From be86d03c8797b7d654b950fdcd573b8f490948e9 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 12:48:01 -0300 Subject: [PATCH 01/16] Testing wazuh Docker image build with presigned url script --- .../Procedure_push_docker_images.yml | 217 ++++++------------ 1 file changed, 67 insertions(+), 150 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 48202f12..0a05031d 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -11,6 +11,10 @@ on: docker_reference: description: 'wazuh-docker reference' required: true + wazuh_automation_reference: + description: 'Branch or tag of the wazuh-automation repository' + required: true + default: 'main' products: description: 'Comma-separated list of the image names to build and push' default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' @@ -40,6 +44,11 @@ on: description: 'wazuh-docker reference' required: false type: string + wazuh_automation_reference: + description: 'Branch or tag of the wazuh-automation repository' + required: true + default: 'main' + type: string products: description: 'Comma-separated list of the image names to build and push' default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' @@ -141,9 +150,21 @@ jobs: needs: setup env: - ARTIFACT_URLS_FILE_TEMP: "/tmp/wazuh-docker/artifact_urls.yml" + WORKFLOW_VENV: "${{ github.workspace }}/workflow_venv" + GENERATE_PRESIGNED_URLS_SCRIPT_PATH: ${{ github.workspace }}/wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py + PRESIGNED_URLS_SCRIPT_PROCESS: "build_docker" + LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/artifact_urls.yml steps: + + - name: Checkout wazuh/wazuh-automation repository + uses: actions/checkout@v4 + with: + repository: wazuh/wazuh-automation + ref: ${{ inputs.wazuh_automation_reference }} + token: ${{ secrets.GH_CLONE_TOKEN }} + path: wazuh-automation + - name: Configure AWS credentials if: ${{ inputs.dev == true }} uses: aws-actions/configure-aws-credentials@v4 @@ -151,169 +172,65 @@ jobs: role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} aws-region: ${{ secrets.AWS_REGION }} - - name: Download S3 package URIs file (if applicable) + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: '3.12' + + - name: Get Wazuh version if: ${{ inputs.dev == true }} run: | - mkdir -p "$(dirname "$ARTIFACT_URLS_FILE_TEMP")" + WAZUH_VERSION=$(jq -r '.version' VERSION.json) + WAZUH_MAJOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1) + WAZUH_MINOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1-2) + echo WAZUH_VERSION=$WAZUH_VERSION >> $GITHUB_ENV + echo WAZUH_MAJOR=$WAZUH_MAJOR >> $GITHUB_ENV + echo WAZUH_MINOR=$WAZUH_MINOR >> $GITHUB_ENV - # Download the S3 package URIs file - S3_BUCKET="${{ secrets.ARTIFACTS_S3_BUCKET }}" - S3_KEY="deployment/artifact_urls.yml" - aws s3 cp "s3://$S3_BUCKET/$S3_KEY" "$ARTIFACT_URLS_FILE_TEMP" --region us-west-1 - - # Verify the file was downloaded - if [ -f "$ARTIFACT_URLS_FILE_TEMP" ]; then - echo "S3 package URIs file downloaded successfully." - else - echo "Failed to download S3 package URIs file." >&2 - exit 1 - fi - - - name: Generate the variables file (signing each package URI) + - name: Get artifacts URLs file if: ${{ inputs.dev == true }} run: | - # Define necessary variables - WAZUH_VERSION_RAW="${{ inputs.image_tag }}" - WAZUH_VERSION="${WAZUH_VERSION_RAW%%-*}" - WAZUH_MAJOR="${WAZUH_VERSION%%.*}" - WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}' - COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}' + LOCAL_AWS_S3_BUCKET_DEV=${{ vars.AWS_S3_BUCKET_DEV }} + echo LOCAL_AWS_S3_BUCKET_DEV=$LOCAL_AWS_S3_BUCKET_DEV >> $GITHUB_ENV - INDEXER_COMMIT="" - MANAGER_COMMIT="" - DASHBOARD_COMMIT="" - AGENT_COMMIT="" + - name: Install and configure python and workflow dependencies + if: ${{ inputs.dev == true }} + run: | + sudo apt-get update + sudo apt-get install -y jq + sudo wget -q https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq + sudo chmod +x /usr/bin/yq + sudo apt-get install -y python3-venv + python3 -m venv ${{ env.WORKFLOW_VENV }} + source ${{ env.WORKFLOW_VENV }}/bin/activate + pip install --upgrade pip + pip install pyyaml - OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_processed.yml" - PRESIGNED_OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_presigned.yml" - mkdir -p "$(dirname "$OUTPUT_FILE")" + - name: Generate presigned URLs for artifacts for dev packages + if: ${{ inputs.dev == true }} + run: | + INDEXER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[0]') + MANAGER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[1]') + DASHBOARD_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[2]') + AGENT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[3]') + ASSISTANT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[4]') - : > "$OUTPUT_FILE" - : > "$PRESIGNED_OUTPUT_FILE" - - # Validate WAZUH_COMPONENTS and COMMIT_LIST have the same length - if [ "$(jq length <<<"$WAZUH_COMPONENTS")" -ne "$(jq length <<<"$COMMIT_LIST")" ]; then - echo "WAZUH_COMPONENTS and COMMIT_LIST must have the same length." >&2 - exit 1 - fi - - # Verify if the input file exists - if [ ! -f "$ARTIFACT_URLS_FILE_TEMP" ]; then - echo "The input file $ARTIFACT_URLS_FILE_TEMP does not exist." >&2 - exit 1 - fi - - # Set each component's commit/revision based on the input lists - for i in $(seq 0 $(($(echo "$WAZUH_COMPONENTS" | jq length) - 1))); do - COMPONENT=$(echo "$WAZUH_COMPONENTS" | jq -r ".[$i]") - COMMIT=$(echo "$COMMIT_LIST" | jq -r ".[$i]") - - case $COMPONENT in - "wazuh-indexer") - INDEXER_COMMIT="$COMMIT" - echo "Indexer commit set to: $COMMIT" - ;; - "wazuh-manager") - MANAGER_COMMIT="$COMMIT" - echo "Manager commit set to: $COMMIT" - ;; - "wazuh-dashboard") - DASHBOARD_COMMIT="$COMMIT" - echo "Dashboard commit set to: $COMMIT" - ;; - "wazuh-agent") - AGENT_COMMIT="$COMMIT" - echo "Agent commit set to: $COMMIT" - ;; - *) - echo "Unknown component: $COMPONENT." - exit 1 - ;; - esac - done - - # Process the file line by line (replacing ocurrences) - while IFS= read -r line || [ -n "$line" ]; do - # Skip empty lines and comments - if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then - continue - fi - - # Replace variables with their actual values - line=${line//\$\{\{ vars.AWS_S3_BUCKET_DEV \}\}/${{ vars.AWS_S3_BUCKET_DEV }}} - line=${line//\$\{\{ env.MAJOR \}\}/$WAZUH_MAJOR} - line=${line//\$\{\{ env.WAZUH_VERSION \}\}/$WAZUH_VERSION} - - # Replace component revisions - line=${line//\$\{\{ env.INDEXER_REVISION \}\}/$INDEXER_COMMIT} - line=${line//\$\{\{ env.MANAGER_REVISION \}\}/$MANAGER_COMMIT} - line=${line//\$\{\{ env.DASHBOARD_REVISION \}\}/$DASHBOARD_COMMIT} - line=${line//\$\{\{ env.AGENT_REVISION \}\}/$AGENT_COMMIT} - line=${line//\$\{\{ env.ASSISTANT_REVISION \}\}/latest} - - # Append the processed line to the output file - echo "$line" >> "$OUTPUT_FILE" - done < "$ARTIFACT_URLS_FILE_TEMP" - - # Verify the output file - if [ -f "$OUTPUT_FILE" ]; then - echo "The downloaded file artifact_urls.yml was successfully processed at $OUTPUT_FILE." - else - echo "Failed to create processed artifact_urls.yml file." >&2 - exit 1 - fi - - # Generate the presigned URLs for each package - while IFS= read -r line || [ -n "$line" ]; do - # Skip empty lines and comments - if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then - continue - fi - - # Extract both package_name and package_s3_uri from the line - if [[ "$line" =~ ^([a-zA-Z0-9_]+):[[:space:]]*\"?s3://([^\"[:space:]]+) ]]; then - PACKAGE_NAME="${BASH_REMATCH[1]}" - PACKAGE_S3_URI="s3://${BASH_REMATCH[2]}" - - # Check if the object exists in S3 - BUCKET_NAME=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 3) - OBJ_KEY=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 4-) - if ! aws s3api head-object --bucket "$BUCKET_NAME" --key "$OBJ_KEY" --region us-west-1 > /dev/null 2>&1; then - echo "Object $PACKAGE_S3_URI does not exist. Skipping..." >&2 - continue - fi - - # Generate a pre-signed URL for the S3 URI - echo "Generating pre-signed URL for $PACKAGE_NAME..." - PRESIGNED_URL=$(aws s3 presign "$PACKAGE_S3_URI" --expires-in 43200 --region us-west-1) - presigned_url_line="$PACKAGE_NAME: \"$PRESIGNED_URL\"" - - # Append the processed line to the output file - echo "$presigned_url_line" >> "$PRESIGNED_OUTPUT_FILE" - else - echo "$line" >> "$PRESIGNED_OUTPUT_FILE" - echo "Skipping line for presigning (no S3 URI found):" - echo "$line" - fi - done < "$OUTPUT_FILE" - - # Verify the presigned urls file - if [ -f "$PRESIGNED_OUTPUT_FILE" ]; then - echo "Presigned URLs file created successfully at $PRESIGNED_OUTPUT_FILE." - else - echo "Failed to create presigned artifact_urls.yml file." >&2 - exit 1 - fi - - # Store file with the same name expected by build-images.sh - cp "$PRESIGNED_OUTPUT_FILE" artifact_urls.yml + python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \ + --process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \ + --wazuh-version ${{ env.WAZUH_VERSION }} \ + --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \ + --indexer-revision $INDEXER_REVISION \ + --manager-revision $MANAGER_REVISION \ + --dashboard-revision $DASHBOARD_REVISION \ + --agent-revision $AGENT_REVISION \ + --assistant-revision $ASSISTANT_REVISION - name: Save presigned URLs file to artifact if: ${{ inputs.dev == true }} uses: actions/upload-artifact@v4 with: name: presigned-artifact-urls-${{ github.run_id }} - path: artifact_urls.yml + path: ${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }} build-and-push: runs-on: From 9987c5e6270f4aa31402f426db604db797f34403 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 13:23:38 -0300 Subject: [PATCH 02/16] Added wazuh Docker clone in presigned url job --- .github/workflows/Procedure_push_docker_images.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 0a05031d..eeaf1133 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -156,8 +156,14 @@ jobs: LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/artifact_urls.yml steps: + - name: Checkout repository + if: ${{ inputs.dev == true }} + uses: actions/checkout@v4 + with: + ref: ${{ inputs.docker_reference }} - name: Checkout wazuh/wazuh-automation repository + if: ${{ inputs.dev == true }} uses: actions/checkout@v4 with: repository: wazuh/wazuh-automation @@ -173,6 +179,7 @@ jobs: aws-region: ${{ secrets.AWS_REGION }} - name: Set up Python + if: ${{ inputs.dev == true }} uses: actions/setup-python@v6 with: python-version: '3.12' From 207683170e86039d6c6e9deb21fb71bc9443917b Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 14:18:35 -0300 Subject: [PATCH 03/16] Added venv activation --- .github/workflows/Procedure_push_docker_images.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index eeaf1133..8454956f 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -216,6 +216,7 @@ jobs: - name: Generate presigned URLs for artifacts for dev packages if: ${{ inputs.dev == true }} run: | + source ${{ env.WORKFLOW_VENV }}/bin/activate INDEXER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[0]') MANAGER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[1]') DASHBOARD_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[2]') From bc7b573e9d3f4af77c993db64b3c79d4398ae50f Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 14:32:08 -0300 Subject: [PATCH 04/16] Fixed commit variables --- .github/workflows/Procedure_push_docker_images.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 8454956f..9dfe282c 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -154,6 +154,7 @@ jobs: GENERATE_PRESIGNED_URLS_SCRIPT_PATH: ${{ github.workspace }}/wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py PRESIGNED_URLS_SCRIPT_PROCESS: "build_docker" LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/artifact_urls.yml + COMMIT_LIST: ${{ inputs.commit_list }} steps: - name: Checkout repository @@ -217,11 +218,10 @@ jobs: if: ${{ inputs.dev == true }} run: | source ${{ env.WORKFLOW_VENV }}/bin/activate - INDEXER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[0]') - MANAGER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[1]') - DASHBOARD_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[2]') + MANAGER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[0]') + DASHBOARD_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[1]') + INDEXER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[2]') AGENT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[3]') - ASSISTANT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[4]') python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \ --process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \ @@ -230,8 +230,7 @@ jobs: --indexer-revision $INDEXER_REVISION \ --manager-revision $MANAGER_REVISION \ --dashboard-revision $DASHBOARD_REVISION \ - --agent-revision $AGENT_REVISION \ - --assistant-revision $ASSISTANT_REVISION + --agent-revision $AGENT_REVISION - name: Save presigned URLs file to artifact if: ${{ inputs.dev == true }} From e69144bb43113cce1acdf039e39d45f21691aa84 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 15:13:31 -0300 Subject: [PATCH 05/16] Updated build image script --- build-docker-images/build-images.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index 34de3c2d..f14f874d 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -58,7 +58,7 @@ build() { fi fi - awk -F':' '!/^#/ && NF>1 {name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $ARTIFACT_URLS_FILE > artifacts_env.txt + awk -F':' '!/^#/ && NF>1 {name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=\"" val "\""}' $ARTIFACT_URLS_FILE > artifacts_env.txt # Set component commit references for development builds if [ -n "${WAZUH_DEV_STAGE}" ]; then From d72ae07e807a55004dc17b5c941dd0a49f1165d0 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 15:40:17 -0300 Subject: [PATCH 06/16] Fixed url presigned process for customs builds --- .../Procedure_push_docker_images.yml | 53 ++++++++++++++----- 1 file changed, 41 insertions(+), 12 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 9dfe282c..34139c3d 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -218,19 +218,48 @@ jobs: if: ${{ inputs.dev == true }} run: | source ${{ env.WORKFLOW_VENV }}/bin/activate - MANAGER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[0]') - DASHBOARD_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[1]') - INDEXER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[2]') - AGENT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[3]') + WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}' + COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}' - python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \ - --process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \ - --wazuh-version ${{ env.WAZUH_VERSION }} \ - --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \ - --indexer-revision $INDEXER_REVISION \ - --manager-revision $MANAGER_REVISION \ - --dashboard-revision $DASHBOARD_REVISION \ - --agent-revision $AGENT_REVISION + # Parse components and their revisions + COMPONENTS=($(echo "$WAZUH_COMPONENTS" | jq -r '.[]')) + REVISIONS=($(echo "$COMMIT_LIST" | jq -r '.[]')) + + # Map revisions to component names + for i in "${!COMPONENTS[@]}"; do + case "${COMPONENTS[$i]}" in + wazuh-manager) + MANAGER_REVISION="${REVISIONS[$i]}" + ;; + wazuh-dashboard) + DASHBOARD_REVISION="${REVISIONS[$i]}" + ;; + wazuh-indexer) + INDEXER_REVISION="${REVISIONS[$i]}" + ;; + wazuh-agent) + AGENT_REVISION="${REVISIONS[$i]}" + ;; + esac + done + + # Build dynamic arguments based on available components + SCRIPT_ARGS="--process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} --wazuh-version ${{ env.WAZUH_VERSION }} --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }}" + + if [[ ! -z "$MANAGER_REVISION" ]]; then + SCRIPT_ARGS="$SCRIPT_ARGS --manager-revision $MANAGER_REVISION" + fi + if [[ ! -z "$DASHBOARD_REVISION" ]]; then + SCRIPT_ARGS="$SCRIPT_ARGS --dashboard-revision $DASHBOARD_REVISION" + fi + if [[ ! -z "$INDEXER_REVISION" ]]; then + SCRIPT_ARGS="$SCRIPT_ARGS --indexer-revision $INDEXER_REVISION" + fi + if [[ ! -z "$AGENT_REVISION" ]]; then + SCRIPT_ARGS="$SCRIPT_ARGS --agent-revision $AGENT_REVISION" + fi + + python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} $SCRIPT_ARGS - name: Save presigned URLs file to artifact if: ${{ inputs.dev == true }} From 4b07a756020c7b8a83257772efe4faf9d73fe366 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 16:08:28 -0300 Subject: [PATCH 07/16] Updated changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5105b559..a8bda688 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Added script to pre-signed internal packages URLs. ([#2259](https://github.com/wazuh/wazuh-docker/pull/2259)) - Update certificate configuration to use separate IP and DNS fields ([#2253](https://github.com/wazuh/wazuh-docker/pull/2253)) - Modify Healthchecks ([#2252](https://github.com/wazuh/wazuh-docker/pull/2252)) - Add deployment healthchecks ([#2251](https://github.com/wazuh/wazuh-docker/pull/2251)) From 7d974ffd7cd39e345843f6f82c6ccdfbbfa84943 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 16:39:17 -0300 Subject: [PATCH 08/16] Added fixes proposed by GitHub copilot --- .github/workflows/5_pr_check.yml | 1 + .../Procedure_push_docker_images.yml | 52 +++++++++++++------ CHANGELOG.md | 2 +- 3 files changed, 39 insertions(+), 16 deletions(-) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 6e590412..4579e2d7 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -44,6 +44,7 @@ jobs: with: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} docker_reference: ${{ github.head_ref || inputs.docker_reference }} + wazuh_automation_reference: 'main' commit_list: '["latest", "latest", "latest", "latest"]' id: ${{ github.run_id }} dev: true diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 34139c3d..0f2b4113 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -13,7 +13,7 @@ on: required: true wazuh_automation_reference: description: 'Branch or tag of the wazuh-automation repository' - required: true + required: false default: 'main' products: description: 'Comma-separated list of the image names to build and push' @@ -46,7 +46,7 @@ on: type: string wazuh_automation_reference: description: 'Branch or tag of the wazuh-automation repository' - required: true + required: false default: 'main' type: string products: @@ -185,6 +185,32 @@ jobs: with: python-version: '3.12' + - name: Install and configure python and workflow dependencies + if: ${{ inputs.dev == true }} + run: | + sudo apt-get update + sudo apt-get install -y jq + # Install yq from a pinned version and verify its checksum + YQ_VERSION="v4.44.3" + YQ_BINARY="yq_linux_amd64" + YQ_BASE_URL="https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}" + wget -q "${YQ_BASE_URL}/checksums" -O /tmp/yq_checksums + wget -q "${YQ_BASE_URL}/${YQ_BINARY}" -O /tmp/${YQ_BINARY} + EXPECTED_SHA256="$(grep " ${YQ_BINARY}$" /tmp/yq_checksums | awk '{print $1}')" + ACTUAL_SHA256="$(sha256sum /tmp/${YQ_BINARY} | awk '{print $1}')" + if [ -z "$EXPECTED_SHA256" ] || [ "$EXPECTED_SHA256" != "$ACTUAL_SHA256" ]; then + echo "yq checksum verification failed" >&2 + exit 1 + fi + sudo mv /tmp/${YQ_BINARY} /usr/bin/yq + sudo chmod +x /usr/bin/yq + rm -f /tmp/yq_checksums + sudo apt-get install -y python3-venv + python3 -m venv ${{ env.WORKFLOW_VENV }} + source ${{ env.WORKFLOW_VENV }}/bin/activate + pip install --upgrade pip + pip install pyyaml + - name: Get Wazuh version if: ${{ inputs.dev == true }} run: | @@ -201,19 +227,6 @@ jobs: LOCAL_AWS_S3_BUCKET_DEV=${{ vars.AWS_S3_BUCKET_DEV }} echo LOCAL_AWS_S3_BUCKET_DEV=$LOCAL_AWS_S3_BUCKET_DEV >> $GITHUB_ENV - - name: Install and configure python and workflow dependencies - if: ${{ inputs.dev == true }} - run: | - sudo apt-get update - sudo apt-get install -y jq - sudo wget -q https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq - sudo chmod +x /usr/bin/yq - sudo apt-get install -y python3-venv - python3 -m venv ${{ env.WORKFLOW_VENV }} - source ${{ env.WORKFLOW_VENV }}/bin/activate - pip install --upgrade pip - pip install pyyaml - - name: Generate presigned URLs for artifacts for dev packages if: ${{ inputs.dev == true }} run: | @@ -225,6 +238,15 @@ jobs: COMPONENTS=($(echo "$WAZUH_COMPONENTS" | jq -r '.[]')) REVISIONS=($(echo "$COMMIT_LIST" | jq -r '.[]')) + # Ensure the number of components matches the number of revisions + if [[ ${#COMPONENTS[@]} -ne ${#REVISIONS[@]} ]]; then + echo "Error: WAZUH_COMPONENTS and COMMIT_LIST length mismatch." >&2 + echo " Components: ${#COMPONENTS[@]}, Revisions: ${#REVISIONS[@]}." >&2 + echo " WAZUH_COMPONENTS=${WAZUH_COMPONENTS}" >&2 + echo " COMMIT_LIST=${COMMIT_LIST}" >&2 + exit 1 + fi + # Map revisions to component names for i in "${!COMPONENTS[@]}"; do case "${COMPONENTS[$i]}" in diff --git a/CHANGELOG.md b/CHANGELOG.md index a8bda688..c3bf3a1e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed -- Added script to pre-signed internal packages URLs. ([#2259](https://github.com/wazuh/wazuh-docker/pull/2259)) +- Use URL signing script to generate presigned internal package URLs. ([#2259](https://github.com/wazuh/wazuh-docker/pull/2259)) - Update certificate configuration to use separate IP and DNS fields ([#2253](https://github.com/wazuh/wazuh-docker/pull/2253)) - Modify Healthchecks ([#2252](https://github.com/wazuh/wazuh-docker/pull/2252)) - Add deployment healthchecks ([#2251](https://github.com/wazuh/wazuh-docker/pull/2251)) From 5616e581af660e88e02cda7934b2f8524f0e0a69 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 16:49:07 -0300 Subject: [PATCH 09/16] Changed yq installation method for url pre signed process --- .../workflows/Procedure_push_docker_images.yml | 18 +++--------------- 1 file changed, 3 insertions(+), 15 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 0f2b4113..cbdd1775 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -190,21 +190,9 @@ jobs: run: | sudo apt-get update sudo apt-get install -y jq - # Install yq from a pinned version and verify its checksum - YQ_VERSION="v4.44.3" - YQ_BINARY="yq_linux_amd64" - YQ_BASE_URL="https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}" - wget -q "${YQ_BASE_URL}/checksums" -O /tmp/yq_checksums - wget -q "${YQ_BASE_URL}/${YQ_BINARY}" -O /tmp/${YQ_BINARY} - EXPECTED_SHA256="$(grep " ${YQ_BINARY}$" /tmp/yq_checksums | awk '{print $1}')" - ACTUAL_SHA256="$(sha256sum /tmp/${YQ_BINARY} | awk '{print $1}')" - if [ -z "$EXPECTED_SHA256" ] || [ "$EXPECTED_SHA256" != "$ACTUAL_SHA256" ]; then - echo "yq checksum verification failed" >&2 - exit 1 - fi - sudo mv /tmp/${YQ_BINARY} /usr/bin/yq - sudo chmod +x /usr/bin/yq - rm -f /tmp/yq_checksums + # Install yq + sudo curl -sL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_amd64" -o /usr/local/bin/yq + sudo chmod +x /usr/local/bin/yq sudo apt-get install -y python3-venv python3 -m venv ${{ env.WORKFLOW_VENV }} source ${{ env.WORKFLOW_VENV }}/bin/activate From a248bdcd39e0382f0e558deae151912259f38d2c Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Wed, 18 Mar 2026 17:05:42 -0300 Subject: [PATCH 10/16] Updated certs tool download command --- .github/workflows/5_pr_check.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 4579e2d7..51def0b5 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -128,7 +128,7 @@ jobs: - name: Create single node certficates run: | - curl -o ./wazuh-certs-tool.sh ${{ env.wazuh_certs_tool }} + curl --output ./wazuh-certs-tool.sh "${{ env.wazuh_certs_tool }}" cat > config.yml < config.yml < Date: Thu, 19 Mar 2026 08:40:32 -0300 Subject: [PATCH 11/16] The validation of empty parameters is removed from the execution of the URL signing script. --- .../Procedure_push_docker_images.yml | 25 ++++++------------- 1 file changed, 8 insertions(+), 17 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index cbdd1775..6ed3aa84 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -253,23 +253,14 @@ jobs: esac done - # Build dynamic arguments based on available components - SCRIPT_ARGS="--process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} --wazuh-version ${{ env.WAZUH_VERSION }} --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }}" - - if [[ ! -z "$MANAGER_REVISION" ]]; then - SCRIPT_ARGS="$SCRIPT_ARGS --manager-revision $MANAGER_REVISION" - fi - if [[ ! -z "$DASHBOARD_REVISION" ]]; then - SCRIPT_ARGS="$SCRIPT_ARGS --dashboard-revision $DASHBOARD_REVISION" - fi - if [[ ! -z "$INDEXER_REVISION" ]]; then - SCRIPT_ARGS="$SCRIPT_ARGS --indexer-revision $INDEXER_REVISION" - fi - if [[ ! -z "$AGENT_REVISION" ]]; then - SCRIPT_ARGS="$SCRIPT_ARGS --agent-revision $AGENT_REVISION" - fi - - python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} $SCRIPT_ARGS + python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \ + --process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \ + --wazuh-version ${{ env.WAZUH_VERSION }} \ + --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \ + --indexer-revision $INDEXER_REVISION \ + --manager-revision $MANAGER_REVISION \ + --dashboard-revision $DASHBOARD_REVISION \ + --agent-revision $AGENT_REVISION - name: Save presigned URLs file to artifact if: ${{ inputs.dev == true }} From 913c8dfbcbe77c5df704450b32044ddf712d8613 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 19 Mar 2026 10:18:47 -0300 Subject: [PATCH 12/16] Added wazuh installation assistant tools revision --- .github/workflows/Procedure_push_docker_images.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 6ed3aa84..1ac30003 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -260,7 +260,8 @@ jobs: --indexer-revision $INDEXER_REVISION \ --manager-revision $MANAGER_REVISION \ --dashboard-revision $DASHBOARD_REVISION \ - --agent-revision $AGENT_REVISION + --agent-revision $AGENT_REVISION\ + --assistant-revision $ASSISTANT_REVISION - name: Save presigned URLs file to artifact if: ${{ inputs.dev == true }} From 52c68b5f391261fde338e891f723fd35279a329b Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 19 Mar 2026 10:46:38 -0300 Subject: [PATCH 13/16] Added Wazuh installation assistant tool as component --- .github/workflows/Procedure_push_docker_images.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 1ac30003..f0f5a50a 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -17,13 +17,13 @@ on: default: 'main' products: description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' + default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent,wazuh-assistant' required: false type: string commit_list: description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product' type: string - default: '["latest", "latest", "latest", "latest"]' + default: '["latest", "latest", "latest", "latest", "latest"]' id: description: "ID used to identify the workflow uniquely." type: string @@ -51,13 +51,13 @@ on: type: string products: description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' + default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent,wazuh-assistant' required: false type: string commit_list: description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product' type: string - default: '["latest", "latest", "latest", "latest"]' + default: '["latest", "latest", "latest", "latest", "latest"]' id: description: "ID used to identify the workflow uniquely." type: string @@ -117,7 +117,7 @@ jobs: done WC_JSON_ARRAY+="]" else - WC_JSON_ARRAY='["wazuh-manager","wazuh-dashboard","wazuh-indexer","wazuh-agent"]' + WC_JSON_ARRAY='["wazuh-manager","wazuh-dashboard","wazuh-indexer","wazuh-agent","wazuh-assistant"]' fi echo "Products to build: $WC_JSON_ARRAY" echo "WAZUH_COMPONENTS=$WC_JSON_ARRAY" >> $GITHUB_OUTPUT @@ -250,6 +250,9 @@ jobs: wazuh-agent) AGENT_REVISION="${REVISIONS[$i]}" ;; + wazuh-assistant) + ASSISTANT_REVISION="${REVISIONS[$i]}" + ;; esac done From fc034c872da8c06744ffbc466499b5454b48e1e5 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 19 Mar 2026 12:48:13 -0300 Subject: [PATCH 14/16] Fixed pr check --- .github/workflows/5_pr_check.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 51def0b5..4bb70d5a 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -45,7 +45,7 @@ jobs: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} docker_reference: ${{ github.head_ref || inputs.docker_reference }} wazuh_automation_reference: 'main' - commit_list: '["latest", "latest", "latest", "latest"]' + commit_list: '["latest", "latest", "latest", "latest", "latest"]' id: ${{ github.run_id }} dev: true From d3748916600f13efa2369cd75cd5e226abbac02d Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Thu, 19 Mar 2026 15:30:34 -0300 Subject: [PATCH 15/16] Added assistant revision input to the build workflow --- .github/workflows/5_pr_check.yml | 3 ++- .../Procedure_push_docker_images.yml | 26 +++++++++++++------ 2 files changed, 20 insertions(+), 9 deletions(-) diff --git a/.github/workflows/5_pr_check.yml b/.github/workflows/5_pr_check.yml index 4bb70d5a..f2d659ed 100644 --- a/.github/workflows/5_pr_check.yml +++ b/.github/workflows/5_pr_check.yml @@ -45,7 +45,8 @@ jobs: image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }} docker_reference: ${{ github.head_ref || inputs.docker_reference }} wazuh_automation_reference: 'main' - commit_list: '["latest", "latest", "latest", "latest", "latest"]' + commit_list: '["latest", "latest", "latest", "latest"]' + assistant_revision: 'latest' id: ${{ github.run_id }} dev: true diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index f0f5a50a..9ee8e27b 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -17,13 +17,18 @@ on: default: 'main' products: description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent,wazuh-assistant' + default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' required: false type: string commit_list: description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product' type: string - default: '["latest", "latest", "latest", "latest", "latest"]' + default: '["latest", "latest", "latest", "latest"]' + assistant_revision: + description: 'Revision for Wazuh installation assistant tools like Wazuh password tool (only for dev)' + type: string + default: 'latest' + required: false id: description: "ID used to identify the workflow uniquely." type: string @@ -51,13 +56,18 @@ on: type: string products: description: 'Comma-separated list of the image names to build and push' - default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent,wazuh-assistant' + default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' required: false type: string commit_list: description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product' type: string - default: '["latest", "latest", "latest", "latest", "latest"]' + default: '["latest", "latest", "latest", "latest"]' + assistant_revision: + description: 'Revision for Wazuh installation assistant tools like Wazuh password tool (only for dev)' + type: string + default: 'latest' + required: false id: description: "ID used to identify the workflow uniquely." type: string @@ -95,9 +105,11 @@ jobs: echo "* id: ${{ inputs.id }}" echo "* image_tag: ${{ inputs.image_tag }}" echo "* docker_reference: ${{ inputs.docker_reference }}" + echo "* wazuh_automation_reference: ${{ inputs.wazuh_automation_reference }}" echo "* products: ${{ inputs.products }}" echo "* dev: ${{ inputs.dev }}" echo "* commit_list: ${{ inputs.commit_list }}" + echo "* assistant_revision: ${{ inputs.assistant_revision }}" echo "---------------------------------------------" - name: Set up variables @@ -117,7 +129,7 @@ jobs: done WC_JSON_ARRAY+="]" else - WC_JSON_ARRAY='["wazuh-manager","wazuh-dashboard","wazuh-indexer","wazuh-agent","wazuh-assistant"]' + WC_JSON_ARRAY='["wazuh-manager","wazuh-dashboard","wazuh-indexer","wazuh-agent"]' fi echo "Products to build: $WC_JSON_ARRAY" echo "WAZUH_COMPONENTS=$WC_JSON_ARRAY" >> $GITHUB_OUTPUT @@ -155,6 +167,7 @@ jobs: PRESIGNED_URLS_SCRIPT_PROCESS: "build_docker" LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/artifact_urls.yml COMMIT_LIST: ${{ inputs.commit_list }} + ASSISTANT_REVISION: ${{ inputs.assistant_revision }} steps: - name: Checkout repository @@ -250,9 +263,6 @@ jobs: wazuh-agent) AGENT_REVISION="${REVISIONS[$i]}" ;; - wazuh-assistant) - ASSISTANT_REVISION="${REVISIONS[$i]}" - ;; esac done From 79a51847ea2b34863af482bfa973111ad361f393 Mon Sep 17 00:00:00 2001 From: Carlos Bordon Date: Fri, 20 Mar 2026 07:55:49 -0300 Subject: [PATCH 16/16] Fixed agent revision --- .github/workflows/Procedure_push_docker_images.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 9ee8e27b..5cb8f95d 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -273,7 +273,7 @@ jobs: --indexer-revision $INDEXER_REVISION \ --manager-revision $MANAGER_REVISION \ --dashboard-revision $DASHBOARD_REVISION \ - --agent-revision $AGENT_REVISION\ + --agent-revision $AGENT_REVISION \ --assistant-revision $ASSISTANT_REVISION - name: Save presigned URLs file to artifact