diff --git a/.github/workflows/temp-master.yml b/.github/workflows/temp-master.yml
new file mode 100644
index 0000000000..d9dbbb4d68
--- /dev/null
+++ b/.github/workflows/temp-master.yml
@@ -0,0 +1,202 @@
+# Todo delete before merge to elastic/beats
+name: Publish Opabeat & Elastic-Agent images from csp master
+
+on:
+  push:
+    branches:
+      - master
+      - staging-update-from-upstream
+
+env:
+  OPABEAT_REGISTRY: ${{ secrets.AWS_ECR_ID_DEVELOP }}.dkr.ecr.${{ secrets.AWS_ECR_REGION_DEVELOP }}.amazonaws.com
+  OPABEAT_IMAGE_BASE: ${{ secrets.AWS_ECR_ID_DEVELOP }}.dkr.ecr.${{ secrets.AWS_ECR_REGION_DEVELOP }}.amazonaws.com/opabeat
+  OPABEAT_IMAGE: ${{ secrets.AWS_ECR_ID_DEVELOP }}.dkr.ecr.${{ secrets.AWS_ECR_REGION_DEVELOP }}.amazonaws.com/opabeat:${{ github.sha }}
+  AGENT_REGISTRY: ${{ secrets.AWS_ECR_ID_DEVELOP }}.dkr.ecr.${{ secrets.AWS_ECR_REGION_DEVELOP }}.amazonaws.com
+  AGENT_IMAGE_BASE: ${{ secrets.AWS_ECR_ID_DEVELOP }}.dkr.ecr.${{ secrets.AWS_ECR_REGION_DEVELOP }}.amazonaws.com/elastic-agent
+  AGENT_IMAGE: ${{ secrets.AWS_ECR_ID_DEVELOP }}.dkr.ecr.${{ secrets.AWS_ECR_REGION_DEVELOP }}.amazonaws.com/elastic-agent:${{ github.sha }}
+  AWS_ECR_KEY: ${{ secrets.AWS_ECR_KEY_DEVELOP }}
+  AWS_ECR_SECRET: ${{ secrets.AWS_ECR_SECRET_DEVELOP }}
+  AWS_ECR_REGION: ${{ secrets.AWS_ECR_REGION_DEVELOP }}
+  DEV: true
+  SNAPSHOT: true
+  PLATFORMS: linux/amd64
+  TYPES: docker
+
+jobs:
+  publish_image_opabeat:
+    name: Push Opabeat Docker image to ECR
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: add rego repo ssh key
+        uses: shaunco/ssh-agent@git-repo-mapping # this action will configure git to use the right SSH key per each repo.
+        with:
+          ssh-private-key: |
+                ${{ secrets.REGO_LIB_KEY }}
+          repo-mappings: |
+            github.com/elastic/csp-security-policies
+
+      - name: Check out the repo
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+
+      - name: Login to ECR
+        uses: docker/login-action@v1
+        with:
+          registry: ${{ env.OPABEAT_REGISTRY }}
+          username: ${{ secrets.AWS_ECR_KEY_DEVELOP }}
+          password: ${{ secrets.AWS_ECR_SECRET_DEVELOP }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.17.2
+
+      - name: Setup Mage
+        run: |
+            make mage
+
+      - name: Build Opabeat Bin
+        working-directory: ./cloudbeat
+        run: |
+            GOOS=linux go build -v && docker build -t opabeat .
+
+      - name: Unit Test Opabeat
+        working-directory: ./cloudbeat
+        run: |
+            GOOS=linux go test
+
+      - name: Push to ECR
+        id: ecr
+        uses: jwalton/gh-ecr-push@v1
+        with:
+          access-key-id: ${{ env.AWS_ECR_KEY }}
+          secret-access-key: ${{ env.AWS_ECR_SECRET }}
+          region: ${{ env.AWS_ECR_REGION }}
+          local-image: opabeat:latest
+          # image: ${{ env.OPABEAT_IMAGE }}, ${{ env.OPABEAT_IMAGE_BASE}}:csp-latest
+          image: opabeat:${{ github.sha }}, opabeat:csp-latest
+      # - name: Notify job failure
+      #   if: failure()
+      #   uses: archive/github-actions-slack@v1.0.3
+      #   with:
+      #     slack-bot-user-oauth-access-token: ${{ secrets.SLACK_BOT_USER_OAUTH_ACCESS_TOKEN }}
+      #     slack-channel: deployment-notifications
+      #     slack-text: |
+      #       Hello @here !
+      #       :no_entry: Deployment to ${{ env.OPABEAT_CLUSTER }} cluster failed :no_entry:
+      #       :no_entry: :no_entry: Building Opabeat docker image failed :no_entry: :no_entry:
+      #       *Please review the logs of the failed deployment*
+      #       repo: ${{ github.repository }}
+      #       branch: ${{ github.ref }}
+      #       author: *${{ github.event.head_commit.author.name }}*
+      #       commit desc: "'${{ github.event.head_commit.message }}'' --> '${{ github.event.head_commit.url }}''"
+      #       gitflow action: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+  publish_image_agent:
+    name: Push Elastic-Agent Docker image to ECR
+    runs-on: ubuntu-latest
+    timeout-minutes: 45
+    steps:
+      - name: add rego repo ssh key
+        uses: shaunco/ssh-agent@git-repo-mapping # this action will configure git to use the right SSH key per each repo.
+        with:
+          ssh-private-key: |
+                ${{ secrets.REGO_LIB_KEY }}
+          repo-mappings: |
+            github.com/elastic/csp-security-policies
+
+      - name: Check out the repo
+        uses: actions/checkout@v2
+        with:
+          submodules: recursive
+
+      - name: Login to ECR
+        uses: docker/login-action@v1
+        with:
+          registry: ${{ env.AGENT_REGISTRY }}
+          username: ${{ secrets.AWS_ECR_KEY_DEVELOP }}
+          password: ${{ secrets.AWS_ECR_SECRET_DEVELOP }}
+
+      - name: Set up Go
+        uses: actions/setup-go@v2
+        with:
+          go-version: 1.17.2
+
+      - name: Setup Mage
+        run: |
+            make mage
+
+      - name: Package Elastic-Agent
+        working-directory: ./x-pack/elastic-agent
+        run: |
+            DEV=true SNAPSHOT=true PLATFORMS=linux/amd64 TYPES=docker mage -v package
+
+      - name: Push to ECR
+        id: ecr
+        uses: jwalton/gh-ecr-push@v1
+        with:
+          access-key-id: ${{ env.AWS_ECR_KEY }}
+          secret-access-key: ${{ env.AWS_ECR_SECRET }}
+          region: ${{ env.AWS_ECR_REGION }}
+          local-image: docker.elastic.co/beats/elastic-agent:8.1.0-SNAPSHOT
+          image: elastic-agent:${{ github.sha }}, elastic-agent:csp-latest
+
+      # - name: Notify job failure
+      #   if: failure()
+      #   uses: archive/github-actions-slack@v1.0.3
+      #   with:
+      #     slack-bot-user-oauth-access-token: ${{ secrets.SLACK_BOT_USER_OAUTH_ACCESS_TOKEN }}
+      #     slack-channel: deployment-notifications
+      #     slack-text: |
+      #       Hello @here !
+      #       :no_entry: Deployment to ${{ env.OPABEAT_CLUSTER }} cluster failed :no_entry:
+      #       :no_entry: :no_entry: Building buildserver docker image failed :no_entry: :no_entry:
+      #       *Please review the logs of the failed deployment*
+      #       repo: ${{ github.repository }}
+      #       branch: ${{ github.ref }}
+      #       author: *${{ github.event.head_commit.author.name }}*
+      #       commit desc: "'${{ github.event.head_commit.message }}'' --> '${{ github.event.head_commit.url }}''"
+      #       gitflow action: https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}
+  # deploy_demo_env:
+  #   name: Deploy to demo environment
+  #   runs-on: ubuntu-latest
+  #   timeout-minutes: 25
+  #   needs: [publish_image_opabeat, publish_image_agent]
+  #   env:
+  #     REGION: eu-west-1
+  #     ENVIRONMENT: dev
+  #     OPABEAT_CLUSTER: dev-eks
+  #   steps:
+  #     - name: Check out the repo
+  #       uses: actions/checkout@v2
+
+  #     - name: Configure AWS credentials
+  #       uses: aws-actions/configure-aws-credentials@v1
+  #       with:
+  #         aws-access-key-id: ${{ secrets.AWS_ECR_KEY_DEVELOP }}
+  #         aws-secret-access-key: ${{ secrets.AWS_ECR_SECRET_DEVELOP }}
+  #         aws-region: ${{ secrets.AWS_ECR_REGION_DEVELOP }}
+
+  #     - name: Generate kubeconfig
+  #       id: generate-kubeconfig
+  #       run: |-
+  #     - name: setup python
+  #       uses: actions/setup-python@v2
+  #       with:
+  #         python-version: 3.9
+
+  #     - name: Send Slack message (deployment-notification) on new deployment
+  #       if: success()
+  #       uses: archive/github-actions-slack@v1.0.3
+  #       with:
+  #         slack-bot-user-oauth-access-token: ${{ secrets.SLACK_BOT_USER_OAUTH_ACCESS_TOKEN }}
+  #         slack-channel: deployment-notifications
+  #         slack-text: |
+  #           Hello @here !
+  #           :fire: New Deployment to cluster ${{ env.OPABEAT_CLUSTER }} :fire:
+  #           repo: ${{ github.repository }}
+  #           branch: ${{ github.ref }}
+  #           author: *${{ github.event.head_commit.author.name }}*
+  #           commit desc: "'${{ github.event.head_commit.message }}'' --> '${{ github.event.head_commit.url }}''"
+