Merge branch 'main' into add-fleet-server-elastic-agent

Author: colleenmcginnis

.github/actions/aws-auth/action.yml

@@ -37,7 +37,7 @@ runs:
           with open(os.environ["GITHUB_OUTPUT"], "a") as f:
             f.write(f"result=arn:aws:iam::{os.environ["AWS_ACCOUNT_ID"]}:role/{prefix}{hash}")
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
       with:
         role-to-assume: ${{ steps.role_arn.outputs.result }}
         aws-region: ${{ inputs.aws_region }}

.github/actions/bootstrap/action.yml

@@ -38,7 +38,7 @@ runs:
         echo "full-version=${REPO_VERSION}" >> $GITHUB_OUTPUT
         echo "major-version=$(echo ${REPO_VERSION} | cut -d"." -f1)" >> $GITHUB_OUTPUT
         
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@v5
       with:
         cache: npm
         cache-dependency-path: src/Elastic.Documentation.Site/package-lock.json

.github/workflows/auto-add-needs-triage-label.yml

@@ -0,0 +1,26 @@
+---
+name: Auto-add triage label
+
+on:
+  issues:
+    types:
+      - opened
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  add-triage-label:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add needs triage label
+        uses: actions/github-script@v7
+        with:
+          script: |
+            github.rest.issues.addLabels({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+              labels: ['needs triage']
+            })

.github/workflows/ci.yml

@@ -46,7 +46,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           cache: npm
           cache-dependency-path: src/Elastic.Documentation.Site/package-lock.json

.github/workflows/deploy-api-lambda-edge.yml

@@ -0,0 +1,18 @@
+name: "Deploy API Lambda (edge)"
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  
+jobs: 
+  deploy:
+    uses: ./.github/workflows/deploy-api-lambda.yml
+    permissions: 
+      id-token: write
+      contents: read
+    with:
+      environment: edge

.github/workflows/deploy-api-lambda-prod.yml

@@ -0,0 +1,22 @@
+name: "Deploy API Lambda (prod)"
+
+on:
+  workflow_dispatch:
+    inputs: 
+      ref:
+        description: 'The git tag of the release to deploy, e.g. 3.0.0'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  
+jobs: 
+  deploy:
+    uses: ./.github/workflows/deploy-api-lambda.yml
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      environment: prod
+      ref: refs/tags/${{ github.event.inputs.ref }}

.github/workflows/deploy-api-lambda.yml

@@ -1,9 +1,16 @@
 name: Deploy API Lambda
+
 on:
-  push:
-    branches:
-      - main
-  workflow_dispatch: 
+  workflow_call: 
+    inputs: 
+      environment:
+        required: true
+        type: string
+        description: edge, staging or prod
+      ref:
+        required: false
+        type: string
+        default: ${{ github.ref }}
 
 permissions: 
   contents: read
@@ -13,23 +20,21 @@ jobs:
     permissions: 
       contents: read
     uses: ./.github/workflows/build-api-lambda.yml
-    
+    with: 
+      ref: ${{ inputs.ref }}
+  
   deploy:
-    concurrency: ${{ github.workflow }}
+    concurrency: ${{ github.workflow }}-${{ inputs.environment }}
     permissions: 
       contents: read
       id-token: write
     runs-on: ubuntu-latest
     needs: build
-    environment: docs-api-edge
+    environment: docs-api-${{ inputs.environment }}
     env:
       ZIP_FILE: api-lambda.zip
     steps:
       - uses: actions/checkout@v5
-      - name: Download bootstrap binary
-        uses: actions/download-artifact@v4
-        with:
-          name: api-lambda-binary
 
       - name: Download bootstrap binary
         uses: actions/download-artifact@v4
@@ -40,13 +45,24 @@ jobs:
         run: |
           zip -j "${ZIP_FILE}" ./bootstrap
 
-      - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      - uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
         with:
-          role-to-assume: arn:aws:iam::197730964718:role/elastic-docs-v3-api-deployer-edge
+          role-to-assume: arn:aws:iam::197730964718:role/elastic-docs-v3-api-deployer-${{ inputs.environment }}
           aws-region: us-east-1
 
       - name: Upload Lambda function
         run: |
-          aws lambda update-function-code \
-            --function-name elastic-docs-v3-edge-api \
-            --zip-file "fileb://${ZIP_FILE}"
+          NEW_VERSION=$(aws lambda update-function-code \
+            --function-name "elastic-docs-v3-${ENVIRONMENT}-api" \
+            --zip-file "fileb://${ZIP_FILE}" \
+            --publish \
+            --query 'Version' \
+            --output text)
+
+          aws lambda update-alias \
+          --function-name "elastic-docs-v3-${ENVIRONMENT}-api" \
+          --name live \
+          --function-version $NEW_VERSION
+          
+        env:
+          ENVIRONMENT: ${{ inputs.environment }}

.github/workflows/preview-build.yml

@@ -367,6 +367,7 @@ jobs:
           env.MATCH == 'true'
           && (
             !cancelled()
+            && github.repository != 'elastic/docs-builder'
             && steps.docs-build.outputs.skip != 'true' 
             && (
               steps.deployment.outputs.result
@@ -377,12 +378,31 @@ jobs:
             )
           )
         uses: elastic/docs-builder/actions/validate-inbound-local@main
+        
+      - name: 'Validate inbound links'
+        if: >
+          env.MATCH == 'true'
+          && (
+            !cancelled()
+            && github.repository == 'elastic/docs-builder'
+            && steps.docs-build.outputs.skip != 'true' 
+            && (
+              steps.deployment.outputs.result
+              || (
+                needs.check.outputs.any_modified == 'true' 
+                && github.event_name == 'merge_group'
+              )
+            )
+          )
+        run: |
+          dotnet run --project src/tooling/docs-builder -- inbound-links validate-link-reference
 
       - name: 'Validate local path prefixes against those claimed by global navigation.yml'
         if: >
           env.MATCH == 'true'
           && (
             !cancelled() 
+            && github.repository != 'elastic/docs-builder'
             && steps.docs-build.outputs.skip != 'true'
             && (
               steps.deployment.outputs.result 
@@ -393,6 +413,24 @@ jobs:
             )
           )
         uses: elastic/docs-builder/actions/validate-path-prefixes-local@main
+        
+      - name: 'Validate local path prefixes against those claimed by global navigation.yml'
+        if: >
+          env.MATCH == 'true'
+          && (
+            !cancelled() 
+            && github.repository == 'elastic/docs-builder'
+            && steps.docs-build.outputs.skip != 'true'
+            && (
+              steps.deployment.outputs.result 
+              || (
+                needs.check.outputs.any_modified == 'true' 
+                && github.event_name == 'merge_group'
+              )
+            )
+          )
+        run: |
+          dotnet run --project src/tooling/docs-assembler -- navigation validate-link-reference
 
       - uses: elastic/docs-builder/.github/actions/aws-auth@main
         if: >

.github/workflows/release.yml

@@ -75,8 +75,19 @@ jobs:
     uses: ./.github/workflows/build-link-index-updater-lambda.yml
     with:
       ref: ${{ needs.release-drafter.outputs.tag_name }}
+      
+  deploy-api-lambda-staging:
+    needs: 
+      - release-drafter
+    uses: ./.github/workflows/deploy-api-lambda.yml
+    permissions:
+      id-token: write
+      contents: read
+    with:
+      environment: staging
+      ref: refs/tags/${{ needs.release-drafter.outputs.tag_name }}
 
-  release-lambda:
+  deploy-link-index-updater-lambda-prod:
     environment: 
       name: link-index-updater-prod
     runs-on: ubuntu-latest
@@ -99,7 +110,7 @@ jobs:
         run: |
           zip -j "${ZIP_FILE}" ./bootstrap
 
-      - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      - uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
         with:
           role-to-assume: arn:aws:iam::197730964718:role/elastic-docs-v3-link-index-updater-deployer
           aws-region: us-east-2
@@ -163,8 +174,9 @@ jobs:
   publish-release:
     needs:
       - release
-      - release-lambda
       - release-drafter
+      - deploy-api-lambda-staging
+      - deploy-link-index-updater-lambda-prod
     runs-on: ubuntu-latest
     permissions: 
       contents: write

actions/update-link-index/action.yml

@@ -42,7 +42,7 @@ runs:
           with open(os.environ["GITHUB_OUTPUT"], "a") as f:
             f.write(f"result=arn:aws:iam::{aws_account_id}:role/{prefix}{hash}")
     - name: Configure AWS Credentials
-      uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
+      uses: aws-actions/configure-aws-credentials@a03048d87541d1d9fcf2ecf528a4a65ba9bd7838 # v5.0.0
       with:
         role-to-assume: ${{ steps.role_arn.outputs.result }}
         aws-region: us-east-1