[One Workflow] Adopt alert-like table and filtering from observability/discovery

[VladimirFilonov]

Important

Temporary data access model (authorization gap)

This PR loads executions via direct Elasticsearch search through Kibana’s data plugin (SearchSource → /internal/search/ese). It does not use the workflows HTTP APIs or the readExecution Kibana privilege that guards those routes.

That means:

• Query-level space filtering is applied in the UI, but it is not a substitute for server-side authorization.
• The page will only return data for users who already have Elasticsearch read access to the internal index .workflows-executions. In practice that is usually admin / superuser-style roles; workflows users who can list executions only through /api/workflows/... may see an empty table or a search error.

This is intentional for the page-shell milestone. Follow-up work will replace direct /ese queries with small wrapper API endpoints that enforce workflows privileges and space scoping the same way as the per-workflow execution list.

Summary

Replaces the global workflow Executions page stub with a functional shell wired to .workflows-executions: Unified Search bar, page filter controls, a paginated executions table, and a detail flyout.

Closes: https://github.com/elastic/security-team/issues/17171

What changed

Executions page UI

• Search bar — Kibana Query Language + time picker via unifiedSearch (WorkflowExecutionsSearchBar).
• Filter controls — Reuses AlertFilterControls from @kbn/alerts-ui-shared with a workflows-specific data view and namespaced URL/storage keys (WorkflowExecutionsFilters).
• Table — UnifiedDataTable backed by SearchSource against .workflows-executions, with server-aligned query filters (WorkflowExecutionsTable).
• Detail flyout — Row expansion shows summary fields and raw JSON (WorkflowExecutionDetailFlyout).
• Page layout — State orchestration in WorkflowExecutionsPageContent; page header updated for live data (stub hint removed).

Query behavior

Executions are loaded client-side via SearchSource with filters that mirror server list semantics:

• Space scoping — Active space + legacy documents without spaceId.
• Top-level executions only — Excludes documents where stepId exists (same as omitStepRuns: true on per-workflow APIs).
• Time range — startedAt range with strict_date_optional_time.
• Index not found — Treated as empty results (no error prompt).

Query helpers live in workflow_executions_search_query.ts.

Stub removal

Deleted placeholder implementations:

• static_execution_rows.ts
• workflow_executions_filter_search_scaffold.tsx
• workflow_executions_stub_data_grid.tsx

Plugin / shared package updates

• Added controls and uiActions as required plugins in kibana.jsonc.
• Wired uiActions through plugin types and mocks (for CellActionsProvider in the table).
• kbn-alerts-ui-shared — Fixed AlertFilterControls to import useAlertsDataView from the hook module instead of the package barrel, avoiding circular initialization when deep-importing the component from workflows.

Feature flag

The page remains behind workflowsManagement.globalExecutionsView.enabled (see WorkflowExecutionsRouteGate). Enable in kibana.yml for local testing:

workflowsManagement.globalExecutionsView.enabled: true

Test plan

• Enable globalExecutionsView and open /app/workflows/executions
• Confirm executions load for the current space (not other spaces)
• Verify KQL search and time range update results (submit search to refresh table)
• Verify page filter controls (Status, Workflow, Executed by, Trigger) filter the table
• Verify pagination and column sort work
• Expand a row and confirm the detail flyout renders
• Confirm empty state when no matches (or before any executions exist)
• Run unit tests:

node scripts/jest src/platform/plugins/shared/workflows_management/public/pages/executions/
node scripts/type_check --project src/platform/plugins/shared/workflows_management/tsconfig.json

Notes for reviewers

• Authorization — See the important notice above. Per-workflow execution UIs use GET /api/workflows/{id}/executions with readExecution; this global page does not yet.
• Data view — Table/search use an in-memory adhoc data view; filter controls register the same adhoc id via AlertFilterControls / dataViews.create().
• URL param — Filter control state uses workflowsExecutionsPageFilters to avoid colliding with other apps' pageFilters params.

[florent-leborgne]

API docs changes seem unrelated - approving to unblock

Copy LGTM

[kibanamachine]

💛 Build succeeded, but was flaky

• Buildkite Build
• Commit: 0c6674e
• Build duration: 73 mins

Failed CI Steps

• FTR Configs #104
• FTR Configs #109
• FTR Configs #162
• Scout Lane #5 - stateful-classic / default

Test Failures

• [job] [logs] FTR Configs #162 / Cloud Security Posture - Group 5 (KSPM + Flyouts) Security Alerts Page - Graph visualization expanded flyout - filter by node
• [job] [logs] Scout Lane #5 - stateful-classic / default / local-stateful-classic - Entity analytics management page - Risk Score tab - should save changes and persist after page reload

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
workflowsManagement	1893	1934	+41

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
workflowsManagement	2.5MB	2.6MB	+93.8KB

Page load bundle

Size of the bundles that are downloaded on every page load. Target size is below 100kb

id	before	after	diff
workflowsManagement	36.3KB	36.7KB	+355.0B

Unknown metric groups

async chunk count

id	before	after	diff
workflowsManagement	13	14	+1

History

• 💛 Build #449340 was flaky d5e48f9
• 💚 Build #448617 succeeded 04d0049
• 💛 Build #447344 was flaky d7e67d9
• 💛 Build #446734 was flaky c7287db
• 💛 Build #444829 was flaky 47b69e6
• 💔 Build #444733 failed a4ba827

cc @VladimirFilonov