diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/4_build_and_push_images.yml similarity index 95% rename from .github/workflows/Procedure_push_docker_images.yml rename to .github/workflows/4_build_and_push_images.yml index 2cf20885..0b73740c 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/4_build_and_push_images.yml @@ -1,5 +1,5 @@ -run-name: Launch Push Docker Images - ${{ inputs.id }} -name: Push Docker Images +run-name: Build and push images - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }} +name: (4.x) Build and push images on: workflow_dispatch: @@ -88,7 +88,7 @@ jobs: - name: Print inputs run: | echo "---------------------------------------------" - echo "Running Procedure_push_docker_images workflow" + echo "Running 4_build_and_push_images workflow" echo "---------------------------------------------" echo "* BRANCH: ${{ github.ref }}" echo "* COMMIT: ${{ github.sha }}" @@ -106,12 +106,12 @@ jobs: echo "---------------------------------------------" - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: ref: ${{ inputs.docker_reference }} - name: Log in to Docker Hub - uses: docker/login-action@v3 + uses: docker/login-action@v4 with: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} diff --git a/.github/workflows/push.yml b/.github/workflows/4_pr_check.yml similarity index 94% rename from .github/workflows/push.yml rename to .github/workflows/4_pr_check.yml index b269247b..d64694c9 100644 --- a/.github/workflows/push.yml +++ b/.github/workflows/4_pr_check.yml @@ -1,6 +1,16 @@ -name: Wazuh Docker pipeline +name: (4.x) Docker PR check -on: [pull_request] +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + branches: + - 4.* + paths: + - 'build-docker-images/**' + - 'multi-node/**' + - 'single-node/**' + - 'wazuh-agent/**' + - '.github/**' jobs: build-docker-images: @@ -8,7 +18,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Install docker-compose run: | @@ -29,21 +39,21 @@ jobs: docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar - name: Temporarily save Wazuh manager Docker image - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: docker-artifact-manager path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar retention-days: 1 - name: Temporarily save Wazuh indexer Docker image - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: docker-artifact-indexer path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar retention-days: 1 - name: Temporarily save Wazuh dashboard Docker image - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: docker-artifact-dashboard path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar @@ -66,7 +76,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Install docker-compose run: | @@ -77,17 +87,17 @@ jobs: run: cat .env > $GITHUB_ENV - name: Retrieve saved Wazuh indexer Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: docker-artifact-indexer - name: Retrieve saved Wazuh manager Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: docker-artifact-manager - name: Retrieve saved Wazuh dashboard Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: docker-artifact-dashboard @@ -194,7 +204,7 @@ jobs: steps: - name: Check out code - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: Install docker-compose run: | @@ -213,17 +223,17 @@ jobs: df -h - name: Retrieve saved Wazuh dashboard Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: docker-artifact-dashboard - name: Retrieve saved Wazuh manager Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: docker-artifact-manager - name: Retrieve saved Wazuh indexer Docker image - uses: actions/download-artifact@v4 + uses: actions/download-artifact@v8 with: name: docker-artifact-indexer diff --git a/.github/workflows/trivy-dashboard.yml b/.github/workflows/trivy-dashboard.yml deleted file mode 100644 index 2e587735..00000000 --- a/.github/workflows/trivy-dashboard.yml +++ /dev/null @@ -1,77 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh dashboard - -on: - release: - types: - - published - pull_request: - branches: - - master - - stable - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-latest" - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh dashboard - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-dashboard.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-dashboard.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-indexer.yml b/.github/workflows/trivy-indexer.yml deleted file mode 100644 index 5107a0d5..00000000 --- a/.github/workflows/trivy-indexer.yml +++ /dev/null @@ -1,77 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh indexer - -on: - release: - types: - - published - pull_request: - branches: - - master - - stable - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-latest" - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh indexer - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-indexer.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-indexer.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/.github/workflows/trivy-manager.yml b/.github/workflows/trivy-manager.yml deleted file mode 100644 index 7e0b6e52..00000000 --- a/.github/workflows/trivy-manager.yml +++ /dev/null @@ -1,77 +0,0 @@ -# This workflow uses actions that are not certified by GitHub. -# They are provided by a third-party and are governed by -# separate terms of service, privacy policy, and support -# documentation. - -name: Trivy scan Wazuh manager - -on: - release: - types: - - published - pull_request: - branches: - - master - - stable - schedule: - - cron: '34 2 * * 1' - workflow_dispatch: - -permissions: - contents: read - -jobs: - build: - permissions: - contents: read # for actions/checkout to fetch code - security-events: write # for github/codeql-action/upload-sarif to upload SARIF results - - name: Build images and upload Trivy results - runs-on: "ubuntu-latest" - steps: - - name: Checkout code - uses: actions/checkout@v4 - - - name: Installing dependencies - run: | - sudo apt-get update - sudo apt-get install -y jq - - - name: Checkout latest tag - run: | - latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name') - git fetch origin - git checkout $latest - - - name: Build Wazuh images - run: build-docker-images/build-images.sh - - - name: Create enviroment variables - run: | - cat .env > $GITHUB_ENV - echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV - - - name: Run Trivy vulnerability scanner for Wazuh manager - uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2 - with: - image-ref: 'wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}' - format: 'template' - template: '@/contrib/sarif.tpl' - output: 'trivy-results-manager.sarif' - severity: 'LOW,MEDIUM,CRITICAL,HIGH' - - - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 - with: - sarif_file: 'trivy-results-manager.sarif' - - - name: Slack notification - uses: rtCamp/action-slack-notify@v2 - env: - SLACK_CHANNEL: cicd-monitoring - SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff' - #SLACK_ICON: https://github.com/rtCamp.png?size=48 - SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}" - SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished. - SLACK_USERNAME: github_actions - SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }} \ No newline at end of file diff --git a/CHANGELOG.md b/CHANGELOG.md index 28ced3ee..a8e7cd7c 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed -- None +- PR revamp modifications LTS ([#2449](https://github.com/wazuh/wazuh-docker/pull/2449)) ### Fixed