Testing wazuh Docker image build with presigned url script

.github/workflows/Procedure_push_docker_images.yml

@@ -11,6 +11,10 @@ on:
       docker_reference:
         description: 'wazuh-docker reference'
         required: true
+      wazuh_automation_reference:
+        description: 'Branch or tag of the wazuh-automation repository'
+        required: true
+        default: 'main'
       products:
         description: 'Comma-separated list of the image names to build and push'
         default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
@@ -40,6 +44,11 @@ on:
         description: 'wazuh-docker reference'
         required: false
         type: string
+      wazuh_automation_reference:
+        description: 'Branch or tag of the wazuh-automation repository'
+        required: true
+        default: 'main'
+        type: string
       products:
         description: 'Comma-separated list of the image names to build and push'
         default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
@@ -141,9 +150,21 @@ jobs:
     needs: setup
 
     env:
-      ARTIFACT_URLS_FILE_TEMP: "/tmp/wazuh-docker/artifact_urls.yml"
+      WORKFLOW_VENV: "${{ github.workspace }}/workflow_venv"
+      GENERATE_PRESIGNED_URLS_SCRIPT_PATH: ${{ github.workspace }}/wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py
+      PRESIGNED_URLS_SCRIPT_PROCESS: "build_docker"
+      LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/artifact_urls.yml
 
     steps:
+
+      - name: Checkout wazuh/wazuh-automation repository
+        uses: actions/checkout@v4
+        with:
+          repository: wazuh/wazuh-automation
+          ref: ${{ inputs.wazuh_automation_reference }}
+          token: ${{ secrets.GH_CLONE_TOKEN }}
+          path: wazuh-automation
+
       - name: Configure AWS credentials
         if: ${{ inputs.dev == true }}
         uses: aws-actions/configure-aws-credentials@v4
@@ -151,169 +172,65 @@ jobs:
           role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
           aws-region: ${{ secrets.AWS_REGION }}
 
-      - name: Download S3 package URIs file (if applicable)
+      - name: Set up Python
+        uses: actions/setup-python@v6
+        with:
+          python-version: '3.12'
+
+      - name: Get Wazuh version
         if: ${{ inputs.dev == true }}
         run: |
-          mkdir -p "$(dirname "$ARTIFACT_URLS_FILE_TEMP")"
+          WAZUH_VERSION=$(jq -r '.version' VERSION.json)
+          WAZUH_MAJOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1)
+          WAZUH_MINOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1-2)
+          echo WAZUH_VERSION=$WAZUH_VERSION >> $GITHUB_ENV
+          echo WAZUH_MAJOR=$WAZUH_MAJOR >> $GITHUB_ENV
+          echo WAZUH_MINOR=$WAZUH_MINOR >> $GITHUB_ENV
 
-          # Download the S3 package URIs file
+      - name: Get artifacts URLs file
-          S3_BUCKET="${{ secrets.ARTIFACTS_S3_BUCKET }}"
-          S3_KEY="deployment/artifact_urls.yml"
-          aws s3 cp "s3://$S3_BUCKET/$S3_KEY" "$ARTIFACT_URLS_FILE_TEMP" --region us-west-1
-
-          # Verify the file was downloaded
-          if [ -f "$ARTIFACT_URLS_FILE_TEMP" ]; then
-            echo "S3 package URIs file downloaded successfully."
-          else
-            echo "Failed to download S3 package URIs file." >&2
-            exit 1
-          fi
-
-      - name: Generate the variables file (signing each package URI)
         if: ${{ inputs.dev == true }}
         run: |
-          # Define necessary variables
+          LOCAL_AWS_S3_BUCKET_DEV=${{ vars.AWS_S3_BUCKET_DEV }}
-          WAZUH_VERSION_RAW="${{ inputs.image_tag }}"
+          echo LOCAL_AWS_S3_BUCKET_DEV=$LOCAL_AWS_S3_BUCKET_DEV >> $GITHUB_ENV
-          WAZUH_VERSION="${WAZUH_VERSION_RAW%%-*}"
-          WAZUH_MAJOR="${WAZUH_VERSION%%.*}"
-          WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
-          COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
 
-          INDEXER_COMMIT=""
+      - name: Install and configure python and workflow dependencies
-          MANAGER_COMMIT=""
+        if: ${{ inputs.dev == true }}
-          DASHBOARD_COMMIT=""
+        run: |
-          AGENT_COMMIT=""
+          sudo apt-get update
+          sudo apt-get install -y jq
+          sudo wget -q https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64 -O /usr/bin/yq
+          sudo chmod +x /usr/bin/yq
+          sudo apt-get install -y python3-venv
+          python3 -m venv ${{ env.WORKFLOW_VENV }}
+          source ${{ env.WORKFLOW_VENV }}/bin/activate
+          pip install --upgrade pip
+          pip install pyyaml
 
-          OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_processed.yml"
+      - name: Generate presigned URLs for artifacts for dev packages
-          PRESIGNED_OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_presigned.yml"
+        if: ${{ inputs.dev == true }}
-          mkdir -p "$(dirname "$OUTPUT_FILE")"
+        run: |
+          INDEXER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[0]')
+          MANAGER_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[1]')
+          DASHBOARD_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[2]')
+          AGENT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[3]')
+          ASSISTANT_REVISION=$(echo "$COMMIT_LIST" | jq -r '.[4]')
 
-          : > "$OUTPUT_FILE"
+          python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \
-          : > "$PRESIGNED_OUTPUT_FILE"
+            --process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \
-
+            --wazuh-version ${{ env.WAZUH_VERSION }} \
-          # Validate WAZUH_COMPONENTS and COMMIT_LIST have the same length
+            --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \
-          if [ "$(jq length <<<"$WAZUH_COMPONENTS")" -ne "$(jq length <<<"$COMMIT_LIST")" ]; then
+            --indexer-revision   $INDEXER_REVISION \
-            echo "WAZUH_COMPONENTS and COMMIT_LIST must have the same length." >&2
+            --manager-revision   $MANAGER_REVISION \
-            exit 1
+            --dashboard-revision $DASHBOARD_REVISION \
-          fi
+            --agent-revision     $AGENT_REVISION \
-
+            --assistant-revision $ASSISTANT_REVISION
-          # Verify if the input file exists
-          if [ ! -f "$ARTIFACT_URLS_FILE_TEMP" ]; then
-            echo "The input file $ARTIFACT_URLS_FILE_TEMP does not exist." >&2
-            exit 1
-          fi
-
-          # Set each component's commit/revision based on the input lists
-          for i in $(seq 0 $(($(echo "$WAZUH_COMPONENTS" | jq length) - 1))); do
-            COMPONENT=$(echo "$WAZUH_COMPONENTS" | jq -r ".[$i]")
-            COMMIT=$(echo "$COMMIT_LIST" | jq -r ".[$i]")
-
-            case $COMPONENT in
-              "wazuh-indexer")
-                INDEXER_COMMIT="$COMMIT"
-                echo "Indexer commit set to: $COMMIT"
-                ;;
-              "wazuh-manager")
-                MANAGER_COMMIT="$COMMIT"
-                echo "Manager commit set to: $COMMIT"
-                ;;
-              "wazuh-dashboard")
-                DASHBOARD_COMMIT="$COMMIT"
-                echo "Dashboard commit set to: $COMMIT"
-                ;;
-              "wazuh-agent")
-                AGENT_COMMIT="$COMMIT"
-                echo "Agent commit set to: $COMMIT"
-                ;;
-              *)
-                echo "Unknown component: $COMPONENT."
-                exit 1
-                ;;
-            esac
-          done
-
-          # Process the file line by line (replacing ocurrences)
-          while IFS= read -r line || [ -n "$line" ]; do
-            # Skip empty lines and comments
-            if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
-              continue
-            fi
-
-            # Replace variables with their actual values
-            line=${line//\$\{\{ vars.AWS_S3_BUCKET_DEV \}\}/${{ vars.AWS_S3_BUCKET_DEV }}}
-            line=${line//\$\{\{ env.MAJOR \}\}/$WAZUH_MAJOR}
-            line=${line//\$\{\{ env.WAZUH_VERSION \}\}/$WAZUH_VERSION}
-
-            # Replace component revisions
-            line=${line//\$\{\{ env.INDEXER_REVISION \}\}/$INDEXER_COMMIT}
-            line=${line//\$\{\{ env.MANAGER_REVISION \}\}/$MANAGER_COMMIT}
-            line=${line//\$\{\{ env.DASHBOARD_REVISION \}\}/$DASHBOARD_COMMIT}
-            line=${line//\$\{\{ env.AGENT_REVISION \}\}/$AGENT_COMMIT}
-            line=${line//\$\{\{ env.ASSISTANT_REVISION \}\}/latest}
-
-            # Append the processed line to the output file
-            echo "$line" >> "$OUTPUT_FILE"
-          done < "$ARTIFACT_URLS_FILE_TEMP"
-
-          # Verify the output file
-          if [ -f "$OUTPUT_FILE" ]; then
-            echo "The downloaded file artifact_urls.yml was successfully processed at $OUTPUT_FILE."
-          else
-            echo "Failed to create processed artifact_urls.yml file." >&2
-            exit 1
-          fi
-
-          # Generate the presigned URLs for each package
-          while IFS= read -r line || [ -n "$line" ]; do
-            # Skip empty lines and comments
-            if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
-              continue
-            fi
-
-            # Extract both package_name and package_s3_uri from the line
-            if [[ "$line" =~ ^([a-zA-Z0-9_]+):[[:space:]]*\"?s3://([^\"[:space:]]+) ]]; then
-              PACKAGE_NAME="${BASH_REMATCH[1]}"
-              PACKAGE_S3_URI="s3://${BASH_REMATCH[2]}"
-
-              # Check if the object exists in S3
-              BUCKET_NAME=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 3)
-              OBJ_KEY=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 4-)
-              if ! aws s3api head-object --bucket "$BUCKET_NAME" --key "$OBJ_KEY" --region us-west-1 > /dev/null 2>&1; then
-                echo "Object $PACKAGE_S3_URI does not exist. Skipping..." >&2
-                continue
-              fi
-
-              # Generate a pre-signed URL for the S3 URI
-              echo "Generating pre-signed URL for $PACKAGE_NAME..."
-              PRESIGNED_URL=$(aws s3 presign "$PACKAGE_S3_URI" --expires-in 43200 --region us-west-1)
-              presigned_url_line="$PACKAGE_NAME: \"$PRESIGNED_URL\""
-
-              # Append the processed line to the output file
-              echo "$presigned_url_line" >> "$PRESIGNED_OUTPUT_FILE"
-            else
-              echo "$line" >> "$PRESIGNED_OUTPUT_FILE"
-              echo "Skipping line for presigning (no S3 URI found):"
-              echo "$line"
-            fi
-          done < "$OUTPUT_FILE"
-
-          # Verify the presigned urls file
-          if [ -f "$PRESIGNED_OUTPUT_FILE" ]; then
-            echo "Presigned URLs file created successfully at $PRESIGNED_OUTPUT_FILE."
-          else
-            echo "Failed to create presigned artifact_urls.yml file." >&2
-            exit 1
-          fi
-
-          # Store file with the same name expected by build-images.sh
-          cp "$PRESIGNED_OUTPUT_FILE" artifact_urls.yml
 
       - name: Save presigned URLs file to artifact
         if: ${{ inputs.dev == true }}
         uses: actions/upload-artifact@v4
         with:
           name: presigned-artifact-urls-${{ github.run_id }}
-          path: artifact_urls.yml
+          path: ${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}
 
   build-and-push:
     runs-on: