diff --git a/.github/workflows/Procedure_push_docker_images.yml b/.github/workflows/Procedure_push_docker_images.yml index 48202f12..0a05031d 100644 --- a/.github/workflows/Procedure_push_docker_images.yml +++ b/.github/workflows/Procedure_push_docker_images.yml @@ -11,6 +11,10 @@ on: docker_reference: description: 'wazuh-docker reference' required: true + wazuh_automation_reference: + description: 'Branch or tag of the wazuh-automation repository' + required: true + default: 'main' products: description: 'Comma-separated list of the image names to build and push' default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' @@ -40,6 +44,11 @@ on: description: 'wazuh-docker reference' required: false type: string + wazuh_automation_reference: + description: 'Branch or tag of the wazuh-automation repository' + required: true + default: 'main' + type: string products: description: 'Comma-separated list of the image names to build and push' default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent' @@ -141,9 +150,21 @@ jobs: needs: setup env: - ARTIFACT_URLS_FILE_TEMP: "/tmp/wazuh-docker/artifact_urls.yml" + WORKFLOW_VENV: "${{ github.workspace }}/workflow_venv" + GENERATE_PRESIGNED_URLS_SCRIPT_PATH: ${{ github.workspace }}/wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py + PRESIGNED_URLS_SCRIPT_PROCESS: "build_docker" + LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/artifact_urls.yml steps: + + - name: Checkout wazuh/wazuh-automation repository + uses: actions/checkout@v4 + with: + repository: wazuh/wazuh-automation + ref: ${{ inputs.wazuh_automation_reference }} + token: ${{ secrets.GH_CLONE_TOKEN }} + path: wazuh-automation + - name: Configure AWS credentials if: ${{ inputs.dev == true }} uses: aws-actions/configure-aws-credentials@v4 @@ -151,169 +172,65 @@ jobs: role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }} aws-region: ${{ secrets.AWS_REGION }} - - name: Download S3 package URIs file (if applicable) + - name: Set up Python + uses: actions/setup-python@v6 + with: + python-version: '3.12' + + - name: Get Wazuh version if: ${{ inputs.dev == true }} run: | - mkdir -p "$(dirname "$ARTIFACT_URLS_FILE_TEMP")" + WAZUH_VERSION=$(jq -r '.version' VERSION.json) + WAZUH_MAJOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1) + WAZUH_MINOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1-2) + echo WAZUH_VERSION=$WAZUH_VERSION >> $GITHUB_ENV + echo WAZUH_MAJOR=$WAZUH_MAJOR >> $GITHUB_ENV + echo WAZUH_MINOR=$WAZUH_MINOR >> $GITHUB_ENV - # Download the S3 package URIs file - S3_BUCKET="${{ secrets.ARTIFACTS_S3_BUCKET }}" - S3_KEY="deployment/artifact_urls.yml" - aws s3 cp "s3://$S3_BUCKET/$S3_KEY" "$ARTIFACT_URLS_FILE_TEMP" --region us-west-1 - - # Verify the file was downloaded - if [ -f "$ARTIFACT_URLS_FILE_TEMP" ]; then - echo "S3 package URIs file downloaded successfully." - else - echo "Failed to download S3 package URIs file." >&2 - exit 1 - fi - - - name: Generate the variables file (signing each package URI) + - name: Get artifacts URLs file if: ${{ inputs.dev == true }} run: | - # Define necessary variables - WAZUH_VERSION_RAW="${{ inputs.image_tag }}" - WAZUH_VERSION="${WAZUH_VERSION_RAW%%-*}" - WAZUH_MAJOR="${WAZUH_VERSION%%.*}" - WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}' - COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}' + LOCAL_AWS_S3_BUCKET_DEV=${{ vars.AWS_S3_BUCKET_DEV }} + echo LOCAL_AWS_S3_BUCKET_DEV=$LOCAL_AWS_S3_BUCKET_DEV >> $GITHUB_ENV - INDEXER_COMMIT="" - MANAGER_COMMIT="" - DASHBOARD_COMMIT="" - AGENT_COMMIT="" + - name: Install and configure python and workflow dependencies + if: ${{ inputs.dev == true }} + run: | + sudo apt-get update + sudo apt-get install -y jq + sudo wget -q https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq + sudo chmod +x /usr/bin/yq + sudo apt-get install -y python3-venv + python3 -m venv ${{ env.WORKFLOW_VENV }} + source ${{ env.WORKFLOW_VENV }}/bin/activate + pip install --upgrade pip + pip install pyyaml - OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_processed.yml" - PRESIGNED_OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_presigned.yml" - mkdir -p "$(dirname "$OUTPUT_FILE")" + - name: Generate presigned URLs for artifacts for dev packages + if: ${{ inputs.dev == true }} + run: | + INDEXER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[0]') + MANAGER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[1]') + DASHBOARD_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[2]') + AGENT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[3]') + ASSISTANT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[4]') - : > "$OUTPUT_FILE" - : > "$PRESIGNED_OUTPUT_FILE" - - # Validate WAZUH_COMPONENTS and COMMIT_LIST have the same length - if [ "$(jq length <<<"$WAZUH_COMPONENTS")" -ne "$(jq length <<<"$COMMIT_LIST")" ]; then - echo "WAZUH_COMPONENTS and COMMIT_LIST must have the same length." >&2 - exit 1 - fi - - # Verify if the input file exists - if [ ! -f "$ARTIFACT_URLS_FILE_TEMP" ]; then - echo "The input file $ARTIFACT_URLS_FILE_TEMP does not exist." >&2 - exit 1 - fi - - # Set each component's commit/revision based on the input lists - for i in $(seq 0 $(($(echo "$WAZUH_COMPONENTS" | jq length) - 1))); do - COMPONENT=$(echo "$WAZUH_COMPONENTS" | jq -r ".[$i]") - COMMIT=$(echo "$COMMIT_LIST" | jq -r ".[$i]") - - case $COMPONENT in - "wazuh-indexer") - INDEXER_COMMIT="$COMMIT" - echo "Indexer commit set to: $COMMIT" - ;; - "wazuh-manager") - MANAGER_COMMIT="$COMMIT" - echo "Manager commit set to: $COMMIT" - ;; - "wazuh-dashboard") - DASHBOARD_COMMIT="$COMMIT" - echo "Dashboard commit set to: $COMMIT" - ;; - "wazuh-agent") - AGENT_COMMIT="$COMMIT" - echo "Agent commit set to: $COMMIT" - ;; - *) - echo "Unknown component: $COMPONENT." - exit 1 - ;; - esac - done - - # Process the file line by line (replacing ocurrences) - while IFS= read -r line || [ -n "$line" ]; do - # Skip empty lines and comments - if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then - continue - fi - - # Replace variables with their actual values - line=${line//\$\{\{ vars.AWS_S3_BUCKET_DEV \}\}/${{ vars.AWS_S3_BUCKET_DEV }}} - line=${line//\$\{\{ env.MAJOR \}\}/$WAZUH_MAJOR} - line=${line//\$\{\{ env.WAZUH_VERSION \}\}/$WAZUH_VERSION} - - # Replace component revisions - line=${line//\$\{\{ env.INDEXER_REVISION \}\}/$INDEXER_COMMIT} - line=${line//\$\{\{ env.MANAGER_REVISION \}\}/$MANAGER_COMMIT} - line=${line//\$\{\{ env.DASHBOARD_REVISION \}\}/$DASHBOARD_COMMIT} - line=${line//\$\{\{ env.AGENT_REVISION \}\}/$AGENT_COMMIT} - line=${line//\$\{\{ env.ASSISTANT_REVISION \}\}/latest} - - # Append the processed line to the output file - echo "$line" >> "$OUTPUT_FILE" - done < "$ARTIFACT_URLS_FILE_TEMP" - - # Verify the output file - if [ -f "$OUTPUT_FILE" ]; then - echo "The downloaded file artifact_urls.yml was successfully processed at $OUTPUT_FILE." - else - echo "Failed to create processed artifact_urls.yml file." >&2 - exit 1 - fi - - # Generate the presigned URLs for each package - while IFS= read -r line || [ -n "$line" ]; do - # Skip empty lines and comments - if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then - continue - fi - - # Extract both package_name and package_s3_uri from the line - if [[ "$line" =~ ^([a-zA-Z0-9_]+):[[:space:]]*\"?s3://([^\"[:space:]]+) ]]; then - PACKAGE_NAME="${BASH_REMATCH[1]}" - PACKAGE_S3_URI="s3://${BASH_REMATCH[2]}" - - # Check if the object exists in S3 - BUCKET_NAME=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 3) - OBJ_KEY=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 4-) - if ! aws s3api head-object --bucket "$BUCKET_NAME" --key "$OBJ_KEY" --region us-west-1 > /dev/null 2>&1; then - echo "Object $PACKAGE_S3_URI does not exist. Skipping..." >&2 - continue - fi - - # Generate a pre-signed URL for the S3 URI - echo "Generating pre-signed URL for $PACKAGE_NAME..." - PRESIGNED_URL=$(aws s3 presign "$PACKAGE_S3_URI" --expires-in 43200 --region us-west-1) - presigned_url_line="$PACKAGE_NAME: \"$PRESIGNED_URL\"" - - # Append the processed line to the output file - echo "$presigned_url_line" >> "$PRESIGNED_OUTPUT_FILE" - else - echo "$line" >> "$PRESIGNED_OUTPUT_FILE" - echo "Skipping line for presigning (no S3 URI found):" - echo "$line" - fi - done < "$OUTPUT_FILE" - - # Verify the presigned urls file - if [ -f "$PRESIGNED_OUTPUT_FILE" ]; then - echo "Presigned URLs file created successfully at $PRESIGNED_OUTPUT_FILE." - else - echo "Failed to create presigned artifact_urls.yml file." >&2 - exit 1 - fi - - # Store file with the same name expected by build-images.sh - cp "$PRESIGNED_OUTPUT_FILE" artifact_urls.yml + python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \ + --process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \ + --wazuh-version ${{ env.WAZUH_VERSION }} \ + --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \ + --indexer-revision $INDEXER_REVISION \ + --manager-revision $MANAGER_REVISION \ + --dashboard-revision $DASHBOARD_REVISION \ + --agent-revision $AGENT_REVISION \ + --assistant-revision $ASSISTANT_REVISION - name: Save presigned URLs file to artifact if: ${{ inputs.dev == true }} uses: actions/upload-artifact@v4 with: name: presigned-artifact-urls-${{ github.run_id }} - path: artifact_urls.yml + path: ${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }} build-and-push: runs-on: