From 07ccedacecb5010406449357f3d47f9e41b3ea08 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 10:09:16 -0300 Subject: [PATCH 01/11] Updated bumped workflow --- .github/workflows/4_bumper_repository.yml | 129 ++++++++++++++++++++++ tools/repository_bumper.sh | 5 +- 2 files changed, 132 insertions(+), 2 deletions(-) create mode 100644 .github/workflows/4_bumper_repository.yml diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml new file mode 100644 index 00000000..44cc8138 --- /dev/null +++ b/.github/workflows/4_bumper_repository.yml @@ -0,0 +1,129 @@ +name: Repository bumper +run-name: Bump ${{ github.ref_name }} (${{ inputs.id }}) + +on: + workflow_dispatch: + inputs: + version: + description: 'Target version (e.g. 4.13.0)' + default: '' + required: false + type: string + stage: + description: 'Version stage (e.g. alpha0)' + default: '' + required: false + type: string + issue-link: + description: 'Issue link in format https://github.com/wazuh//issues/' + required: true + type: string + id: + description: 'Optional identifier for the run' + required: false + type: string + push: + +jobs: + bump: + name: Repository bumper + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + + env: + CI_COMMIT_AUTHOR: wazuhci + CI_COMMIT_EMAIL: 22834044+wazuhci@users.noreply.github.com + CI_GPG_PRIVATE_KEY: ${{ secrets.CI_WAZUHCI_GPG_PRIVATE }} + GH_TOKEN: ${{ secrets.CI_WAZUHCI_BUMPER_TOKEN }} + BUMP_SCRIPT_PATH: tools/repository_bumper.sh + BUMP_LOG_PATH: tools + + steps: + - name: Dump event payload + run: | + cat $GITHUB_EVENT_PATH | jq '.inputs' + + - name: Set up GPG key + id: signing_setup + run: | + echo "${{ env.CI_GPG_PRIVATE_KEY }}" | gpg --batch --import + KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $5; exit}') + echo "gpg_key_id=$KEY_ID" >> $GITHUB_OUTPUT + + - name: Set up git + run: | + git config --global user.name "${{ env.CI_COMMIT_AUTHOR }}" + git config --global user.email "${{ env.CI_COMMIT_EMAIL }}" + git config --global commit.gpgsign true + git config --global user.signingkey "${{ steps.signing_setup.outputs.gpg_key_id }}" + echo "use-agent" >> ~/.gnupg/gpg.conf + echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf + echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf + echo RELOADAGENT | gpg-connect-agent + export DEBIAN_FRONTEND=noninteractive + export GPG_TTY=$(tty) + + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Determine branch name + id: vars + env: + VERSION: ${{ inputs.version }} + STAGE: ${{ inputs.stage }} + run: | + script_params="" + version=${{ env.VERSION }} + stage=${{ env.STAGE }} + # Both version and stage provided + if [[ -n "$version" && -n "$stage" ]]; then + script_params="--version ${version} --stage ${stage}" + elif [[ -z "$version" && -n "$stage" ]]; then + script_params="--stage ${stage}" + fi + issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}') + BRANCH_NAME="enhancement/docker${issue_number}-bump-${{ github.ref_name }}" + echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT + echo "script_params=${script_params}" >> $GITHUB_OUTPUT + + - name: Create and switch to bump branch + run: | + git checkout -b ${{ steps.vars.outputs.branch_name }} + + - name: Make version bump changes + run: | + echo "Running bump script" + bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }} + + - name: Commit and push changes + run: | + git add . + git commit -m "feat: bump ${{ github.ref_name }}" + git push origin ${{ steps.vars.outputs.branch_name }} + + - name: Create pull request + id: create_pr + run: | + gh auth setup-git + PR_URL=$(gh pr create \ + --title "Bump ${{ github.ref_name }} branch" \ + --body "Issue: ${{ inputs.issue-link }}" \ + --base ${{ github.ref_name }} \ + --head ${{ steps.vars.outputs.branch_name }}) + echo "Pull request created: ${PR_URL}" + echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT + + - name: Merge pull request + run: | + # Any checks for the PR are bypassed since the branch is expected to be functional (i.e. the bump process does not introduce any bugs) + gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge + + - name: Show logs + run: | + echo "Bump complete." + echo "Branch: ${{ steps.vars.outputs.branch_name }}" + echo "PR: https://github.com/${{ github.repository }}/pull/${{ steps.create_pr.outputs.pull_request_number }}" + echo "Bumper scripts logs:" + cat ${BUMP_LOG_PATH}/repository_bumper*log diff --git a/tools/repository_bumper.sh b/tools/repository_bumper.sh index 8223e54b..6a1c747f 100644 --- a/tools/repository_bumper.sh +++ b/tools/repository_bumper.sh @@ -5,11 +5,12 @@ # Usage: ./repository_bumper.sh # Global variables -DIR=$(dirname "$(pwd)") +DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" LOG_FILE="${DIR}/tools/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log" VERSION="" STAGE="" FILES_EDITED=() +FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" --exclude="4_bumper_repository.yml"' get_old_version_and_stage() { local VERSION_FILE="${DIR}/VERSION.json" @@ -24,7 +25,7 @@ grep_command() { # This function is used to search for a specific string in the specified directory. # It takes two arguments: the string to search for and the directory to search in. # Usage: grep_command - eval grep -Rl "${1}" "${2}" --exclude-dir=".git" --exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" "${3}" + eval grep -Rl "${1}" "${2}" --exclude-dir=".git" $FILES_EXCLUDED "${3}" } update_version_in_files() { From 0177c4ab982ccd1a8cc8caaece22b46edeb35c81 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 10:10:14 -0300 Subject: [PATCH 02/11] Removed push --- .github/workflows/4_bumper_repository.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml index 44cc8138..0157d4fa 100644 --- a/.github/workflows/4_bumper_repository.yml +++ b/.github/workflows/4_bumper_repository.yml @@ -22,7 +22,6 @@ on: description: 'Optional identifier for the run' required: false type: string - push: jobs: bump: From 46edb16dbb170be60a689c18049cd22f6c1784f4 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 10:34:09 -0300 Subject: [PATCH 03/11] Updated changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 94919027..38f2fa69 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file. ### Added +- Integrate bumper script via GitHub action. ([#1863](https://github.com/wazuh/wazuh-docker/pull/1863)) - Added repository_bumper script. ([#1781](https://github.com/wazuh/wazuh-docker/pull/1781)) - Fix Warning message when migrating Docker compose v2 ([#1828](https://github.com/wazuh/wazuh-docker/pull/1828)) - Add technical documentation ([#1822](https://github.com/wazuh/wazuh-docker/pull/1822)) From 61dfe53a084fac316372c36b78a0acd0829bdc7f Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 16:31:42 -0300 Subject: [PATCH 04/11] Added tag argument for bumper script --- .github/workflows/4_bumper_repository.yml | 17 +++++++-- tools/repository_bumper.sh | 45 +++++++++++++++++------ 2 files changed, 46 insertions(+), 16 deletions(-) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml index 0157d4fa..39c450d1 100644 --- a/.github/workflows/4_bumper_repository.yml +++ b/.github/workflows/4_bumper_repository.yml @@ -14,6 +14,11 @@ on: default: '' required: false type: string + tag: + description: 'Change branches references to tag-like references (e.g. v4.12.0-alpha7)' + default: false + required: false + type: boolean issue-link: description: 'Issue link in format https://github.com/wazuh//issues/' required: true @@ -72,18 +77,22 @@ jobs: env: VERSION: ${{ inputs.version }} STAGE: ${{ inputs.stage }} + TAG: ${{ inputs.tag }} run: | script_params="" version=${{ env.VERSION }} stage=${{ env.STAGE }} + tag=${{ env.TAG }} + # Both version and stage provided - if [[ -n "$version" && -n "$stage" ]]; then + if [[ -n "$version" && -n "$stage" && "$tag" != "true" ]]; then script_params="--version ${version} --stage ${stage}" - elif [[ -z "$version" && -n "$stage" ]]; then - script_params="--stage ${stage}" + elif [[ -n "$version" && -n "$stage" && "$tag" == "true" ]]; then + script_params="--version ${version} --stage ${stage} --tag ${tag}" fi + issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}') - BRANCH_NAME="enhancement/docker${issue_number}-bump-${{ github.ref_name }}" + BRANCH_NAME="enhancement/kubernetes${issue_number}-bump-${{ github.ref_name }}" echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT echo "script_params=${script_params}" >> $GITHUB_OUTPUT diff --git a/tools/repository_bumper.sh b/tools/repository_bumper.sh index 6a1c747f..653c1012 100644 --- a/tools/repository_bumper.sh +++ b/tools/repository_bumper.sh @@ -76,6 +76,17 @@ update_stage_in_files() { done } +update_docker_images_tag() { + local NEW_TAG="$1" + local DOCKERFILES=( $(grep_command -E "wazuh/wazuh-[a-zA-Z0-9._-]*" "${DIR}") ) + for file in "${DOCKERFILES[@]}"; do + sed -i -E "s/(wazuh\/wazuh-[a-zA-Z0-9._-]*):[a-zA-Z0-9._-]+/\1:${NEW_TAG}/g" "${file}" + if [[ $(git diff --name-only "${file}") ]]; then + FILES_EDITED+=("${file}") + fi + done +} + main() { echo "Starting repository version bumping process..." | tee -a "${LOG_FILE}" @@ -91,6 +102,10 @@ main() { STAGE="$2" shift 2 ;; + --tag) + TAG="$2" + shift 2 + ;; *) echo "Unknown argument: $1" exit 1 @@ -99,44 +114,50 @@ main() { done # Validate arguments - if [[ -z "$VERSION" ]]; then + if [[ -z "${VERSION}" ]]; then echo "Error: --version argument is required." | tee -a "${LOG_FILE}" exit 1 fi - if [[ -z "$STAGE" ]]; then + if [[ -z "${STAGE}" ]]; then echo "Error: --stage argument is required." | tee -a "${LOG_FILE}" exit 1 fi # Validate if version is in the correct format - if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then + if ! [[ "${VERSION}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then echo "Error: Version must be in the format X.Y.Z (e.g., 1.2.3)." | tee -a "${LOG_FILE}" exit 1 fi # Validate if stage is in the correct format - STAGE=$(echo "$STAGE" | tr '[:upper:]' '[:lower:]') - if ! [[ "$STAGE" =~ ^(alpha[0-9]*|beta[0-9]*|rc[0-9]*|stable)$ ]]; then + STAGE=$(echo "${STAGE}" | tr '[:upper:]' '[:lower:]') + if ! [[ "${STAGE}" =~ ^(alpha[0-9]*|beta[0-9]*|rc[0-9]*|stable)$ ]]; then echo "Error: Stage must be one of the following examples: alpha1, beta1, rc1, stable." | tee -a "${LOG_FILE}" exit 1 fi + # Validate if tag is true or false + if [[ -n "${TAG}" && ! "${TAG}" =~ ^(true|false)$ ]]; then + echo "Error: --tag must be either true or false." | tee -a "${LOG_FILE}" + exit 1 + fi + # Get old version and stage get_old_version_and_stage - if [[ "$OLD_VERSION" == "$VERSION" && "$OLD_STAGE" == "$STAGE" ]]; then + if [[ "${OLD_VERSION}" == "${VERSION}" && "${OLD_STAGE}" == "${STAGE}" ]]; then echo "Version and stage are already up to date." | tee -a "${LOG_FILE}" echo "No changes needed." | tee -a "${LOG_FILE}" exit 0 fi - if [[ "$OLD_VERSION" != "$VERSION" ]]; then - echo "Updating version from $OLD_VERSION to $VERSION" | tee -a "${LOG_FILE}" - update_version_in_files "$VERSION" + if [[ "${OLD_VERSION}" != "${VERSION}" ]]; then + echo "Updating version from ${OLD_VERSION} to ${VERSION}" | tee -a "${LOG_FILE}" + update_version_in_files "${VERSION}" fi - if [[ "$OLD_STAGE" != "$STAGE" ]]; then - echo "Updating stage from $OLD_STAGE to $STAGE" | tee -a "${LOG_FILE}" - update_stage_in_files "$STAGE" + if [[ "${OLD_STAGE}" != "${STAGE}" ]]; then + echo "Updating stage from ${OLD_STAGE} to ${STAGE}" | tee -a "${LOG_FILE}" + update_stage_in_files "${STAGE}" fi echo "The following files were edited:" | tee -a "${LOG_FILE}" From e166d705c33519d2cc0961e361efe9b5ba080518 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 16:40:02 -0300 Subject: [PATCH 05/11] Fixed tag validation --- tools/repository_bumper.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tools/repository_bumper.sh b/tools/repository_bumper.sh index 653c1012..be0b2c17 100644 --- a/tools/repository_bumper.sh +++ b/tools/repository_bumper.sh @@ -160,6 +160,13 @@ main() { update_stage_in_files "${STAGE}" fi + # Update Docker images tag if tag is true + if [[ "${TAG}" == "true" ]]; then + echo "Updating Docker images tag to ${VERSION}-${STAGE}" | tee -a "${LOG_FILE}" + update_docker_images_tag "${VERSION}-${STAGE}" + fi + + echo "The following files were edited:" | tee -a "${LOG_FILE}" for file in $(printf "%s\n" "${FILES_EDITED[@]}" | sort -u); do echo "${file}" | tee -a "${LOG_FILE}" From b2f46deb7dd8011261c5d7bb80db08096b256242 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 16:41:55 -0300 Subject: [PATCH 06/11] Updated repository branch name --- .github/workflows/4_bumper_repository.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml index 39c450d1..53911484 100644 --- a/.github/workflows/4_bumper_repository.yml +++ b/.github/workflows/4_bumper_repository.yml @@ -92,7 +92,7 @@ jobs: fi issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}') - BRANCH_NAME="enhancement/kubernetes${issue_number}-bump-${{ github.ref_name }}" + BRANCH_NAME="enhancement/docker${issue_number}-bump-${{ github.ref_name }}" echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT echo "script_params=${script_params}" >> $GITHUB_OUTPUT From 75753a9714e697e87c3a88a5e67171dcfd391d89 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Mon, 9 Jun 2025 10:18:44 -0300 Subject: [PATCH 07/11] Updated GH token --- .github/workflows/4_bumper_repository.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml index 53911484..a4b882c0 100644 --- a/.github/workflows/4_bumper_repository.yml +++ b/.github/workflows/4_bumper_repository.yml @@ -71,6 +71,10 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + with: + # Using workflow-specific GITHUB_TOKEN because currently CI_WAZUHCI_BUMPER_TOKEN + # doesn't have all the necessary permissions + token: ${{ env.GH_TOKEN }} - name: Determine branch name id: vars From 513cbda314d756352c4b249c4f3f649c74409be1 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Mon, 9 Jun 2025 10:25:53 -0300 Subject: [PATCH 08/11] Updated PR message in log --- .github/workflows/4_bumper_repository.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml index a4b882c0..f0cddd50 100644 --- a/.github/workflows/4_bumper_repository.yml +++ b/.github/workflows/4_bumper_repository.yml @@ -136,6 +136,6 @@ jobs: run: | echo "Bump complete." echo "Branch: ${{ steps.vars.outputs.branch_name }}" - echo "PR: https://github.com/${{ github.repository }}/pull/${{ steps.create_pr.outputs.pull_request_number }}" + echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}" echo "Bumper scripts logs:" cat ${BUMP_LOG_PATH}/repository_bumper*log From 578619c0c173664120ffa3b701065e03da3da144 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Mon, 9 Jun 2025 12:07:36 -0300 Subject: [PATCH 09/11] Added exclude for cert tool image --- tools/repository_bumper.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/repository_bumper.sh b/tools/repository_bumper.sh index be0b2c17..30bf828a 100644 --- a/tools/repository_bumper.sh +++ b/tools/repository_bumper.sh @@ -78,7 +78,7 @@ update_stage_in_files() { update_docker_images_tag() { local NEW_TAG="$1" - local DOCKERFILES=( $(grep_command -E "wazuh/wazuh-[a-zA-Z0-9._-]*" "${DIR}") ) + local DOCKERFILES=( $(grep_command -E "wazuh/wazuh-[a-zA-Z0-9._-]*" "${DIR}" --exclude="indexer-certs-creator/README.md" --exclude="generate-indexer-certs.yml") ) for file in "${DOCKERFILES[@]}"; do sed -i -E "s/(wazuh\/wazuh-[a-zA-Z0-9._-]*):[a-zA-Z0-9._-]+/\1:${NEW_TAG}/g" "${file}" if [[ $(git diff --name-only "${file}") ]]; then From 79bc2516b2a77e0a508a63c1c73321d3cbe713f6 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Mon, 9 Jun 2025 12:53:25 -0300 Subject: [PATCH 10/11] Updated bumper script for tag variable --- tools/repository_bumper.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/repository_bumper.sh b/tools/repository_bumper.sh index 30bf828a..f995bafb 100644 --- a/tools/repository_bumper.sh +++ b/tools/repository_bumper.sh @@ -78,7 +78,7 @@ update_stage_in_files() { update_docker_images_tag() { local NEW_TAG="$1" - local DOCKERFILES=( $(grep_command -E "wazuh/wazuh-[a-zA-Z0-9._-]*" "${DIR}" --exclude="indexer-certs-creator/README.md" --exclude="generate-indexer-certs.yml") ) + local DOCKERFILES=( $(grep_command "wazuh/wazuh-[a-zA-Z0-9._-]*" "${DIR}" "--exclude="README.md" --exclude="generate-indexer-certs.yml"") ) for file in "${DOCKERFILES[@]}"; do sed -i -E "s/(wazuh\/wazuh-[a-zA-Z0-9._-]*):[a-zA-Z0-9._-]+/\1:${NEW_TAG}/g" "${file}" if [[ $(git diff --name-only "${file}") ]]; then From 7f61ed18a44f03b19cfdfe41ff2a01314faf0723 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Mon, 9 Jun 2025 12:55:24 -0300 Subject: [PATCH 11/11] Updated wildcard for workflow file name --- tools/repository_bumper.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/repository_bumper.sh b/tools/repository_bumper.sh index f995bafb..dd643c04 100644 --- a/tools/repository_bumper.sh +++ b/tools/repository_bumper.sh @@ -10,7 +10,7 @@ LOG_FILE="${DIR}/tools/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log" VERSION="" STAGE="" FILES_EDITED=() -FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" --exclude="4_bumper_repository.yml"' +FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" --exclude="*_bumper_repository.yml"' get_old_version_and_stage() { local VERSION_FILE="${DIR}/VERSION.json"