fix(ci): switch ai workflows to openrouter

[margaretjgu]

This repo's LITELLM_API_KEY secret was replaced with OPENROUTER_API_KEY/OPENROUTER_BASE_URL, which currently breaks the backport resolver, auto-pr, and AI PR review workflows since they still reference the old secret. Switches all three to OpenRouter, matching elastic/clients-team-automations#37 and elastic/clients-team-automations#38.

resolve-conflicts.yml also gets a job-level if so it skips non-backport comments before invoking the reusable workflow, instead of spinning up a runner for every comment in the repo.

[github-actions]

Nothing wrong here. Straightforward credential/endpoint migration from LiteLLM to OpenRouter, with a sensible fallback default for BASE_URL. The added if: guard in resolve-conflicts.yml is a real improvement that prevents unnecessary workflow runs.

[github-actions]

❌MegaLinter analysis: Error

Descriptor	Linter	Files	Fixed	Errors	Warnings	Elapsed time
✅ ACTION	actionlint	3		0	0	0.33s
✅ COPYPASTE	jscpd	yes		no	no	0.92s
✅ REPOSITORY	gitleaks	yes		no	no	58.22s
✅ REPOSITORY	git_diff	yes		no	no	0.17s
✅ REPOSITORY	secretlint	yes		no	no	28.04s
❌ REPOSITORY	trivy	yes		1	no	18.81s
✅ YAML	yamllint	3		0	0	0.54s

Detailed Issues

❌ REPOSITORY / trivy - 1 error

2026-08-06T15:54:37Z	INFO	[vulndb] Need to update DB
2026-08-06T15:54:37Z	INFO	[vulndb] Downloading vulnerability DB...
2026-08-06T15:54:37Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
1.36 MiB / 103.68 MiB [>_____________________________________________________________] 1.31% ? p/s ?14.46 MiB / 103.68 MiB [-------->___________________________________________________] 13.95% ? p/s ?38.56 MiB / 103.68 MiB [---------------------->_____________________________________] 37.19% ? p/s ?62.86 MiB / 103.68 MiB [--------------------------->__________________] 60.63% 102.63 MiB p/s ETA 0s88.92 MiB / 103.68 MiB [--------------------------------------->______] 85.77% 102.63 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [------------------------------------------->] 100.00% 102.63 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [------------------------------------------->] 100.00% 100.39 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [------------------------------------------->] 100.00% 100.39 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [------------------------------------------->] 100.00% 100.39 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 93.92 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 93.92 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 93.92 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 87.86 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 87.86 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 87.86 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 82.19 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 82.19 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 82.19 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 76.89 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 76.89 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 76.89 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 71.93 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 71.93 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 71.93 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 67.28 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 67.28 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 67.28 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 62.94 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 62.94 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 62.94 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 58.88 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 58.88 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 58.88 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 55.08 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 55.08 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 55.08 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 51.53 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-------------------------------------------->] 100.00% 51.53 MiB p/s ETA 0s103.68 MiB / 103.68 MiB [-----------------------------------------------] 100.00% 13.80 MiB p/s 7.7s2026-08-06T15:54:46Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-08-06T15:54:46Z	INFO	[vuln] Vulnerability scanning is enabled
2026-08-06T15:54:46Z	INFO	[misconfig] Misconfiguration scanning is enabled
2026-08-06T15:54:46Z	INFO	[checks-client] Need to update the checks bundle
2026-08-06T15:54:46Z	INFO	[checks-client] Downloading the checks bundle...
234.65 KiB / 234.65 KiB [--------------------------------------------------------->] 100.00% ? p/s ?234.65 KiB / 234.65 KiB [----------------------------------------------] 100.00% 42.72 MiB p/s 200ms2026-08-06T15:54:55Z	INFO	Suppressing dependencies for development and testing. To display them, try the '--include-dev-deps' flag.
2026-08-06T15:54:55Z	INFO	Number of language-specific files	num=1
2026-08-06T15:54:55Z	INFO	[npm] Detecting vulnerabilities...
2026-08-06T15:54:55Z	INFO	Detected config files	num=1

Report Summary

┌───────────────────┬────────────┬─────────────────┬───────────────────┐
│      Target       │    Type    │ Vulnerabilities │ Misconfigurations │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ package-lock.json │    npm     │        1        │         -         │
├───────────────────┼────────────┼─────────────────┼───────────────────┤
│ catalog-info.yaml │ kubernetes │        -        │         0         │
└───────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.71/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


package-lock.json (npm)
=======================
Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 1, CRITICAL: 0)

┌──────────┬────────────────┬──────────┬────────┬───────────────────┬─────────────────────┬──────────────────────────────────────────────────────┐
│ Library  │ Vulnerability  │ Severity │ Status │ Installed Version │    Fixed Version    │                        Title                         │
├──────────┼────────────────┼──────────┼────────┼───────────────────┼─────────────────────┼──────────────────────────────────────────────────────┤
│ fast-uri │ CVE-2026-18446 │ HIGH     │ fixed  │ 3.1.4             │ 2.4.4, 3.1.5, 4.1.2 │ fast-uri: fast-uri: Host confusion vulnerability via │
│          │                │          │        │                   │                     │ backslash in URI authority                           │
│          │                │          │        │                   │                     │ https://avd.aquasec.com/nvd/cve-2026-18446           │
└──────────┴────────────────┴──────────┴────────┴───────────────────┴─────────────────────┴──────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.73.0 of Trivy is now available, current version is 0.71.2

To suppress version checks, run Trivy scans with the --skip-version-check flag

Notices

📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository