feat: Persisted all of opensearch-security folder

scheme seems to not be working???

.github/workflows/4_build_and_push_images.yml

@@ -1,5 +1,5 @@
-run-name: Launch Push Docker Images - ${{ inputs.id }}
+run-name: (4.x) Build and push images - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
-name: Push Docker Images
+name: (4.x) Build and push images
 
 on:
   workflow_dispatch:
@@ -72,7 +72,7 @@ on:
 
 jobs:
   setup:
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
 
     permissions:
       id-token: write
@@ -92,7 +92,7 @@ jobs:
     - name: Print inputs
       run: |
         echo "---------------------------------------------"
-        echo "Running Procedure_push_docker_images workflow"
+        echo "Running 4_build_and_push_images workflow"
         echo "---------------------------------------------"
         echo "* BRANCH: ${{ github.ref }}"
         echo "* COMMIT: ${{ github.sha }}"
@@ -130,7 +130,7 @@ jobs:
         echo "WAZUH_COMPONENTS=$JSON_ARRAY" >> $GITHUB_OUTPUT
 
   build-and-push:
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
 
     permissions:
       id-token: write
@@ -155,8 +155,11 @@ jobs:
       with:
         ref: ${{ inputs.docker_reference }}
 
-    - name: free disk space
+    - name: Log in to Docker Hub
-      uses: ./.github/free-disk-space
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v4
@@ -175,13 +178,6 @@ jobs:
       if: ${{ inputs.dev == true }}
       uses: aws-actions/amazon-ecr-login@v2
 
-    - name: Log in to Docker Hub
-      if: ${{ inputs.dev == false }}
-      uses: docker/login-action@v4
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
     - name: Build Wazuh images
       run: |
         IMAGE_TAG="${{ inputs.image_tag }}"
@@ -216,7 +212,7 @@ jobs:
 
 
   notify:
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: [setup, build-and-push]
     # Only run if NOT dev AND all products were selected
     if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}

.github/workflows/4_bumper_repository.yml

@@ -1,4 +1,4 @@
-name: Repository bumper
+name: (4.x) Repository bumper
 run-name: Bump ${{ github.ref_name }} (${{ inputs.id }})
 
 on:
@@ -31,7 +31,7 @@ on:
 jobs:
   bump:
     name: Repository bumper
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
       pull-requests: write
@@ -110,13 +110,21 @@ jobs:
           bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }}
 
       - name: Commit and push changes
+        id: bump_commit
         run: |
           git add .
-          git commit -m "feat: bump ${{ github.ref_name }}"
+          if git diff --staged --quiet; then
-          git push origin ${{ steps.vars.outputs.branch_name }}
+            echo "Nothing to bump: the repository is already at the requested version/stage. Skipping commit."
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            git commit -m "feat: bump ${{ github.ref_name }}"
+            git push origin ${{ steps.vars.outputs.branch_name }}
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
 
       - name: Create pull request
         id: create_pr
+        if: steps.bump_commit.outputs.has_changes == 'true'
         run: |
           gh auth setup-git
           PR_URL=$(gh pr create \
@@ -129,14 +137,19 @@ jobs:
           echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT
 
       - name: Merge pull request
+        if: steps.bump_commit.outputs.has_changes == 'true'
         run: |
           # Any checks for the PR are bypassed since the branch is expected to be functional (i.e. the bump process does not introduce any bugs)
           gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge --admin
 
       - name: Show logs
         run: |
-          echo "Bump complete."
+          if [[ "${{ steps.bump_commit.outputs.has_changes }}" == "true" ]]; then
-          echo "Branch: ${{ steps.vars.outputs.branch_name }}"
+            echo "Bump complete."
-          echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
+            echo "Branch: ${{ steps.vars.outputs.branch_name }}"
+            echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
+          else
+            echo "Bump skipped: the repository is already at the requested version/stage."
+          fi
           echo "Bumper scripts logs:"
           cat ${BUMP_LOG_PATH}/repository_bumper*log

.github/workflows/4_pr_check.yml

@@ -1,15 +1,39 @@
-name: Wazuh Docker pipeline
+name: (4.x) Docker PR check
 
-on: [pull_request]
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - 4.*
+    paths:
+      - 'build-docker-images/**'
+      - 'multi-node/**'
+      - 'single-node/**'
+      - 'wazuh-agent/**'
+      - '.github/**'
+
+env:
+  ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
+  ARTIFACT_NAMES: |
+    wazuh-manager.tar
+    wazuh-indexer.tar
+    wazuh-dashboard.tar
+    wazuh-agent.tar
 
 jobs:
   build-docker-images:
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     steps:
 
     - name: Check out code
       uses: actions/checkout@v6
 
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
     - name: Build Wazuh images
       run: ./build-images.sh
       working-directory: ./build-docker-images
@@ -25,47 +49,20 @@ jobs:
         docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
         docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
 
-    - name: Temporarily save Wazuh manager Docker image
+    - name: Temporarily save Wazuh Docker images
-      uses: actions/upload-artifact@v7
-      with:
-        name: docker-artifact-manager
-        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
-        retention-days: 1
-
-    - name: Temporarily save Wazuh indexer Docker image
-      uses: actions/upload-artifact@v7
-      with:
-        name: docker-artifact-indexer
-        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
-        retention-days: 1
-
-    - name: Temporarily save Wazuh dashboard Docker image
-      uses: actions/upload-artifact@v7
-      with:
-        name: docker-artifact-dashboard
-        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
-        retention-days: 1
-
-    - name: Temporarily save Wazuh agent Docker image
-      uses: actions/upload-artifact@v7
-      with:
-        name: docker-artifact-agent
-        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
-        retention-days: 1
-
-    - name: Install Goss
-      uses: e1himself/goss-installation-action@v1.0.3
-      with:
-        version: v0.3.16
-
-    - name: Execute Goss tests (wazuh-manager)
-      run: dgoss run wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}
       env:
-        GOSS_SLEEP: 30
+        S3_ARTIFACTS_PATH: ${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
-        GOSS_FILE: .github/.goss.yaml
+      run: |
+        echo "Uploading Docker image artifacts to S3..."
+        while IFS= read -r artifact; do
+          [ -z "$artifact" ] && continue
+          echo "  Uploading: $artifact"
+          aws s3 cp "${ARTIFACTS_LOCAL_DIR}/${artifact}" "${S3_ARTIFACTS_PATH}/${artifact}"
+        done <<< "$ARTIFACT_NAMES"
+        echo "All artifacts uploaded successfully."
 
   check-single-node:
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: build-docker-images
     steps:
 
@@ -75,32 +72,27 @@ jobs:
     - name: Create enviroment variables
       run: cat .env > $GITHUB_ENV
 
-    - name: Retrieve saved Wazuh indexer Docker image
+    - name: Log in to Docker Hub
-      uses: actions/download-artifact@v8
+      uses: docker/login-action@v4
       with:
-        name: docker-artifact-indexer
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-    - name: Retrieve saved Wazuh manager Docker image
+    - name: Retrieve saved Wazuh Docker images and load them into Docker
-      uses: actions/download-artifact@v8
+      env:
-      with:
+        S3_ARTIFACTS_PATH: s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
-        name: docker-artifact-manager
+        ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
-
-    - name: Retrieve saved Wazuh dashboard Docker image
-      uses: actions/download-artifact@v8
-      with:
-        name: docker-artifact-dashboard
-
-    - name: Retrieve saved Wazuh agent Docker image
-      uses: actions/download-artifact@v8
-      with:
-        name: docker-artifact-agent
-
-    - name: Docker load
       run: |
-        docker load --input ./wazuh-indexer.tar
+        mkdir -p "${ARTIFACTS_LOCAL_DIR}"
-        docker load --input ./wazuh-dashboard.tar
+        echo "Downloading and loading Docker image artifacts from S3..."
-        docker load --input ./wazuh-manager.tar
+        while IFS= read -r artifact; do
-        docker load --input ./wazuh-agent.tar
+          [ -z "$artifact" ] && continue
+          echo "  Downloading: $artifact"
+          aws s3 cp "${S3_ARTIFACTS_PATH}/${artifact}" "${ARTIFACTS_LOCAL_DIR}/${artifact}"
+          echo "  Loading into Docker: $artifact"
+          docker load -i "${ARTIFACTS_LOCAL_DIR}/${artifact}"
+        done <<< "$ARTIFACT_NAMES"
+        echo "All artifacts downloaded and loaded successfully."
 
     - name: Create single node certficates
       run: docker compose -f single-node/generate-indexer-certs.yml run --rm generator
@@ -138,17 +130,6 @@ jobs:
         exit 1
        fi
 
-    - name: Check documents into wazuh-alerts index
-      run: |
-       sleep 120
-       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
-       if [[ $docs -gt 0 ]]; then
-        echo "wazuh-alerts index documents: ${docs}"
-       else
-        echo "wazuh-alerts index documents: ${docs}"
-        exit 1
-       fi
-
     - name: Check Wazuh templates
       run: |
        qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
@@ -202,11 +183,22 @@ jobs:
       env:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
+    - name: Check documents into wazuh-alerts index
+      run: |
+       sleep 120
+       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
+       if [[ $docs -gt 0 ]]; then
+        echo "wazuh-alerts index documents: ${docs}"
+       else
+        echo "wazuh-alerts index documents: ${docs}"
+        exit 1
+       fi
+
     - name: Check errors in ossec.log for Wazuh manager
       run: ./.github/single-node-log-check.sh
 
   check-multi-node:
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: build-docker-images
     steps:
 
@@ -216,36 +208,27 @@ jobs:
     - name: Create enviroment variables
       run: cat .env > $GITHUB_ENV
 
-    - name: free disk space
+    - name: Log in to Docker Hub
-      uses: ./.github/free-disk-space
+      uses: docker/login-action@v4
-
-    - name: Retrieve saved Wazuh dashboard Docker image
-      uses: actions/download-artifact@v8
       with:
-        name: docker-artifact-dashboard
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-    - name: Retrieve saved Wazuh manager Docker image
+    - name: Retrieve saved Wazuh Docker images and load them into Docker
-      uses: actions/download-artifact@v8
+      env:
-      with:
+        S3_ARTIFACTS_PATH: s3://${{ secrets.CI_DEV_INTERNAL_S3_BUCKET }}/wazuh-docker/4_pr_check/${{ github.run_id }}
-        name: docker-artifact-manager
+        ARTIFACTS_LOCAL_DIR: /home/runner/work/wazuh-docker/wazuh-docker/docker-images
-
-    - name: Retrieve saved Wazuh indexer Docker image
-      uses: actions/download-artifact@v8
-      with:
-        name: docker-artifact-indexer
-
-    - name: Retrieve saved Wazuh agent Docker image
-      uses: actions/download-artifact@v8
-      with:
-        name: docker-artifact-agent
-
-    - name: Docker load
       run: |
-        docker load --input ./wazuh-manager.tar
+        mkdir -p "${ARTIFACTS_LOCAL_DIR}"
-        docker load --input ./wazuh-indexer.tar
+        echo "Downloading and loading Docker image artifacts from S3..."
-        docker load --input ./wazuh-dashboard.tar
+        while IFS= read -r artifact; do
-        docker load --input ./wazuh-agent.tar
+          [ -z "$artifact" ] && continue
-        rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar wazuh-agent.tar
+          echo "  Downloading: $artifact"
+          aws s3 cp "${S3_ARTIFACTS_PATH}/${artifact}" "${ARTIFACTS_LOCAL_DIR}/${artifact}"
+          echo "  Loading into Docker: $artifact"
+          docker load -i "${ARTIFACTS_LOCAL_DIR}/${artifact}"
+        done <<< "$ARTIFACT_NAMES"
+        echo "All artifacts downloaded and loaded successfully."
 
     - name: Create multi node certficates
       run: docker compose -f multi-node/generate-indexer-certs.yml run --rm generator
@@ -288,23 +271,6 @@ jobs:
         exit 1
        fi
 
-    - name: Check documents into wazuh-alerts index
-      run: |
-       until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``)  -gt 0 ]]
-       do
-         echo 'Waiting for Wazuh indexer events'
-         free -m
-         df -h
-         sleep 10
-       done
-       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
-       if [[ $docs -gt 0 ]]; then
-        echo "wazuh-alerts index documents: ${docs}"
-       else
-        echo "wazuh-alerts index documents: ${docs}"
-        exit 1
-       fi
-
     - name: Check Wazuh templates
       run: |
        qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
@@ -365,5 +331,22 @@ jobs:
       env:
         TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
 
+    - name: Check documents into wazuh-alerts index
+      run: |
+       until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``)  -gt 0 ]]
+       do
+         echo 'Waiting for Wazuh indexer events'
+         free -m
+         df -h
+         sleep 10
+       done
+       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
+       if [[ $docs -gt 0 ]]; then
+        echo "wazuh-alerts index documents: ${docs}"
+       else
+        echo "wazuh-alerts index documents: ${docs}"
+        exit 1
+       fi
+
     - name: Check errors in ossec.log for Wazuh manager
       run: ./.github/multi-node-log-check.sh

.github/workflows/trivy-dashboard.yml

@@ -1,76 +0,0 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-name: Trivy scan Wazuh dashboard
-
-on:
-  release:
-    types:
-    - published
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: '34 2 * * 1'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    permissions:
-      contents: read # for actions/checkout to fetch code
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-
-    name: Build images and upload Trivy results
-    runs-on: "ubuntu-22.04"
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Installing dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y jq
-
-      - name: Checkout latest tag
-        run: |
-          latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name')
-          git fetch origin
-          git checkout $latest
-
-      - name: Build Wazuh images
-        run: build-docker-images/build-images.sh
-
-      - name: Create enviroment variables
-        run: |
-          cat .env > $GITHUB_ENV
-          echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV
-
-      - name: Run Trivy vulnerability scanner for Wazuh dashboard
-        uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2
-        with:
-          image-ref: 'wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          output: 'trivy-results-dashboard.sarif'
-          severity: 'LOW,MEDIUM,CRITICAL,HIGH'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: 'trivy-results-dashboard.sarif'
-
-      - name: Slack notification
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_CHANNEL: cicd-monitoring
-          SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff'
-          #SLACK_ICON: https://github.com/rtCamp.png?size=48
-          SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}"
-          SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished.
-          SLACK_USERNAME: github_actions
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/trivy-indexer.yml

@@ -1,76 +0,0 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-name: Trivy scan Wazuh indexer
-
-on:
-  release:
-    types:
-    - published
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: '34 2 * * 1'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    permissions:
-      contents: read # for actions/checkout to fetch code
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-
-    name: Build images and upload Trivy results
-    runs-on: "ubuntu-22.04"
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Installing dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y jq
-
-      - name: Checkout latest tag
-        run: |
-          latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name')
-          git fetch origin
-          git checkout $latest
-
-      - name: Build Wazuh images
-        run: build-docker-images/build-images.sh
-
-      - name: Create enviroment variables
-        run: |
-          cat .env > $GITHUB_ENV
-          echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV
-
-      - name: Run Trivy vulnerability scanner for Wazuh indexer
-        uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2
-        with:
-          image-ref: 'wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          output: 'trivy-results-indexer.sarif'
-          severity: 'LOW,MEDIUM,CRITICAL,HIGH'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: 'trivy-results-indexer.sarif'
-
-      - name: Slack notification
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_CHANNEL: cicd-monitoring
-          SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff'
-          #SLACK_ICON: https://github.com/rtCamp.png?size=48
-          SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}"
-          SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished.
-          SLACK_USERNAME: github_actions
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/trivy-manager.yml

@@ -1,76 +0,0 @@
-# This workflow uses actions that are not certified by GitHub.
-# They are provided by a third-party and are governed by
-# separate terms of service, privacy policy, and support
-# documentation.
-
-name: Trivy scan Wazuh manager
-
-on:
-  release:
-    types:
-    - published
-  pull_request:
-    branches:
-      - main
-  schedule:
-    - cron: '34 2 * * 1'
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-jobs:
-  build:
-    permissions:
-      contents: read # for actions/checkout to fetch code
-      security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
-
-    name: Build images and upload Trivy results
-    runs-on: "ubuntu-22.04"
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-
-      - name: Installing dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y jq
-
-      - name: Checkout latest tag
-        run: |
-          latest=$(curl -s "https://api.github.com/repos/wazuh/wazuh-docker/releases/latest" | jq -r '.tag_name')
-          git fetch origin
-          git checkout $latest
-
-      - name: Build Wazuh images
-        run: build-docker-images/build-images.sh
-
-      - name: Create enviroment variables
-        run: |
-          cat .env > $GITHUB_ENV
-          echo "GITHUB_REF_NAME="${GITHUB_REF_NAME%/*} >> $GITHUB_ENV
-
-      - name: Run Trivy vulnerability scanner for Wazuh manager
-        uses: aquasecurity/trivy-action@2a2157eb22c08c9a1fac99263430307b8d1bc7a2
-        with:
-          image-ref: 'wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}}'
-          format: 'template'
-          template: '@/contrib/sarif.tpl'
-          output: 'trivy-results-manager.sarif'
-          severity: 'LOW,MEDIUM,CRITICAL,HIGH'
-
-      - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: 'trivy-results-manager.sarif'
-
-      - name: Slack notification
-        uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_CHANNEL: cicd-monitoring
-          SLACK_COLOR: ${{ job.status }} # or a specific color like 'good' or '#ff00ff'
-          #SLACK_ICON: https://github.com/rtCamp.png?size=48
-          SLACK_MESSAGE: "Check the results: https://github.com/wazuh/wazuh-docker/security/code-scanning?query=is%3Aopen+branch%3A${{ env.GITHUB_REF_NAME }}"
-          SLACK_TITLE: Wazuh docker Trivy vulnerability scan finished.
-          SLACK_USERNAME: github_actions
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}

CHANGELOG.md

@@ -9,11 +9,12 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
-- None
+- Change upload and download methods ([#2504](https://github.com/wazuh/wazuh-docker/pull/2504))
+- PR revamp modifications 4.x ([#2445](https://github.com/wazuh/wazuh-docker/pull/2445))
 
 ### Fixed
 
-- None
+- Fix bumper workflow failure when bump produces no changes ([#2534](https://github.com/wazuh/wazuh-docker/pull/2534))
 
 ### Deleted
 
@@ -27,10 +28,11 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
-- None
+- Change runners on repository workflows ([#2470](https://github.com/wazuh/wazuh-docker/pull/2470))
 
 ### Fixed
 
+- Fixed login in Docker Hub before triggering the QEMU action ([#2494](https://github.com/wazuh/wazuh-docker/pull/2494))
 - Changed update_user function from wazuh.security to wazuh.rbac.orm module ([#2406](https://github.com/wazuh/wazuh-docker/pull/2406))
 - GH issue notification fix ([#2312](https://github.com/wazuh/wazuh-docker/pull/2312))
 
@@ -284,6 +286,81 @@ All notable changes to this project will be documented in this file.
 
 - None
 
+## [4.10.5]
+
+### Added
+
+- None
+
+### Changed
+
+- Change runner name for Codebuild ([#2474](https://github.com/wazuh/wazuh-docker/pull/2474))
+- PR revamp modifications LTS ([#2449](https://github.com/wazuh/wazuh-docker/pull/2449))
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
+## [4.10.4]
+
+### Added
+
+- None
+
+### Changed
+
+- Removed sslmanager key from the docker manager image. ([#2092](https://github.com/wazuh/wazuh-docker/pull/2092))
+- Backport 4.13.0 changes: Modify wazuh-keystore use ([#2036](https://github.com/wazuh/wazuh-docker/pull/2036)) \- (wazuh-keystore)
+
+### Fixed
+
+- Changed update_user function from wazuh.security to wazuh.rbac.orm module ([#2405](https://github.com/wazuh/wazuh-docker/pull/2405))
+- Add wazuh-template.json into permanent data exception ([#1967](https://github.com/wazuh/wazuh-docker/pull/1967))
+
+### Deleted
+
+- None
+
+## [4.10.3]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
+## [4.10.2]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- Updated docker/login-action module ([#1837](https://github.com/wazuh/wazuh-docker/pull/1837))
+
+### Deleted
+
+- None
+
 ## [4.10.1]
 
 ### Added

VERSION.json

@@ -1,4 +1,4 @@
 {
     "version": "4.14.7",
-    "stage": "alpha0"
+    "stage": "rc1"
 }

single-node/docker-compose.yml

@@ -38,11 +38,12 @@ services:
       - wazuh_wodles:/var/ossec/wodles
       - filebeat_etc:/etc/filebeat
       - filebeat_var:/var/lib/filebeat
-      - ./config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/root-ca-manager.pem:/etc/ssl/root-ca.pem
-      - ./config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager.pem:/etc/ssl/filebeat.pem
-      - ./config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/wazuh.manager-key.pem:/etc/ssl/filebeat.key
-      - ./config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
+      - /opt/stacks/wazuh/config/wazuh_cluster/wazuh_manager.conf:/wazuh-config-mount/etc/ossec.conf
-
+    networks:
+      - backend
   wazuh.indexer:
     image: wazuh/wazuh-indexer:4.14.7
     hostname: wazuh.indexer
@@ -60,20 +61,22 @@ services:
         hard: 65536
     volumes:
       - wazuh-indexer-data:/var/lib/wazuh-indexer
-      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-indexer/config/certs/root-ca.pem
-      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer-key.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.key
-      - ./config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/wazuh.indexer.pem:/usr/share/wazuh-indexer/config/certs/wazuh.indexer.pem
-      - ./config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/admin.pem:/usr/share/wazuh-indexer/config/certs/admin.pem
-      - ./config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
-      - ./config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
+      - /opt/stacks/wazuh/config/wazuh_indexer/wazuh.indexer.yml:/usr/share/wazuh-indexer/config/opensearch.yml
-      - ./config/wazuh_indexer/internal_users.yml:/usr/share/wazuh-indexer/config/opensearch-security/internal_users.yml
+      - /opt/stacks/wazuh/config/wazuh_indexer/opensearch-security/:/usr/share/wazuh-indexer/config/opensearch-security/
+    networks:
+      - backend
 
   wazuh.dashboard:
     image: wazuh/wazuh-dashboard:4.14.7
     hostname: wazuh.dashboard
     restart: always
-    ports:
+    #ports:
-      - 443:5601
+    #  - 443:5601
     environment:
       - INDEXER_USERNAME=admin
       - INDEXER_PASSWORD=SecretPassword
@@ -83,11 +86,11 @@ services:
       - API_USERNAME=wazuh-wui
       - API_PASSWORD=MyS3cr37P450r.*-
     volumes:
-      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard.pem
-      - ./config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/wazuh.dashboard-key.pem:/usr/share/wazuh-dashboard/certs/wazuh-dashboard-key.pem
-      - ./config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
+      - /opt/stacks/wazuh/config/wazuh_indexer_ssl_certs/root-ca.pem:/usr/share/wazuh-dashboard/certs/root-ca.pem
-      - ./config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
+      - /opt/stacks/wazuh/config/wazuh_dashboard/opensearch_dashboards.yml:/usr/share/wazuh-dashboard/config/opensearch_dashboards.yml
-      - ./config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
+      - /opt/stacks/wazuh/config/wazuh_dashboard/wazuh.yml:/usr/share/wazuh-dashboard/data/wazuh/config/wazuh.yml
       - wazuh-dashboard-config:/usr/share/wazuh-dashboard/data/wazuh/config
       - wazuh-dashboard-custom:/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom
     depends_on:
@@ -95,7 +98,16 @@ services:
     links:
       - wazuh.indexer:wazuh.indexer
       - wazuh.manager:wazuh.manager
-
+    labels:
+      - traefik.enable=true
+      - traefik.http.routers.wazuh-dashboard.rule=Host(`wazuh.fuusenkazura.io`)
+      - traefik.http.routers.wazuh-dashboard.entrypoints=websecure
+      - traefik.http.routers.wazuh-dashboard.tls.certresolver=ovh
+      - traefik.http.services.wazuh-dashboard.loadbalancer.server.scheme=https
+      - traefik.http.services.wazuh-dashboard.loadbalancer.server.port=5601
+    networks:
+      - backend
+      - web
 volumes:
   wazuh_api_configuration:
   wazuh_etc:
@@ -111,3 +123,9 @@ volumes:
   wazuh-indexer-data:
   wazuh-dashboard-config:
   wazuh-dashboard-custom:
+
+networks:
+  web:
+    external: true
+  backend:
+    external: true