mrodm · Sep 11, 2026 · Sep 10, 2026
@@ -25,9 +25,6 @@ export GO_VERSION
 REPO_NAME=$(repo_name "${BUILDKITE_REPO}")
 export REPO_NAME
 
-export TMP_FOLDER_TEMPLATE_BASE="tmp.${REPO_NAME}"
-export TMP_FOLDER_TEMPLATE="${TMP_FOLDER_TEMPLATE_BASE}.XXXXXXXXX"
-
 REPO_BUILD_TAG="${REPO_NAME}/$(buildkite_pr_branch_build_id)"
 export REPO_BUILD_TAG
 
@@ -113,11 +110,6 @@ if [[ "${BUILDKITE_PIPELINE_SLUG}" =~ ^(integrations|integrations-test-stack)$ ]
         BUILDKITE_API_TOKEN=$(retry 5 vault kv get -field buildkite_token "${BUILDKITE_API_TOKEN_PATH}")
         export BUILDKITE_API_TOKEN
     fi
-
-    if [[ "${BUILDKITE_STEP_KEY}" =~ ^test-integrations- ]]; then
-        BUILDKITE_API_TOKEN=$(retry 5 vault kv get -field buildkite_token "${BUILDKITE_API_TOKEN_PATH}")
-        export BUILDKITE_API_TOKEN
-    fi
 fi
 
 if [[ "${BUILDKITE_PIPELINE_SLUG}" == "integrations-serverless" ]]; then

@@ -50,6 +50,5 @@ fi
 
 echo "--- Cleaning up"
 unset_secrets
-cleanup
 
 exit "${exit_code}"
@@ -0,0 +1,43 @@
+# yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
+
+env:
+  SETUP_GVM_VERSION: "v0.6.0"
+  LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
+  YQ_VERSION: 'v4.35.2'
+  GH_CLI_VERSION: "2.29.0"
+  NOTIFY_TO: "ecosystem-team@elastic.co"
+
+steps:
+  - label: ":ballot_box_with_check: Backports inventory validation"
+    key: "check-backports-inventory"
+    command: ".buildkite/scripts/check_backports_inventory.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    if_changed:
+      - ".backports.yml"
+      - ".buildkite/scripts/run_dev_scripts_tests.sh"
+      - "dev/scripts/**.sh"
+      - "cmd/backport/**"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') == "false" && build.branch == "main"
+
+  - label: ":git: Create backport branches for new entries"
+    key: "trigger-backport-create"
+    command: ".buildkite/scripts/trigger_backport.sh"
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "check-backports-inventory"
+        allow_failure: false
+    if_changed:
+      - ".backports.yml"
+    if: |
+      build.env('BUILDKITE_PULL_REQUEST') == "false" &&
+      build.branch == "main" &&
+      build.env('BUILDKITE_PIPELINE_SLUG') == "integrations-backport-dispatch"
+
+notify:
+  - email: "$NOTIFY_TO"
+    if: "build.state == 'failed' && build.env('BUILDKITE_PULL_REQUEST') == 'false'"
@@ -3,21 +3,33 @@
 name: "integrations-backport"
 
 env:
+  SETUP_GVM_VERSION: "v0.6.0"
   YQ_VERSION: 'v4.35.2'
+  GH_CLI_VERSION: "2.29.0"
   # Agent images used in pipeline steps
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
+  NOTIFY_TO: "ecosystem-team@elastic.co"
 
 steps:
 
   - label: "Check that it runs from UI"
     key: "check-ui"
     command:
-      - "buildkite-agent annotate \"The $BUILDKITE_PIPELINE_SLUG is used only for running from UI!\" --style 'warning'"
+      - "buildkite-agent annotate \"The $${BUILDKITE_PIPELINE_SLUG} pipeline can only be triggered from the UI by members of the 'ecosystem' team, or via a trigger step from the 'integrations' or 'integrations-backport-dispatch' pipeline. For the recommended workflow see the [documentation](https://www.elastic.co/guide/en/integrations-developer/current/developer-workflow-support-old-package.html).\" --style 'warning'"
       - "exit 1"
-    if: "build.source != 'ui'"
+    if: |
+      !(
+        (build.source == 'ui' && build.creator.teams includes "ecosystem") ||
+        (build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations') ||
+        (build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations-backport-dispatch')
+      )
+
+  # Ensure that the check-ui step runs before any other step
+  - wait: ~
 
   - input: "Input values for the variables"
     key: "input-variables"
+    if: "build.source != 'trigger_job'"
     fields:
     - select: "DRY_RUN"
       key: "DRY_RUN"
@@ -31,7 +43,7 @@ steps:
       key: "BASE_COMMIT"
       required: true
       default: ""
-    - text: "Enter package name"
+    - text: "Enter package name (as defined in manifest.yml)"
       key: "PACKAGE_NAME"
       required: true
       default: ""
@@ -46,7 +58,15 @@ steps:
           value: "true"
         - label: "False"
           value: "false"
-      default: "false"
+      default: "true"
+    - text: "Backport branch name (optional, defaults to backport-<package>-<major>.<minor>)"
+      key: "BACKPORT_BRANCH_NAME"
+      required: false
+      default: ""
+    - text: "PR number to notify on completion (optional)"
+      key: "PR_NUMBER"
+      required: false
+      default: ""
 
   - label: "Creating the backport branch"
     key: "create-backport-branch"
@@ -61,3 +81,30 @@ steps:
     depends_on:
       - step: "input-variables"
         allow_failure: false
+
+  - label: ":github: Notify PR"
+    key: "notify-pr"
+    command: |
+      if ! outcome=$$(buildkite-agent step get "outcome" --step "create-backport-branch"); then
+        echo "Failed to retrieve step outcome, skipping PR notification"
+        exit 0
+      fi
+      if [[ "$${outcome}" == "passed" ]]; then
+        NOTIFY_STATUS=success .buildkite/scripts/notify_backport_pr.sh
+      else
+        NOTIFY_STATUS=failure .buildkite/scripts/notify_backport_pr.sh
+      fi
+    agents:
+      image: "${LINUX_AGENT_IMAGE}"
+    plugins:
+      - elastic/vault-github-token#v0.1.0:
+    depends_on:
+      - step: "create-backport-branch"
+        allow_failure: true
+
+notify:
+  # Only notify for automated backport creation failures (triggered by integrations-backport-dispatch).
+  # Dry-run failures from PR builds (triggered by integrations) are already surfaced as a failing
+  # CI status on the PR itself and do not warrant a team email.
+  - email: "$NOTIFY_TO"
+    if: "build.state == 'failed' && build.source == 'trigger_job' && build.env('BUILDKITE_TRIGGERED_FROM_BUILD_PIPELINE_SLUG') == 'integrations-backport-dispatch'"
@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
 
 env:
-  SETUP_GVM_VERSION: "v0.5.2"
+  SETUP_GVM_VERSION: "v0.6.0"
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
   DOCKER_COMPOSE_VERSION: "v2.24.1"
   DOCKER_VERSION: "false"
@@ -38,6 +38,9 @@ steps:
       ARTIFACTS_FOLDER: "artifacts-to-sign"
       # by default it will publish packages
       DRY_RUN: "${DRY_RUN:-false}"
+      # Comma-separated list of package zip filenames to skip (e.g. "foo-1.0.0.zip,bar-2.0.0.zip")
+      # kubeletstats_input_otel-0.1.0 was deleted but it is kept in the repository for now, in case it is needed to release a new version if needed
+      SKIP_PACKAGES: "kubeletstats_input_otel-0.1.0.zip"
     depends_on:
       - step: "check"
         allow_failure: false

@@ -2,7 +2,7 @@
 name: integrations-schedule-daily
 
 env:
-  SETUP_GVM_VERSION: "v0.5.2"
+  SETUP_GVM_VERSION: "v0.6.0"
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
 
 # The pipeline is triggered by the scheduler every day
@@ -34,7 +34,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.0-SNAPSHOT
+        STACK_VERSION: 8.19.22-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "true"
     depends_on:
       - step: "check"
@@ -48,7 +48,7 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.0-SNAPSHOT
+        STACK_VERSION: 8.19.22-SNAPSHOT
         STACK_LOGSDB_ENABLED: "true"
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:
@@ -86,13 +86,13 @@ steps:
     if: |
       build.env('TEST_PACKAGES_BASIC_SUBSCRIPTION') == "true"
 
-  - label: "Check integrations local stacks - Stack Version v9.2"
+  - label: "Check integrations local stacks - Stack Version v9.6"
     trigger: "integrations"
     build:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 9.2.0-SNAPSHOT
+        STACK_VERSION: 9.6.0-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
     depends_on:
       - step: "check"

@@ -2,7 +2,7 @@
 name: integrations-schedule-weekly
 
 env:
-  SETUP_GVM_VERSION: "v0.5.2"
+  SETUP_GVM_VERSION: "v0.6.0"
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
 
 # The pipeline is triggered by the scheduler every week
@@ -21,20 +21,20 @@ steps:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 8.19.0-SNAPSHOT
+        STACK_VERSION: 8.19.22-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:
       - step: "check"
         allow_failure: false
 
-  - label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.2"
+  - label: "Check integrations local stacks and non-wolfi images for Elastic Agent - Stack Version v9.6"
     trigger: "integrations"
     build:
       env:
         SERVERLESS: "false"
         FORCE_CHECK_ALL: "true"
-        STACK_VERSION: 9.2.0-SNAPSHOT
+        STACK_VERSION: 9.6.0-SNAPSHOT
         PUBLISH_COVERAGE_REPORTS: "false"
         ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "true"
     depends_on:

@@ -1,14 +1,14 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/buildkite/pipeline-schema/main/schema.json
 
 env:
-  SETUP_GVM_VERSION: "v0.5.2"
+  SETUP_GVM_VERSION: "v0.6.0"
   LINUX_AGENT_IMAGE: "golang:${GO_VERSION}"
   DOCKER_COMPOSE_VERSION: "v2.24.1"
   DOCKER_VERSION: "false" # not required to set since system tests are not running yet
   KIND_VERSION: 'v0.27.0'
   K8S_VERSION: 'v1.33.0'
   YQ_VERSION: 'v4.35.2'
-  IMAGE_UBUNTU_X86_64: "family/core-ubuntu-2204"
+  IMAGE_UBUNTU_X86_64: "family/platform-obs-integrations-ubuntu-2204"
   GH_CLI_VERSION: "2.29.0"
   # This pipeline is intended to test packages with Elastic Serverless
   SERVERLESS: true
@@ -30,6 +30,8 @@ env:
   ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI: "${ELASTIC_PACKAGE_DISABLE_ELASTIC_AGENT_WOLFI:-false}"
   # Disable checking for newer versions
   ELASTIC_PACKAGE_CHECK_UPDATE_DISABLED: "true"
+  # Required to install packages via API even if they are already present in EPR (only available in QA)
+  ELASTIC_PACKAGE_SERVERLESS_KIBANA_SKIP_UPLOAD_PACKAGE_VALIDATION: "true"
 
 steps:
   - input: "Input values for the variables"
@@ -71,14 +73,13 @@ steps:
       # See https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/integrations/01-aws-buildkite-oidc.tf
       # This plugin creates the environment variables required by the service deployer (AWS_SECRET_ACCESS_KEY and AWS_SECRET_KEY_ID)
       - elastic/oblt-aws-auth#v0.1.0:
-          duration: 10800 # seconds
+          duration: 21600 # seconds
       # See https://github.com/elastic/oblt-infra/blob/main/conf/resources/repos/integrations/01-gcp-buildkite-oidc.tf
       # This plugin authenticates to CI Google Cloud using the OIDC token.
       - elastic/oblt-google-auth#v1.3.0:
-          lifetime: 10800 # seconds
+          lifetime: 21600 # seconds
           project-id: "elastic-observability-ci"
           project-number: "911195782929"
-          lifetime: 10800 # seconds
       - avaly/gcp-secret-manager#v1.2.0:
           env:
             EC_API_KEY: elastic-cloud-observability-team-qa-api-key
@@ -95,17 +96,22 @@ steps:
     continue_on_failure: true
 
   - label: ":junit: Junit annotate"
+    agents:
+      # requires at least "bash", "curl" and "git"
+      image: "docker.elastic.co/ci-agent-images/buildkite-junit-annotate:1.0"
     plugins:
-      - junit-annotate#v2.5.0:
+      - junit-annotate#v2.7.0:
           artifacts: "build/test-results/*.xml"
           failed-download-exit-code: 0 # Not fail the build in case there are no XML files
           report-skipped: true
-    agents:
-      provider: "gcp"  # junit plugin requires docker
+          always-annotate: true
+          run-in-docker: false
 
   - label: ":github: Report failed tests"
     key: report-failed-tests
     command: ".buildkite/scripts/report_issues.sh"
+    env:
+      CI_MAX_TESTS_REPORTED: 30
     agents:
       image: "${LINUX_AGENT_IMAGE}"
       cpu: "8"