fix: remove RuleQueryMatchCriteria hacks and prefer env vars over sec…

…rets (#3462)

Co-authored-by: Cursor <cursoragent@cursor.com>

Codex: Make index resilient to repos that failed to clone (#3460)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Search: Fix schema key content_type → type to match API response (#3459)

The navigation-search API serializes NavigationSearchResultItem.Type as
"type" (CamelCase policy). The previous fix incorrectly renamed the Zod
key from "type" to "content_type", causing SearchResponse.parse() to
fail on every result item.

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Search: Fix modal rejecting valid responses with content type "docs" (#…

…3456)

* Fix search modal rejecting valid responses with type "docs"

The navigation-search contract changed the result item type value from
"doc" to "docs", but the frontend Zod schemas still enumerated ['doc',
'api'], causing SearchResponse.parse() to throw on every result item and
surface "Error loading search results" even for healthy 200 responses.

Also adds a console.error + logError branch for non-ApiError query
failures so ZodError/parse mismatches are no longer completely silent.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

* Fix search schema: rename type → content_type with value 'docs'

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Update internal search packages to fix mapping (#3455)

Update to stable version of internal site search contracts (#3448)

fix: add missing permissions to build-changelog-scrubber-lambda job (#…

…3446)

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

changelog: make generated entry YAMLs self-describing for the scrubber (

#3417)

The changelog-upload Lambda (`docs-lambda-changelog-scrubber`) reads each
`{product}/changelogs/*.yaml` from the private S3 bucket and applies the
allowlist sanitizer before mirroring to the public bucket. Because each
per-entry YAML carries no embedded repo context, it calls
`LinkAllowlistSanitizer.TryApplyChangelogEntry(..., defaultOwner: "elastic",
defaultRepo: null, ...)`.

For an entry produced by the upload action's fork-PR re-derivation step —

    docs-builder changelog add --concise --use-pr-number \
      --owner elastic --repo cloud --prs 155500

— `BuildChangelogData` stored the bare PR number verbatim in the entry's
`Prs` list, so the written YAML contained `prs: ['155500']`. When the
Lambda later tried to scrub it, `ChangelogTextUtilities.TryGetGitHubRepo`
couldn't resolve a repo for the bare number (no `defaultRepo`), the
sanitizer emitted an error and aborted, and SQS retried the message
indefinitely with the same outcome:

    System.InvalidOperationException: Failed to apply allowlist to
    changelog entry; errors: 1

Two fixes here, with tests:

1. `ChangelogFileWriter.NormalizeReferences` — when `--owner` and `--repo`
   are supplied and a `--prs` / `--issues` value is just a number, expand
   it to `https://github.com/{owner}/{repo}/{pull|issues}/N` before
   writing the YAML. Bundle-style multi-repo strings (`a+b`) and
   pre-qualified `org/repo` values are left alone to avoid producing
   wrong URLs. Full URLs and `owner/repo#N` short-forms pass through
   unchanged. The validator already requires `--owner` and `--repo` when
   `--prs` is bare, so this is a strict superset of accepted input.

2. `LinkAllowlistSanitizer.FilterReferenceList` (defense in depth) — if
   we encounter a bare numeric reference and `defaultRepo` is unknown,
   keep the reference as-is and emit a warning instead of failing the
   entry. A bare number carries no repo identity, so it cannot leak a
   private link on its own, and downstream rendering supplies owner/repo
   from runtime context. Genuinely unparseable references (e.g.
   `not-a-pr-ref`) still hit the original fail-closed error branch so
   schema regressions remain visible.

Together these unblock the already-uploaded entries that the Lambda is
currently dead-lettering, and prevent the same shape of bad YAML from
ever being produced again.

Verified `dotnet format`, `./build.sh build --skip-dirty-check`, AOT
publish (`dotnet publish src/tooling/docs-builder -c Release`), the full
`Elastic.Changelog.Tests` suite (689 passing), and `docs/cli-schema.json`
regeneration shows no change (the CLI surface is unchanged).

Refs: elastic/cloud changelog-upload SQS DLQ for
`cloud-hosted/changelogs/155500.yaml`

Co-authored-by: Cursor <cursoragent@cursor.com>

Assembler: embed elastic-website-search web component on staging (#3411)

Adds the elastic-website-search web component (chat-mode="input") to the
assembler build, gated behind a new WEBSITE_SEARCH feature flag. The script
URL is configurable per environment via website_search_url in assembler.yml,
so staging and local dev can each point at their own bundle. The chat input
mounts into a sticky container at the bottom of the content column with a
short entrance animation.

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>

Hide Supported on line for settings whose stack is fully planned (#3407)

* Hide "Supported on" line when stack badge would be "Planned"

When a setting's applies_to.stack only targets versions greater than
the currently released stack, the inline stack badge renders "Planned"
but the "Supported on" line could still claim ECH / Self-managed
availability today, which is misleading: those surfaces all run the
stack and cannot expose a setting that has not shipped yet.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

* Apply suggestion from @florent-leborgne

* Apply suggestion from @florent-leborgne

* Apply suggestion from @florent-leborgne

---------

Co-authored-by: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>