changelog: align CDN registry paths with singular S3 key prefixes

Follows #3434, which moved bundle/changelog artifacts from {product}/bundles/
and {product}/changelogs/ to the singular {product}/bundle/ and
{product}/changelog/. The CDN consumer fetched bundles from the old plural
path, so it would 404 against the new layout; this points it at
{product}/bundle/{file} and updates the registry docs/comments/tests to match.
The directive's local-folder convention (changelog/bundles/) is unchanged.

Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

docs/development/changelog-bundle-registry.md

@@ -34,7 +34,7 @@ copies, no cross-repo file syncing.
 │  Client CI   │  --artifact-type      │  Private bundles   │ ───────────────────▶ │ Changelog scrubber │
 │ (docs-actions)│  bundle  ───────────▶ │  S3 bucket         │                       │ Lambda             │
 └──────────────┘                       │                    │                       └─────────┬─────────┘
-       │                               │  {product}/bundles/*.yaml                            │ scrub + copy
+       │                               │  {product}/bundle/*.yaml                             │ scrub + copy
        │ also refreshes                │  {product}/registry.json                       │ (pass-through for
        └──────────────────────────────▶                    │                                  │  registry.json)
                                        └────────────────────┘                                 ▼
@@ -46,7 +46,7 @@ copies, no cross-repo file syncing.
 
 1. **Producer** — `changelog upload --artifact-type bundle --target s3` (invoked by the
    docs-actions changelog upload workflow) uploads each bundle to
-   `{product}/bundles/{file}` in the **private** bucket, then refreshes
+   `{product}/bundle/{file}` in the **private** bucket, then refreshes
    `{product}/registry.json` for every product the run touched.
 2. **Scrubber Lambda** — triggered by `s3:ObjectCreated` on the private bucket, it scrubs
    private repository references out of bundle YAML and writes the sanitized copy to the
@@ -57,7 +57,7 @@ copies, no cross-repo file syncing.
 ### Why a registry instead of an S3 listing
 
 The public surface is a CDN (CloudFront) in front of S3. CloudFront does not expose bucket
-listing, so the consumer cannot enumerate `{product}/bundles/`. The registry is a stable,
+listing, so the consumer cannot enumerate `{product}/bundle/`. The registry is a stable,
 cacheable manifest at a predictable key that lists exactly which bundles exist for a product.
 
 ## `registry.json` format
@@ -81,7 +81,7 @@ Stored at `{product}/registry.json`. Serialized with `snake_case` keys.
 | `schema_version` | Bumped when consumers must change their parser. |
 | `product` | Product identifier; matches the first S3 key segment. |
 | `generated_at` | UTC timestamp of the last regeneration. |
-| `bundles[].file` | Bundle file name, resolved at `{product}/bundles/{file}`. |
+| `bundles[].file` | Bundle file name, resolved at `{product}/bundle/{file}`. |
 | `bundles[].target` | Target version/date from the bundle's declaration of **this** product (may be null). |
 | `bundles[].etag` | See the ETag caveat below. |
 
@@ -104,7 +104,7 @@ reads of the same bucket).
 The refresh runs inside `ChangelogUploadService` after a successful **bundle** upload (it is
 skipped for `--artifact-type changelog`). `RegistryBuilder`:
 
-- Groups the run's upload targets by product (from the `{product}/bundles/{file}` key).
+- Groups the run's upload targets by product (from the `{product}/bundle/{file}` key).
 - For each product, derives one `registry` entry per bundle (file name, that product's
   target, locally-computed S3 ETag).
 - Reads the existing manifest from S3, merges by file name (re-uploads replace their entry;
@@ -187,7 +187,7 @@ also given) and the directive sources bundles from the CDN instead.
 ### Fetch flow
 
 1. `GET {cdnBase}/{product}/registry.json`.
-2. Parse it; for each `bundles[].file`, `GET {cdnBase}/{product}/bundles/{file}`.
+2. Parse it; for each `bundles[].file`, `GET {cdnBase}/{product}/bundle/{file}`.
 3. Feed the downloaded YAML into the existing `BundleLoader` → `MergeBundlesByTarget` →
    render pipeline. **Rendering is unchanged**; only the source of the bundle bytes differs.
 
@@ -216,7 +216,7 @@ entry files; the existing private-repo link and description visibility logic sti
   uses it to download only the matching registry entry instead of every listed bundle.
 - **Security.** The base URL is trusted configuration; the product and registry-supplied bundle
   file names are validated to single path segments so neither can traverse outside
-  `{product}/bundles/`.
+  `{product}/bundle/`.
 
 ### Follow-ups (not yet implemented) [implementation-notes]
 

src/Elastic.Documentation.Configuration/ReleaseNotes/CdnChangelogFetcher.cs

@@ -13,7 +13,7 @@ namespace Elastic.Documentation.Configuration.ReleaseNotes;
 /// <summary>
 /// Fetches changelog bundles for a single product from the public CDN at build time, for the
 /// <c>changelog</c> directive in <c>cdn:</c> mode. It reads <c>{base}/{product}/registry.json</c>
-/// to enumerate bundles, downloads each <c>{base}/{product}/bundles/{file}</c>, and parses them via
+/// to enumerate bundles, downloads each <c>{base}/{product}/bundle/{file}</c>, and parses them via
 /// <see cref="BundleLoader.LoadBundlesFromContent"/>.
 /// </summary>
 /// <remarks>
@@ -156,7 +156,7 @@ private IReadOnlyList<LoadedBundle> FetchUncached(
 				continue;
 			}
 
-			var bundleUri = Combine(baseUri, product, "bundles", fileName);
+			var bundleUri = Combine(baseUri, product, "bundle", fileName);
 			try
 			{
 				contents.Add((fileName, FetchText(bundleUri, ctx)));
@@ -190,7 +190,7 @@ private static Uri Combine(Uri baseUri, params string[] segments)
 
 	/// <summary>
 	/// Guards against path traversal or nested keys sneaking in via the registry: a bundle file name
-	/// must be a single path segment (the producer always writes <c>{product}/bundles/{file}</c>).
+	/// must be a single path segment (the producer always writes <c>{product}/bundle/{file}</c>).
 	/// </summary>
 	private static bool IsSafeBundleFileName(string fileName) =>
 		!fileName.Contains('/', StringComparison.Ordinal)

src/Elastic.Documentation.Configuration/ReleaseNotes/ChangelogRegistry.cs

@@ -28,7 +28,7 @@ public sealed record ChangelogRegistry
 /// <summary>One entry in <see cref="ChangelogRegistry.Bundles"/>.</summary>
 public sealed record ChangelogRegistryBundle
 {
-	/// <summary>Bundle file name, resolved at <c>{product}/bundles/{file}</c> on the CDN.</summary>
+	/// <summary>Bundle file name, resolved at <c>{product}/bundle/{file}</c> on the CDN.</summary>
 	public string? File { get; init; }
 
 	/// <summary>Target version or release date declared by the bundle (e.g. <c>9.3.0</c>).</summary>

src/services/Elastic.Changelog/Uploading/Registry.cs

@@ -46,7 +46,7 @@ public sealed record RegistryBundle
 {
 	/// <summary>
 	/// Bundle file name (e.g. <c>9.3.0.yaml</c> or <c>2025-11.yaml</c>),
-	/// resolved at <c>{product}/bundles/{file}</c>.
+	/// resolved at <c>{product}/bundle/{file}</c>.
 	/// </summary>
 	public required string File { get; init; }
 

src/services/Elastic.Changelog/Uploading/RegistryBuilder.cs

@@ -53,7 +53,7 @@ public async Task<RefreshResult> RefreshAsync(
 		IReadOnlyList<UploadTarget> bundleTargets,
 		Cancel ctx)
 	{
-		// Each upload target carries a "{product}/bundles/{file}" S3 key. Group by product
+		// Each upload target carries a "{product}/bundle/{file}" S3 key. Group by product
 		// so we can produce one manifest per affected product.
 		var byProduct = bundleTargets
 			.Select(t => (Target: t, Product: ExtractProduct(t.S3Key)))
@@ -95,7 +95,7 @@ public async Task<RefreshResult> RefreshAsync(
 
 	/// <summary>
 	/// Extracts the leading <c>product</c> segment from an S3 key shaped like
-	/// <c>{product}/bundles/{file}</c>. Returns null on unrecognized shapes.
+	/// <c>{product}/bundle/{file}</c>. Returns null on unrecognized shapes.
 	/// </summary>
 	private static string? ExtractProduct(string s3Key)
 	{

src/services/Elastic.Changelog/Uploading/RegistryKey.cs

@@ -21,7 +21,7 @@ public static class RegistryKey
 	/// <remarks>
 	/// Used by the changelog scrubber Lambda to decide whether to pass an incoming
 	/// <c>*.json</c> object through to the public bucket. Anything else (e.g. nested
-	/// under a bundles/ prefix, or a multi-segment product) is rejected, which keeps
+	/// under a bundle/ prefix, or a multi-segment product) is rejected, which keeps
 	/// arbitrary JSON out of the public surface.
 	/// </remarks>
 	public static bool IsRegistry(string key)

tests/Elastic.Changelog.Tests/Uploading/ChangelogUploadServiceTests.cs

@@ -492,7 +492,7 @@ public async Task Upload_BundleArtifactType_UploadsRegistryAlongsideBundle()
 		_collector.Errors.Should().Be(0);
 
 		A.CallTo(() => _s3Client.PutObjectAsync(
-			A<PutObjectRequest>.That.Matches(r => r.Key == "elasticsearch/bundles/9.3.0.yaml"),
+			A<PutObjectRequest>.That.Matches(r => r.Key == "elasticsearch/bundle/9.3.0.yaml"),
 			A<CancellationToken>._
 		)).MustHaveHappenedOnceExactly();
 

tests/Elastic.Changelog.Tests/Uploading/RegistryBuilderTests.cs

@@ -105,7 +105,7 @@ private static Registry Deserialize(string? json) =>
 	public async Task Refresh_NoExistingManifest_CreatesManifestWithIfNoneMatch()
 	{
 		var path = AddBundle("9.3.0.yaml", "elasticsearch", "9.3.0");
-		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundles/9.3.0.yaml") };
+		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundle/9.3.0.yaml") };
 		StubExistingManifestNotFound();
 
 		var result = await _builder.RefreshAsync(_collector, targets, TestContext.Current.CancellationToken);
@@ -145,8 +145,8 @@ public async Task Refresh_ExistingManifest_MergesByFileNameAndUsesIfMatch()
 		var ten = AddBundle("9.4.0.yaml", "elasticsearch", "9.4.0");
 		var targets = new List<UploadTarget>
 		{
-			new(newer, "elasticsearch/bundles/9.3.0.yaml"),
-			new(ten,   "elasticsearch/bundles/9.4.0.yaml")
+			new(newer, "elasticsearch/bundle/9.3.0.yaml"),
+			new(ten,   "elasticsearch/bundle/9.4.0.yaml")
 		};
 
 		var result = await _builder.RefreshAsync(_collector, targets, TestContext.Current.CancellationToken);
@@ -174,8 +174,8 @@ public async Task Refresh_MultipleProducts_WritesOneManifestPerProduct()
 		var kb = AddBundle("kb-9.3.0.yaml", "kibana", "9.3.0");
 		var targets = new List<UploadTarget>
 		{
-			new(es, "elasticsearch/bundles/9.3.0.yaml"),
-			new(kb, "kibana/bundles/kb-9.3.0.yaml")
+			new(es, "elasticsearch/bundle/9.3.0.yaml"),
+			new(kb, "kibana/bundle/kb-9.3.0.yaml")
 		};
 		StubExistingManifestNotFound();
 
@@ -212,8 +212,8 @@ public async Task Refresh_MultiProductBundle_RecordsTargetPerProduct()
 			"""));
 		var targets = new List<UploadTarget>
 		{
-			new(path, "elasticsearch/bundles/multi.yaml"),
-			new(path, "kibana/bundles/multi.yaml")
+			new(path, "elasticsearch/bundle/multi.yaml"),
+			new(path, "kibana/bundle/multi.yaml")
 		};
 		StubExistingManifestNotFound();
 
@@ -237,7 +237,7 @@ public async Task Refresh_ExistingManifestUnreadable_OverwritesUsingLiveETag()
 			});
 
 		var path = AddBundle("9.3.0.yaml", "elasticsearch", "9.3.0");
-		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundles/9.3.0.yaml") };
+		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundle/9.3.0.yaml") };
 
 		var result = await _builder.RefreshAsync(_collector, targets, TestContext.Current.CancellationToken);
 
@@ -257,7 +257,7 @@ public async Task Refresh_BundleWithoutTarget_RecordsEntryWithoutTarget()
 		_mockFileSystem.AddFile(path, new MockFileData("""
 			entries: []
 			"""));
-		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundles/no-target.yaml") };
+		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundle/no-target.yaml") };
 		StubExistingManifestNotFound();
 
 		var result = await _builder.RefreshAsync(_collector, targets, TestContext.Current.CancellationToken);
@@ -285,7 +285,7 @@ public async Task Refresh_UnchangedManifest_SkipsWrite()
 		};
 		StubExistingManifest("elasticsearch", existing, "\"manifest-v1\"");
 
-		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundles/9.3.0.yaml") };
+		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundle/9.3.0.yaml") };
 		var result = await _builder.RefreshAsync(_collector, targets, TestContext.Current.CancellationToken);
 
 		result.Unchanged.Should().Be(1);
@@ -324,7 +324,7 @@ public async Task Refresh_ConcurrentWrite_RetriesAfterPreconditionFailed()
 			.Once();
 
 		var path = AddBundle("9.4.0.yaml", "elasticsearch", "9.4.0");
-		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundles/9.4.0.yaml") };
+		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundle/9.4.0.yaml") };
 
 		var result = await _builder.RefreshAsync(_collector, targets, TestContext.Current.CancellationToken);
 
@@ -357,7 +357,7 @@ public async Task Refresh_PersistentConcurrentWrite_EmitsWarningAndReportsFailur
 			.Throws(new AmazonS3Exception("Precondition Failed") { StatusCode = HttpStatusCode.PreconditionFailed });
 
 		var path = AddBundle("9.4.0.yaml", "elasticsearch", "9.4.0");
-		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundles/9.4.0.yaml") };
+		var targets = new List<UploadTarget> { new(path, "elasticsearch/bundle/9.4.0.yaml") };
 
 		var result = await _builder.RefreshAsync(_collector, targets, TestContext.Current.CancellationToken);
 

tests/Elastic.Changelog.Tests/Uploading/RegistryKeyTests.cs

@@ -22,9 +22,9 @@ public void IsRegistry_ValidProductKeys_ReturnsTrue(string key) =>
 	[InlineData("")]
 	[InlineData("registry.json")]
 	[InlineData("/registry.json")]
-	[InlineData("elasticsearch/bundles/registry.json")]
+	[InlineData("elasticsearch/bundle/registry.json")]
 	[InlineData("elasticsearch/registry.yaml")]
-	[InlineData("elasticsearch/changelogs/registry.json")]
+	[InlineData("elasticsearch/changelog/registry.json")]
 	[InlineData("../registry.json")]
 	[InlineData("elastic search/registry.json")]
 	[InlineData("elastic.search/registry.json")]