Merge 4.14.5 into main

.github/workflows/Procedure_push_docker_images.yml

@@ -6,25 +6,29 @@ on:
     inputs:
       image_tag:
         description: 'Docker image tag'
-        default: '4.14.5'
+        default: '5.0.0'
         required: true
       docker_reference:
         description: 'wazuh-docker reference'
         required: true
-      filebeat_module_version:
-        description: 'Filebeat module version'
-        default: '0.5'
-        required: true
-        type: string
+      wazuh_automation_reference:
+        description: 'Branch or tag of the wazuh-automation repository'
+        required: false
+        default: 'main'
       products:
         description: 'Comma-separated list of the image names to build and push'
         default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
         required: false
         type: string
-      revision:
-        description: 'Package revision'
-        default: '1'
-        required: true
+      commit_list:
+        description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product'
+        type: string
+        default: '["latest", "latest", "latest", "latest"]'
+      assistant_revision:
+        description: 'Revision for Wazuh installation assistant tools like Wazuh password tool (only for dev)'
+        type: string
+        default: 'latest'
+        required: false
       id:
         description: "ID used to identify the workflow uniquely."
         type: string
@@ -38,28 +42,32 @@ on:
     inputs:
       image_tag:
         description: 'Docker image tag'
-        default: '4.14.5'
+        default: '5.0.0'
         required: true
         type: string
       docker_reference:
         description: 'wazuh-docker reference'
         required: false
         type: string
-      filebeat_module_version:
-        description: 'Filebeat module version'
-        default: '0.5'
-        required: true
+      wazuh_automation_reference:
+        description: 'Branch or tag of the wazuh-automation repository'
+        required: false
+        default: 'main'
         type: string
       products:
         description: 'Comma-separated list of the image names to build and push'
         default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
         required: false
         type: string
-      revision:
-        description: 'Package revision'
-        default: '1'
-        required: true
+      commit_list:
+        description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product'
         type: string
+        default: '["latest", "latest", "latest", "latest"]'
+      assistant_revision:
+        description: 'Revision for Wazuh installation assistant tools like Wazuh password tool (only for dev)'
+        type: string
+        default: 'latest'
+        required: false
       id:
         description: "ID used to identify the workflow uniquely."
         type: string
@@ -70,22 +78,18 @@ on:
         default: false
         required: false
 
-jobs:
-  setup:
-    runs-on: ubuntu-22.04
-
-    permissions:
+permissions:
       id-token: write
       contents: read
 
-    env:
-      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
-      IMAGE_TAG: ${{ inputs.image_tag }}
-      FILEBEAT_MODULE_VERSION: ${{ inputs.filebeat_module_version }}
-      REVISION: ${{ inputs.revision }}
+jobs:
+  setup:
+    runs-on:
+      group: wz-linux-amd64
 
     outputs:
       WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
+      COMMIT_LIST: ${{ steps.compute-outputs.outputs.COMMIT_LIST }}
 
     steps:
     - name: Print inputs
@@ -101,40 +105,191 @@ jobs:
         echo "* id: ${{ inputs.id }}"
         echo "* image_tag: ${{ inputs.image_tag }}"
         echo "* docker_reference: ${{ inputs.docker_reference }}"
-        echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
+        echo "* wazuh_automation_reference: ${{ inputs.wazuh_automation_reference }}"
         echo "* products: ${{ inputs.products }}"
-        echo "* revision: ${{ inputs.revision }}"
         echo "* dev: ${{ inputs.dev }}"
+        echo "* commit_list: ${{ inputs.commit_list }}"
+        echo "* assistant_revision: ${{ inputs.assistant_revision }}"
         echo "---------------------------------------------"
 
     - name: Set up variables
       id: compute-outputs
       run: |
+        # Set WAZUH_COMPONENTS
+        WC_JSON_ARRAY=""
         if [[ "${{ inputs.products }}" != "null" && "${{ inputs.products }}" != "" ]]; then
           # Convert comma-separated list to JSON array format
           IFS=',' read -ra COMPONENTS <<< "${{ inputs.products }}"
-          JSON_ARRAY="["
+          WC_JSON_ARRAY="["
           for i in "${!COMPONENTS[@]}"; do
             if [ $i -gt 0 ]; then
-              JSON_ARRAY+=","
+              WC_JSON_ARRAY+=","
             fi
-            JSON_ARRAY+="\"${COMPONENTS[$i]}\""
+            WC_JSON_ARRAY+="\"${COMPONENTS[$i]}\""
           done
-          JSON_ARRAY+="]"
-          echo "WAZUH_COMPONENTS=$JSON_ARRAY" >> $GITHUB_OUTPUT
+          WC_JSON_ARRAY+="]"
         else
-          echo "WAZUH_COMPONENTS=[\"wazuh-manager\",\"wazuh-dashboard\",\"wazuh-indexer\",\"wazuh-agent\"]" >> $GITHUB_OUTPUT
+          WC_JSON_ARRAY='["wazuh-manager","wazuh-dashboard","wazuh-indexer","wazuh-agent"]'
         fi
+        echo "Products to build: $WC_JSON_ARRAY"
+        echo "WAZUH_COMPONENTS=$WC_JSON_ARRAY" >> $GITHUB_OUTPUT
+
+        # Set COMMIT_LIST
+        WC_COMMIT_LIST=""
+        if [[ "${{ inputs.dev }}" == "true" ]]; then
+          if [[ "${{ inputs.commit_list }}" != "null" && "${{ inputs.commit_list }}" != "" ]]; then
+            WC_COMMIT_LIST='${{ inputs.commit_list }}'
+          else
+            # Set commit list to "latest" for all components using WAZUH_COMPONENTS
+            COMPONENTS=($(echo "$WC_JSON_ARRAY" | jq -r '.[]'))
+            WC_COMMIT_LIST="["
+            for i in "${!COMPONENTS[@]}"; do
+              if [ $i -gt 0 ]; then
+                WC_COMMIT_LIST+=" ,"
+              fi
+              WC_COMMIT_LIST+="\"latest\""
+            done
+            WC_COMMIT_LIST+="]"
+          fi
+          echo "Revision list: $WC_COMMIT_LIST"
+        fi
+        echo "COMMIT_LIST=$WC_COMMIT_LIST" >> $GITHUB_OUTPUT
+
+  package-urls:
+    name: generate package urls
+    runs-on:
+      group: wz-linux-amd64
+    needs: setup
+
+    env:
+      WORKFLOW_VENV: "${{ github.workspace }}/workflow_venv"
+      GENERATE_PRESIGNED_URLS_SCRIPT_PATH: ${{ github.workspace }}/wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py
+      PRESIGNED_URLS_SCRIPT_PROCESS: "build_docker"
+      LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/${{ vars.ARTIFACT_URL_FILE_NAME }}
+      COMMIT_LIST: ${{ inputs.commit_list }}
+      ASSISTANT_REVISION: ${{ inputs.assistant_revision }}
+
+    steps:
+      - name: Checkout repository
+        if: ${{ inputs.dev == true }}
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ inputs.docker_reference }}
+
+      - name: Checkout wazuh/wazuh-automation repository
+        if: ${{ inputs.dev == true }}
+        uses: actions/checkout@v4
+        with:
+          repository: wazuh/wazuh-automation
+          ref: ${{ inputs.wazuh_automation_reference }}
+          token: ${{ secrets.GH_CLONE_TOKEN }}
+          path: wazuh-automation
+
+      - name: Configure AWS credentials
+        if: ${{ inputs.dev == true }}
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
+          aws-region: ${{ secrets.AWS_REGION }}
+
+      - name: Set up Python
+        if: ${{ inputs.dev == true }}
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Install and configure python and workflow dependencies
+        if: ${{ inputs.dev == true }}
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y jq
+          # Install yq
+          sudo curl -sL "https://github.com/mikefarah/yq/releases/download/v4.44.3/yq_linux_amd64" -o /usr/local/bin/yq
+          sudo chmod +x /usr/local/bin/yq
+          sudo apt-get install -y python3-venv
+          python3 -m venv ${{ env.WORKFLOW_VENV }}
+          source ${{ env.WORKFLOW_VENV }}/bin/activate
+          pip install --upgrade pip
+          pip install pyyaml
+
+      - name: Get Wazuh version
+        if: ${{ inputs.dev == true }}
+        run: |
+          WAZUH_VERSION=$(jq -r '.version' VERSION.json)
+          WAZUH_MAJOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1)
+          WAZUH_MINOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1-2)
+          echo WAZUH_VERSION=$WAZUH_VERSION >> $GITHUB_ENV
+          echo WAZUH_MAJOR=$WAZUH_MAJOR >> $GITHUB_ENV
+          echo WAZUH_MINOR=$WAZUH_MINOR >> $GITHUB_ENV
+
+      - name: Get artifacts URLs file
+        if: ${{ inputs.dev == true }}
+        run: |
+          LOCAL_AWS_S3_BUCKET_DEV=${{ vars.AWS_S3_BUCKET_DEV }}
+          echo LOCAL_AWS_S3_BUCKET_DEV=$LOCAL_AWS_S3_BUCKET_DEV >> $GITHUB_ENV
+
+      - name: Generate presigned URLs for artifacts for dev packages
+        if: ${{ inputs.dev == true }}
+        run: |
+          source ${{ env.WORKFLOW_VENV }}/bin/activate
+          WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
+          COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
+
+          # Parse components and their revisions
+          COMPONENTS=($(echo "$WAZUH_COMPONENTS" | jq -r '.[]'))
+          REVISIONS=($(echo "$COMMIT_LIST" | jq -r '.[]'))
+
+          # Ensure the number of components matches the number of revisions
+          if [[ ${#COMPONENTS[@]} -ne ${#REVISIONS[@]} ]]; then
+            echo "Error: WAZUH_COMPONENTS and COMMIT_LIST length mismatch." >&2
+            echo "       Components: ${#COMPONENTS[@]}, Revisions: ${#REVISIONS[@]}." >&2
+            echo "       WAZUH_COMPONENTS=${WAZUH_COMPONENTS}" >&2
+            echo "       COMMIT_LIST=${COMMIT_LIST}" >&2
+            exit 1
+          fi
+
+          # Map revisions to component names
+          for i in "${!COMPONENTS[@]}"; do
+          case "${COMPONENTS[$i]}" in
+            wazuh-manager)
+            MANAGER_REVISION="${REVISIONS[$i]}"
+            ;;
+            wazuh-dashboard)
+            DASHBOARD_REVISION="${REVISIONS[$i]}"
+            ;;
+            wazuh-indexer)
+            INDEXER_REVISION="${REVISIONS[$i]}"
+            ;;
+            wazuh-agent)
+            AGENT_REVISION="${REVISIONS[$i]}"
+            ;;
+          esac
+          done
+
+          python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \
+              --process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \
+              --wazuh-version ${{ env.WAZUH_VERSION }} \
+              --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \
+              --indexer-revision   $INDEXER_REVISION \
+              --manager-revision   $MANAGER_REVISION \
+              --dashboard-revision $DASHBOARD_REVISION \
+              --agent-revision     $AGENT_REVISION \
+              --assistant-revision $ASSISTANT_REVISION
+
+      - name: Save presigned URLs file to artifact
+        if: ${{ inputs.dev == true }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: presigned-artifact-urls-${{ github.run_id }}
+          path: ${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}
 
   build-and-push:
-    runs-on: ubuntu-22.04
-
-    permissions:
-      id-token: write
-      contents: read
+    runs-on:
+      group: wz-linux-amd64
 
     needs:
       - setup
+      - package-urls
 
     strategy:
       fail-fast: false # all jobs will run even if one fails
@@ -144,7 +299,6 @@ jobs:
     env:
       IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
       IMAGE_TAG: ${{ inputs.image_tag }}
-      REVISION: ${{ inputs.revision }}
 
     steps:
     - name: Checkout repository
@@ -152,9 +306,6 @@ jobs:
       with:
         ref: ${{ inputs.docker_reference }}
 
-    - name: free disk space
-      uses: ./.github/free-disk-space
-
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v4
 
@@ -179,12 +330,28 @@ jobs:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
+    - name: Download artifact_urls.yaml (dev)
+      if: ${{ inputs.dev == true }}
+      uses: actions/download-artifact@v4
+      with:
+        name: presigned-artifact-urls-${{ github.run_id }}
+        path: ./build-docker-images
+
+    - name: Compute component reference (dev)
+      if: ${{ inputs.dev == true }}
+      run: |
+        COMPONENT='${{ matrix.wazuh_component }}'
+        WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
+        COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
+
+        idx=$(jq -r --arg c "$COMPONENT" 'index($c)' <<<"$WAZUH_COMPONENTS")
+        ref=$(jq -r --argjson i "$idx" '.[ $i ]' <<<"$COMMIT_LIST")
+
+        echo "COMPONENT_REFS_JSON=[\"$ref\"]" >> "$GITHUB_ENV"
+        echo "Using component ref for $COMPONENT: $ref"
+
     - name: Build Wazuh images
       run: |
-        IMAGE_TAG="${{ inputs.image_tag }}"
-        FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }}
-        REVISION=${{ inputs.revision }}
-
         if [[ "$IMAGE_TAG" == *"-"* ]]; then
           IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
           if [ -z "${tokens[1]}" ]; then
@@ -193,11 +360,38 @@ jobs:
           fi
           DEV_STAGE=${tokens[1]}
           WAZUH_VER=${tokens[0]}
-          ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }}
+          if [ "${{ inputs.dev }}" = true ]; then
+            ./build-images.sh \
+              -v $WAZUH_VER \
+              -d $DEV_STAGE \
+              -rg $IMAGE_REGISTRY \
+              -m \
+              -refs "$COMPONENT_REFS_JSON" \
+              -c ${{ matrix.wazuh_component }}
+          else
+            ./build-images.sh \
+              -v $WAZUH_VER \
+              -d $DEV_STAGE \
+              -rg $IMAGE_REGISTRY \
+              -m \
+              -c ${{ matrix.wazuh_component }}
+          fi
         else
-          ./build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }}
+          if [ "${{ inputs.dev }}" = true ]; then
+            ./build-images.sh \
+              -v $IMAGE_TAG \
+              -rg $IMAGE_REGISTRY \
+              -m \
+              -refs "$COMPONENT_REFS_JSON" \
+              -c ${{ matrix.wazuh_component }}
+          else
+            ./build-images.sh \
+              -v $IMAGE_TAG \
+              -rg $IMAGE_REGISTRY \
+              -m \
+              -c ${{ matrix.wazuh_component }}
+          fi
         fi
-
         # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
         ENV_FILE_PATH="../.env"