[updatecli] update elastic stack version for testing 9.4.7-af3d4c92-SNAPSHOT

[github-actions]

Bump elastic-stack to latest snapshot version

Update snapshot.yml

1 file(s) updated with "$1=9.4.7-af3d4c92-SNAPSHOT": * dev-tools/integration/.env

GitHub Action workflow link

---

Created automatically by Updatecli Options: Most of Updatecli configuration is done via its manifest(s). If you close this pull request, Updatecli will automatically reopen it, the next time it runs. If you close this pull request and delete the base branch, Updatecli will automatically recreate it, erasing all previous commits made. Feel free to report any issues at github.com/updatecli/updatecli. If you find this tool useful, do not hesitate to star our GitHub repository as a sign of appreciation, and/or to tell us directly on our chat!

[github-actions]

TL;DR

Both failing Buildkite packaging jobs are blocked by an expired Debian bullseye-security apt Release file in the builder image path, so this is an infrastructure/base-image freshness issue, not a regression from this PR’s snapshot bump.

Remediation

• Re-run once the upstream docker.elastic.co/beats-dev/golang-crossbuild:*debian11 base image (or Buildkite worker apt mirror state) is refreshed so apt-get update can read a valid bullseye-security InRelease.
• If this persists, pin packaging to a refreshed Debian base variant (or update the crossbuild image lineage) before retrying release packaging.

Investigation details

Root Cause

The failure happens during Docker image build for release packaging, before repository code is compiled or tests run. In both jobs, Dockerfile.build fails at:

• Dockerfile.build:5 (RUN apt-get update && apt-get install --no-install-recommends -y zip && apt-get clean)

The apt resolver aborts with an expired security repository metadata error:

• E: Release file for (deb.debian.org/redacted) is expired ...

This is consistent across architectures (x86_64 and aarch64), indicating environment/base-image timing rather than PR logic.

PR scope check: this PR only changes dev-tools/integration/.env (snapshot version string), which is not on the failing path for packaging Dockerfile apt metadata.

Evidence

• Build: https://buildkite.com/elastic/fleet-server/builds/16687
• Jobs/steps:
  • Package x86_64 → .buildkite/scripts/release_test.sh
  • Package aarch64 → .buildkite/scripts/release_test.sh
• Key log excerpts:
  • /tmp/gh-aw/buildkite-logs/fleet-server-package-x86_64.txt
    • ERROR [2/7] RUN apt-get update ...
    • E: Release file for ... bullseye-security/InRelease is expired ...
  • /tmp/gh-aw/buildkite-logs/fleet-server-package-aarch64.txt
    • ERROR [2/7] RUN apt-get update ...
    • E: Release file for ... bullseye-security/InRelease is expired ...

Verification

• Not run (analysis-only workflow on provided logs and PR metadata).

Follow-up

If retries continue failing after mirror freshness recovers, consider tracking a CI-maintenance issue to refresh/deprecate Debian 11 crossbuild bases used by Dockerfile.build packaging paths.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.