forked from wazuh/wazuh-docker
Add separate URL generation job to Docker image push workflow
This commit is contained in:
Jesus Garcia
@@ -68,14 +68,14 @@ on:
|
||||
default: false
|
||||
required: false
|
||||
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
setup:
|
||||
runs-on: ubuntu-22.04
|
||||
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
|
||||
outputs:
|
||||
WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
|
||||
|
||||
@@ -118,15 +118,159 @@ jobs:
|
||||
echo "WAZUH_COMPONENTS=[\"wazuh-manager\",\"wazuh-dashboard\",\"wazuh-indexer\",\"wazuh-agent\"]" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
package-urls:
|
||||
name: generate package urls
|
||||
runs-on: ubuntu-22.04
|
||||
needs: setup
|
||||
|
||||
env:
|
||||
ARTIFACT_URLS_FILE_TEMP: "/tmp/wazuh-docker/artifact_urls.yml"
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
with:
|
||||
ref: ${{ inputs.docker_reference }}
|
||||
|
||||
- name: Configure AWS credentials
|
||||
if: ${{ inputs.dev == true }}
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
aws-region: ${{ secrets.AWS_REGION }}
|
||||
|
||||
- name: Download S3 package URIs file (if applicable)
|
||||
if: ${{ inputs.dev == true }}
|
||||
run: |
|
||||
mkdir -p "$(dirname "$ARTIFACT_URLS_FILE_TEMP")"
|
||||
|
||||
# Download the S3 package URIs file
|
||||
S3_BUCKET="${{ secrets.ARTIFACTS_S3_BUCKET }}"
|
||||
S3_KEY="deployment/artifact_urls.yml"
|
||||
aws s3 cp "s3://$S3_BUCKET/$S3_KEY" "$ARTIFACT_URLS_FILE_TEMP" --region us-west-1
|
||||
|
||||
# Verify the file was downloaded
|
||||
if [ -f "$ARTIFACT_URLS_FILE_TEMP" ]; then
|
||||
echo "S3 package URIs file downloaded successfully."
|
||||
else
|
||||
echo "Failed to download S3 package URIs file." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Generate the variables file (signing each package URI)
|
||||
if: ${{ inputs.dev == true }}
|
||||
run: |
|
||||
# Define necessary variables
|
||||
WAZUH_VERSION_RAW="${{ inputs.image_tag }}"
|
||||
WAZUH_VERSION="${WAZUH_VERSION_RAW%%-*}"
|
||||
WAZUH_MAJOR="${WAZUH_VERSION%%.*}"
|
||||
REFERENCE="${{ inputs.reference }}"
|
||||
|
||||
OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_processed.yml"
|
||||
PRESIGNED_OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_presigned.yml"
|
||||
|
||||
mkdir -p "$(dirname "$OUTPUT_FILE")"
|
||||
|
||||
: > "$OUTPUT_FILE"
|
||||
: > "$PRESIGNED_OUTPUT_FILE"
|
||||
|
||||
# Verify if the input file exists
|
||||
if [ ! -f "$ARTIFACT_URLS_FILE_TEMP" ]; then
|
||||
echo "The input file $ARTIFACT_URLS_FILE_TEMP does not exist." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Process the file line by line (replacing ocurrences)
|
||||
while IFS= read -r line || [ -n "$line" ]; do
|
||||
# Skip empty lines and comments
|
||||
if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
|
||||
echo "$line" >> "$OUTPUT_FILE"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Replace variables with their actual values
|
||||
line=${line//\$\{\{ vars.AWS_S3_BUCKET_DEV \}\}/${{ vars.AWS_S3_BUCKET_DEV }}}
|
||||
line=${line//\$\{\{ env.MAJOR \}\}/$WAZUH_MAJOR}
|
||||
line=${line//\$\{\{ env.WAZUH_VERSION \}\}/$WAZUH_VERSION}
|
||||
|
||||
# Replace component revisions
|
||||
line=${line//\$\{\{ env.INDEXER_REVISION \}\}/$REFERENCE}
|
||||
line=${line//\$\{\{ env.MANAGER_REVISION \}\}/$REFERENCE}
|
||||
line=${line//\$\{\{ env.DASHBOARD_REVISION \}\}/$REFERENCE}
|
||||
line=${line//\$\{\{ env.AGENT_REVISION \}\}/$REFERENCE}
|
||||
|
||||
# Append the processed line to the output file
|
||||
echo "$line" >> "$OUTPUT_FILE"
|
||||
done < "$ARTIFACT_URLS_FILE_TEMP"
|
||||
|
||||
# Verify the output file
|
||||
if [ -f "$OUTPUT_FILE" ]; then
|
||||
echo "The downloaded file artifact_urls.yml was successfully processed at $OUTPUT_FILE."
|
||||
else
|
||||
echo "Failed to create processed artifact_urls.yml file." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Generate the presigned URLs for each package
|
||||
while IFS= read -r line || [ -n "$line" ]; do
|
||||
# Skip empty lines and comments
|
||||
if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
|
||||
echo "$line" >> "$PRESIGNED_OUTPUT_FILE"
|
||||
continue
|
||||
fi
|
||||
|
||||
# Extract both package_name and package_s3_uri from the line
|
||||
if [[ "$line" =~ ^([a-zA-Z0-9_]+):[[:space:]]*\"?s3://([^\"[:space:]]+) ]]; then
|
||||
PACKAGE_NAME="${BASH_REMATCH[1]}"
|
||||
PACKAGE_S3_URI="s3://${BASH_REMATCH[2]}"
|
||||
|
||||
# Check if the object exists in S3
|
||||
BUCKET_NAME=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 3)
|
||||
OBJ_KEY=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 4-)
|
||||
if ! aws s3api head-object --bucket "$BUCKET_NAME" --key "$OBJ_KEY" --region us-west-1 > /dev/null 2>&1; then
|
||||
echo "Object $PACKAGE_S3_URI does not exist. Skipping..." >&2
|
||||
continue
|
||||
fi
|
||||
|
||||
# Generate a pre-signed URL for the S3 URI
|
||||
echo "Generating pre-signed URL for $PACKAGE_NAME..."
|
||||
PRESIGNED_URL=$(aws s3 presign "$PACKAGE_S3_URI" --expires-in 43200 --region us-west-1)
|
||||
presigned_url_line="$PACKAGE_NAME: \"$PRESIGNED_URL\""
|
||||
|
||||
# Append the processed line to the output file
|
||||
echo "$presigned_url_line" >> "$PRESIGNED_OUTPUT_FILE"
|
||||
else
|
||||
echo "$line" >> "$PRESIGNED_OUTPUT_FILE"
|
||||
|
||||
echo "Skipping line for presigning (no S3 URI found):"
|
||||
echo "$line"
|
||||
fi
|
||||
done < "$OUTPUT_FILE"
|
||||
|
||||
# Verify the presigned urls file
|
||||
if [ -f "$PRESIGNED_OUTPUT_FILE" ]; then
|
||||
echo "Presigned URLs file created successfully at $PRESIGNED_OUTPUT_FILE."
|
||||
else
|
||||
echo "Failed to create presigned artifact_urls.yml file." >&2
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# Also store the final file as the name expected by build-images.sh
|
||||
cp "$PRESIGNED_OUTPUT_FILE" artifact_urls.yml
|
||||
|
||||
- name: Save presigned URLs file to artifact
|
||||
if: ${{ inputs.dev == true }}
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: artifact_urls.yml
|
||||
|
||||
build-and-push:
|
||||
runs-on: ubuntu-22.04
|
||||
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
|
||||
needs:
|
||||
- setup
|
||||
- package-urls
|
||||
|
||||
strategy:
|
||||
fail-fast: false # all jobs will run even if one fails
|
||||
@@ -171,33 +315,12 @@ jobs:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Create artifact_urls.yml file
|
||||
if : ${{ inputs.dev == true }}
|
||||
run: |
|
||||
cat << EOF > artifact_urls.yml
|
||||
wazuh_manager_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
|
||||
wazuh_manager_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
|
||||
wazuh_manager_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
|
||||
wazuh_manager_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-manager-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
|
||||
wazuh_indexer_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
|
||||
wazuh_indexer_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
|
||||
wazuh_indexer_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
|
||||
wazuh_indexer_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-indexer-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
|
||||
wazuh_dashboard_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
|
||||
wazuh_dashboard_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
|
||||
wazuh_dashboard_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
|
||||
wazuh_dashboard_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-dashboard-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
|
||||
wazuh_agent_url_amd64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_amd64.deb --expires-in 3600 --region us-west-1)"
|
||||
wazuh_agent_url_arm64_deb: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent_5.0.0-${{ inputs.reference }}_arm64.deb --expires-in 3600 --region us-west-1)"
|
||||
wazuh_agent_url_x86_64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.x86_64.rpm --expires-in 3600 --region us-west-1)"
|
||||
wazuh_agent_url_aarch64_rpm: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.aarch64.rpm --expires-in 3600 --region us-west-1)"
|
||||
wazuh_agent_url_i386_msi: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.i386.msi --expires-in 3600 --region us-west-1)"
|
||||
wazuh_agent_url_intel64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.intel64.pkg --expires-in 3600 --region us-west-1)"
|
||||
wazuh_agent_url_arm64_pkg: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/main/packages/wazuh-agent-5.0.0-${{ inputs.reference }}.arm64.pkg --expires-in 3600 --region us-west-1)"
|
||||
wazuh_certs_tool: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/wazuh-certs-tool.sh --expires-in 3600 --region us-west-1)"
|
||||
wazuh_config_yml: "$(aws s3 presign s3://${{ vars.AWS_S3_BUCKET_DEV }}/development/wazuh/5.x/secondary/installation-assistant/5.0.0/config.yml --expires-in 3600 --region us-west-1)"
|
||||
EOF
|
||||
working-directory: ./build-docker-images
|
||||
- name: Download artifact_urls.yml (dev)
|
||||
if: ${{ inputs.dev == true }}
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ./build-docker-images
|
||||
|
||||
- name: Build Wazuh images
|
||||
run: |
|
||||
|
||||
Reference in New Issue
Block a user