diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 039f8952..046439e3 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -68,14 +68,14 @@ on: default: false required: false +permissions: + id-token: write + contents: read + jobs: setup: runs-on: ubuntu-22.04 - permissions: - id-token: write - contents: read - outputs: WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }} @@ -118,15 +118,159 @@ jobs: echo "WAZUH_COMPONENTS=[\"wazuh-manager\",\"wazuh-dashboard\",\"wazuh-indexer\",\"wazuh-agent\"]" >> $GITHUB_OUTPUT fi + package-urls: + name: generate package urls + runs-on: ubuntu-22.04 + needs: setup + + env: + ARTIFACT_URLS_FILE_TEMP: "/tmp/wazuh-docker/artifact_urls.yml" + + steps: + - name: Checkout repository + uses: actions/checkout@v4 + with: + ref: ${{ inputs.docker_reference }} + + - name: Configure AWS credentials + if: ${{ inputs.dev == true }} + uses: aws-actions/configure-aws-credentials@v4 + with: + role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} + aws-region: ${{ secrets.AWS_REGION }} + + - name: Download S3 package URIs file (if applicable) + if: ${{ inputs.dev == true }} + run: | + mkdir -p "$(dirname "$ARTIFACT_URLS_FILE_TEMP")" + + # Download the S3 package URIs file + S3_BUCKET="${{ secrets.ARTIFACTS_S3_BUCKET }}" + S3_KEY="deployment/artifact_urls.yml" + aws s3 cp "s3://$S3_BUCKET/$S3_KEY" "$ARTIFACT_URLS_FILE_TEMP" --region us-west-1 + + # Verify the file was downloaded + if [ -f "$ARTIFACT_URLS_FILE_TEMP" ]; then + echo "S3 package URIs file downloaded successfully." + else + echo "Failed to download S3 package URIs file." >&2 + exit 1 + fi + + - name: Generate the variables file (signing each package URI) + if: ${{ inputs.dev == true }} + run: | + # Define necessary variables + WAZUH_VERSION_RAW="${{ inputs.image_tag }}" + WAZUH_VERSION="${WAZUH_VERSION_RAW%%-*}" + WAZUH_MAJOR="${WAZUH_VERSION%%.*}" + REFERENCE="${{ inputs.reference }}" + + OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_processed.yml" + PRESIGNED_OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_presigned.yml" + + mkdir -p "$(dirname "$OUTPUT_FILE")" + + : > "$OUTPUT_FILE" + : > "$PRESIGNED_OUTPUT_FILE" + + # Verify if the input file exists + if [ ! -f "$ARTIFACT_URLS_FILE_TEMP" ]; then + echo "The input file $ARTIFACT_URLS_FILE_TEMP does not exist." >&2 + exit 1 + fi + + # Process the file line by line (replacing ocurrences) + while IFS= read -r line || [ -n "$line" ]; do + # Skip empty lines and comments + if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then + echo "$line" >> "$OUTPUT_FILE" + continue + fi + + # Replace variables with their actual values + line=${line//\$\{\{ vars.AWS_S3_BUCKET_DEV \}\}/${{ vars.AWS_S3_BUCKET_DEV }}} + line=${line//\$\{\{ env.MAJOR \}\}/$WAZUH_MAJOR} + line=${line//\$\{\{ env.WAZUH_VERSION \}\}/$WAZUH_VERSION} + + # Replace component revisions + line=${line//\$\{\{ env.INDEXER_REVISION \}\}/$REFERENCE} + line=${line//\$\{\{ env.MANAGER_REVISION \}\}/$REFERENCE} + line=${line//\$\{\{ env.DASHBOARD_REVISION \}\}/$REFERENCE} + line=${line//\$\{\{ env.AGENT_REVISION \}\}/$REFERENCE} + + # Append the processed line to the output file + echo "$line" >> "$OUTPUT_FILE" + done < "$ARTIFACT_URLS_FILE_TEMP" + + # Verify the output file + if [ -f "$OUTPUT_FILE" ]; then + echo "The downloaded file artifact_urls.yml was successfully processed at $OUTPUT_FILE." + else + echo "Failed to create processed artifact_urls.yml file." >&2 + exit 1 + fi + + # Generate the presigned URLs for each package + while IFS= read -r line || [ -n "$line" ]; do + # Skip empty lines and comments + if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then + echo "$line" >> "$PRESIGNED_OUTPUT_FILE" + continue + fi + + # Extract both package_name and package_s3_uri from the line + if [[ "$line" =~ ^([a-zA-Z0-9_]+):[[:space:]]*\"?s3://([^\"[:space:]]+) ]]; then + PACKAGE_NAME="${BASH_REMATCH[1]}" + PACKAGE_S3_URI="s3://${BASH_REMATCH[2]}" + + # Check if the object exists in S3 + BUCKET_NAME=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 3) + OBJ_KEY=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 4-) + if ! aws s3api head-object --bucket "$BUCKET_NAME" --key "$OBJ_KEY" --region us-west-1 > /dev/null 2>&1; then + echo "Object $PACKAGE_S3_URI does not exist. Skipping..." >&2 + continue + fi + + # Generate a pre-signed URL for the S3 URI + echo "Generating pre-signed URL for $PACKAGE_NAME..." + PRESIGNED_URL=$(aws s3 presign "$PACKAGE_S3_URI" --expires-in 43200 --region us-west-1) + presigned_url_line="$PACKAGE_NAME: \"$PRESIGNED_URL\"" + + # Append the processed line to the output file + echo "$presigned_url_line" >> "$PRESIGNED_OUTPUT_FILE" + else + echo "$line" >> "$PRESIGNED_OUTPUT_FILE" + + echo "Skipping line for presigning (no S3 URI found):" + echo "$line" + fi + done < "$OUTPUT_FILE" + + # Verify the presigned urls file + if [ -f "$PRESIGNED_OUTPUT_FILE" ]; then + echo "Presigned URLs file created successfully at $PRESIGNED_OUTPUT_FILE." + else + echo "Failed to create presigned artifact_urls.yml file." >&2 + exit 1 + fi + + # Also store the final file as the name expected by build-images.sh + cp "$PRESIGNED_OUTPUT_FILE" artifact_urls.yml + + - name: Save presigned URLs file to artifact + if: ${{ inputs.dev == true }} + uses: actions/upload-artifact@v4 + with: + name: presigned-artifact-urls-${{ github.run_id }} + path: artifact_urls.yml + build-and-push: runs-on: ubuntu-22.04 - permissions: - id-token: write - contents: read - needs: - setup + - package-urls strategy: fail-fast: false # all jobs will run even if one fails @@ -171,33 +315,12 @@ jobs: username: ${{ secrets.DOCKERHUB_USERNAME }} password: ${{ secrets.DOCKERHUB_PASSWORD }} - - name: Create artifact_urls.yml file - if : ${{ inputs.dev == true }} - run: | - cat << EOF > artifact_urls.yml - wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" - wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" - wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" - wazuh_manager_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)" - wazuh_indexer_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" - wazuh_indexer_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" - wazuh_indexer_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" - wazuh_indexer_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)" - wazuh_dashboard_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" - wazuh_dashboard_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" - wazuh_dashboard_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" - wazuh_dashboard_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)" - wazuh_agent_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)" - wazuh_agent_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)" - wazuh_agent_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)" - wazuh_agent_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)" - wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)" - wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)" - wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)" - wazuh_certs_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)" - wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)" - EOF - working-directory: ./build-docker-images + - name: Download artifact_urls.yml (dev) + if: ${{ inputs.dev == true }} + uses: actions/download-artifact@v4 + with: + name: presigned-artifact-urls-${{ github.run_id }} + path: ./build-docker-images - name: Build Wazuh images run: |