From a480db9efcb45aa466338055091cb737482b6603 Mon Sep 17 00:00:00 2001 From: Jesus Garcia Date: Mon, 9 Feb 2026 13:16:48 -0500 Subject: [PATCH 1/3] Improve build script and workflow component revisions handling --- .../Procedure_push_docker_images.yml | 129 ++++++++++++++---- build-docker-images/build-images.sh | 78 ++++++++--- 2 files changed, 159 insertions(+), 48 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 864e4ffe..1546bb6b 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -21,7 +21,7 @@ on: default: '1' required: true commit_list: - description: 'Wazuh components revisions (comma-separated string list) ["indexer", "manager", "dashboard", "agent"]' + description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product' type: string default: '["latest", "latest", "latest", "latest"]' id: @@ -55,7 +55,7 @@ on: required: true type: string commit_list: - description: 'Wazuh components revisions (comma-separated string list) ["indexer", "manager", "dashboard", "agent"]' + description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product' type: string default: '["latest", "latest", "latest", "latest"]' id: @@ -103,30 +103,45 @@ jobs: - name: Set up variables id: compute-outputs run: | + # Set WAZUH_COMPONENTS + WC_JSON_ARRAY="" if [[ "${{ inputs.products }}" != "null" && "${{ inputs.products }}" != "" ]]; then # Convert comma-separated list to JSON array format IFS=',' read -ra COMPONENTS <<< "${{ inputs.products }}" - JSON_ARRAY="[" + WC_JSON_ARRAY="[" for i in "${!COMPONENTS[@]}"; do if [ $i -gt 0 ]; then - JSON_ARRAY+="," + WC_JSON_ARRAY+="," fi - JSON_ARRAY+="\"${COMPONENTS[$i]}\"" + WC_JSON_ARRAY+="\"${COMPONENTS[$i]}\"" done - JSON_ARRAY+="]" - echo "WAZUH_COMPONENTS=$JSON_ARRAY" >> $GITHUB_OUTPUT + WC_JSON_ARRAY+="]" else - echo "WAZUH_COMPONENTS=[\"wazuh-manager\",\"wazuh-dashboard\",\"wazuh-indexer\",\"wazuh-agent\"]" >> $GITHUB_OUTPUT + WC_JSON_ARRAY='["wazuh-manager","wazuh-dashboard","wazuh-indexer","wazuh-agent"]' fi + echo "Products to build: $WC_JSON_ARRAY" + echo "WAZUH_COMPONENTS=$WC_JSON_ARRAY" >> $GITHUB_OUTPUT - # Set REVISIONS - if [[ "${{ inputs.commit_list }}" != "null" && "${{ inputs.commit_list }}" != "" ]]; then - COMMIT_LIST='${{ inputs.commit_list }}' - else - COMMIT_LIST='["latest", "latest", "latest", "latest"]' + # Set COMMIT_LIST + WC_COMMIT_LIST="" + if [[ "${{ inputs.dev }}" == "true" ]]; then + if [[ "${{ inputs.commit_list }}" != "null" && "${{ inputs.commit_list }}" != "" ]]; then + WC_COMMIT_LIST='${{ inputs.commit_list }}' + else + # Set commit list to "latest" for all components using WAZUH_COMPONENTS + COMPONENTS=($(echo "$WC_JSON_ARRAY" | jq -r '.[]')) + WC_COMMIT_LIST="[" + for i in "${!COMPONENTS[@]}"; do + if [ $i -gt 0 ]; then + WC_COMMIT_LIST+=" ," + fi + WC_COMMIT_LIST+="\"latest\"" + done + WC_COMMIT_LIST+="]" + fi + echo "Revision list: $WC_COMMIT_LIST" fi - echo "COMMIT_LIST=$COMMIT_LIST" >> $GITHUB_OUTPUT - echo "Revision list (indexer, manager, dashboard, agent): $COMMIT_LIST" + echo "COMMIT_LIST=$WC_COMMIT_LIST" >> $GITHUB_OUTPUT package-urls: name: generate package urls @@ -169,21 +184,26 @@ jobs: WAZUH_VERSION_RAW="${{ inputs.image_tag }}" WAZUH_VERSION="${WAZUH_VERSION_RAW%%-*}" WAZUH_MAJOR="${WAZUH_VERSION%%.*}" + WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}' COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}' + INDEXER_COMMIT="" + MANAGER_COMMIT="" + DASHBOARD_COMMIT="" + AGENT_COMMIT="" + OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_processed.yml" PRESIGNED_OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_presigned.yml" - mkdir -p "$(dirname "$OUTPUT_FILE")" : > "$OUTPUT_FILE" : > "$PRESIGNED_OUTPUT_FILE" - # Extract revisions using jq - INDEXER_COMMIT=$(echo "$COMMIT_LIST" | jq -r '.[0]') - MANAGER_COMMIT=$(echo "$COMMIT_LIST" | jq -r '.[1]') - DASHBOARD_COMMIT=$(echo "$COMMIT_LIST" | jq -r '.[2]') - AGENT_COMMIT=$(echo "$COMMIT_LIST" | jq -r '.[3]') + # Validate WAZUH_COMPONENTS and COMMIT_LIST have the same length + if [ "$(jq length <<<"$WAZUH_COMPONENTS")" -ne "$(jq length <<<"$COMMIT_LIST")" ]; then + echo "WAZUH_COMPONENTS and COMMIT_LIST must have the same length." >&2 + exit 1 + fi # Verify if the input file exists if [ ! -f "$ARTIFACT_URLS_FILE_TEMP" ]; then @@ -191,11 +211,39 @@ jobs: exit 1 fi + # Set each component's commit/revison based on the input lists + for i in $(seq 0 $(($(echo "$WAZUH_COMPONENTS" | jq length) - 1))); do + COMPONENT=$(echo "$WAZUH_COMPONENTS" | jq -r ".[$i]") + COMMIT=$(echo "$COMMIT_LIST" | jq -r ".[$i]") + + case $COMPONENT in + "wazuh-indexer") + INDEXER_COMMIT="$COMMIT" + echo "Indexer commit set to: $COMMIT" + ;; + "wazuh-manager") + MANAGER_COMMIT="$COMMIT" + echo "Manager commit set to: $COMMIT" + ;; + "wazuh-dashboard") + DASHBOARD_COMMIT="$COMMIT" + echo "Dashboard commit set to: $COMMIT" + ;; + "wazuh-agent") + AGENT_COMMIT="$COMMIT" + echo "Agent commit set to: $COMMIT" + ;; + *) + echo "Unknown component: $COMPONENT." + exit 1 + ;; + esac + done + # Process the file line by line (replacing ocurrences) while IFS= read -r line || [ -n "$line" ]; do # Skip empty lines and comments if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then - echo "$line" >> "$OUTPUT_FILE" continue fi @@ -227,7 +275,6 @@ jobs: while IFS= read -r line || [ -n "$line" ]; do # Skip empty lines and comments if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then - echo "$line" >> "$PRESIGNED_OUTPUT_FILE" continue fi @@ -253,7 +300,6 @@ jobs: echo "$presigned_url_line" >> "$PRESIGNED_OUTPUT_FILE" else echo "$line" >> "$PRESIGNED_OUTPUT_FILE" - echo "Skipping line for presigning (no S3 URI found):" echo "$line" fi @@ -267,7 +313,7 @@ jobs: exit 1 fi - # Also store the final file as the name expected by build-images.sh + # Store file with the same name expected by build-images.sh cp "$PRESIGNED_OUTPUT_FILE" artifact_urls.yml - name: Save presigned URLs file to artifact @@ -333,7 +379,6 @@ jobs: - name: Build Wazuh images run: | - COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}' if [[ "$IMAGE_TAG" == *"-"* ]]; then IFS='-' read -r -a tokens <<< "$IMAGE_TAG" if [ -z "${tokens[1]}" ]; then @@ -343,15 +388,39 @@ jobs: DEV_STAGE=${tokens[1]} WAZUH_VER=${tokens[0]} if [ "${{ inputs.dev }}" = true ]; then - ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -rg $IMAGE_REGISTRY -m -refs "$COMMIT_LIST" -c ${{ matrix.wazuh_component }} + ./build-images.sh \ + -v $WAZUH_VER \ + -r $REVISION \ + -d $DEV_STAGE \ + -rg $IMAGE_REGISTRY \ + -m \ + -refs "${{ needs.setup.outputs.COMMIT_LIST }}" \ + -c ${{ matrix.wazuh_component }} else - ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }} + ./build-images.sh \ + -v $WAZUH_VER \ + -r $REVISION \ + -d $DEV_STAGE \ + -rg $IMAGE_REGISTRY \ + -m \ + -c ${{ matrix.wazuh_component }} fi else if [ "${{ inputs.dev }}" = true ]; then - ./build-images.sh -v $IMAGE_TAG -r $REVISION -rg $IMAGE_REGISTRY -m -refs "$COMMIT_LIST" -c ${{ matrix.wazuh_component }} + ./build-images.sh \ + -v $IMAGE_TAG \ + -r $REVISION \ + -rg $IMAGE_REGISTRY \ + -m \ + -refs "${{ needs.setup.outputs.COMMIT_LIST }}" \ + -c ${{ matrix.wazuh_component }} else - ./build-images.sh -v $IMAGE_TAG -r $REVISION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }} + ./build-images.sh \ + -v $IMAGE_TAG \ + -r $REVISION \ + -rg $IMAGE_REGISTRY \ + -m \ + -c ${{ matrix.wazuh_component }} fi fi # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV diff --git a/build-docker-images/build-images.sh b/build-docker-images/build-images.sh index aba70691..2cf67656 100755 --- a/build-docker-images/build-images.sh +++ b/build-docker-images/build-images.sh @@ -19,7 +19,7 @@ WAZUH_REGISTRY=docker.io WAZUH_IMAGE_VERSION="5.0.0" WAZUH_TAG_REVISION="1" WAZUH_DEV_STAGE="" -WAZUH_COMPONENTS_COMMIT_LIST='["latest", "latest", "latest", "latest"]' +WAZUH_COMPONENTS_COMMIT_LIST='' # ----------------------------------------------------------------------------- @@ -63,22 +63,63 @@ build() { awk -F':' '!/^#/ && NF>1 {name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' $ARTIFACT_URLS_FILE > artifacts_env.txt - # Parse component commit list if provided - if [ -n "${WAZUH_COMPONENTS_COMMIT_LIST}" ]; then - # Extract individual commits from JSON array format: ["indexer", "manager", "dashboard", "agent"] - INDEXER_COMMIT=$(echo "${WAZUH_COMPONENTS_COMMIT_LIST}" | grep -o '"[^"]*"' | sed -n '1p' | tr -d '"') - MANAGER_COMMIT=$(echo "${WAZUH_COMPONENTS_COMMIT_LIST}" | grep -o '"[^"]*"' | sed -n '2p' | tr -d '"') - DASHBOARD_COMMIT=$(echo "${WAZUH_COMPONENTS_COMMIT_LIST}" | grep -o '"[^"]*"' | sed -n '3p' | tr -d '"') - AGENT_COMMIT=$(echo "${WAZUH_COMPONENTS_COMMIT_LIST}" | grep -o '"[^"]*"' | sed -n '4p' | tr -d '"') + # Set component commit references for development builds + if [ -n "${WAZUH_DEV_STAGE}" ]; then + if [ -z "${WAZUH_COMPONENTS_COMMIT_LIST}" ]; then + # Set default to 'latest' for all components if no specific references are provided + INDEXER_COMMIT="latest" + MANAGER_COMMIT="latest" + DASHBOARD_COMMIT="latest" + AGENT_COMMIT="latest" + else + if ! printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" \ + | jq -e 'type=="array" and (all(.[]; type=="string"))' >/dev/null 2>&1; then + echo 'Error: --references must be a JSON array of strings, e.g. ["ref1","ref2","ref3","ref4"]' >&2 + clean 1 + fi - echo "Component commits parsed:" - echo " - Indexer: ${INDEXER_COMMIT}" - echo " - Manager: ${MANAGER_COMMIT}" - echo " - Dashboard: ${DASHBOARD_COMMIT}" - echo " - Agent: ${AGENT_COMMIT}" - elif [ -n "${WAZUH_DEV_STAGE}" ]; then - echo "Error: Not found WAZUH_COMPONENTS_COMMIT_LIST." >&2 - clean 1 + refs_count="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r 'length')" + if [ -z "${WAZUH_COMPONENT}" ]; then + # No specific component to be build: require exactly 4 items + if [ "${refs_count}" -ne 4 ]; then + echo "Error: --references must contain exactly 4 items when no --component is specified." >&2 + clean 1 + fi + + # Set all component commits + + INDEXER_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[0]')" + MANAGER_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[1]')" + DASHBOARD_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[2]')" + AGENT_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[3]')" + else + # Specific component to be build: allow 1 (component-only) + if [ "${refs_count}" -ne 1 ]; then + echo "Error: --references must contain exactly 1 item when --component is specified." >&2 + clean 1 + fi + + # Set specific component commit + case "${WAZUH_COMPONENT}" in + wazuh-indexer) + INDEXER_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[0]')" + ;; + wazuh-manager) + MANAGER_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[0]')" + ;; + wazuh-dashboard) + DASHBOARD_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[0]')" + ;; + wazuh-agent) + AGENT_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[0]')" + ;; + *) + echo "Error: Unknown component '${WAZUH_COMPONENT}'" >&2 + clean 1 + ;; + esac + fi + fi fi @@ -215,7 +256,7 @@ help() { echo echo " -d, --dev [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default." echo " -r, --revision [Optional] Package revision. By default ${WAZUH_TAG_REVISION}" - echo " -refs, --references [Optional] Set each Wazuh component reference to be build (indexer, manager, dasboard and agent). Only used for development builds. By default, using the latest release: ['latest', 'latest', 'latest', 'latest']" + echo " -refs, --references [Optional] [Only for Dev] JSON array of commit refs for components to be build (indexer, manager, dashboard, agent) in order. Defaults to latest." echo " -rg, --registry [Optional] Set the Docker registry to push the images." echo " -c, --component [Required] Set the Wazuh component to build. Accepted values: 'wazuh-indexer', 'wazuh-manager', 'wazuh-dashboard', 'wazuh-agent'." echo " -v, --version [Optional] Set the Wazuh version should be builded. By default, ${WAZUH_IMAGE_VERSION}." @@ -256,7 +297,8 @@ main() { ;; "-refs"|"--references") if [ -n "${2}" ]; then - WAZUH_COMPONENTS_COMMIT_LIST="${2}" + # Replace single quotes with double quotes to ensure it's valid JSON for jq processing + WAZUH_COMPONENTS_COMMIT_LIST="$(printf '%s' "${2}" | sed "s/'/\"/g")" shift 2 else help 1 From 052fb765ed2d0d10148ff7331b8be666264b1992 Mon Sep 17 00:00:00 2001 From: Jesus Garcia Date: Mon, 9 Feb 2026 13:25:44 -0500 Subject: [PATCH 2/3] Compute component references dynamically --- .../workflows/Procedure_push_docker_images.yml | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 1546bb6b..3b750ceb 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -377,6 +377,19 @@ jobs: name: presigned-artifact-urls-${{ github.run_id }} path: ./build-docker-images + - name: Compute component reference (dev) + if: ${{ inputs.dev == true }} + run: | + COMPONENT='${{ matrix.wazuh_component }}' + WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}' + COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}' + + idx=$(jq -r --arg c "$COMPONENT" 'index($c)' <<<"$WAZUH_COMPONENTS") + ref=$(jq -r --argjson i "$idx" '.[ $i ]' <<<"$COMMIT_LIST") + + echo "COMPONENT_REFS_JSON=[\"$ref\"]" >> "$GITHUB_ENV" + echo "Using component ref for $COMPONENT: $ref" + - name: Build Wazuh images run: | if [[ "$IMAGE_TAG" == *"-"* ]]; then @@ -394,7 +407,7 @@ jobs: -d $DEV_STAGE \ -rg $IMAGE_REGISTRY \ -m \ - -refs "${{ needs.setup.outputs.COMMIT_LIST }}" \ + -refs "$COMPONENT_REFS_JSON" \ -c ${{ matrix.wazuh_component }} else ./build-images.sh \ @@ -412,7 +425,7 @@ jobs: -r $REVISION \ -rg $IMAGE_REGISTRY \ -m \ - -refs "${{ needs.setup.outputs.COMMIT_LIST }}" \ + -refs "$COMPONENT_REFS_JSON" \ -c ${{ matrix.wazuh_component }} else ./build-images.sh \ From 60896b92a01a587eab120edd513fc861616b79c8 Mon Sep 17 00:00:00 2001 From: Jesus Garcia Date: Mon, 9 Feb 2026 16:41:31 -0500 Subject: [PATCH 3/3] Update changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4461fd73..f8de0607 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,6 +9,7 @@ All notable changes to this project will be documented in this file. ### Changed +- Improve build script and workflow component revisions handling ([#2212](https://github.com/wazuh/wazuh-docker/pull/2212)) - Add Wazuh version and revision into wazuh-certs-tool and config file ([#2195](https://github.com/wazuh/wazuh-docker/pull/2195)) - Improve S3 artifact URLs handling ([#2183](https://github.com/wazuh/wazuh-docker/pull/2183)) - Allow building separate targets ([#2177](https://github.com/wazuh/wazuh-docker/pull/2177))