Fail CMake configure if 3rd-party git clone fails (#3164) (#3173)

Previously, execute_process() silently ignored a non-zero exit from the
git clone command. If the GitLab server is unavailable or overloaded,
CMake would continue configuring with no Eigen headers present, leading
to a cryptic compiler error hundreds of lines later instead of a clear
configure-time failure.

Same hardening for valijson as for pull-eigen.cmake: report a clear configure-time error
if the git clone fails rather than silently continuing and producing a
cryptic compiler error later.

(cherry picked from commit f95b8ef)

Co-authored-by: Ed Savage <ed.savage@elastic.co>

[ML] Fix auto-approve version-bump workflow for current gh CLI (#3153) (

#3158)

gh api rejects combining --paginate --slurp with --jq, which made the
Auto-approve version bump step fail on recent patch bumps. Count
approvals per page and sum instead.


(cherry picked from commit bb43676)

Co-authored-by: Ed Savage <ed.savage@elastic.co>
Co-authored-by: Cursor <cursoragent@cursor.com>

[ML] Fix auto-approve version-bump workflow for current gh CLI (#3153) (

#3157)

gh api rejects combining --paginate --slurp with --jq, which made the
Auto-approve version bump step fail on recent patch bumps. Count
approvals per page and sum instead.


(cherry picked from commit bb43676)

Co-authored-by: Ed Savage <ed.savage@elastic.co>
Co-authored-by: Cursor <cursoragent@cursor.com>

[ML] Fix auto-approve version-bump workflow for current gh CLI (#3153) (

#3159)

gh api rejects combining --paginate --slurp with --jq, which made the
Auto-approve version bump step fail on recent patch bumps. Count
approvals per page and sum instead.


(cherry picked from commit bb43676)

Co-authored-by: Ed Savage <ed.savage@elastic.co>
Co-authored-by: Cursor <cursoragent@cursor.com>

[ML] Auto-approve automated version-bump PRs (#3137) (#3142)

The automated version-bump PRs already arm auto-merge but stalled on the
single required review. Add a workflow that approves them as
github-actions[bot] (a distinct identity from the vault-app author, mirroring
the Backport workflow), gated to the bump topic branch + author and to a diff
that only touches gradle.properties. Auto-merge then lands them on green CI.

---------


(cherry picked from commit 68fb7cc)

Co-authored-by: Ed Savage <ed.savage@elastic.co>
Co-authored-by: Cursor <cursoragent@cursor.com>

[ML] Auto-approve automated version-bump PRs (#3137) (#3141)

The automated version-bump PRs already arm auto-merge but stalled on the
single required review. Add a workflow that approves them as
github-actions[bot] (a distinct identity from the vault-app author, mirroring
the Backport workflow), gated to the bump topic branch + author and to a diff
that only touches gradle.properties. Auto-merge then lands them on green CI.

---------


(cherry picked from commit 68fb7cc)

Co-authored-by: Ed Savage <ed.savage@elastic.co>
Co-authored-by: Cursor <cursoragent@cursor.com>

[ML] Auto-approve automated version-bump PRs (#3137) (#3140)

The automated version-bump PRs already arm auto-merge but stalled on the
single required review. Add a workflow that approves them as
github-actions[bot] (a distinct identity from the vault-app author, mirroring
the Backport workflow), gated to the bump topic branch + author and to a diff
that only touches gradle.properties. Auto-merge then lands them on green CI.

---------


(cherry picked from commit 68fb7cc)

Co-authored-by: Ed Savage <ed.savage@elastic.co>
Co-authored-by: Cursor <cursoragent@cursor.com>

[ML] Make Appex QA/PyTorch tests version-aware on release branches (#…

…3115) (#3126)

The downstream appex-qa-stateful-custom-ml-cpp-build-testing pipeline
(elastic/qaf-tests) defaults to ES_BRANCH=main and STACK_VERSION=<current
main SNAPSHOT>, then downloads ml-cpp-<version>-SNAPSHOT-linux-x86_64.zip
from the parent build. On a release-branch / backport build the parent
produced ml-cpp-<release-version>-SNAPSHOT-... instead, so the download
missed ('No artifacts found') and the QA/PyTorch build failed spuriously
(e.g. a 9.5 backport looking for 9.6.0-SNAPSHOT).

Derive STACK_VERSION from gradle.properties (the exact artifact version)
and ES_BRANCH by comparing to ml-cpp main's version (main for the current
dev line, else major.minor), and forward both through the QA and PyTorch
downstream triggers. For main builds the derived values equal today's
defaults, so only release-branch/backport builds change behaviour. No
qaf-tests change is required; it already supports these overrides and lists
the active release branches/versions.


(cherry picked from commit 6c3df89)

Co-authored-by: Ed Savage <ed.savage@elastic.co>
Co-authored-by: Cursor <cursoragent@cursor.com>

[8.19] [ML] Automate patch version bump in CI pipeline (#3030) (#3067)

Replace the ml-cpp-version-bump stub with a two-phase Buildkite flow.

Phase 1 (job-version-bump.json.py): validate_version_bump_params.sh on Wolfi
(patch-only rules; optional git fetch re-check when enabled), then
version_bump_upload_phase2.sh uploads phase 2 only when work remains (step
conditionals cannot rely on build meta-data).

Phase 2 (job-version-bump-phase2.json.py): bump_version.sh bumps
elasticsearchVersion on a ci/ml-cpp-version-bump-* topic branch, pushes,
opens a PR via GitHub CLI (ensure_github_cli.sh, create_github_pull_request.sh),
defaults to gh pr merge --auto --squash, optional immediate merge and
VERSION_BUMP_MERGE_ADMIN; records meta-data for no-op and PR URL. Slack step
(send_slack_version_bump_notification.sh) uses Wolfi and step notify. DRA wait
(wait_version_bump_dra.py) skips on DRY_RUN or when validation/bump report no
change.

Adds dev-tools/unittest for validation and pipeline JSON. Does not modify
.backportrc.json (reserved for future release automation). Minor version bumps
stay a follow-up change.

Co-authored-by: Cursor <cursoragent@cursor.com>

[ML] Automate patch version bump in CI pipeline (#3030) (#3061)

Replace the ml-cpp-version-bump stub with a two-phase Buildkite flow.

Phase 1 (job-version-bump.json.py): validate_version_bump_params.sh on Wolfi
(patch-only rules; optional git fetch re-check when enabled), then
version_bump_upload_phase2.sh uploads phase 2 only when work remains (step
conditionals cannot rely on build meta-data).

Phase 2 (job-version-bump-phase2.json.py): bump_version.sh bumps
elasticsearchVersion on a ci/ml-cpp-version-bump-* topic branch, pushes,
opens a PR via GitHub CLI (ensure_github_cli.sh, create_github_pull_request.sh),
defaults to gh pr merge --auto --squash, optional immediate merge and
VERSION_BUMP_MERGE_ADMIN; records meta-data for no-op and PR URL. Slack step
(send_slack_version_bump_notification.sh) uses Wolfi and step notify. DRA wait
(wait_version_bump_dra.py) skips on DRY_RUN or when validation/bump report no
change.

Adds dev-tools/unittest for validation and pipeline JSON. Does not modify
.backportrc.json (reserved for future release automation). Minor version bumps
stay a follow-up change.

Co-authored-by: Cursor <cursoragent@cursor.com>