forked from wazuh/wazuh-docker
Compare commits
6
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Wazuh CI
|
e2582f0aab | ||
|
wazuhci
|
513733cb4f | ||
|
Wazuh CI
|
5bd2286b6f | ||
|
wazuhci
|
0fe10c4e42 | ||
|
Wazuh CI
|
3c4b8551d2 | ||
|
wazuhci
|
fd2e55e7ab |
@@ -6,7 +6,7 @@ on:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag'
|
||||
default: '4.14.8'
|
||||
default: '4.14.7'
|
||||
required: true
|
||||
docker_reference:
|
||||
description: 'wazuh-docker reference'
|
||||
@@ -38,7 +38,7 @@ on:
|
||||
inputs:
|
||||
image_tag:
|
||||
description: 'Docker image tag'
|
||||
default: '4.14.8'
|
||||
default: '4.14.7'
|
||||
required: true
|
||||
type: string
|
||||
docker_reference:
|
||||
@@ -155,12 +155,6 @@ jobs:
|
||||
with:
|
||||
ref: ${{ inputs.docker_reference }}
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Set up QEMU
|
||||
uses: docker/setup-qemu-action@v4
|
||||
|
||||
@@ -178,6 +172,12 @@ jobs:
|
||||
if: ${{ inputs.dev == true }}
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Build Wazuh images
|
||||
run: |
|
||||
IMAGE_TAG="${{ inputs.image_tag }}"
|
||||
|
||||
@@ -110,21 +110,13 @@ jobs:
|
||||
bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }}
|
||||
|
||||
- name: Commit and push changes
|
||||
id: bump_commit
|
||||
run: |
|
||||
git add .
|
||||
if git diff --staged --quiet; then
|
||||
echo "Nothing to bump: the repository is already at the requested version/stage. Skipping commit."
|
||||
echo "has_changes=false" >> $GITHUB_OUTPUT
|
||||
else
|
||||
git commit -m "feat: bump ${{ github.ref_name }}"
|
||||
git push origin ${{ steps.vars.outputs.branch_name }}
|
||||
echo "has_changes=true" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
git commit -m "feat: bump ${{ github.ref_name }}"
|
||||
git push origin ${{ steps.vars.outputs.branch_name }}
|
||||
|
||||
- name: Create pull request
|
||||
id: create_pr
|
||||
if: steps.bump_commit.outputs.has_changes == 'true'
|
||||
run: |
|
||||
gh auth setup-git
|
||||
PR_URL=$(gh pr create \
|
||||
@@ -137,19 +129,14 @@ jobs:
|
||||
echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Merge pull request
|
||||
if: steps.bump_commit.outputs.has_changes == 'true'
|
||||
run: |
|
||||
# Any checks for the PR are bypassed since the branch is expected to be functional (i.e. the bump process does not introduce any bugs)
|
||||
gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge --admin
|
||||
|
||||
- name: Show logs
|
||||
run: |
|
||||
if [[ "${{ steps.bump_commit.outputs.has_changes }}" == "true" ]]; then
|
||||
echo "Bump complete."
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
else
|
||||
echo "Bump skipped: the repository is already at the requested version/stage."
|
||||
fi
|
||||
echo "Bump complete."
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
echo "Bumper scripts logs:"
|
||||
cat ${BUMP_LOG_PATH}/repository_bumper*log
|
||||
@@ -12,14 +12,6 @@ on:
|
||||
- 'wazuh-agent/**'
|
||||
- '.github/**'
|
||||
|
||||
env:
|
||||
ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
|
||||
ARTIFACT_NAMES: |
|
||||
wazuh-manager.tar
|
||||
wazuh-indexer.tar
|
||||
wazuh-dashboard.tar
|
||||
wazuh-agent.tar
|
||||
|
||||
jobs:
|
||||
build-docker-images:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
@@ -49,17 +41,33 @@ jobs:
|
||||
docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
|
||||
docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
|
||||
|
||||
- name: Temporarily save Wazuh Docker images
|
||||
env:
|
||||
S3_ARTIFACTS_PATH: ${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
|
||||
run: |
|
||||
echo "Uploading Docker image artifacts to S3..."
|
||||
while IFS= read -r artifact; do
|
||||
[ -z "$artifact" ] && continue
|
||||
echo " Uploading: $artifact"
|
||||
aws s3 cp "${ARTIFACTS_LOCAL_DIR}/${artifact}" "${S3_ARTIFACTS_PATH}/${artifact}"
|
||||
done <<< "$ARTIFACT_NAMES"
|
||||
echo "All artifacts uploaded successfully."
|
||||
- name: Temporarily save Wazuh manager Docker image
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: docker-artifact-manager
|
||||
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
|
||||
retention-days: 1
|
||||
|
||||
- name: Temporarily save Wazuh indexer Docker image
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: docker-artifact-indexer
|
||||
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
|
||||
retention-days: 1
|
||||
|
||||
- name: Temporarily save Wazuh dashboard Docker image
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: docker-artifact-dashboard
|
||||
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
|
||||
retention-days: 1
|
||||
|
||||
- name: Temporarily save Wazuh agent Docker image
|
||||
uses: actions/upload-artifact@v7
|
||||
with:
|
||||
name: docker-artifact-agent
|
||||
path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
|
||||
retention-days: 1
|
||||
|
||||
check-single-node:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
@@ -78,21 +86,32 @@ jobs:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Retrieve saved Wazuh Docker images and load them into Docker
|
||||
env:
|
||||
S3_ARTIFACTS_PATH: s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
|
||||
ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
|
||||
- name: Retrieve saved Wazuh indexer Docker image
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: docker-artifact-indexer
|
||||
|
||||
- name: Retrieve saved Wazuh manager Docker image
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: docker-artifact-manager
|
||||
|
||||
- name: Retrieve saved Wazuh dashboard Docker image
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: docker-artifact-dashboard
|
||||
|
||||
- name: Retrieve saved Wazuh agent Docker image
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: docker-artifact-agent
|
||||
|
||||
- name: Docker load
|
||||
run: |
|
||||
mkdir -p "${ARTIFACTS_LOCAL_DIR}"
|
||||
echo "Downloading and loading Docker image artifacts from S3..."
|
||||
while IFS= read -r artifact; do
|
||||
[ -z "$artifact" ] && continue
|
||||
echo " Downloading: $artifact"
|
||||
aws s3 cp "${S3_ARTIFACTS_PATH}/${artifact}" "${ARTIFACTS_LOCAL_DIR}/${artifact}"
|
||||
echo " Loading into Docker: $artifact"
|
||||
docker load -i "${ARTIFACTS_LOCAL_DIR}/${artifact}"
|
||||
done <<< "$ARTIFACT_NAMES"
|
||||
echo "All artifacts downloaded and loaded successfully."
|
||||
docker load --input ./wazuh-indexer.tar
|
||||
docker load --input ./wazuh-dashboard.tar
|
||||
docker load --input ./wazuh-manager.tar
|
||||
docker load --input ./wazuh-agent.tar
|
||||
|
||||
- name: Create single node certficates
|
||||
run: docker compose -f single-node/generate-indexer-certs.yml run --rm generator
|
||||
@@ -214,21 +233,33 @@ jobs:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Retrieve saved Wazuh Docker images and load them into Docker
|
||||
env:
|
||||
S3_ARTIFACTS_PATH: s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
|
||||
ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
|
||||
- name: Retrieve saved Wazuh dashboard Docker image
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: docker-artifact-dashboard
|
||||
|
||||
- name: Retrieve saved Wazuh manager Docker image
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: docker-artifact-manager
|
||||
|
||||
- name: Retrieve saved Wazuh indexer Docker image
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: docker-artifact-indexer
|
||||
|
||||
- name: Retrieve saved Wazuh agent Docker image
|
||||
uses: actions/download-artifact@v8
|
||||
with:
|
||||
name: docker-artifact-agent
|
||||
|
||||
- name: Docker load
|
||||
run: |
|
||||
mkdir -p "${ARTIFACTS_LOCAL_DIR}"
|
||||
echo "Downloading and loading Docker image artifacts from S3..."
|
||||
while IFS= read -r artifact; do
|
||||
[ -z "$artifact" ] && continue
|
||||
echo " Downloading: $artifact"
|
||||
aws s3 cp "${S3_ARTIFACTS_PATH}/${artifact}" "${ARTIFACTS_LOCAL_DIR}/${artifact}"
|
||||
echo " Loading into Docker: $artifact"
|
||||
docker load -i "${ARTIFACTS_LOCAL_DIR}/${artifact}"
|
||||
done <<< "$ARTIFACT_NAMES"
|
||||
echo "All artifacts downloaded and loaded successfully."
|
||||
docker load --input ./wazuh-manager.tar
|
||||
docker load --input ./wazuh-indexer.tar
|
||||
docker load --input ./wazuh-dashboard.tar
|
||||
docker load --input ./wazuh-agent.tar
|
||||
rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar wazuh-agent.tar
|
||||
|
||||
- name: Create multi node certficates
|
||||
run: docker compose -f multi-node/generate-indexer-certs.yml run --rm generator
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
run-name: Build and push images 5.x - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
|
||||
name: (5.x) Build and push images
|
||||
run-name: Build and push images 8.x - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
|
||||
name: (8.x) Build and push images
|
||||
|
||||
on:
|
||||
workflow_dispatch:
|
||||
@@ -81,8 +81,6 @@ on:
|
||||
permissions:
|
||||
id-token: write
|
||||
contents: read
|
||||
env:
|
||||
LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/${{ vars.ARTIFACT_URL_FILE_NAME }}
|
||||
|
||||
jobs:
|
||||
setup:
|
||||
@@ -168,6 +166,7 @@ jobs:
|
||||
WORKFLOW_VENV: "${{ github.workspace }}/workflow_venv"
|
||||
GENERATE_PRESIGNED_URLS_SCRIPT_PATH: ${{ github.workspace }}/wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py
|
||||
PRESIGNED_URLS_SCRIPT_PROCESS: "build_docker"
|
||||
LOCAL_ARTIFACT_URLS_FILEPATH: /tmp/${{ vars.ARTIFACT_URL_FILE_NAME }}
|
||||
COMMIT_LIST: ${{ inputs.commit_list }}
|
||||
ASSISTANT_REVISION: ${{ inputs.assistant_revision }}
|
||||
|
||||
@@ -285,9 +284,10 @@ jobs:
|
||||
|
||||
- name: Save presigned URLs file to artifact
|
||||
if: ${{ inputs.dev == true }}
|
||||
run: |
|
||||
echo "Uploading presigned URLs artifact..."
|
||||
aws s3 cp "${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}" "s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/5_build_and_push_images/${{ github.run_id }}/${{ vars.ARTIFACT_URL_FILE_NAME }}"
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}
|
||||
|
||||
build-and-push:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
@@ -337,10 +337,10 @@ jobs:
|
||||
|
||||
- name: Download artifact_urls.yaml (dev)
|
||||
if: ${{ inputs.dev == true }}
|
||||
run: |
|
||||
echo "Downloading presigned URLs artifact..."
|
||||
aws s3 cp "s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/5_build_and_push_images/${{ github.run_id }}/${{ vars.ARTIFACT_URL_FILE_NAME }}" "${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}"
|
||||
mv "${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}" ./build-docker-images/${{ vars.ARTIFACT_URL_FILE_NAME }}
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ./build-docker-images
|
||||
|
||||
- name: Compute component reference (dev)
|
||||
if: ${{ inputs.dev == true }}
|
||||
|
||||
@@ -37,11 +37,6 @@ on:
|
||||
default: false
|
||||
required: false
|
||||
type: boolean
|
||||
bump-issue-link:
|
||||
description: 'Issue link used in the original bump (required for revert if different from issue-link)'
|
||||
required: false
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
bump:
|
||||
name: Repository bumper 5.x
|
||||
@@ -144,17 +139,10 @@ jobs:
|
||||
bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }}
|
||||
|
||||
- name: Commit changes (Bump)
|
||||
id: bump_commit
|
||||
if: inputs.revert != true
|
||||
run: |
|
||||
git add .
|
||||
if git diff --staged --quiet; then
|
||||
echo "Nothing to bump: the repository is already at the requested version/stage. Skipping commit."
|
||||
echo "has_changes=false" >> $GITHUB_OUTPUT
|
||||
else
|
||||
git commit -m "feat: bump ${{ github.ref_name }}"
|
||||
echo "has_changes=true" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
git commit -m "feat: bump ${{ github.ref_name }}"
|
||||
|
||||
- name: Fetch full history (Revert)
|
||||
if: inputs.revert == true
|
||||
@@ -164,18 +152,9 @@ jobs:
|
||||
id: revert_step
|
||||
if: inputs.revert == true
|
||||
run: |
|
||||
# 1. Get the current issue number (for the new revert branch/PR)
|
||||
ISSUE_NUMBER=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}')
|
||||
|
||||
# 2. Get the issue number from the original bump (if provided; otherwise, defaults to the current one)
|
||||
if [ -n "${{ inputs.bump-issue-link }}" ]; then
|
||||
BUMP_ISSUE_NUMBER=$(echo "${{ inputs.bump-issue-link }}" | awk -F'/' '{print $NF}')
|
||||
else
|
||||
BUMP_ISSUE_NUMBER=$ISSUE_NUMBER
|
||||
fi
|
||||
|
||||
# 3. Search for the original bump branch using the obtained BUMP ISSUE number
|
||||
BUMP_BRANCH="enhancement/wqa${BUMP_ISSUE_NUMBER}-bump-${{ github.ref_name }}"
|
||||
BUMP_BRANCH="enhancement/wqa${ISSUE_NUMBER}-bump-${{ github.ref_name }}"
|
||||
|
||||
PR_NUMBER=$(gh pr list --head "$BUMP_BRANCH" --base "${{ github.ref_name }}" --state merged --json number --jq '.[0].number')
|
||||
|
||||
@@ -194,7 +173,7 @@ jobs:
|
||||
# Remove the files to prevent them from being included in the revert commit
|
||||
git checkout HEAD -- VERSION.json 2>/dev/null || true
|
||||
git checkout HEAD -- CHANGELOG.md 2>/dev/null || true
|
||||
# [!] ADD ANY OTHER REPOSITORY-SPECIFIC VERSION FILES HERE [!]
|
||||
# Add any other repository-specific version files here
|
||||
|
||||
if git diff --staged --quiet; then
|
||||
echo "No references to revert. Skipping commit."
|
||||
@@ -205,13 +184,13 @@ jobs:
|
||||
fi
|
||||
|
||||
- name: Push changes
|
||||
if: (inputs.revert != true && steps.bump_commit.outputs.has_changes == 'true') || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
run: |
|
||||
git push origin ${{ steps.vars.outputs.branch_name }}
|
||||
|
||||
- name: Create pull request
|
||||
id: create_pr
|
||||
if: (inputs.revert != true && steps.bump_commit.outputs.has_changes == 'true') || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
run: |
|
||||
gh auth setup-git
|
||||
PR_URL=$(gh pr create \
|
||||
@@ -224,7 +203,7 @@ jobs:
|
||||
echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT
|
||||
|
||||
- name: Merge pull request
|
||||
if: (inputs.revert != true && steps.bump_commit.outputs.has_changes == 'true') || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
|
||||
run: |
|
||||
# Any checks for the PR are bypassed since the branch is expected to be functional
|
||||
gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge --admin
|
||||
@@ -232,13 +211,9 @@ jobs:
|
||||
- name: Show logs
|
||||
if: inputs.revert != true
|
||||
run: |
|
||||
if [[ "${{ steps.bump_commit.outputs.has_changes }}" == "true" ]]; then
|
||||
echo "Bump complete."
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
else
|
||||
echo "Bump skipped: the repository is already at the requested version/stage."
|
||||
fi
|
||||
echo "Bump complete."
|
||||
echo "Branch: ${{ steps.vars.outputs.branch_name }}"
|
||||
echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
|
||||
echo "Bumper scripts logs:"
|
||||
cat ${BUMP_LOG_PATH}/repository_bumper*log
|
||||
|
||||
|
||||
@@ -1,64 +0,0 @@
|
||||
name: 5.x Changelog check
|
||||
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, reopened, ready_for_review, labeled, unlabeled]
|
||||
|
||||
jobs:
|
||||
changelog_check:
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
if: ${{ github.event_name == 'pull_request' && !github.event.pull_request.draft && !contains(github.event.pull_request.labels.*.name, 'no-changelog') }}
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v6
|
||||
with:
|
||||
fetch-depth: 0
|
||||
|
||||
- name: Validate CHANGELOG.md changes
|
||||
env:
|
||||
BASE_REF: ${{ github.base_ref }}
|
||||
run: |
|
||||
UPDATED="✅" FORMAT="—" INVALID=""
|
||||
|
||||
ADDED=$(git diff -U0 "origin/${BASE_REF}...HEAD" -- CHANGELOG.md | grep -E '^\+[^+]' | sed 's/^+//' || true)
|
||||
if [ -z "$ADDED" ]; then
|
||||
UPDATED="❌"
|
||||
echo "::error::CHANGELOG.md was not updated with new entries. Add one or add the 'no-changelog' label to skip this check."
|
||||
else
|
||||
FORMAT="✅"
|
||||
|
||||
TABLE_ENTRY_REGEX='^\| \[#[0-9]+\]\(https://github\.com/[^)]+/(issues|pull)/[0-9]+\) \| .+ \|$'
|
||||
TABLE_HEADER_REGEX='^\| Issue \| Comment \|$|^\| - \| - \|$'
|
||||
PRIOR_VERSION_REGEX='^- \[v?[0-9]+\.[0-9]+\.[0-9]+\]\(https://github\.com/[^)]+/blob/[^)]+/CHANGELOG\.md\)$|^- \[\]\(\)$'
|
||||
INVALID=$(echo "$ADDED" | grep -E '^(\||-)' | grep -vx -- '- None' | grep -vE "$TABLE_HEADER_REGEX" | grep -vE "$TABLE_ENTRY_REGEX" | grep -vE "$PRIOR_VERSION_REGEX" || true)
|
||||
if [ -n "$INVALID" ]; then
|
||||
FORMAT="❌"
|
||||
echo "::error::Invalid CHANGELOG.md entries. Expected format: '- Description ([#123](https://github.com/<org>/<repo>/issues/123))' or, for the Prior versions section, '- [vX.X.X](https://github.com/<org>/<repo>/blob/vX.X.X/CHANGELOG.md)'. Offending lines:"
|
||||
echo "$INVALID"
|
||||
fi
|
||||
fi
|
||||
|
||||
{
|
||||
echo "## Changelog check"
|
||||
echo ""
|
||||
echo "| Check | Result |"
|
||||
echo "|---|---|"
|
||||
echo "| CHANGELOG.md has new entries | $UPDATED |"
|
||||
echo "| Entry format | $FORMAT |"
|
||||
if [ -n "$INVALID" ]; then
|
||||
echo ""
|
||||
echo "Offending lines:"
|
||||
echo '```'
|
||||
echo "$INVALID"
|
||||
echo '```'
|
||||
fi
|
||||
} >> "$GITHUB_STEP_SUMMARY"
|
||||
|
||||
if [ "$UPDATED" != "✅" ] || [ "$FORMAT" != "✅" ]; then
|
||||
exit 1
|
||||
fi
|
||||
echo "CHANGELOG.md update is valid."
|
||||
@@ -2,7 +2,7 @@ run-name: >-
|
||||
${{ github.event_name == 'workflow_dispatch'
|
||||
&& format('Docker Integration Test - Manual {0} on {1}', inputs.deployment_type, inputs.pr_head_ref)
|
||||
|| format('Docker Integration Test - #{0} {1}', github.event.issue.number, github.event.issue.title) }}
|
||||
name: (5.x) PR Check - Docker Integration Tests
|
||||
name: (8.x) PR Check - Docker Integration Tests
|
||||
|
||||
on:
|
||||
issue_comment:
|
||||
@@ -53,7 +53,6 @@ env:
|
||||
AUTOMATION_REFERENCE: ${{ inputs.automation_reference || 'main' }}
|
||||
ALLOCATOR_PATH: /tmp/allocator_instance
|
||||
REGION: us-east-1
|
||||
LOGS_ARTIFACT_ZIP_FILE: "docker_logs_artifacts_${{ github.run_id }}.zip"
|
||||
|
||||
jobs:
|
||||
# -------------------------------------------------------------------------
|
||||
@@ -177,8 +176,8 @@ jobs:
|
||||
echo "deployment_matrix=[\"${DEPLOY_TYPE}\"]" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
else
|
||||
echo 'pr_head_ref=${{ needs.get_pr_info.outputs.pr_head_ref }}' >> $GITHUB_OUTPUT
|
||||
echo 'deployment_matrix=${{ needs.get_pr_info.outputs.deployment_matrix }}' >> $GITHUB_OUTPUT
|
||||
echo "pr_head_ref=${{ needs.get_pr_info.outputs.pr_head_ref }}" >> $GITHUB_OUTPUT
|
||||
echo "deployment_matrix=${{ needs.get_pr_info.outputs.deployment_matrix }}" >> $GITHUB_OUTPUT
|
||||
fi
|
||||
|
||||
- name: Checkout wazuh-docker PR branch (VERSION.json only)
|
||||
@@ -410,7 +409,6 @@ jobs:
|
||||
pip install -r wazuh-automation/deployability/deps/requirements.txt
|
||||
pip install -r wazuh-automation/integration-test-module/requirements.txt
|
||||
pip install -e wazuh-automation/integration-test-module/
|
||||
pip install pyyaml
|
||||
|
||||
- name: Configure AWS credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
@@ -419,19 +417,6 @@ jobs:
|
||||
role-session-name: docker-test-${{ github.run_id }}-${{ matrix.deployment_type }}
|
||||
aws-region: ${{ env.REGION }}
|
||||
|
||||
- name: Generate presigned cert tool URL
|
||||
run: |
|
||||
python wazuh-automation/tools/sign_urls/generate_presigned_dev_urls.py \
|
||||
--process build_docker \
|
||||
--wazuh-version "${{ env.DOCKER_VERSION }}" \
|
||||
--aws-s3-bucket-dev "${{ vars.AWS_S3_BUCKET_DEV }}"
|
||||
|
||||
python3 -c "
|
||||
import yaml
|
||||
data = yaml.safe_load(open('/tmp/artifact_urls.yaml'))
|
||||
print(f'wazuh_certs_tool={data[\"wazuh_certs_tool\"]}')
|
||||
" >> "$GITHUB_ENV"
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Provision: allocate VM and extract SSH credentials
|
||||
# -----------------------------------------------------------------------
|
||||
@@ -517,10 +502,20 @@ jobs:
|
||||
- name: Prepare cert tool and config
|
||||
run: |
|
||||
DEPLOYMENT="${{ matrix.deployment_type }}"
|
||||
VERSION="${{ env.WAZUH_VERSION }}"
|
||||
STAGE="${{ env.WAZUH_STAGE }}"
|
||||
MAJOR=$(echo "$VERSION" | cut -d. -f1)
|
||||
|
||||
echo "Cert tool: ${{ env.wazuh_certs_tool }} Docker image: ${{ env.DOCKER_TAG }}"
|
||||
echo "Cert tool: ${VERSION}-${STAGE} Docker image: ${{ env.DOCKER_TAG }}"
|
||||
|
||||
curl --output "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh" "${{ env.wazuh_certs_tool }}"
|
||||
# Download cert tool once on the runner
|
||||
if [ -n "$STAGE" ]; then
|
||||
CERT_TOOL_URL="https://packages-staging.xdrsiem.wazuh.info/pre-release/${MAJOR}.x/installation-assistant/wazuh-certs-tool-${VERSION}-${STAGE}.sh"
|
||||
else
|
||||
CERT_TOOL_URL="https://packages.wazuh.com/${MAJOR}.$(echo "$VERSION" | cut -d. -f2)/wazuh-certs-tool-${VERSION}-1.sh"
|
||||
fi
|
||||
echo "Downloading cert tool: $CERT_TOOL_URL"
|
||||
curl -fsSL -o "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh" "$CERT_TOOL_URL"
|
||||
chmod +x "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh"
|
||||
echo "Downloaded OK"
|
||||
|
||||
@@ -737,10 +732,11 @@ jobs:
|
||||
|
||||
- name: Upload Docker logs
|
||||
if: failure() || steps.run_tests.outcome == 'failure'
|
||||
run: |
|
||||
echo "Uploading Docker logs artifact..."
|
||||
zip "${{ env.LOGS_ARTIFACT_ZIP_FILE }}" docker-logs-*.txt
|
||||
aws s3 cp "${{ env.LOGS_ARTIFACT_ZIP_FILE }}" "s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/5_check_integration_tools/${{ github.run_id }}/${{ env.LOGS_ARTIFACT_ZIP_FILE }}"
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: docker-logs-${{ matrix.deployment_type }}-${{ github.run_id }}
|
||||
path: docker-logs-*.txt
|
||||
retention-days: 7
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Reporting
|
||||
@@ -814,16 +810,11 @@ jobs:
|
||||
|
||||
- name: Upload test results
|
||||
if: always()
|
||||
env:
|
||||
S3_ARTIFACTS_PATH: s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/5_check_integration_tools/${{ github.run_id }}
|
||||
LOCAL_RESULTS_PATH: test-results-docker-${{ matrix.deployment_type }}.github
|
||||
run: |
|
||||
if [ -f "${LOCAL_RESULTS_PATH}" ]; then
|
||||
echo "Uploading test results to S3..."
|
||||
aws s3 cp "${LOCAL_RESULTS_PATH}" "${S3_ARTIFACTS_PATH}/test-results-docker-${{ matrix.deployment_type }}/"
|
||||
else
|
||||
echo "::warning::No test results file found - skipping upload (an earlier step likely failed before test_runner produced output)."
|
||||
fi
|
||||
uses: actions/upload-artifact@v4
|
||||
with:
|
||||
name: test-results-docker-${{ matrix.deployment_type }}-${{ github.run_id }}
|
||||
path: test-results-docker-${{ matrix.deployment_type }}.github
|
||||
retention-days: 7
|
||||
|
||||
# -----------------------------------------------------------------------
|
||||
# Cleanup: always stop stack and deallocate VM
|
||||
|
||||
@@ -0,0 +1,664 @@
|
||||
name: (8.x) Docker PR check
|
||||
permissions:
|
||||
contents: read
|
||||
id-token: write
|
||||
on:
|
||||
pull_request:
|
||||
types: [opened, synchronize, reopened, ready_for_review]
|
||||
branches:
|
||||
- 5.*
|
||||
- main
|
||||
paths:
|
||||
- 'build-docker-images/**'
|
||||
- 'multi-node/**'
|
||||
- 'single-node/**'
|
||||
- 'wazuh-agent/**'
|
||||
- '.github/**'
|
||||
workflow_dispatch:
|
||||
inputs:
|
||||
docker_reference:
|
||||
description: 'Branch or tag to build from'
|
||||
required: true
|
||||
type: string
|
||||
|
||||
jobs:
|
||||
|
||||
prepare-variables:
|
||||
if: ${{ !github.event.pull_request.draft }}
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
outputs:
|
||||
WAZUH_VERSION: ${{ steps.dotenv.outputs.WAZUH_VERSION }}
|
||||
WAZUH_IMAGE_VERSION: ${{ steps.dotenv.outputs.WAZUH_IMAGE_VERSION }}
|
||||
WAZUH_REGISTRY: ${{ vars.IMAGE_REGISTRY_DEV }}
|
||||
IMAGE_TAG: ${{ steps.dotenv.outputs.IMAGE_TAG }}
|
||||
WAZUH_MINOR_VERSION: ${{ steps.dotenv.outputs.WAZUH_MINOR_VERSION }}
|
||||
steps:
|
||||
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Export .env variables
|
||||
id: dotenv
|
||||
shell: bash
|
||||
run: |
|
||||
if [ ! -f .env ]; then echo "::error::.env missing"; exit 1; fi
|
||||
grep -v '^#' .env | grep -v '^\s*$' >> "$GITHUB_OUTPUT"
|
||||
FULL_VERSION=$(grep "^WAZUH_VERSION=" .env | cut -d'=' -f2)
|
||||
MINOR_VERSION=$(echo "$FULL_VERSION" | cut -d'.' -f1,2)
|
||||
echo "WAZUH_MINOR_VERSION=$MINOR_VERSION" >> "$GITHUB_OUTPUT"
|
||||
|
||||
|
||||
build-images:
|
||||
needs: prepare-variables
|
||||
uses: ./.github/workflows/5_build_and_push_images.yml
|
||||
secrets: inherit
|
||||
with:
|
||||
image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
|
||||
docker_reference: ${{ github.head_ref || inputs.docker_reference }}
|
||||
wazuh_automation_reference: '5.0.0'
|
||||
commit_list: '["latest", "latest", "latest", "latest"]'
|
||||
assistant_revision: 'latest'
|
||||
id: ${{ github.run_id }}
|
||||
dev: true
|
||||
|
||||
Execute-Goss-tests:
|
||||
needs: [prepare-variables, build-images]
|
||||
runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
|
||||
env:
|
||||
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
|
||||
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Install Goss
|
||||
uses: e1himself/goss-installation-action@v1.0.3
|
||||
with:
|
||||
version: 'v0.4.4'
|
||||
|
||||
- name: Configure aws credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
aws-region: "${{ secrets.AWS_REGION }}"
|
||||
|
||||
- name: Log in to Amazon ECR
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Execute Goss tests (wazuh-manager)
|
||||
run: dgoss run ${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-manager:${{ env.WAZUH_IMAGE_VERSION }}-latest
|
||||
env:
|
||||
GOSS_SLEEP: 30
|
||||
GOSS_FILE: .github/.goss.yaml
|
||||
|
||||
check-single-node:
|
||||
name: Check single node on ${{ matrix.os }}
|
||||
runs-on: ${{ matrix.os }}
|
||||
strategy:
|
||||
matrix:
|
||||
os: ["codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}", "codebuild-github-actions-codebuild-runner-devops-arm-${{ github.run_id }}-${{ github.run_attempt }}"]
|
||||
fail-fast: false
|
||||
needs: [prepare-variables, Execute-Goss-tests]
|
||||
env:
|
||||
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
|
||||
WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
|
||||
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
|
||||
INDEXER_USERNAME: admin
|
||||
INDEXER_PASSWORD: admin
|
||||
MANAGER_NODES: "manager"
|
||||
API_USERNAME: wazuh-wui
|
||||
API_PASSWORD: wazuh-wui
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Configure aws credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
aws-region: "${{ secrets.AWS_REGION }}"
|
||||
|
||||
- name: Log in to Amazon ECR
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Download artifact_urls.yaml
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ./single-node/
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Add environment variables into GITHUB_ENV
|
||||
run: |
|
||||
# Export variables to the environment
|
||||
awk -F':' '!/^#/ && NF>1 {name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' ${{ vars.ARTIFACT_URL_FILE_NAME }} >> "$GITHUB_ENV"
|
||||
working-directory: ./single-node/
|
||||
|
||||
- name: Create single node certficates
|
||||
run: |
|
||||
curl --output ./wazuh-certs-tool.sh "${{ env.wazuh_certs_tool }}"
|
||||
cat > config.yml <<EOF
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: wazuh.indexer
|
||||
dns: "wazuh.indexer"
|
||||
|
||||
# Wazuh manager nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
manager:
|
||||
- name: wazuh.manager
|
||||
dns: "wazuh.manager"
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
dns: "wazuh.dashboard"
|
||||
EOF
|
||||
cat config.yml
|
||||
sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
working-directory: ./single-node
|
||||
|
||||
- name: Edit single node docker-compose file
|
||||
shell: bash
|
||||
env:
|
||||
WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
|
||||
run: |
|
||||
TARGET_FILE="single-node/docker-compose.yml"
|
||||
if [ -f "$TARGET_FILE" ]; then
|
||||
echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
|
||||
sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
|
||||
sed -i "s/\(.*wazuh\/wazuh-.*:\)${{ env.WAZUH_IMAGE_VERSION }}/\1${{ env.WAZUH_IMAGE_VERSION }}-latest/g" "$TARGET_FILE"
|
||||
else
|
||||
echo "File $TARGET_FILE not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Start single node stack
|
||||
id: start_single_node_stack
|
||||
run: docker compose up -d
|
||||
working-directory: ./single-node
|
||||
|
||||
- name: Check Wazuh indexer start
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking Wazuh indexer health (Attempt $i/20)"
|
||||
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
|
||||
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
|
||||
if echo "$RESPONSE" | grep -qE "green|yellow"; then
|
||||
echo "Cluster Online"
|
||||
echo "$RESPONSE"
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for cluster to be online"
|
||||
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
|
||||
echo ""
|
||||
echo "========================================================="
|
||||
echo "Container logs for $CONTAINER_NAME"
|
||||
echo "========================================================="
|
||||
docker logs --tail 30 "$CONTAINER_NAME"
|
||||
echo "---------------------------------------------------------"
|
||||
done
|
||||
[ $i -lt 20 ] && sleep 60
|
||||
done
|
||||
status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
|
||||
status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green|yellow" | wc -l`"
|
||||
if [[ $status_index_green -eq $status_index ]]; then
|
||||
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
|
||||
else
|
||||
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
|
||||
exit 1
|
||||
fi
|
||||
|
||||
|
||||
- name: Check Wazuh indexer nodes
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
|
||||
- name: Check Wazuh templates
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
|
||||
templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
|
||||
if [[ $qty_templates -gt 3 ]]; then
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
else
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh manager start
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for NODE in "${{ env.MANAGER_NODES }}"; do
|
||||
ok=false
|
||||
for i in {1..20}; do
|
||||
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X POST "https://127.0.0.1:55000/security/user/authenticate?raw=true")
|
||||
services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`"
|
||||
if [[ $services -gt 7 ]]; then
|
||||
echo "Wazuh Manager $NODE Services: ${services}"
|
||||
echo "OK"
|
||||
ok=true
|
||||
break
|
||||
else
|
||||
curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items
|
||||
echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s"
|
||||
[ $i -lt 20 ] && sleep 30
|
||||
fi
|
||||
done
|
||||
if [[ "$ok" != "true" ]]; then
|
||||
echo "Error: Wazuh Manager $NODE did not reach expected running services threshold"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
- name: Check Wazuh dashboard service URL
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking Wazuh dashboard (Attempt $i/20)"
|
||||
STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://127.0.0.1:443/app/status" || true)
|
||||
echo "Current status: $STATUS"
|
||||
if [[ "$STATUS" == "200" ]]; then
|
||||
echo "Wazuh dashboard is UP"
|
||||
exit 0
|
||||
elif [[ "$STATUS" == "429" || "$STATUS" == "503" ]]; then
|
||||
echo "Dashboard is busy or initializing (Status $STATUS). Retrying in 30s"
|
||||
else
|
||||
echo "Unexpected status $STATUS. Retrying in 30s"
|
||||
fi
|
||||
sleep 30
|
||||
done
|
||||
echo "Error: Dashboard did not reach 200 status in time."
|
||||
exit 1
|
||||
|
||||
- name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
|
||||
|
||||
- name: Edit Wazuh agent docker-compose file
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
shell: bash
|
||||
env:
|
||||
WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
|
||||
run: |
|
||||
TARGET_FILE="wazuh-agent/docker-compose.yml"
|
||||
if [ -f "$TARGET_FILE" ]; then
|
||||
echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
|
||||
sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
|
||||
sed -i "s/\(.*wazuh\/wazuh-.*:\)${{ env.WAZUH_IMAGE_VERSION }}/\1${{ env.WAZUH_IMAGE_VERSION }}-latest/g" "$TARGET_FILE"
|
||||
else
|
||||
echo "File $TARGET_FILE not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Start Wazuh agent
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: docker compose up -d
|
||||
working-directory: ./wazuh-agent
|
||||
|
||||
- name: Check Wazuh agent enrollment
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
enrolled=false
|
||||
for i in {1..5}; do
|
||||
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X POST "https://127.0.0.1:55000/security/user/authenticate?raw=true")
|
||||
agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`"
|
||||
if [[ $agents -gt 0 ]]; then
|
||||
echo "Wazuh agents: ${agents}"
|
||||
echo "OK"
|
||||
enrolled=true
|
||||
break
|
||||
else
|
||||
curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}"
|
||||
echo "Wazuh agents: ${agents}. Retrying in 10s"
|
||||
[ $i -lt 5 ] && sleep 10
|
||||
fi
|
||||
done
|
||||
if [[ "$enrolled" != "true" ]]; then
|
||||
echo "Error: Wazuh agent enrollment did not reach expected active agents threshold"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check errors in wazuh-manager.log for Wazuh manager
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: ./.github/single-node-log-check.sh
|
||||
|
||||
- name: Check documents into wazuh-states index
|
||||
if: ${{ always() && steps.start_single_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking documents in wazuh-states (Attempt $i/20)..."
|
||||
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
|
||||
DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
|
||||
if [[ "$DOCS" -gt 0 ]]; then
|
||||
echo "wazuh-states index has documents: ${DOCS}"
|
||||
exit 0
|
||||
fi
|
||||
echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
|
||||
[ $i -lt 20 ] && sleep 60
|
||||
done
|
||||
echo "Error: No documents found in wazuh-states after 20 attempts."
|
||||
echo "Last response: $RESPONSE"
|
||||
exit 1
|
||||
|
||||
- name: Docker logs
|
||||
if: always()
|
||||
continue-on-error: true
|
||||
run: |
|
||||
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}')
|
||||
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
|
||||
echo ""
|
||||
echo "========================================================="
|
||||
echo "Container logs for $CONTAINER_NAME"
|
||||
echo "========================================================="
|
||||
docker logs "$CONTAINER_NAME"
|
||||
echo "---------------------------------------------------------"
|
||||
done
|
||||
working-directory: ./single-node
|
||||
|
||||
check-multi-node:
|
||||
name: Check multi node on ${{ matrix.os }}
|
||||
runs-on: ${{ matrix.os }}
|
||||
strategy:
|
||||
matrix:
|
||||
os: ["codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}", "codebuild-github-actions-codebuild-runner-devops-arm-${{ github.run_id }}-${{ github.run_attempt }}"]
|
||||
fail-fast: false
|
||||
needs: [prepare-variables, Execute-Goss-tests]
|
||||
env:
|
||||
WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
|
||||
WAZUH_MINOR_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_MINOR_VERSION }}
|
||||
WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
|
||||
INDEXER_USERNAME: admin
|
||||
INDEXER_PASSWORD: admin
|
||||
MANAGER_NODES: "master,worker01"
|
||||
API_USERNAME: wazuh-wui
|
||||
API_PASSWORD: wazuh-wui
|
||||
steps:
|
||||
|
||||
- name: Check out code
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Configure aws credentials
|
||||
uses: aws-actions/configure-aws-credentials@v4
|
||||
with:
|
||||
role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
|
||||
aws-region: "${{ secrets.AWS_REGION }}"
|
||||
|
||||
- name: Log in to Amazon ECR
|
||||
uses: aws-actions/amazon-ecr-login@v2
|
||||
|
||||
- name: Download artifact_urls.yaml
|
||||
uses: actions/download-artifact@v4
|
||||
with:
|
||||
name: presigned-artifact-urls-${{ github.run_id }}
|
||||
path: ./multi-node/
|
||||
|
||||
- name: Log in to Docker Hub
|
||||
uses: docker/login-action@v4
|
||||
with:
|
||||
username: ${{ secrets.DOCKERHUB_USERNAME }}
|
||||
password: ${{ secrets.DOCKERHUB_PASSWORD }}
|
||||
|
||||
- name: Add environment variables into GITHUB_ENV
|
||||
run: |
|
||||
# Export variables to the environment
|
||||
awk -F':' '!/^#/ && NF>1 {name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=" val}' ${{ vars.ARTIFACT_URL_FILE_NAME }} >> "$GITHUB_ENV"
|
||||
working-directory: ./multi-node/
|
||||
|
||||
- name: Create multi node certficates
|
||||
run: |
|
||||
curl --output ./wazuh-certs-tool.sh "${{ env.wazuh_certs_tool }}"
|
||||
cat > config.yml <<EOF
|
||||
nodes:
|
||||
# Wazuh indexer server nodes
|
||||
indexer:
|
||||
- name: wazuh1.indexer
|
||||
dns: "wazuh1.indexer"
|
||||
- name: wazuh2.indexer
|
||||
dns: "wazuh2.indexer"
|
||||
- name: wazuh3.indexer
|
||||
dns: "wazuh3.indexer"
|
||||
|
||||
# Wazuh manager nodes
|
||||
# Use node_type only with more than one Wazuh manager
|
||||
manager:
|
||||
- name: wazuh.master
|
||||
dns: "wazuh.master"
|
||||
node_type: master
|
||||
- name: wazuh.worker
|
||||
dns: "wazuh.worker"
|
||||
node_type: worker
|
||||
|
||||
# Wazuh dashboard node
|
||||
dashboard:
|
||||
- name: wazuh.dashboard
|
||||
dns: "wazuh.dashboard"
|
||||
EOF
|
||||
cat config.yml
|
||||
sudo bash ../tools/utils/deployment/certificates-conf.sh --cert --copy --priv
|
||||
sudo sysctl -w vm.max_map_count=262144
|
||||
working-directory: ./multi-node
|
||||
|
||||
- name: Edit multi node docker-compose file
|
||||
shell: bash
|
||||
run: |
|
||||
TARGET_FILE="multi-node/docker-compose.yml"
|
||||
if [ -f "$TARGET_FILE" ]; then
|
||||
echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
|
||||
sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
|
||||
sed -i "s/\(.*wazuh\/wazuh-.*:\)${{ env.WAZUH_IMAGE_VERSION }}/\1${{ env.WAZUH_IMAGE_VERSION }}-latest/g" "$TARGET_FILE"
|
||||
else
|
||||
echo "File $TARGET_FILE not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Start multi node stack
|
||||
id: start_multi_node_stack
|
||||
run: docker compose up -d
|
||||
working-directory: ./multi-node
|
||||
|
||||
- name: Check Wazuh indexer start
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking Wazuh indexer health (Attempt $i/20)"
|
||||
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/_cluster/health?pretty" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s --retry 2 || true)
|
||||
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}' | grep "indexer")
|
||||
if echo "$RESPONSE" | grep -qE "green|yellow"; then
|
||||
echo "Cluster Online"
|
||||
echo "$RESPONSE"
|
||||
exit 0
|
||||
fi
|
||||
echo "Waiting for cluster to be online"
|
||||
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
|
||||
echo ""
|
||||
echo "========================================================="
|
||||
echo "Container logs for $CONTAINER_NAME"
|
||||
echo "========================================================="
|
||||
docker logs --tail 30 "$CONTAINER_NAME"
|
||||
echo "---------------------------------------------------------"
|
||||
done
|
||||
[ $i -lt 20 ] && sleep 60
|
||||
done
|
||||
status_index="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | wc -l`"
|
||||
status_index_green="`curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "green" | wc -l`"
|
||||
if [[ $status_index_green -eq $status_index ]]; then
|
||||
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
|
||||
else
|
||||
curl -XGET "https://127.0.0.1:9200/_cat/indices" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh indexer nodes
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
nodes="`curl -XGET "https://127.0.0.1:9200/_cat/nodes" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep -E "indexer" | wc -l`"
|
||||
if [[ $nodes -eq 3 ]]; then
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
else
|
||||
echo "Wazuh indexer nodes: ${nodes}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh templates
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
qty_templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh" | wc -l`"
|
||||
templates="`curl -XGET "https://127.0.0.1:9200/_cat/templates" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s | grep "wazuh"`"
|
||||
if [[ $qty_templates -gt 3 ]]; then
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
else
|
||||
echo "wazuh templates:"
|
||||
echo "${templates}"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check Wazuh manager start
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
IFS=',' read -r -a NODES <<< "${{ env.MANAGER_NODES }}"
|
||||
for NODE in "${NODES[@]}"; do
|
||||
if [[ "$NODE" == "master" ]]; then
|
||||
THRESHOLD=8
|
||||
else
|
||||
THRESHOLD=7
|
||||
fi
|
||||
ok=false
|
||||
for i in {1..20}; do
|
||||
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X POST "https://127.0.0.1:55000/security/user/authenticate?raw=true")
|
||||
services="`curl -k -s -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep running | wc -l`"
|
||||
if [[ $services -ge $THRESHOLD ]]; then
|
||||
echo "Wazuh Manager $NODE Services: ${services}"
|
||||
echo "OK"
|
||||
ok=true
|
||||
break
|
||||
else
|
||||
curl -k -X GET "https://127.0.0.1:55000/cluster/$NODE/status?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items
|
||||
echo "Wazuh Manager $NODE Services: ${services}. Retrying in 30s"
|
||||
[ $i -lt 20 ] && sleep 30
|
||||
fi
|
||||
done
|
||||
if [[ "$ok" != "true" ]]; then
|
||||
echo "Error: Wazuh Manager $NODE did not reach expected running services threshold"
|
||||
exit 1
|
||||
fi
|
||||
done
|
||||
|
||||
- name: Check Wazuh dashboard service URL
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking Wazuh dashboard (Attempt $i/20)"
|
||||
STATUS=$(curl -k -s -o /dev/null -w "%{http_code}" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} "https://127.0.0.1:443/app/status" || true)
|
||||
echo "Current status: $STATUS"
|
||||
if [[ "$STATUS" == "200" ]]; then
|
||||
echo "Wazuh dashboard is UP"
|
||||
exit 0
|
||||
elif [[ "$STATUS" == "429" || "$STATUS" == "503" ]]; then
|
||||
echo "Dashboard is busy or initializing (Status $STATUS). Retrying in 30s"
|
||||
else
|
||||
echo "Unexpected status $STATUS. Retrying in 30s"
|
||||
fi
|
||||
sleep 30
|
||||
done
|
||||
echo "Error: Dashboard did not reach 200 status in time."
|
||||
exit 1
|
||||
|
||||
- name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
|
||||
|
||||
- name: Edit Wazuh agent docker-compose file
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
shell: bash
|
||||
env:
|
||||
WAZUH_REGISTRY: ${{ env.WAZUH_REGISTRY }}
|
||||
run: |
|
||||
TARGET_FILE="wazuh-agent/docker-compose.yml"
|
||||
if [ -f "$TARGET_FILE" ]; then
|
||||
echo "Updating registry in $TARGET_FILE to: ${{ env.WAZUH_REGISTRY }}"
|
||||
sed -i "s|wazuh/wazuh-|${{ env.WAZUH_REGISTRY }}/wazuh/wazuh-|g" "$TARGET_FILE"
|
||||
sed -i "s/\(.*wazuh\/wazuh-.*:\)${{ env.WAZUH_IMAGE_VERSION }}/\1${{ env.WAZUH_IMAGE_VERSION }}-latest/g" "$TARGET_FILE"
|
||||
else
|
||||
echo "File $TARGET_FILE not found"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Start Wazuh agent
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: docker compose -f wazuh-agent/docker-compose.yml up -d
|
||||
|
||||
- name: Check Wazuh agent enrollment
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
enrolled=false
|
||||
for i in {1..5}; do
|
||||
TOKEN=$(curl -s -u ${{ env.API_USERNAME }}:${{ env.API_PASSWORD }} -k -X POST "https://127.0.0.1:55000/security/user/authenticate?raw=true")
|
||||
agents="`curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}" | jq -r .data.affected_items | grep active | wc -l`"
|
||||
if [[ $agents -gt 0 ]]; then
|
||||
echo "Wazuh agents: ${agents}"
|
||||
echo "OK"
|
||||
enrolled=true
|
||||
break
|
||||
else
|
||||
curl -k -s -X GET "https://127.0.0.1:55000/agents?pretty=true" -H "Authorization: Bearer ${TOKEN}"
|
||||
echo "Wazuh agents: ${agents}. Retrying in 10s"
|
||||
[ $i -lt 5 ] && sleep 10
|
||||
fi
|
||||
done
|
||||
if [[ "$enrolled" != "true" ]]; then
|
||||
echo "Error: Wazuh agent enrollment did not reach expected active agents threshold"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
- name: Check errors in wazuh-manager.log for Wazuh manager
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: ./.github/multi-node-log-check.sh
|
||||
|
||||
- name: Check documents into wazuh-states index
|
||||
if: ${{ always() && steps.start_multi_node_stack.outcome == 'success' }}
|
||||
run: |
|
||||
for i in {1..20}; do
|
||||
echo "Checking documents in wazuh-states (Attempt $i/20)..."
|
||||
RESPONSE=$(curl -XGET "https://127.0.0.1:9200/wazuh-states*/_count" -u ${{ env.INDEXER_USERNAME }}:${{ env.INDEXER_PASSWORD }} -k -s || echo "{}")
|
||||
DOCS=$(echo "$RESPONSE" | jq -r '.count // 0')
|
||||
if [[ "$DOCS" -gt 0 ]]; then
|
||||
echo "wazuh-states index has documents: ${DOCS}"
|
||||
exit 0
|
||||
fi
|
||||
echo "The index is empty or does not exist yet (Count: $DOCS). Waiting 60s"
|
||||
[ $i -lt 20 ] && sleep 60
|
||||
done
|
||||
echo "Error: No documents found in wazuh-states after 20 attempts."
|
||||
echo "Last response: $RESPONSE"
|
||||
exit 1
|
||||
|
||||
- name: Docker logs
|
||||
if: always()
|
||||
continue-on-error: true
|
||||
run: |
|
||||
INDEXER_CONTAINERS=$(docker ps --format '{{.Names}}')
|
||||
for CONTAINER_NAME in $INDEXER_CONTAINERS; do
|
||||
echo ""
|
||||
echo "========================================================="
|
||||
echo "Container logs for $CONTAINER_NAME"
|
||||
echo "========================================================="
|
||||
docker logs "$CONTAINER_NAME"
|
||||
echo "---------------------------------------------------------"
|
||||
done
|
||||
working-directory: ./multi-node
|
||||
+1119
-81
File diff suppressed because it is too large
Load Diff
+8
-19
@@ -1,6 +1,6 @@
|
||||
# Wazuh Open Source Project Security Policy
|
||||
|
||||
Version: 2026-07-06
|
||||
Version: 2023-06-12
|
||||
|
||||
## Introduction
|
||||
This document outlines the Security Policy for Wazuh's open source projects. It emphasizes our commitment to maintain a secure environment for our users and contributors, and reflects our belief in the power of collaboration to identify and resolve security vulnerabilities.
|
||||
@@ -13,27 +13,16 @@ If you believe you've discovered a potential security vulnerability in one of ou
|
||||
|
||||
Please submit your findings as security advisories under the "Security" tab in the relevant GitHub repository. Alternatively, you may send the details of your findings to [security@wazuh.com](mailto:security@wazuh.com).
|
||||
|
||||
## Reporting Vulnerabilities in Non-GA Versions
|
||||
|
||||
Wazuh publishes pre-release versions (Alphas, Betas, and Release Candidates) of its open source projects ahead of General Availability (GA) to gather community feedback. If you discover a potential security vulnerability in one of these non-GA versions, please report it following the process described above.
|
||||
|
||||
Upon receiving such a report, we will determine whether the vulnerability:
|
||||
|
||||
- **Affects only non-GA version(s)**: We will manage the report privately by opening a GitHub Security Advisory (GHSA). Since the affected code has not been part of a GA release, the vulnerability is not eligible for a CVE ID, consistent with the [CNA Operational Rules](https://www.cve.org/ResourcesSupport/AllResources/CNARules). Once resolved, the GHSA will be converted into a public issue instead of a security advisory.
|
||||
- **Also affects a previously released GA version**: We will continue managing the report as a GHSA and evaluate requesting a CVE ID for the GA-affected versions, in accordance with the eligibility criteria in the CNA Operational Rules.
|
||||
|
||||
## Vulnerability Disclosure Policy
|
||||
Upon receiving a report of a potential vulnerability, our team will initiate an investigation. If the reported issue is confirmed as a vulnerability, we will take the following steps:
|
||||
|
||||
1. **Acknowledgment**: We will acknowledge the receipt of your vulnerability report and begin our investigation.
|
||||
2. **Validation**: We will validate the issue and work on reproducing it in our environment.
|
||||
3. **Remediation**: We will develop a fix, have it reviewed, and merge it once thoroughly tested.
|
||||
4. **Release**: We will publish a security release for the affected project that includes the fix.
|
||||
5. **Rollout**: We will confirm that the fix has been applied to environments managed by Wazuh before proceeding with disclosure.
|
||||
6. **Disclosure**: Once the fix has been released and confirmed in managed environments, we will publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures), where applicable, and acknowledging the discovering party.
|
||||
7. **Exceptions**: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments.
|
||||
1. Acknowledgment: We will acknowledge the receipt of your vulnerability report and begin our investigation.
|
||||
2. Validation: We will validate the issue and work on reproducing it in our environment.
|
||||
3. Remediation: We will work on a fix and thoroughly test it
|
||||
4. Release & Disclosure: After 90 days from the discovery of the vulnerability, or as soon as a fix is ready and thoroughly tested (whichever comes first), we will release a security update for the affected project. We will also publicly disclose the vulnerability by publishing a CVE (Common Vulnerabilities and Exposures) and acknowledging the discovering party.
|
||||
5. Exceptions: In order to preserve the security of the Wazuh community at large, we might extend the disclosure period to allow users to patch their deployments.
|
||||
|
||||
Steps 1 through 6 will be completed within 90 days from the report of the vulnerability. This period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability.
|
||||
This 90-day period allows for end-users to update their systems and minimizes the risk of widespread exploitation of the vulnerability.
|
||||
|
||||
## Automatic Scanning
|
||||
We leverage GitHub Actions to perform automated scans of our supply chain. These scans assist us in identifying vulnerabilities and outdated dependencies in a proactive and timely manner.
|
||||
@@ -53,4 +42,4 @@ We ask that all users and contributors respect this policy and the security of o
|
||||
## Changes to this Security Policy
|
||||
This policy may be revised from time to time. Each version of the policy will be identified at the top of the page by its effective date.
|
||||
|
||||
If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com)
|
||||
If you have any questions about this Security Policy, please contact us at [security@wazuh.com](mailto:security@wazuh.com)
|
||||
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
{
|
||||
"version": "5.0.0",
|
||||
"stage": "rc1"
|
||||
"version": "8.0.0",
|
||||
"stage": "rc8"
|
||||
}
|
||||
|
||||
@@ -36,7 +36,8 @@ RUN dnf install procps shadow-utils -y && \
|
||||
curl -o /wazuh-agent.rpm "${agent_url}" && \
|
||||
dnf install /wazuh-agent.rpm -y && \
|
||||
rm -rf /wazuh-agent.rpm && \
|
||||
dnf clean all
|
||||
dnf clean all && \
|
||||
sed -i '/<authorization_pass_path>/d' /var/ossec/etc/ossec.conf
|
||||
|
||||
# Download tini static binary (no external library dependencies)
|
||||
RUN curl --fail --silent -L \
|
||||
|
||||
@@ -62,15 +62,6 @@ set_manager_conn() {
|
||||
sed -i "s#<address>CHANGE_MANAGER_IP</address>#<address>$WAZUH_MANAGER_SERVER</address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
sed -i "s#<manager_address>CHANGE_ENROLL_IP</manager_address>#<manager_address>$WAZUH_REGISTRATION_SERVER</manager_address>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
sed -i "s#<agent_name>CHANGE_AGENT_NAME</agent_name>#<agent_name>$WAZUH_AGENT_NAME</agent_name>#g" ${WAZUH_INSTALL_PATH}/etc/ossec.conf
|
||||
if [ -n "$WAZUH_REGISTRATION_PASSWORD" ]; then
|
||||
set +x
|
||||
cat << EOF > /var/ossec/etc/authd.pass
|
||||
$WAZUH_REGISTRATION_PASSWORD
|
||||
EOF
|
||||
set -x
|
||||
else
|
||||
echo "WAZUH_REGISTRATION_PASSWORD is not set; the authd.pass configuration is omitted."
|
||||
fi
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
|
||||
@@ -46,7 +46,8 @@ RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the current Wazuh dashboard image):
|
||||
# Copy wazuh-dashboard from builder
|
||||
#
|
||||
# Copy wazuh-dashboard from stage 0
|
||||
# Add entrypoint
|
||||
# Add wazuh_dashboard_config
|
||||
################################################################################
|
||||
|
||||
@@ -41,7 +41,8 @@ RUN yum install curl-minimal shadow-utils findutils hostname -y && \
|
||||
|
||||
################################################################################
|
||||
# Build stage 1 (the actual Wazuh indexer image):
|
||||
# Copy wazuh-indexer from builder
|
||||
#
|
||||
# Copy wazuh-indexer from stage 0
|
||||
# Add entrypoint
|
||||
################################################################################
|
||||
FROM amazonlinux:2023
|
||||
|
||||
@@ -252,9 +252,9 @@ configure_permissions() {
|
||||
##############################################################################
|
||||
|
||||
set_correct_permOwner() {
|
||||
find /var/wazuh-manager/ -group 997 -exec chown :101 {} +
|
||||
find /var/wazuh-manager/ -group 999 -exec chown :101 {} +
|
||||
find /var/wazuh-manager/ -user 999 -exec chown 101 {} +
|
||||
find /var/wazuh-manager/ -group 997 -exec chown :101 {} +;
|
||||
find /var/wazuh-manager/ -group 999 -exec chown :101 {} +;
|
||||
find /var/wazuh-manager/ -user 999 -exec chown 101:{} +;
|
||||
}
|
||||
|
||||
##############################################################################
|
||||
|
||||
@@ -30,9 +30,3 @@
|
||||
- [Security](ref/security.md)
|
||||
- [Performance](ref/performance.md)
|
||||
- [Glossary](ref/glossary.md)
|
||||
|
||||
---
|
||||
|
||||
# Integration Tests
|
||||
|
||||
- [Docker Integration Tests](ref/integration_test/docker_integration_tests.md)
|
||||
|
||||
@@ -21,8 +21,8 @@ The Wazuh Manager container accepts the following environment variables, which c
|
||||
|
||||
```yaml
|
||||
environment:
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
@@ -30,7 +30,7 @@ environment:
|
||||
|
||||
**Variable Descriptions:**
|
||||
|
||||
- `INDEXER_USERNAME` / `INDEXER_PASSWORD`: Credentials for accessing the Wazuh Indexer with `wazuh-manager` user or a user with the same permissions.
|
||||
- `INDEXER_USERNAME` / `INDEXER_PASSWORD`: Credentials for accessing the Wazuh Indexer with `admin` user or a user with the same permissions.
|
||||
- `WAZUH_API_URL`: URL of the Wazuh API, used by other services for communication.
|
||||
- `DASHBOARD_USERNAME` / `DASHBOARD_PASSWORD`: Credentials for the Wazuh Dashboard to authenticate with the Indexer.
|
||||
|
||||
@@ -57,8 +57,8 @@ The Wazuh Dashboard container accepts the following environment variables, which
|
||||
|
||||
```yaml
|
||||
environment:
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=SecretPassword
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
|
||||
@@ -19,11 +19,9 @@ Follow these steps to deploy the Wazuh agent using Docker.
|
||||
# ...
|
||||
environment:
|
||||
- WAZUH_MANAGER_SERVER=<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>
|
||||
- WAZUH_REGISTRATION_PASSWORD=<authd.pass-PASSWORD>
|
||||
# ...
|
||||
```
|
||||
**Note:** Replaces `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager.
|
||||
**Note:** Replaces `<authd.pass-PASSWORD>` with the password configured in the `/var/wazuh-manager/etc/authd.pass` file of the Wazuh manager server where you will connect.
|
||||
**Note:** Replace `<YOUR_WAZUH_MANAGER_IP_OR_HOSTNAME>` with the actual IP address or hostname of your Wazuh manager.
|
||||
|
||||
3. Start the environment using `docker compose`:
|
||||
|
||||
|
||||
@@ -1,332 +0,0 @@
|
||||
# Docker Integration Tests
|
||||
|
||||
Workflow file: `.github/workflows/5_check_integration_tools.yml`
|
||||
|
||||
This workflow optionally builds Docker images from the PR branch, provisions a dedicated AWS VM, deploys the Wazuh Docker stack (single-node or multi-node), and runs the integration test suite against it via SSH.
|
||||
|
||||
---
|
||||
|
||||
## Triggers
|
||||
|
||||
| Mode | Trigger | Who can trigger |
|
||||
|---|---|---|
|
||||
| PR comment | `issue_comment` on an open, non-draft PR | Any repo collaborator |
|
||||
| Manual | `workflow_dispatch` | Anyone with repo write access |
|
||||
|
||||
---
|
||||
|
||||
## Execution Flows
|
||||
|
||||
### issue_comment flow
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A[PR comment posted] --> B{Recognized command\non open non-draft PR?}
|
||||
B -- No --> Z[Ignored]
|
||||
B -- Yes --> C[get_pr_info\nReact · Extract PR data\nParse command · Create Check Run]
|
||||
C --> D[prepare\nResolve branch · Read VERSION.json]
|
||||
D --> E[build_images\nBuild + push to ECR\nalways runs on PR comment]
|
||||
E --> F{deployment_matrix}
|
||||
F --> G[docker_test\nsingle-node]
|
||||
F --> H[docker_test\nmulti-node]
|
||||
G --> I[update_check]
|
||||
H --> I
|
||||
```
|
||||
|
||||
**Recognized commands:**
|
||||
|
||||
| Comment | Deployment matrix |
|
||||
|---|---|
|
||||
| `/test-docker` | `["single-node","multi-node"]` |
|
||||
| `/test-docker-single` | `["single-node"]` |
|
||||
| `/test-docker-multi` | `["multi-node"]` |
|
||||
|
||||
When triggered by PR comment, `build_images` **always** runs — images are always built from the PR branch and pushed to ECR.
|
||||
|
||||
### workflow_dispatch flow
|
||||
|
||||
```mermaid
|
||||
flowchart TD
|
||||
A[Manual trigger] --> D[prepare\nResolve branch · Read VERSION.json]
|
||||
D --> E{Build needed?\nno version + no stage\n+ registry=ECR}
|
||||
E -- Yes --> F[build_images\nBuild + push to ECR]
|
||||
E -- No --> G{deployment_type input}
|
||||
F --> G
|
||||
G -- single-node --> H[docker_test\nsingle-node]
|
||||
G -- multi-node --> I[docker_test\nmulti-node]
|
||||
G -- both --> H & I
|
||||
```
|
||||
|
||||
`build_images` is **skipped** when either `version` or `stage` is provided, or when `registry = DockerHub`.
|
||||
|
||||
---
|
||||
|
||||
## Parameters
|
||||
|
||||
### workflow_dispatch inputs
|
||||
|
||||
| Input | Required | Default | Description |
|
||||
|---|---|---|---|
|
||||
| `pr_head_ref` | Yes | — | Branch of `wazuh-docker` to test |
|
||||
| `automation_reference` | No | `main` | Branch of `wazuh-automation` to use |
|
||||
| `deployment_type` | Yes | — | `single-node`, `multi-node`, or `both` |
|
||||
| `version` | No | — | Override image version (e.g. `5.0.1`). If empty, reads from `VERSION.json` |
|
||||
| `stage` | No | — | Image stage suffix (e.g. `beta1`, `beta2-latest`). Required when `version` is set |
|
||||
| `registry` | No | `ECR` | `ECR` (dev/built images) or `DockerHub` (released images) |
|
||||
|
||||
### issue_comment parameters
|
||||
|
||||
All parameters are derived automatically:
|
||||
|
||||
| Parameter | Source |
|
||||
|---|---|
|
||||
| `pr_head_ref` | PR head branch from GitHub API |
|
||||
| `deployment_matrix` | Parsed from comment command |
|
||||
| `version` / `stage` | Read from `VERSION.json` on the PR branch |
|
||||
| `registry` | Always ECR (images are always built) |
|
||||
| `automation_reference` | Always `main` |
|
||||
|
||||
---
|
||||
|
||||
## Image Resolution Scenarios
|
||||
|
||||
The workflow distinguishes five cases based on inputs:
|
||||
|
||||
| Case | `version` input | `stage` input | Registry | Action | Image tag |
|
||||
|---|---|---|---|---|---|
|
||||
| a.1 | empty | empty | ECR (or PR comment) | **BUILD** from PR → ECR | `{version}-{stage}-latest` |
|
||||
| a.2 | empty | empty | DockerHub | Pull (no build) | `{version}-{stage}` |
|
||||
| b.1 | set | empty | ECR | Pull (no build) | `{version}-latest` |
|
||||
| b.2 | set | empty | DockerHub | Pull (no build) | `{version}` |
|
||||
| c | set or empty | set | ECR or DockerHub | Pull (no build) | `{version}-{stage}` |
|
||||
|
||||
> When neither `version` nor `stage` is set, `version` and `stage` are read from `VERSION.json` on the target branch.
|
||||
|
||||
> Case a.1 always applies when triggered by PR comment, regardless of the `registry` input (which is not available in that trigger mode).
|
||||
|
||||
---
|
||||
|
||||
## Job Details
|
||||
|
||||
### Job 1 — `get_pr_info` (issue_comment only)
|
||||
|
||||
| Step | What it does |
|
||||
|---|---|
|
||||
| React to comment | Adds a 🚀 reaction to the triggering PR comment |
|
||||
| Extract PR data | Calls GitHub API to get PR `head_ref` and `head_sha` |
|
||||
| Parse command | Maps comment text → `deployment_matrix` JSON and `check_name` string |
|
||||
| Create Check Run | Creates a GitHub Check Run in `in_progress` state on the PR head SHA |
|
||||
|
||||
### Job 2 — `prepare` (both triggers)
|
||||
|
||||
| Step | What it does |
|
||||
|---|---|
|
||||
| Resolve context | Reads inputs (workflow_dispatch) or `get_pr_info` outputs (issue_comment) |
|
||||
| Checkout `VERSION.json` | Sparse-checks out only `VERSION.json` from the target branch |
|
||||
| Read version info | Extracts `version` and `stage` from `VERSION.json` |
|
||||
| Show test plan | Logs the resolved image case (a.1/a.2/b.1/b.2/c) and writes a summary table |
|
||||
|
||||
Outputs: `pr_head_ref`, `deployment_matrix`, `wazuh_version`, `wazuh_stage`.
|
||||
|
||||
### Job 3 — `build_images` (conditional)
|
||||
|
||||
Calls the reusable workflow `.github/workflows/5_build_and_push_images.yml`.
|
||||
|
||||
**Runs when:** `version == ''` AND `stage == ''` AND (`registry == 'ECR'` OR `github.event_name == 'issue_comment'`).
|
||||
|
||||
**Skipped when:** any explicit `version` or `stage` is provided, or `registry = DockerHub`.
|
||||
|
||||
| Parameter passed | Value |
|
||||
|---|---|
|
||||
| `image_tag` | `{wazuh_version}-{wazuh_stage}` |
|
||||
| `docker_reference` | `pr_head_ref` |
|
||||
| `wazuh_automation_reference` | `automation_reference` input |
|
||||
| `products` | `wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent` |
|
||||
| `dev` | `true` |
|
||||
| `id` | `docker-integration-{run_id}` |
|
||||
|
||||
### Job 4 — `docker_test` (matrix, both triggers)
|
||||
|
||||
Runs once per entry in `deployment_matrix`. Each instance provisions its own VM.
|
||||
|
||||
#### Setup
|
||||
|
||||
1. Checkout `wazuh-automation` at `automation_reference`
|
||||
2. Checkout `wazuh-docker` at `pr_head_ref`
|
||||
3. Resolve image configuration (see [Image Resolution Scenarios](#image-resolution-scenarios)) → sets `DOCKER_REGISTRY`, `DOCKER_TAG`, `DOCKER_VERSION`
|
||||
4. Set up Python 3.12 and install `test_runner`
|
||||
5. Configure AWS credentials via OIDC (`AWS_IAM_DOCKER_ROLE`)
|
||||
|
||||
#### Instance allocation
|
||||
|
||||
Provisions a dedicated AWS VM using the `deployability` allocator module:
|
||||
|
||||
```bash
|
||||
python3 wazuh-automation/deployability/modules/allocation/main.py \
|
||||
--action create \
|
||||
--provider aws \
|
||||
--size large \
|
||||
--composite-name ubuntu-24-amd64 \
|
||||
--instance-name gha_{run_id}_docker_{deployment_type} \
|
||||
--label-team devops \
|
||||
--label-termination-date 1d
|
||||
```
|
||||
|
||||
The allocator writes `inventory.yml` with the SSH connection details (`ansible_host`, `ansible_port`, `ansible_user`, `ansible_ssh_private_key_file`). These are extracted and exported as `SSH_HOST`, `SSH_PORT`, `SSH_USER`, `SSH_KEY` environment variables.
|
||||
|
||||
#### VM configuration and Docker install
|
||||
|
||||
All subsequent steps run on the remote VM over SSH:
|
||||
|
||||
1. **Install Docker CE**: `curl -fsSL https://get.docker.com | sudo sh`
|
||||
2. **Login to ECR** (when registry is ECR or trigger is issue_comment): authenticates the VM's Docker daemon to the dev registry
|
||||
3. **Set `vm.max_map_count=262144`**: required for OpenSearch/Wazuh Indexer
|
||||
|
||||
#### Certificate generation and config
|
||||
|
||||
Runs on the **runner** (not the VM):
|
||||
|
||||
1. **Download `wazuh-certs-tool.sh`** directly from the packages URL:
|
||||
- Pre-release: `packages-staging.xdrsiem.wazuh.info/pre-release/{major}.x/installation-assistant/wazuh-certs-tool-{version}-{stage}.sh`
|
||||
- Release: `packages.wazuh.com/{major}.{minor}/wazuh-certs-tool-{version}-1.sh`
|
||||
|
||||
2. **Generate `config.yml`** inline based on deployment type:
|
||||
|
||||
**single-node:**
|
||||
```yaml
|
||||
nodes:
|
||||
indexer: [{ name: wazuh.indexer, dns: wazuh.indexer }]
|
||||
manager: [{ name: wazuh.manager, dns: wazuh.manager }]
|
||||
dashboard:[{ name: wazuh.dashboard, dns: wazuh.dashboard }]
|
||||
```
|
||||
|
||||
**multi-node:**
|
||||
```yaml
|
||||
nodes:
|
||||
indexer:
|
||||
- { name: wazuh1.indexer, dns: wazuh1.indexer }
|
||||
- { name: wazuh2.indexer, dns: wazuh2.indexer }
|
||||
- { name: wazuh3.indexer, dns: wazuh3.indexer }
|
||||
manager:
|
||||
- { name: wazuh.master, dns: wazuh.master, node_type: master }
|
||||
- { name: wazuh.worker, dns: wazuh.worker, node_type: worker }
|
||||
dashboard: [{ name: wazuh.dashboard, dns: wazuh.dashboard }]
|
||||
```
|
||||
|
||||
3. **Copy `wazuh-docker/` to VM** via SCP: `scp -r wazuh-docker {remote}:/tmp/wazuh-docker`
|
||||
|
||||
4. **Generate certificates on VM**: runs `tools/utils/deployment/certificates-conf.sh --cert --copy` inside `/tmp/wazuh-docker/{deployment}/`
|
||||
|
||||
#### Deployment
|
||||
|
||||
```bash
|
||||
# On the VM
|
||||
cd /tmp/wazuh-docker/{deployment_type}
|
||||
sudo docker compose up -d
|
||||
```
|
||||
|
||||
Waits up to **15 minutes** polling every 10 seconds until all non-nginx containers report `healthy` status.
|
||||
|
||||
After containers are healthy, waits for steady state:
|
||||
- `single-node`: 60 seconds
|
||||
- `multi-node`: 90 seconds
|
||||
|
||||
#### Test execution
|
||||
|
||||
```bash
|
||||
test_runner \
|
||||
--test-type "docker-{deployment_type}" \
|
||||
--deployment-type "docker-{deployment_type}" \
|
||||
--ssh-host "{SSH_HOST}" \
|
||||
--ssh-port "{SSH_PORT}" \
|
||||
--ssh-key-path "{SSH_KEY}" \
|
||||
--ssh-username "{SSH_USER}" \
|
||||
--version "{DOCKER_VERSION}" \
|
||||
--log-level INFO \
|
||||
--output github \
|
||||
--output-file "test-results-docker-{deployment_type}.github"
|
||||
```
|
||||
|
||||
| Argument | Value | Notes |
|
||||
|---|---|---|
|
||||
| `--test-type` | `docker-single-node` or `docker-multi-node` | Selects the test module set |
|
||||
| `--deployment-type` | `docker-single-node` or `docker-multi-node` | Selects the deployment profile |
|
||||
| `--ssh-host/port/key/username` | From allocator inventory | Connects to the allocated VM |
|
||||
| `--version` | Resolved `DOCKER_VERSION` | Used for version assertion tests |
|
||||
| `--output github` | — | Emits GitHub Actions annotations |
|
||||
|
||||
For details on what `docker-single-node` and `docker-multi-node` test types validate, see the `Integration Test Module — Description` of the internal documentation.
|
||||
|
||||
#### Reporting
|
||||
|
||||
| Output | When | Content |
|
||||
|---|---|---|
|
||||
| Step summary | Always | Test results appended to `$GITHUB_STEP_SUMMARY` |
|
||||
| PR comment | `issue_comment` trigger only | Posts or updates a comment (marker: `<!-- docker-integration-check-{deployment} -->`) with ✅/❌ and results |
|
||||
| Artifact: `test-results-docker-{deployment}-{run_id}` | Always | Results file, retained 7 days |
|
||||
| Artifact: `docker-logs-{deployment}-{run_id}` | On failure only | Full `docker compose logs` output, retained 7 days |
|
||||
|
||||
#### Cleanup (always runs, even on failure)
|
||||
|
||||
1. `docker compose down -v` on the VM (stops containers and removes volumes)
|
||||
2. Deallocate the VM:
|
||||
```bash
|
||||
python3 wazuh-automation/deployability/modules/allocation/main.py \
|
||||
--action delete \
|
||||
--track-output {ALLOCATOR_PATH}/track.yml
|
||||
```
|
||||
|
||||
### Job 5 — `update_check` (issue_comment only)
|
||||
|
||||
Updates the GitHub Check Run created in Job 1:
|
||||
|
||||
| `docker_test` result | Check conclusion |
|
||||
|---|---|
|
||||
| `success` | `success` — ✅ All Docker integration tests passed |
|
||||
| `failure` | `failure` — ❌ One or more tests failed |
|
||||
| `cancelled` | `cancelled` |
|
||||
|
||||
---
|
||||
|
||||
## Required Secrets and Variables
|
||||
|
||||
### Secrets
|
||||
|
||||
| Secret | Used by |
|
||||
|---|---|
|
||||
| `AWS_IAM_DOCKER_ROLE` | OIDC role for AWS operations (allocator + ECR) |
|
||||
| `GH_CLONE_TOKEN` | Checkout `wazuh-automation` |
|
||||
| `GITHUB_TOKEN` | PR comments and Check Run updates (built-in) |
|
||||
|
||||
### Repository variables
|
||||
|
||||
| Variable | Used by |
|
||||
|---|---|
|
||||
| `IMAGE_REGISTRY_PROD` | DockerHub registry URL |
|
||||
| `IMAGE_REGISTRY_DEV` | ECR registry URL |
|
||||
|
||||
---
|
||||
|
||||
## Permissions
|
||||
|
||||
| Permission | Purpose |
|
||||
|---|---|
|
||||
| `id-token: write` | OIDC authentication to AWS |
|
||||
| `contents: read` | Checkout repository |
|
||||
| `pull-requests: write` | Post PR comments |
|
||||
| `issues: write` | Post comments via issues API |
|
||||
| `checks: write` | Create and update GitHub Check Runs |
|
||||
|
||||
---
|
||||
|
||||
## Instance Naming
|
||||
|
||||
Allocated VMs are named:
|
||||
|
||||
```
|
||||
gha_{github.run_id}_docker_{deployment_type}
|
||||
```
|
||||
|
||||
Example: `gha_12345678_docker_single-node`
|
||||
|
||||
VMs are tagged with `termination-date: 1d` — they are automatically terminated after 24 hours as a safety net, even if the cleanup step fails.
|
||||
@@ -31,8 +31,8 @@ services:
|
||||
- WAZUH_NODE_TYPE=master
|
||||
- WAZUH_CLUSTER_BIND_ADDR=0.0.0.0
|
||||
- WAZUH_CLUSTER_NODES=wazuh.master
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
volumes:
|
||||
- master-wazuh-api-configuration:/var/wazuh-manager/api/configuration
|
||||
- master-wazuh-etc:/var/wazuh-manager/etc
|
||||
@@ -70,8 +70,8 @@ services:
|
||||
- WAZUH_NODE_TYPE=worker
|
||||
- WAZUH_CLUSTER_BIND_ADDR=0.0.0.0
|
||||
- WAZUH_CLUSTER_NODES=wazuh.master
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
volumes:
|
||||
- worker-wazuh-api-configuration:/var/wazuh-manager/api/configuration
|
||||
- worker-wazuh-etc:/var/wazuh-manager/etc
|
||||
@@ -213,6 +213,8 @@ services:
|
||||
- SERVER_PORT=5601
|
||||
- SERVER_HOST=0.0.0.0
|
||||
- OPENSEARCH_HOSTS=["https://wazuh1.indexer:9200","https://wazuh2.indexer:9200","https://wazuh3.indexer:9200"]
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- WAZUH_API_URL=https://wazuh.master
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
|
||||
@@ -31,8 +31,8 @@ services:
|
||||
- WAZUH_NODE_NAME=manager
|
||||
- WAZUH_CLUSTER_NODES=wazuh.manager
|
||||
- WAZUH_CLUSTER_BIND_ADDR=wazuh.manager
|
||||
- INDEXER_USERNAME=wazuh-manager
|
||||
- INDEXER_PASSWORD=wazuh-manager
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
volumes:
|
||||
- wazuh_api_configuration:/var/wazuh-manager/api/configuration
|
||||
- wazuh_etc:/var/wazuh-manager/etc
|
||||
@@ -97,6 +97,8 @@ services:
|
||||
- SERVER_PORT=5601
|
||||
- SERVER_HOST=0.0.0.0
|
||||
- OPENSEARCH_HOSTS=https://wazuh.indexer:9200
|
||||
- INDEXER_USERNAME=admin
|
||||
- INDEXER_PASSWORD=admin
|
||||
- WAZUH_API_URL=https://wazuh.manager
|
||||
- DASHBOARD_USERNAME=kibanaserver
|
||||
- DASHBOARD_PASSWORD=kibanaserver
|
||||
|
||||
@@ -5,4 +5,3 @@ services:
|
||||
restart: always
|
||||
environment:
|
||||
- WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>
|
||||
- WAZUH_REGISTRATION_PASSWORD=<authd.pass-PASSWORD>
|
||||
|
||||
Reference in New Issue
Block a user