Remove legacy PR Buildkite Detective workflow - #3930
Open
fr4nc1sc0-r4m0n wants to merge 2 commits into
Open
fr4nc1sc0-r4m0n wants to merge 2 commits into
fr4nc1sc0-r4m0n wants to merge 2 commits into
Conversation
Install trigger-obs-aw client workflows from elastic/oblt-aw and remove the legacy direct lock invocation for gh-aw-estc-pr-buildkite-detective.
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The new workflows introduce security-sensitive patterns (mutable @main reusable workflow refs and broad contents: write permissions) that should be addressed or justified before approval.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
This PR migrates the “PR Buildkite Detective” GitHub status handler from the legacy elastic/ai-github-actions reusable workflow to the newer observability agentic workflow (obs-aw) routing, and adds additional obs-aw trigger entrypoints for other event types.
Changes:
- Removed the legacy
trigger-pr-buildkite-detective.ymlworkflow that directly invokedgh-aw-estc-pr-buildkite-detective.lock.yml. - Added a new status-triggered obs-aw entrypoint (
trigger-obs-aw-status.yml) to route Buildkite failures throughelastic/oblt-aw. - Added additional obs-aw entrypoint workflows for schedule, pull request, issues, and issue comments.
File summaries
| File | Description |
|---|---|
.github/workflows/trigger-pr-buildkite-detective.yml |
Removes legacy PR Buildkite Detective workflow trigger. |
.github/workflows/trigger-obs-aw-status.yml |
Adds obs-aw status trigger routing Buildkite failures via reusable workflow. |
.github/workflows/trigger-obs-aw-schedule.yml |
Adds scheduled obs-aw trigger entrypoint. |
.github/workflows/trigger-obs-aw-pull-request.yml |
Adds pull_request obs-aw trigger entrypoint. |
.github/workflows/trigger-obs-aw-issues.yml |
Adds issues obs-aw trigger entrypoint. |
.github/workflows/trigger-obs-aw-issue-comment.yml |
Adds issue_comment obs-aw trigger entrypoint. |
Review details
Suppressed comments (4)
.github/workflows/trigger-obs-aw-schedule.yml:20
- This reusable workflow is referenced at
@main, which is mutable and can change behavior without review; this reduces auditability and increases supply-chain risk. Prefer pinning to an immutable tag or commit SHA (similar to other pinned actions in this repo, e.g..github/workflows/catalog-info.yml:21usesactions/checkout@v7).
uses: elastic/oblt-aw/.github/workflows/obs-aw-event-schedule.yml@main # ratchet:exclude
.github/workflows/trigger-obs-aw-issue-comment.yml:20
- This reusable workflow is referenced at
@main, which is mutable and can change behavior without review; this reduces auditability and increases supply-chain risk. Prefer pinning to an immutable tag or commit SHA (consistent with other pinned actions in this repo, e.g..github/workflows/run-updatecli.yml:25usesactions/checkout@v7).
uses: elastic/oblt-aw/.github/workflows/obs-aw-event-issue-comment.yml@main # ratchet:exclude
.github/workflows/trigger-obs-aw-pull-request.yml:20
- This reusable workflow is referenced at
@main, which is mutable and can change behavior without review; this reduces auditability and increases supply-chain risk. Prefer pinning to an immutable tag or commit SHA (consistent with other pinned actions in this repo, e.g..github/workflows/run-updatecli.yml:38pinsupdatecli/updatecli-actionby SHA).
uses: elastic/oblt-aw/.github/workflows/obs-aw-event-pull-request.yml@main # ratchet:exclude
.github/workflows/trigger-obs-aw-issues.yml:21
- This reusable workflow is referenced at
@main, which is mutable and can change behavior without review; this reduces auditability and increases supply-chain risk. Prefer pinning to an immutable tag or commit SHA (similar to other pinned actions in this repo, e.g..github/workflows/run-updatecli.yml:25usesactions/checkout@v7).
uses: elastic/oblt-aw/.github/workflows/obs-aw-event-issues.yml@main # ratchet:exclude
- Files reviewed: 6/6 changed files
- Comments generated: 5
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| id-token: write | ||
| issues: write | ||
| pull-requests: write | ||
| uses: elastic/oblt-aw/.github/workflows/obs-aw-event-status.yml@main # ratchet:exclude |
Comment on lines
+12
to
+15
| permissions: | ||
| actions: read | ||
| contents: write | ||
| copilot-requests: write |
Comment on lines
+13
to
+16
| permissions: | ||
| actions: read | ||
| contents: write | ||
| copilot-requests: write |
Comment on lines
+12
to
+15
| permissions: | ||
| actions: read | ||
| contents: write | ||
| copilot-requests: write |
Comment on lines
+13
to
+16
| permissions: | ||
| actions: read | ||
| contents: write | ||
| copilot-requests: write |
Drop the previously added trigger-obs-aw client templates; distribute-client-workflow will install those after control-plane registration merges.
fr4nc1sc0-r4m0n
changed the title
Contributor
There was a problem hiding this comment.
🔵 Needs a closer look
It removes an operational workflow without adding the replacement in-repo, so safe merge timing depends on external/distributed workflow rollout to avoid a coverage gap.
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 0 new
- Review effort level: Lite
teresaromero
approved these changes
Sep 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
gh-aw-estc-pr-buildkite-detective.lock.yml.trigger-obs-aw-*.ymlworkflows are installed bydistribute-client-workflowafter the control-plane registration merges (Register estc-pr-buildkite-detective consumers in obs active repositories oblt-aw#1852).Merge gate
Do not merge this PR until the oblt-aw distribution process has opened and merged the install PR that adds
trigger-obs-aw-*.yml(especiallytrigger-obs-aw-status.yml) to this repository. Merging the legacy removal first would leave Buildkite status failures without a detective entrypoint.Notes
obs:estc-pr-buildkite-detectiveon the[oblt-aw] Control Plane Dashboardissue (default is off).BUILDKITE_LOGS_API_TOKEN(already used by the legacy workflow where present).Test plan
trigger-obs-aw-status.ymlis present via distribute-client-workflow