[ci] Promote ES docker image after verification

.buildkite/scripts/steps/es_snapshots/build.sh

@@ -90,6 +90,13 @@ docker images "docker.elastic.co/elasticsearch/elasticsearch"
 docker images "docker.elastic.co/elasticsearch/elasticsearch" --format "{{.Tag}}" | xargs -n1 echo 'docker save docker.elastic.co/elasticsearch/elasticsearch:${0} | gzip > ../es-build/elasticsearch-${0}-docker-image.tar.gz'
 docker images "docker.elastic.co/elasticsearch/elasticsearch" --format "{{.Tag}}" | xargs -n1 bash -c 'docker save docker.elastic.co/elasticsearch/elasticsearch:${0} | gzip > ../es-build/elasticsearch-${0}-docker-image.tar.gz'
 
+ES_VERSION=$(docker images "docker.elastic.co/elasticsearch/elasticsearch" --format "{{.Tag}}" | grep SNAPSHOT | head -1)
+KIBANA_ES_DEFAULT_VERSION="$ES_VERSION-$ELASTICSEARCH_GIT_COMMIT"
+KIBANA_ES_DEFAULT_IMAGE="docker.elastic.co/kibana-ci/elasticsearch:$KIBANA_ES_DEFAULT_VERSION"
+echo $ES_VERSION $KIBANA_ES_DEFAULT_VERSION $KIBANA_ES_DEFAULT_IMAGE
+docker tag "docker.elastic.co/elasticsearch/elasticsearch:$ES_VERSION" "$KIBANA_ES_DEFAULT_IMAGE"
+docker_with_retry push "$KIBANA_ES_DEFAULT_IMAGE"
+
 echo "--- Create kibana-ci docker cloud image archives"
 ./gradlew :distribution:docker:cloud-ess-docker-export:assemble \
   -x :distribution:tools:server-launcher:nativeImageLinuxX64 \

.buildkite/scripts/steps/es_snapshots/promote_manifest.ts

@@ -27,7 +27,19 @@ import { BASE_BUCKET_DAILY, BASE_BUCKET_PERMANENT } from './bucket_config';
 
     const manifestJson = fs.readFileSync('manifest.json').toString();
     const manifest = JSON.parse(manifestJson);
-    const { id, bucket, version } = manifest;
+    const { id, bucket, version, sha } = manifest;
+    if (!/^\d+\.\d+\.\d+(-SNAPSHOT)?$/.test(version)) {
+      throw Error(`Invalid version format: ${version}`);
+    }
+    if (!/^[0-9a-f]{40}$/.test(sha)) {
+      throw Error(`Invalid sha format: ${sha}`);
+    }
+    if (!/^[\w./-]+$/.test(id)) {
+      throw Error(`Invalid id format: ${id}`);
+    }
+    if (!/^[\w./-]+$/.test(bucket)) {
+      throw Error(`Invalid bucket format: ${bucket}`);
+    }
 
     const manifestPermanentJson = manifestJson
       .split(BASE_BUCKET_DAILY)
@@ -51,6 +63,16 @@ import { BASE_BUCKET_DAILY, BASE_BUCKET_PERMANENT } from './bucket_config';
     `,
       { shell: '/bin/bash' }
     );
+
+    const registry = 'docker.elastic.co/kibana-ci/elasticsearch';
+    const sourceTag = `${version}-SNAPSHOT-${sha}`;
+    const targetTag = `${version}-SNAPSHOT`;
+
+    console.log(`Promoting docker image: ${registry}:${sourceTag} -> ${registry}:${targetTag}`);
+    execSync(
+      `docker buildx imagetools create -t ${registry}:${targetTag} ${registry}:${sourceTag}`,
+      { stdio: 'inherit' }
+    );
   } catch (ex) {
     console.error(ex);
     process.exit(1);

src/platform/packages/shared/kbn-es/src/utils/docker.ts

@@ -1470,11 +1470,38 @@ async function runDockerContainerInSnapshotMode(
   await verifyDockerInstalled(log);
   await maybeCreateDockerNetwork(log);
 
-  const tag = options.tag || (options.version ? `${options.version}-SNAPSHOT` : DOCKER_TAG);
+  let tag = options.tag || (options.version ? `${options.version}-SNAPSHOT` : DOCKER_TAG);
+
+  // When ES_SNAPSHOT_MANIFEST is set, use the commit-pinned docker tag from kibana-ci
+  let repo = DOCKER_REPO;
+  const manifestUrl = process.env.ES_SNAPSHOT_MANIFEST;
+  if (!options.tag && !options.image && manifestUrl) {
+    const resp = await fetch(manifestUrl);
+    if (resp.ok) {
+      const manifest = await resp.json();
+      const { version, sha } = manifest;
+
+      if (!/^\d+\.\d+\.\d+(-SNAPSHOT)?$/.test(version)) {
+        throw createCliError(`Invalid version format in manifest: ${version}`);
+      }
+      if (!/^[0-9a-f]{40}$/.test(sha)) {
+        throw createCliError(`Invalid sha format in manifest: ${sha}`);
+      }
+
+      tag = `${version}-SNAPSHOT-${sha}`;
+      repo = `${DOCKER_REGISTRY}/kibana-ci/elasticsearch`;
+      log.info(`Using commit-pinned docker tag from manifest: ${repo}:${tag}`);
+    } else {
+      log.warning(
+        `Failed to fetch ES_SNAPSHOT_MANIFEST (${resp.status}), falling back to default image`
+      );
+    }
+  }
+
   const image = resolveDockerImage({
     image: options.image,
     tag,
-    repo: DOCKER_REPO,
+    repo,
     defaultImg: DOCKER_IMG,
   });
   await setupDockerImage({ log, image });