[CI] GH workflow to assign reviewer for manual backport

[Ikuni17]

Summary

AI assisted with Cursor + gpt-5.4-high

Adds a Github Workflow that automatically assigns a reviewer for manual backports and removes kibanamachine. This avoids common confusion with kibanamachine being the codeowner and improves DX. This workflow is gated behind PRs where kibanamachine is not the author, therefore it does not collide with backports that were created automatically and are auto-approved through .github/workflows/auto-approve-backports.yml.

The reviewer is chosen with this algorithm:

1. Try to find the intersection of the PR author's teams and the codeowner teams which submitted reviews in the source PR (via onBehalfOf property).
2. If there are matching team(s), they are requested for review on the backport.
3. If no matching teams were found, we fallback to the last human reviewer that approved.
4. If that is also not found, this workflow is a no-op and kibanamachine stays as the reviewer.

Testing

I used a generated json event for an old backport: #260565. You can see the reviewers changed at the bottom when running locally with act.

Local run

➜ kibana (ci/assign-backport-reviewer) ✗ act pull_request_target \
  -W .github/workflows/assign-backport-reviewer.yml \
  -e data/assign-backport-reviewer.pull_request_target.pr-260565.json \
  --env GITHUB_REPOSITORY=elastic/kibana \
  --env GITHUB_REPOSITORY_OWNER=elastic \
  -s GITHUB_TOKEN="$(gh auth token)" \
  -s KIBANAMACHINE_TOKEN="$(gh auth token)"
INFO[0000] Using docker host 'unix:///var/run/docker.sock', and daemon socket 'unix:///var/run/docker.sock' 
[Assign backport reviewer/Assign team reviewer for manual backport] ⭐ Run Set up job
[Assign backport reviewer/Assign team reviewer for manual backport] 🚀  Start image=catthehacker/ubuntu:act-latest
[Assign backport reviewer/Assign team reviewer for manual backport]   🐳  docker pull image=catthehacker/ubuntu:act-latest platform= username= forcePull=true
[Assign backport reviewer/Assign team reviewer for manual backport]   🐳  docker create image=catthehacker/ubuntu:act-latest platform= entrypoint=["tail" "-f" "/dev/null"] cmd=[] network="host"
[Assign backport reviewer/Assign team reviewer for manual backport]   🐳  docker run image=catthehacker/ubuntu:act-latest platform= entrypoint=["tail" "-f" "/dev/null"] cmd=[] network="host"
[Assign backport reviewer/Assign team reviewer for manual backport]   🐳  docker exec cmd=[node --no-warnings -e console.log(process.execPath)] user= workdir=
[Assign backport reviewer/Assign team reviewer for manual backport]   ✅  Success - Set up job
[Assign backport reviewer/Assign team reviewer for manual backport]   ☁  git clone 'https://github.com/actions/github-script' # ref=ed597411d8f924073f98dfc5c65a23a2325f34cd
[Assign backport reviewer/Assign team reviewer for manual backport] Non-terminating error while running 'git clone': some refs were not updated
[Assign backport reviewer/Assign team reviewer for manual backport]   ☁  git clone 'https://github.com/actions/github-script' # ref=ed597411d8f924073f98dfc5c65a23a2325f34cd
[Assign backport reviewer/Assign team reviewer for manual backport] Non-terminating error while running 'git clone': some refs were not updated
[Assign backport reviewer/Assign team reviewer for manual backport] ⭐ Run Main Select reviewers
[Assign backport reviewer/Assign team reviewer for manual backport]   🐳  docker cp src=/home/brad/.cache/act/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/ dst=/var/run/act/actions/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/
[Assign backport reviewer/Assign team reviewer for manual backport]   🐳  docker exec cmd=[/opt/acttoolcache/node/24.14.1/x64/bin/node /var/run/act/actions/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/dist/index.js] user= workdir=
[Assign backport reviewer/Assign team reviewer for manual backport]   ✅  Success - Main Select reviewers [1.27416023s]
[Assign backport reviewer/Assign team reviewer for manual backport]   ⚙  ::set-output:: reviewer=jbudz
[Assign backport reviewer/Assign team reviewer for manual backport]   ⚙  ::set-output:: result=
[Assign backport reviewer/Assign team reviewer for manual backport]   ⚙  ::set-output:: team_reviewers=elastic/kibana-operations
[Assign backport reviewer/Assign team reviewer for manual backport] ⭐ Run Main Update reviewers
[Assign backport reviewer/Assign team reviewer for manual backport]   🐳  docker cp src=/home/brad/.cache/act/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/ dst=/var/run/act/actions/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/
[Assign backport reviewer/Assign team reviewer for manual backport]   🐳  docker exec cmd=[/opt/acttoolcache/node/24.14.1/x64/bin/node /var/run/act/actions/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/dist/index.js] user= workdir=
| Updating reviewers: teamReviewers=elastic/kibana-operations, reviewer=jbudz
[Assign backport reviewer/Assign team reviewer for manual backport]   ✅  Success - Main Update reviewers [321.09717ms]
[Assign backport reviewer/Assign team reviewer for manual backport]   ⚙  ::set-output:: result=
[Assign backport reviewer/Assign team reviewer for manual backport] ⭐ Run Complete job
[Assign backport reviewer/Assign team reviewer for manual backport] Cleaning up container for job Assign team reviewer for manual backport
[Assign backport reviewer/Assign team reviewer for manual backport]   ✅  Success - Complete job
[Assign backport reviewer/Assign team reviewer for manual backport] 🏁  Job succeeded

[Ikuni17]

@macroscope-app review

[macroscopeapp]

Code review is in progress. Results will be posted as check runs complete.

Previously completed:

• Macroscope - Correctness Check

[elasticmachine]

Pinging @elastic/kibana-operations (Team:Operations)

[macroscopeapp]

Approvability

Verdict: Needs human review

This PR introduces a new GitHub Actions workflow for automatic reviewer assignment on backport PRs. The workflow file is owned by @elastic/kibana-operations, and since the author is not a designated owner of this CI configuration, the operations team should review this new automation.

No code changes detected at 8635867. Prior analysis still applies.

^{You can customize Macroscope's approvability policy. Learn more.}

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 441947f

cc @Ikuni17

[TamerlanG]

What do you think about having this be a script we call from the operations repo or a github javascript action?

[Ikuni17]

@TamerlanG

What do you think about having this be a script we call from the operations repo or a github javascript action?

Maybe, I'm missing something, what would be the advantage of doing that or do you have something specific in mind?

[github-actions]

Found one reviewer-assignment edge case where the fallback can request the current PR author.

[delanni]

I think the potential benefit in having this in a separate repo is that the code is not in a yml file, and could be called outside of github actions, as an operational action - but I don't see this being ran by us very often.

I still would prefer if this was not inline a yml file, but somewhere in a scripts folder and sourced/used from there.

[github-actions]

Found one reviewer-selection edge case in the team matching query.

[Ikuni17]

@delanni Converted to a script inside of inline yml. Tested locally with act against #260565

Local run logs

➜ kibana (ci/assign-backport-reviewer) ✔ act pull_request_target \
  -W .github/workflows/assign-backport-reviewer.yml \
  -e data/assign-backport-reviewer.pull_request_target.pr-260565.json \
  --env GITHUB_REPOSITORY=elastic/kibana \
  --env GITHUB_REPOSITORY_OWNER=elastic \
  -s GITHUB_TOKEN="$(gh auth token)" \
  -s KIBANAMACHINE_TOKEN="$(gh auth token)"
INFO[0000] Using docker host 'unix:///var/run/docker.sock', and daemon socket 'unix:///var/run/docker.sock' 
[Assign manual backport reviewer/Find reviewer for manual backport] ⭐ Run Set up job
[Assign manual backport reviewer/Find reviewer for manual backport] 🚀  Start image=catthehacker/ubuntu:act-latest
[Assign manual backport reviewer/Find reviewer for manual backport]   🐳  docker pull image=catthehacker/ubuntu:act-latest platform= username= forcePull=true
[Assign manual backport reviewer/Find reviewer for manual backport]   🐳  docker create image=catthehacker/ubuntu:act-latest platform= entrypoint=["tail" "-f" "/dev/null"] cmd=[] network="host"
[Assign manual backport reviewer/Find reviewer for manual backport]   🐳  docker run image=catthehacker/ubuntu:act-latest platform= entrypoint=["tail" "-f" "/dev/null"] cmd=[] network="host"
[Assign manual backport reviewer/Find reviewer for manual backport]   🐳  docker exec cmd=[node --no-warnings -e console.log(process.execPath)] user= workdir=
[Assign manual backport reviewer/Find reviewer for manual backport]   ✅  Success - Set up job
[Assign manual backport reviewer/Find reviewer for manual backport]   ☁  git clone 'https://github.com/actions/github-script' # ref=ed597411d8f924073f98dfc5c65a23a2325f34cd
[Assign manual backport reviewer/Find reviewer for manual backport] Non-terminating error while running 'git clone': some refs were not updated
[Assign manual backport reviewer/Find reviewer for manual backport] ⭐ Run Main Checkout repository
[Assign manual backport reviewer/Find reviewer for manual backport]   🐳  docker cp src=/home/brad/kibana/. dst=/home/brad/kibana
[Assign manual backport reviewer/Find reviewer for manual backport]   ✅  Success - Main Checkout repository [5m30.132362977s]
[Assign manual backport reviewer/Find reviewer for manual backport] ⭐ Run Main Assign reviewers
[Assign manual backport reviewer/Find reviewer for manual backport]   🐳  docker cp src=/home/brad/.cache/act/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/ dst=/var/run/act/actions/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/
[Assign manual backport reviewer/Find reviewer for manual backport]   🐳  docker exec cmd=[/opt/acttoolcache/node/24.15.0/x64/bin/node /var/run/act/actions/actions-github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd/dist/index.js] user= workdir=
| Updating reviewers: teamReviewers=elastic/kibana-operations, reviewer=undefined
[Assign manual backport reviewer/Find reviewer for manual backport]   ✅  Success - Main Assign reviewers [3.166924089s]
[Assign manual backport reviewer/Find reviewer for manual backport]   ⚙  ::set-output:: result=
[Assign manual backport reviewer/Find reviewer for manual backport] ⭐ Run Complete job
[Assign manual backport reviewer/Find reviewer for manual backport] Cleaning up container for job Find reviewer for manual backport
[Assign manual backport reviewer/Find reviewer for manual backport]   ✅  Success - Complete job
[Assign manual backport reviewer/Find reviewer for manual backport] 🏁  Job succeeded

I also don't really see a need to run this ourselves. We can always add workflow_dispatch in the future for manual runs if needed.

[delanni]

a lot more readable, thanks!