[hackerone] Initial release of HackerOne with Report data streams

[clement-fouque]

Proposed commit message

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

Author's Checklist

• [ ]

How to test this PR locally

Related issues

Screenshots

[github-actions]

Vale Linting Results

Summary: 9 warnings, 35 suggestions found

⚠️ Warnings (9)

File	Line	Rule	Message
packages/hackerone/docs/README.md	116	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	116	Elastic.DontUse	Don't use 'please'.
packages/hackerone/docs/README.md	359	Elastic.DontUse	Don't use 'just'.
packages/hackerone/docs/README.md	375	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	375	Elastic.QuotesPunctuation	Place punctuation inside closing quotation marks.
packages/hackerone/docs/README.md	488	Elastic.DontUse	Don't use 'Thus'.
packages/hackerone/docs/README.md	510	Elastic.Latinisms	Latin terms and abbreviations are a common source of confusion. Use 'for example' instead of 'e.g'.
packages/hackerone/docs/README.md	510	Elastic.DontUse	Don't use 'please'.
packages/hackerone/docs/README.md	754	Elastic.DontUse	Don't use 'just'.

💡 Suggestions (35)

File	Line	Rule	Message
packages/hackerone/_dev/build/docs/README.md	87	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/_dev/build/docs/README.md	93	Elastic.Semicolons	Use semicolons judiciously.
packages/hackerone/docs/README.md	88	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	94	Elastic.Semicolons	Use semicolons judiciously.
packages/hackerone/docs/README.md	106	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	114	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/hackerone/docs/README.md	114	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	114	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	116	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	116	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	117	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/hackerone/docs/README.md	117	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	124	Elastic.Clone	Use cloning only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
packages/hackerone/docs/README.md	227	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	242	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	259	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	326	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	336	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	359	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	500	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	508	Elastic.Wordiness	Consider using 'tell' instead of 'inform'.
packages/hackerone/docs/README.md	508	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	508	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	510	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	510	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	511	Elastic.WordChoice	Consider using 'efficiently' instead of 'simply', unless the term is in the UI.
packages/hackerone/docs/README.md	511	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	518	Elastic.Clone	Use cloning only when referring to cloning a GitHub repository or creating a copy that is linked to the original. Often confused with 'copy' and 'duplicate'.
packages/hackerone/docs/README.md	621	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	636	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	653	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	720	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	730	Elastic.WordChoice	Consider using 'deactivated, deselected, hidden, turned off, unavailable' instead of 'disabled', unless the term is in the UI.
packages/hackerone/docs/README.md	754	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/hackerone/docs/README.md	793	Elastic.WordChoice	Consider using 'can, might' instead of 'may', unless the term is in the UI.

---

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

[clement-fouque]

@efd6 can you perform a review of the CEL part? Thanks.

[efd6]

Does the API return null in this case?

[clement-fouque]

I believe so as response is:

{
  [...],
  "links": {}
}

[efd6]

That's not null, that's absence. null would look like this:

{
  [...],
  "links": {"next": null}
}

[efd6]

If it does, we should not be using "" sentinels.

[efd6]

Why are we using "" as a sentinel when there is nothing here?

But also,

Suggested change

	"pageMax": body.?data.orValue([]).map(r,
	r.attributes.?last_activity_at.orValue(r.attributes.?created_at.orValue(""))
	).filter(t, t != "").as(stamps,
	(size(stamps) > 0) ? stamps.max() : ""
	),
	"pageMax": body.?data.orValue([]).map(r, has(r.?attributes.last_activity_at) || has(r.?attributes.created_at),
	r.attributes.?last_activity_at.orValue(r.attributes.created_at)
	).as(stamps,
	(size(stamps) > 0) ? stamps.max() : ""
	),

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[github-actions]

TL;DR

Buildkite failed before tests ran because the PR commit could not be merged with main (fatal: refusing to merge unrelated histories). Recreate the PR branch from elastic/integrations:main and re-apply your changes, then push again.

Remediation

• Rebase/cherry-pick your changes onto a branch created from the current upstream main history (not a repo with independent root history), then force-push the PR branch.
• Re-run Buildkite; this should unblock the checkout/merge step and allow normal CI jobs to start.

Investigation details

Root Cause

The failure happens in the repository post-checkout hook when Buildkite creates pr_merge_18951 and executes:

• .buildkite/hooks/post-checkout:47 → git merge --no-edit "${BUILDKITE_COMMIT}"

This merge fails with unrelated histories, which indicates the PR commit lineage does not share ancestry with elastic/integrations target branch history.

Evidence

• Build: https://buildkite.com/elastic/integrations/builds/42880
• Job/step: :pipeline::arrow_up: Upload Pipeline: .buildkite/pipeline.yml
• Key log excerpt (/tmp/gh-aw/buildkite-logs/integrations-pipelinearrow_up-upload-pipeline-buildkitepipelineyml.txt):

Switched to a new branch 'pr_merge_18951'
New branch created: pr_merge_18951
fatal: refusing to merge unrelated histories
Merge failed: 128
🚨 Error: running "repository post-checkout" shell hook: The repository post-checkout hook exited with status 128

Verification

• Not run locally: failure occurs in Buildkite checkout/merge orchestration before repo tests/build steps.

Follow-up

If this branch was intentionally created from a disconnected history, open a fresh branch from upstream main and copy only the integration changes needed for this PR.

Note

🔒 Integrity filter blocked 2 items

The following items were blocked because they don't meet the GitHub integrity level.

• #18951 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".
• [hackerone] Initial release of HackerOne with Report data streams #18951 pull_request_read: has lower integrity than agent requires. The agent cannot read data with integrity below "approved".

To allow these resources, lower min-integrity in your GitHub frontmatter:

tools:
  github:
    min-integrity: approved  # merged | approved | unapproved | none

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: f0de135

History

• 💚 Build #42894 succeeded ff41eb7
• 💔 Build #42880 failed e95dfe1
• 💔 Build #42879 failed d394b3e
• 💔 Build #42878 failed f37c435
• 💔 Build #42876 failed 92037e3
• 💔 Build #42873 failed 7ab7673