[agent-suggestions] Agent suggestions - 2026-07-20

## Agent Suggestions
**Date:** 2026-07-20

### 1. `trigger-release-buildkite-failure-investigator`
**Trigger:** `status` failures from Buildkite contexts on `main` and active release branches; optionally `workflow_dispatch` for a commit or branch.

**Purpose:** Diagnose post-merge Beats packaging and DRA publishing failures, correlate the failed Buildkite step with the triggering commit/branch, and create one deduplicated tracking issue with the failing stage, relevant log excerpt, artifact/package scope, and suggested owner. Restrict this to release/snapshot packaging failures; do not rerun jobs, publish artifacts, or modify code.

**Proposed safe outputs:** `create-issue` for a deduplicated release-health tracker and `add-comment` on the associated commit or release PR when one exists.

**Evidence:**
- The packaging pipeline is triggered by commits to `main` and release branches and publishes snapshot/staging packages plus DRA artifacts (`.buildkite/packaging.pipeline.md:1-7,14-21`; https://github.com/elastic/beats/blob/main/.buildkite/packaging.pipeline.md).
- The release target builds every Beat and x-pack package and moves generated distributions into the release staging tree (`Makefile:204-216`; https://github.com/elastic/beats/blob/main/Makefile#L204-L216), so a failure after merge can block a release without an open PR to investigate.
- The existing Buildkite detective only runs when a failed status has an associated open PR: `.github/workflows/trigger-pr-buildkite-detective.yml:14-18,34-41` (https://github.com/elastic/beats/blob/main/.github/workflows/trigger-pr-buildkite-detective.yml#L14-L18). Its first job explicitly queries open PRs and the agent job is gated on `has-open-pr == true`, leaving post-merge packaging failures outside its scope.
- The existing scheduled snapshot workflow only detects that `testing/environments/snapshot.yml` has not changed for seven days and sends Slack (`.github/workflows/notify-stalled-snapshots.yml:40-60`); it does not inspect failed packaging/DRA steps.

**Why not covered already:** Current agent workflows cover PR Buildkite failures, generic PR action failures, stale snapshot-version updates, issue triage, and code/docs/test review. None investigates failed release-branch or post-merge packaging/DRA runs when no open PR is attached. This is distinct from prior suggestions #51891 (generated-asset drift), #51744 (OTel receiver routing), #51416 (PR readiness), and #51149 (backport branch health).

## Duplicate Checks
- Prior agent-suggestion reports reviewed: [#51891](https://github.com/elastic/beats/issues/51891), [#51744](https://github.com/elastic/beats/issues/51744), [#51416](https://github.com/elastic/beats/issues/51416), [#51149](https://github.com/elastic/beats/issues/51149), [#50211](https://github.com/elastic/beats/issues/50211), and [#49774](https://github.com/elastic/beats/issues/49774).
- Open workflow/automation searches and open PR searches were reviewed; no matching post-merge packaging/DRA failure investigator was found.

## Downstream Signals
- Active downstream maintenance work includes Logstash backports of new CI workflows across release branches ([#19310](https://github.com/elastic/logstash/pull/19310), [#19309](https://github.com/elastic/logstash/pull/19309), [#19308](https://github.com/elastic/logstash/pull/19308), updated 2026-07-20) and elastic-package version-gated test support ([#3768](https://github.com/elastic/elastic-package/pull/3768), updated 2026-07-20). These reviews confirm ongoing cross-branch CI and compatibility maintenance, but no downstream workflow was a stronger or less-duplicative Beats-specific gap.

## Suggested Next Steps
- [ ] Add a post-merge/release-branch Buildkite status workflow that can access packaging logs with a read-only token.
- [ ] Match failures by branch, Buildkite step, and commit SHA; suppress duplicate issues for the same failure signature.
- [ ] Include package/DRA stage, failing Beat/platform, bounded log evidence, and release-owner routing in the issue template.

---
[What is this?](https://ela.st/github-ai-tools) | [From workflow: Agent Suggestions](https://github.com/elastic/beats/actions/runs/29743814375)

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.
> - [x] expires on Jul 27, 2026, 12:59 PM UTC

Start by reading .github/workflows/trigger-pr-buildkite-detective.yml and notify-stalled-snapshots.yml, then review .buildkite/packaging.pipeline.md and Makefile:204-216. Define how release-branch and post-merge Buildkite failures are matched and deduplicated. Done means the workflow reports the failing stage, package or DRA scope, bounded evidence, and owner without rerunning jobs or publishing artifacts.

Written by the indexing model from the issue text.