Fix stale baseline_snapshot.json hashes in Check Saved Objects CI step

[clintandrewhall]

Summary

Fixes a false positive in the Check Saved Objects CI step that causes unrelated PRs to fail with:

"Some modelVersions have been updated for SO type 'person-so-type' after they were defined: 10.1.0."

Root cause

The joi dependency was bumped from ^18.0.1 to ^18.0.2 in #245131 (Jan 14), one day after the person-so-type test fixture and its baseline_snapshot.json were introduced in #248443 (Jan 13).

The baseline_snapshot.json contains precomputed hashes (modelVersionHash, schemas.forwardCompatibility, schemas.create) derived from @kbn/config-schema objects, which are built on top of joi. The hashes are generated by JSON.stringify-ing schema objects and computing SHA-256 digests. When joi's internal representation changed in the patch update, the serialization output changed, producing different hashes — even though the model version definitions themselves were untouched.

The CI step's getMutatedModelVersions function (in validate_changes.ts) deep-compares baseline model version summaries against freshly computed ones. The stale hashes cause it to flag person-so-type version 1 as "mutated," which is a false positive.

This only manifests in test mode — the fallback path (#251139) that runs when a PR doesn't modify any SO types. In that path, the CI loads the committed baseline_snapshot.json as the "before" state and compares it against a fresh takeSnapshot(TEST_TYPES).

Changes

1. Refreshed baseline_snapshot.json hashes — Updated the hash, modelVersionHash, and schemas hash fields for all three test types to match the current joi version. The structural "before" state (which types exist, which model versions are present, mappings, etc.) is preserved exactly as-is, since the deliberate differences between the baseline and current code are what make the test mode exercise the validation pipeline and trigger rollback tests.

2. Added update_baseline_hashes.ts utility — A script that automates refreshing these hashes for the next time a transitive dependency change invalidates them. It reads the existing baseline, takes a fresh snapshot of TEST_TYPES, patches only the hash-dependent fields, and writes it back. Run via:

   yarn test:jest packages/kbn-check-saved-objects-cli/src/commands/test/update_baseline_hashes.test.ts
   

Test plan

• All 25 @kbn/check-saved-objects-cli unit tests pass (24 existing + 1 new).
• CI Check Saved Objects step passes on this PR (test mode fallback path).

Made with Cursor

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[clintandrewhall]

This was just a suggestion, and a check to see if the fix actually resolved the CI failure-- which it did. But now that the change has been reverted, I'm sure there will be discussions as to how to address this.

I'm closing it in the meantime. Perhaps it will be helpful later!