add skip-so-check label to bypass Saved Objects CI check

[hammad-nasir-elastic]

resolves elastic/kibana-team#3144

Summary

Adds a ci:skip-so-check PR label that, when present, skips the "Check changes in Saved Objects" CI step entirely. This gives contributors an escape hatch for unrelated false positives so that the SO check can be moved toward hard-fail enforcement without holding the whole repo hostage to the next unanticipated edge case.

Problem

• The "Check changes in Saved Objects" step is intended to become a hard-blocking CI check, but historically has produced false positives in cases the rules don't yet model (e.g. Joi version bumps that change snapshot hashes without changing semantics, no-op schema refactors).
• Today there is no per-PR way to bypass the check when one of these edge cases surfaces; every contributor would have to wait for a Core-side fix.

Solution

• Gate the existing SO-check pipeline step on !GITHUB_PR_LABELS.includes('ci:skip-so-check') in .buildkite/scripts/pipelines/pull_request/pipeline.ts, following the same pattern as ci:skip-cypress-osquery and agent-builder:skip-smoke-tests.
• When the label is present, the step is simply not emitted into the generated pipeline.
• Document the label and its intended use in packages/kbn-check-saved-objects-cli/README.md under the existing "How it is used in CI" section.

How to test

1. Open a PR that touches one of the gating paths (e.g. packages/kbn-check-saved-objects-cli/current_fields.json) and confirm the "Check changes in Saved Objects" step appears in Buildkite as today.
2. Add the ci:skip-so-check label to the PR, re-run the pipeline build, and confirm the step is no longer emitted.
3. Remove the label and confirm the step reappears on the next pipeline build.

Checklist

• Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
• Documentation was added for features that require explanation or tutorials
• Unit or functional tests were updated or added to match the most common scenarios
• If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
• This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
• Flaky Test Runner was used on any tests changed
• The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
• Review the backport guidelines and apply applicable backport:* labels.

Identify risks

• Misuse of the label could allow a real, unsafe Saved Object change to merge without validation. Mitigated by the README guidance restricting the label to false positives, and by the fact that the label is opt-in per PR and visible to reviewers.
• No risk to existing PRs that do not apply the label — the gating condition is purely additive.

[infra-vault-gh-plugin-prod]

Pinging @elastic/kibana-core (Team:Core)

[gsoldevila]

LGTM! maybe we could add the ci: prefix to the label ci:skip-so-check

[kibanamachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 1acb81a

Failed CI Steps

• FTR Configs #109
• FTR Configs #193

Test Failures

• [job] [logs] FTR Configs #109 / apis Streams Endpoints Draft Streams Forking as draft parent ES|QL view does NOT reference the draft child
• [job] [logs] FTR Configs #193 / discover/tabs discover - ES|QL controls should add an ES|QL value control

Metrics [docs]

✅ unchanged

History

• 💚 Build #437727 succeeded 9804210