Transfer Linux and Windows team ownership to security-service-integrations - #20626
Conversation
…tions Reassign the packages previously owned by @elastic/sec-linux-platform and @elastic/sec-windows-platform to @elastic/security-service-integrations, both in the CODEOWNERS file and in each affected package's manifest.yml owner field. Co-authored-by: Cursor <cursoragent@cursor.com>
✅ Elastic Docs Style Checker (Vale)No issues found on modified lines! The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale. |
|
starting the handover process @nfritts , @111andre111 |
narph
added
Team:Security-Service Integrations
![vera-review-bot[bot]](https://cdn.statically.io/img/avatars.githubusercontent.com/in/3297022?s=60&v=4){kind=small}
| description: "Collecting application logs from Auditd instances (input: logfile)" | ||
| owner: | ||
| github: elastic/sec-linux-platform | ||
| github: elastic/security-service-integrations |
There was a problem hiding this comment.
Severity: 🟠 High confidence: high path: packages/auditd/manifest.yml:32
All 16 package manifests change owner.github but none bump the package version or add a changelog entry, so the new owner never reaches the published packages. Bump each package's patch version and add a matching changelog entry.
Details
This PR edits owner.github in 16 package manifests (auditd, auditd_manager, fim, hid_bravura_monitor, macos, microsoft_dhcp, microsoft_dnsserver, microsoft_exchange_server, mysql_enterprise, network_traffic, osquery, sysmon_linux, system_audit, unifiedlogs, windows_etw, winlog) without touching a single changelog.yml or version: field — no changelog file appears in the changed-file set.
Packages are published to EPR per version. With the version unchanged, none of these manifest edits are ever released: every package already published on epr.elastic.co keeps elastic/sec-linux-platform / elastic/sec-windows-platform as its owner, even though those teams are being dissolved by this handover. Only the in-repo copy is updated.
The repo's own contribution docs require both steps for any package change (docs/extend/_publish_an_integration.md, step 2 'Add a changelog entry' and step 5 'Bump the package version appropriately'). The precedent for exactly this kind of change is consistent: merged ownership-transfer PR 17982 bumped cloud_asset_inventory and cloud_security_posture and added a 'Transfer package ownership to ...' changelog entry to each, and packages/auditd/changelog.yml already carries a 3.19.1 entry with description 'Changed owners' from a previous transfer.
I am flagging this once on auditd rather than 16 times; the same fix is needed in all 16 packages. The .github/CODEOWNERS change itself is correct and complete — no sec-linux-platform / sec-windows-platform reference remains under packages/, the manifest owner of every touched package is listed in its CODEOWNERS entry (so dev/codeowners Check() still passes), the duplicate teams on /packages/system/manifest.yml and /packages/system/changelog.yml were correctly collapsed to a single entry, and every data-stream-level entry still resolves to exactly one team.
Recommendation:
For each of the 16 packages, bump the patch version in manifest.yml and prepend a matching entry to changelog.yml. For auditd (currently 3.24.0):
# packages/auditd/manifest.yml
version: "3.24.1"# packages/auditd/changelog.yml (top of file)
- version: "3.24.1"
changes:
- description: Transfer package ownership to elastic/security-service-integrations team.
type: enhancement
link: https://github.com/elastic/integrations/pull/20626Repeat for auditd_manager, fim, hid_bravura_monitor, macos, microsoft_dhcp, microsoft_dnsserver, microsoft_exchange_server, mysql_enterprise, network_traffic, osquery, sysmon_linux, system_audit, unifiedlogs, windows_etw and winlog, using each package's own current version.
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
⚠️ Automated review — verify suggestions before applying.
Review summaryIssues found across the latest commits d78a231 — 1 high
🤖 AI-Generated Review | Vera Review Bot | 📚 Knowledge base: integration-skills
|
🚀 Benchmarks reportPackage
|
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
log |
1367.99 | 1005.03 | -362.96 (-26.53%) | 💔 |
Package macos 👍(5) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
system_change |
7042.25 | 5025.13 | -2017.12 (-28.64%) | 💔 |
Package microsoft_dnsserver 👍(1) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
analytical |
2590.67 | 1680.67 | -910 (-35.13%) | 💔 |
Package microsoft_exchange_server 👍(2) 💚(1) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
messagetracking |
10101.01 | 7812.5 | -2288.51 (-22.66%) | 💔 |
Package mysql_enterprise 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
audit |
3289.47 | 2493.77 | -795.7 (-24.19%) | 💔 |
Package system_audit 👍(0) 💚(0) 💔(1)
Expand to view
| Data stream | Previous EPS | New EPS | Diff (%) | Result |
|---|---|---|---|---|
package |
76923.08 | 43478.26 | -33444.82 (-43.48%) | 💔 |
To see the full report comment with /test benchmark fullreport
Patch-bump the 16 packages reassigned to security-service-integrations so the owner.github change is published with matching changelog entries. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Pull request overview
Reassigns ownership for a set of Linux/Windows-focused integration packages from @elastic/sec-linux-platform / @elastic/sec-windows-platform to @elastic/security-service-integrations, updating both package metadata and repo-level ownership rules.
Changes:
- Updates
.github/CODEOWNERSentries for affected/packages/...paths to point to@elastic/security-service-integrations(preserving existing co-owners where present). - Updates
owner.githubin the affected packages’manifest.ymlfiles toelastic/security-service-integrations. - Bumps package versions and adds corresponding
changelog.ymlentries for the ownership transfer (note: this currently contradicts the PR description/notes).
Reviewed changes
Copilot reviewed 33 out of 33 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| .github/CODEOWNERS | Reassigns CODEOWNERS entries from Linux/Windows platform teams to @elastic/security-service-integrations. |
| packages/auditd/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/auditd/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/auditd_manager/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/auditd_manager/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/fim/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/fim/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/hid_bravura_monitor/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/hid_bravura_monitor/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/macos/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/macos/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/microsoft_dhcp/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/microsoft_dhcp/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/microsoft_dnsserver/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/microsoft_dnsserver/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/microsoft_exchange_server/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/microsoft_exchange_server/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/mysql_enterprise/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/mysql_enterprise/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/network_traffic/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/network_traffic/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/osquery/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/osquery/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/sysmon_linux/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/sysmon_linux/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/system_audit/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/system_audit/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/unifiedlogs/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/unifiedlogs/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/windows_etw/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/windows_etw/changelog.yml | Adds changelog entry documenting ownership transfer. |
| packages/winlog/manifest.yml | Updates package owner and bumps version for ownership transfer. |
| packages/winlog/changelog.yml | Adds changelog entry documenting ownership transfer. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Resolve mysql_enterprise changelog conflict by keeping main's 1.17.2 group-field change and bumping the ownership transfer to 1.17.3. Co-authored-by: Cursor <cursoragent@cursor.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 33 out of 33 changed files in this pull request and generated no new comments.
Suppressed comments (2)
packages/winlog/manifest.yml:6
- PR description says the change is scoped to CODEOWNERS + manifest.yml and that no version bumps/changelog entries were added, but this PR does bump versions and adds changelog entries. Please update the PR description (and/or Notes) to match the actual changes.
packages/macos/changelog.yml:2 - In this changelog, existing versions are unquoted (e.g.
1.0.0), but the newly added1.0.1is quoted. Please keep the version scalar format consistent within the file.
- version: "1.0.1"
|
✅ All changelog entries have the correct PR link. |
💚 Build Succeeded
History
|
|
LGTM but not sure if we need to either change the description or remove the version bumps as the description and changes are contradicting atm |
|
Tick the box to add this pull request to the merge queue (same as
|
|
We should either update the description to match or revert the version bumps. |
|
Package auditd - 3.24.1 containing this change is available at https://epr.elastic.co/package/auditd/3.24.1/ |
|
Package auditd_manager - 1.20.1 containing this change is available at https://epr.elastic.co/package/auditd_manager/1.20.1/ |
|
Package fim - 1.17.1 containing this change is available at https://epr.elastic.co/package/fim/1.17.1/ |
|
Package hid_bravura_monitor - 1.21.1 containing this change is available at https://epr.elastic.co/package/hid_bravura_monitor/1.21.1/ |
|
Package macos - 1.0.1 containing this change is available at https://epr.elastic.co/package/macos/1.0.1/ |
|
Package microsoft_dhcp - 1.27.1 containing this change is available at https://epr.elastic.co/package/microsoft_dhcp/1.27.1/ |
|
Package microsoft_dnsserver - 1.5.2 containing this change is available at https://epr.elastic.co/package/microsoft_dnsserver/1.5.2/ |
|
Package microsoft_exchange_server - 1.5.2 containing this change is available at https://epr.elastic.co/package/microsoft_exchange_server/1.5.2/ |
|
Package mysql_enterprise - 1.17.3 containing this change is available at https://epr.elastic.co/package/mysql_enterprise/1.17.3/ |
|
Package network_traffic - 1.34.3 containing this change is available at https://epr.elastic.co/package/network_traffic/1.34.3/ |
|
Package osquery - 1.24.2 containing this change is available at https://epr.elastic.co/package/osquery/1.24.2/ |
|
Package sysmon_linux - 1.9.1 containing this change is available at https://epr.elastic.co/package/sysmon_linux/1.9.1/ |
|
Package system_audit - 1.11.1 containing this change is available at https://epr.elastic.co/package/system_audit/1.11.1/ |
|
Package unifiedlogs - 0.5.2 containing this change is available at https://epr.elastic.co/package/unifiedlogs/0.5.2/ |
|
Package windows_etw - 1.0.1 containing this change is available at https://epr.elastic.co/package/windows_etw/1.0.1/ |
|
Package winlog - 2.6.1 containing this change is available at https://epr.elastic.co/package/winlog/2.6.1/ |
What
Reassigns the packages previously owned by
@elastic/sec-linux-platformand@elastic/sec-windows-platformto@elastic/security-service-integrations.Changes
Scoped to two file types only:
.github/CODEOWNERS— all/packages/...entries (package- and data-stream-level) owned by the Linux/Windows teams reassigned to@elastic/security-service-integrations. Shared-ownership lines (e.g.system,windows,endace) keep their other co-owners and were de-duplicated where both teams appeared.packages/<name>/manifest.yml— theowner.githubfield updated toelastic/security-service-integrationsfor the 16 affected packages: auditd, auditd_manager, fim, hid_bravura_monitor, macos, microsoft_dhcp, microsoft_dnsserver, microsoft_exchange_server, mysql_enterprise, network_traffic, osquery, sysmon_linux, system_audit, unifiedlogs, windows_etw, winlog.Notes
changelog.ymlentries were added (ownership-only change).Made with Cursor