Update AI workflows to match upstream patterns

.github/workflows/address-pr-review-feedback.yml

@@ -0,0 +1,60 @@
+name: Address PR Review Feedback
+on:
+  pull_request_review:
+    types: [submitted]
+
+concurrency:
+  group: pr-address-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  actions: read
+  contents: write
+  issues: write
+  pull-requests: write
+
+jobs:
+  run:
+    if: >-
+      github.event.review.user.type == 'Bot' &&
+      github.event.pull_request.draft == false &&
+      !contains(github.event.pull_request.labels.*.name, 'no-address-pr-feedback')
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-pr-review-addresser.lock.yml@main
+    with:
+      allowed-bot-users: "coderabbitai[bot],github-actions[bot]"
+      additional-instructions: |
+        Focus on minor and straightforward fixes only. Address feedback that involves:
+        - Typos, naming, and formatting issues
+        - Missing or incorrect types
+        - Simple logic corrections with obvious fixes
+        - Import cleanup or unused variable removal
+        - Documentation or comment improvements
+        - Small refactors with clear intent (e.g. extract a constant, simplify a condition)
+
+        Do NOT attempt to fix feedback that involves:
+        - Architectural or design changes
+        - Complex logic rewrites or algorithm changes
+        - Subjective style preferences where reasonable people could disagree
+        - Changes requiring deep domain knowledge or broader context
+        - Performance optimizations that need benchmarking
+
+        When in doubt, reply to the review thread explaining why you're skipping
+        the change rather than making a potentially incorrect fix.
+
+        ## CI failures
+
+        After addressing review threads, also check the PR's CI status:
+
+        1. Look at the failing checks on the PR (use the GitHub API or gh CLI).
+        2. Read any bot comments on the PR — the PR Actions Detective agent posts
+           comments explaining what caused CI to fail and how to fix it. These
+           comments are your primary guide for fixing CI.
+        3. If CI is failing and the bot comment (or the check logs) point to a
+           clear, straightforward fix (e.g. a lint error, a type error, a failing
+           unit test, a missing import), apply the fix.
+        4. Apply the same scope rules as review feedback: fix simple, obvious CI
+           failures only. Do NOT attempt complex logic rewrites to make tests pass.
+        5. If you fix a CI failure, briefly describe what you changed and why in
+           your commit message.
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/breaking-change-detector.yml

@@ -0,0 +1,18 @@
+name: Breaking Change Detector
+on:
+  schedule:
+    - cron: "0 13 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-breaking-change-detector.lock.yml@main
+    with:
+      title-prefix: "[breaking-change]"
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/code-duplication-detector.yml

@@ -0,0 +1,19 @@
+name: Code Duplication Detector
+on:
+  schedule:
+    - cron: "0 12 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-code-duplication-detector.lock.yml@main
+    with:
+      title-prefix: "[code-duplication]"
+      languages: "python"
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/docs-patrol.yml

@@ -0,0 +1,18 @@
+name: Docs Patrol
+on:
+  schedule:
+    - cron: "0 10 * * 1-5"
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-docs-patrol.lock.yml@main
+    with:
+      title-prefix: "[docs-patrol]"
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/duplicate-issue-detector.yml

@@ -0,0 +1,17 @@
+name: Duplicate Issue Detector
+on:
+  issues:
+    types: [opened]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  discussions: write
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-duplicate-issue-detector.lock.yml@main
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/minimize-resolved-reviews.yml

@@ -1,26 +1,21 @@
-name: Minimize Resolved Reviews
+name: "Internal: Minimize Resolved Reviews"
+
 on:
   pull_request_review:
     types: [submitted]
-  pull_request_review_comment:
-    types: [created, edited]
-  issue_comment:
-    types: [created]
+
+concurrency:
+  group: minimize-reviews-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: true
 
 permissions:
   pull-requests: write
 
 jobs:
   minimize:
     runs-on: ubuntu-latest
-    if: >-
-      github.event_name != 'issue_comment' || (
-        contains(github.event.comment.body, '/tidy') &&
-        github.event.issue.pull_request &&
-        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)
-      )
     steps:
-      - name: Minimize resolved review threads
+      - name: Minimize resolved review comments
         uses: strawgate/minimize-resolved-pr-reviews@v0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/pr-actions-detective.yml

@@ -0,0 +1,41 @@
+name: PR Actions Detective
+on:
+  workflow_run:
+    workflows: ["Run Tests"]
+    types: [completed]
+
+permissions:
+  actions: read
+  contents: read
+  issues: write
+  pull-requests: write
+
+jobs:
+  gate:
+    if: >-
+      github.event.workflow_run.conclusion == 'failure' &&
+      toJSON(github.event.workflow_run.pull_requests) != '[]'
+    runs-on: ubuntu-latest
+    outputs:
+      enabled: ${{ steps.gate.outputs.enabled }}
+    steps:
+      - id: gate
+        uses: actions/github-script@v7
+        with:
+          script: |
+            const prNumber = context.payload.workflow_run.pull_requests[0].number;
+            const pr = await github.rest.pulls.get({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              pull_number: prNumber,
+            });
+            const enabled = !(pr.data.labels || []).some((label) => label.name === "no-pr-actions-detective");
+            core.info(`PR #${prNumber} no-pr-actions-detective absent (enabled): ${enabled}`);
+            core.setOutput("enabled", enabled ? "true" : "false");
+
+  run:
+    needs: gate
+    if: needs.gate.outputs.enabled == 'true'
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-pr-actions-detective.lock.yml@main
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/refactor-opportunist.yml

@@ -0,0 +1,19 @@
+name: Refactor Opportunist
+on:
+  schedule:
+    - cron: "0 14 * * 1"
+  workflow_dispatch:
+
+permissions:
+  actions: read
+  contents: read
+  issues: write
+  pull-requests: read
+
+jobs:
+  run:
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-refactor-opportunist.lock.yml@main
+    with:
+      title-prefix: "[refactor-opportunist]"
+    secrets:
+      COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/trigger-bug-hunter.yml

@@ -5,19 +5,15 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  actions: read
+  contents: read
   issues: write
-  pull-requests: write
+  pull-requests: read
 
 jobs:
   run:
     uses: elastic/ai-github-actions/.github/workflows/gh-aw-bug-hunter.lock.yml@main
     with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
+      title-prefix: "[bug-hunter]"
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/trigger-issue-triage.yml

@@ -8,17 +8,10 @@ permissions:
   contents: read
   discussions: write
   issues: write
-  pull-requests: read
+  pull-requests: write
 
 jobs:
   run:
     uses: elastic/ai-github-actions/.github/workflows/gh-aw-issue-triage.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/trigger-mention-in-issue.yml

@@ -15,13 +15,6 @@ jobs:
     if: >-
       github.event.issue.pull_request == null &&
       startsWith(github.event.comment.body, '/ai')
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-issue.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-issue-no-sandbox.lock.yml@main
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}

.github/workflows/trigger-mention-in-pr.yml

@@ -17,13 +17,6 @@ jobs:
     if: >-
       startsWith(github.event.comment.body, '/ai') &&
       (github.event.issue.pull_request != null || github.event_name == 'pull_request_review_comment')
-    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-pr.lock.yml@main
-    with:
-      setup-commands: make setup
-      messages-footer: |
-        ---
-        [From workflow: ${{ github.workflow }}](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-
-        Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
+    uses: elastic/ai-github-actions/.github/workflows/gh-aw-mention-in-pr-no-sandbox.lock.yml@main
     secrets:
       COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}