[9.5] [CI] remove yarn.lock, adjust configs (#291037) (#291077)

# Backport

This will backport the following commits from `main` to `9.5`:
- [[CI] remove yarn.lock, adjust configs
(#291037)](#291037)

<!--- Backport version: 12.0.4 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Alex
Szabo","email":"alex.szabo@elastic.co"},"sourceCommit":{"committedDate":"2026-09-15T09:29:04Z","message":"[CI]
remove yarn.lock, adjust configs (#291037)\n\n## Summary\nRemoves
yarn.lock, cleans up some references to it, ignore what's left,\nadjusts
configs.","sha":"e089b00e7df0908b7af0215f66e2dbce69ec9fe1","branchLabelMapping":{"^v9.6.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport:all-open","v9.6.0"],"title":"[CI]
remove yarn.lock, adjust
configs","number":291037,"url":"https://github.com/elastic/kibana/pull/291037","mergeCommit":{"message":"[CI]
remove yarn.lock, adjust configs (#291037)\n\n## Summary\nRemoves
yarn.lock, cleans up some references to it, ignore what's left,\nadjusts
configs.","sha":"e089b00e7df0908b7af0215f66e2dbce69ec9fe1"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v9.6.0","branchLabelMappingKey":"^v9.6.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/291037","number":291037,"mergeCommit":{"message":"[CI]
remove yarn.lock, adjust configs (#291037)\n\n## Summary\nRemoves
yarn.lock, cleans up some references to it, ignore what's left,\nadjusts
configs.","sha":"e089b00e7df0908b7af0215f66e2dbce69ec9fe1"}}]}]
BACKPORT-->

Author: delanni

.buildkite/scripts/pipelines/pull_request/pipeline.test.ts

@@ -258,8 +258,8 @@ describe('pull_request pipeline generation', () => {
     expect(mockAreChangesSkippable).not.toHaveBeenCalled();
   });
 
-  it('emits storybooks when yarn.lock changes', async () => {
-    const changes = [{ filename: 'yarn.lock' }];
+  it('emits storybooks when pnpm-lock.yaml changes', async () => {
+    const changes = [{ filename: 'pnpm-lock.yaml' }];
     mockGetPrChangesCached.mockResolvedValue(changes);
     mockDoAnyChangesMatch.mockImplementation((paths, scopedChanges) =>
       realDoAnyChangesMatch(paths, scopedChanges ?? changes)

.buildkite/scripts/pipelines/pull_request/pipeline.ts

@@ -52,7 +52,7 @@ const SKIPPABLE_PR_MATCHERS = prConfig.skip_ci_on_only_changed!.map((r) => new R
 
 // this covers external dependency changes, which the package graph below cannot see.
 const STORYBOOK_BUILD_CRITICAL_PATHS = [
-  /^yarn\.lock$/,
+  /^pnpm-lock\.yaml$/,
   /^pnpm-workspace\.yaml$/,
   /^\.buildkite\/scripts\/steps\/storybooks\//,
 ];

.buildkite/scripts/steps/esql_generate_function_metadata.sh

@@ -42,7 +42,7 @@ main () {
 
   # Check for differences
   set +e
-  git diff --exit-code --quiet $GIT_SCOPE 
+  git diff --exit-code --quiet $GIT_SCOPE
   if [ $? -eq 0 ]; then
     echo "No differences found. Our work is done here."
     exit
@@ -74,14 +74,17 @@ main () {
   git checkout -b "$BRANCH_NAME"
 
   git add $GIT_SCOPE
+  if [ "$VERSION_BUMPED" == "true" ]; then
+    git add package.json pnpm-lock.yaml
+  fi
   git commit -m "Update function metadata"
 
   report_main_step "Changes committed. Creating pull request."
 
   git push origin "$BRANCH_NAME"
 
   # Create a PR
-  gh pr create --title "$PR_TITLE" --body "$PR_BODY" --base main --head "${BRANCH_NAME}" --label 'release_note:skip' --label 'Team:ESQL' 
+  gh pr create --title "$PR_TITLE" --body "$PR_BODY" --base main --head "${BRANCH_NAME}" --label 'release_note:skip' --label 'Team:ESQL'
 }
 
 main

.gitignore

@@ -105,6 +105,7 @@ selenium
 *.out
 package-lock.json
 !/.buildkite/package-lock.json
+yarn.lock
 .yo-rc.json
 .vscode
 *.sublime-*

docs/extend/contributing/workflow/how-we-use-github.md

@@ -30,7 +30,7 @@ Pull requests are made into the main branch and only backported when it is safe
 - Bug fixes can be backported to a `<major>.<minor>` branch if the changes are safe and appropriate. Safety is a judgment call you make based on factors like the bug’s severity, test coverage, confidence in the changes, etc. Your reasoning should be included in the pull request description.
 - Documentation changes can be backported to any branch at any time.
 
-### Managing updates to `yarn.lock` across branches
+### Managing dependency updates across branches
 
 We want to keep updates to dependencies (both transitive dependencies and direct dependencies) in sync across both `main` and `<previous major>.<last minor>` (ex: `7.17`) as much as possible.
 A good rule of thumb is that most package upgrades should be backported to the `<previous major>.<last minor>` branch, though as always, exceptions may apply – if an upgrade requires significant code changes, then it might make sense to skip a backport for it.

packages/kbn-eslint-config/.gitignore

@@ -33,4 +33,5 @@ node_modules
 .node_repl_history
 .eslintrc.json
 
-yarn.lock
+yarn.lock
+pnpm-lock.yaml

packages/kbn-yarn-lock-validator/README.mdx

@@ -4,10 +4,10 @@ slug: /kibana-dev-docs/ops/kbn-yarn-lock-validator
 title: "@kbn/yarn-lock-validator"
 description: 'A tool for validating specific conditions for our dependency chain'
 date: 2022-07-14
-tags: ['kibana', 'dev', 'contributor', 'operations', 'packages', 'scripts', 'yarn']
+tags: ['kibana', 'dev', 'contributor', 'operations', 'packages', 'scripts', 'pnpm']
 ---
 
-`@kbn/yarn-lock-validator` provides yarn.lock validation logic for the Kibana project. It is loaded up by <DocLink id="kibDevDocsOpsKbnPm" /> after bootstrap and validates that we haven't accidentally re-introduced specific dependencies or version-combination scenarios detailed below:
+`@kbn/yarn-lock-validator` provides pnpm lockfile validation logic for the Kibana project. It is loaded up by <DocLink id="kibDevDocsOpsKbnPm" /> after bootstrap and validates that we haven't accidentally re-introduced specific dependencies or version-combination scenarios detailed below:
 
 ## validation scenarios
 

src/platform/plugins/shared/console/packaging/yarn.lock

@@ -1 +1,2 @@
 yarn.lock
+pnpm-lock.yaml