport PR
+      if: always()
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.github-token }}
+        BACKPORT_PR_NUMBER: ${{ steps.sync.outputs.backport_pr_number }}
+        WORKING_BRANCH: ${{ steps.sync.outputs.working_branch }}
+        NOT_FOUND_PACKAGES: ${{ steps.sync.outputs.not_found_packages }}
+        CREATE_OUTCOME: ${{ steps.sync.outputs.create_outcome }}
+        EXISTING_SYNC_PR_URL: ${{ steps.sync.outputs.existing_sync_pr_url }}
+        RUN_ID: ${{ github.run_id }}
+        REPOSITORY: ${{ github.repository }}
+      run: |
+        "$GITHUB_WORKSPACE/build/backport" post-comment
@@ -68,10 +68,10 @@ jobs:
         run: |
           PERMISSION=$(gh api "repos/$REPOSITORY/collaborators/$ACTOR/permission" \
             --jq '.permission' 2>/dev/null || echo "none")
-          if [[ "$PERMISSION" == "write" || "$PERMISSION" == "admin" ]]; then
+          if [[ "$PERMISSION" == "write" || "$PERMISSION" == "maintain" || "$PERMISSION" == "admin" ]]; then
             echo "permitted=true" >> "$GITHUB_OUTPUT"
           else
-            echo "Actor $ACTOR lacks write/admin permission ($PERMISSION) — skipping"
+            echo "Actor $ACTOR lacks write/maintain/admin permission ($PERMISSION) — skipping"
           fi
 
       - name: Resolve merge SHA and PR metadata

@@ -33,7 +33,7 @@ jobs:
         run: go install github.com/magefile/mage
 
       - name: Install Updatecli in the runner
-        uses: updatecli/updatecli-action@5dfc616e57b07d2302c3f37e5b72a4ead82dbbf8 #v3.4.0
+        uses: updatecli/updatecli-action@41b9c8d707830a9daebaeaa84c1b62d60b779564 #v3.6.0
 
       - name: Select diff action
         if: ${{ github.event_name == 'pull_request' }}