Merge branch 'main' into feature/private_bundling

Author: cotti

.github/aw/actions-lock.json

@@ -1,5 +1,10 @@
 {
   "entries": {
+    "actions/download-artifact@v8.0.1": {
+      "repo": "actions/download-artifact",
+      "version": "v8.0.1",
+      "sha": "3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c"
+    },
     "actions/github-script@v8": {
       "repo": "actions/github-script",
       "version": "v8",
@@ -10,10 +15,20 @@
       "version": "v9",
       "sha": "373c709c69115d41ff229c7e5df9f8788daa9553"
     },
-    "github/gh-aw-actions/setup@v0.68.3": {
+    "actions/upload-artifact@v7.0.1": {
+      "repo": "actions/upload-artifact",
+      "version": "v7.0.1",
+      "sha": "043fb46d1a93c77aae656e7c1c64a875d1fc6a0a"
+    },
+    "github/gh-aw-actions/setup@v0.69.0": {
       "repo": "github/gh-aw-actions/setup",
-      "version": "v0.68.3",
-      "sha": "ba90f2186d7ad780ec640f364005fa24e797b360"
+      "version": "v0.69.0",
+      "sha": "81b86c58b134601fc10d4745e276d7861cd12911"
+    },
+    "microsoft/apm-action@v1.4.1": {
+      "repo": "microsoft/apm-action",
+      "version": "v1.4.1",
+      "sha": "a190b0b1a91031057144dc136acf9757a59c9e4d"
     }
   }
 }

.github/aw/imports/.gitattributes

@@ -9,13 +9,15 @@ jobs:
   check-updates:
     name: Recompile lock files and open PR if changed
     runs-on: ubuntu-latest
+    env:
+      GH_AW_VERSION: v0.69.0
     permissions:
       id-token: write
       contents: read
     steps:
       - name: Create ephemeral GitHub token
         id: create-token
-        uses: elastic/oblt-actions/github/create-token@v1
+        uses: elastic/oblt-actions/github/create-token@v1.38.1
         with:
           token-policy: token-policy-8749eaab83f2
 
@@ -29,7 +31,7 @@ jobs:
 
       - name: Install gh-aw and compile
         run: |
-          gh extension install github/gh-aw
+          gh extension install github/gh-aw --pin "$GH_AW_VERSION"
           gh aw compile
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -46,7 +48,7 @@ jobs:
 
       - name: Create pull request
         if: steps.changes.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v8.1.0
         with:
           token: ${{ steps.create-token.outputs.token }}
           commit-message: |
@@ -56,7 +58,7 @@ jobs:
           branch: automated/gh-aw-update
           title: Update gh-aw lock files
           body: |
-            Automated weekly check detected updated gh-aw lock files after recompilation.
+            Automated weekly check detected updated gh-aw lock files after recompilation with `${{ env.GH_AW_VERSION }}`.
 
             Review the lock file diffs to verify the changes are expected.
           labels: automation

.github/aw/imports/github/gh-aw/e685a0e73cce06fab31ac477082e820ee4dff2e6/.github_workflows_shared_apm.md

@@ -226,7 +226,7 @@ jobs:
         if: steps.context.outputs.is-fork == 'true' && steps.context.outputs.event == 'pull_request'
         continue-on-error: true
         id: fetch-ephemeral-token
-        uses: elastic/ci-gh-actions/fetch-github-token@v1
+        uses: elastic/ci-gh-actions/fetch-github-token@v1.3.0
         with:
           vault-instance: "ci-prod"
           vault-role: "token-policy-8c6a5ed19135"
@@ -785,7 +785,7 @@ jobs:
             f.write(f"result=arn:aws:iam::197730964718:role/{prefix}{hash}")
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@8df5847569e6427dd6c4fb1cf565c83acfa8afa7 # v6.0.0
+        uses: aws-actions/configure-aws-credentials@ec61189d14ec14c8efccab744f656cffd0e33f37 # v6.1.0
         with:
           role-to-assume: ${{ steps.role_arn.outputs.result }}
           aws-region: us-east-1