Merge pull request #2350 from wazuh/merge-4.14.6.into-main

Merge 4.14.6 into main

.github/workflows/5_bumper_repository.yml

@@ -32,7 +32,11 @@ on:
         description: 'Optional identifier for the run'
         required: false
         type: string
-
+      revert:
+        description: 'Set to true to revert the bump changes applied for this issue'
+        default: false
+        required: false
+        type: boolean
 jobs:
   bump:
     name: Repository bumper 5.x
@@ -107,7 +111,14 @@ jobs:
           fi
 
           issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}')
-          BRANCH_NAME="enhancement/wqa${issue_number}-bump-${{ github.ref_name }}"
+
+          if [[ "${{ inputs.revert }}" == "true" ]]; then
+            BRANCH_NAME="enhancement/wqa${issue_number}-revert-bump-${{ github.ref_name }}"
+            echo "pr_title=Revert bump ${{ github.ref_name }} branch" >> $GITHUB_OUTPUT
+          else
+            BRANCH_NAME="enhancement/wqa${issue_number}-bump-${{ github.ref_name }}"
+            echo "pr_title=Bump ${{ github.ref_name }} branch" >> $GITHUB_OUTPUT
+          fi
           echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT
           echo "script_params=${script_params}" >> $GITHUB_OUTPUT
 
@@ -116,22 +127,68 @@ jobs:
           git checkout -b ${{ steps.vars.outputs.branch_name }}
 
       - name: Make version bump changes
+        if: inputs.revert != true
         run: |
           echo "Running bump script"
           bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }}
 
-      - name: Commit and push changes
+      - name: Commit changes (Bump)
+        if: inputs.revert != true
         run: |
           git add .
           git commit -m "feat: bump ${{ github.ref_name }}"
+
+      - name: Fetch full history (Revert)
+        if: inputs.revert == true
+        run: git fetch --unshallow
+
+      - name: Revert references (Revert)
+        id: revert_step
+        if: inputs.revert == true
+        run: |
+          ISSUE_NUMBER=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}')
+
+          BUMP_BRANCH="enhancement/wqa${ISSUE_NUMBER}-bump-${{ github.ref_name }}"
+
+          PR_NUMBER=$(gh pr list --head "$BUMP_BRANCH" --base "${{ github.ref_name }}" --state merged --json number --jq '.[0].number')
+
+          if [ -z "$PR_NUMBER" ] || [ "$PR_NUMBER" == "null" ]; then
+            echo "Error: The original PR for the bump was not found"
+            echo "Searching merged PR from: $BUMP_BRANCH to ${{ github.ref_name }}"
+            exit 1
+          fi
+
+          echo "Original PR found: #$PR_NUMBER"
+
+          MERGE_COMMIT=$(gh pr view $PR_NUMBER --json mergeCommit --jq '.mergeCommit.oid')
+
+          git revert -m 1 $MERGE_COMMIT --no-commit
+
+          # Remove the files to prevent them from being included in the revert commit
+          git checkout HEAD -- VERSION.json 2>/dev/null || true
+          git checkout HEAD -- CHANGELOG.md 2>/dev/null || true
+          # Add any other repository-specific version files here
+
+          if git diff --staged --quiet; then
+            echo "No references to revert. Skipping commit."
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          else
+            git commit -m "feat: revert ${{ github.ref_name }} references"
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Push changes
+        if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
+        run: |
           git push origin ${{ steps.vars.outputs.branch_name }}
 
       - name: Create pull request
         id: create_pr
+        if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
         run: |
           gh auth setup-git
           PR_URL=$(gh pr create \
-            --title "Bump ${{ github.ref_name }} branch" \
+            --title "${{ steps.vars.outputs.pr_title }}" \
             --body "Issue: ${{ inputs.issue-link }}" \
             --base ${{ github.ref_name }} \
             --head ${{ steps.vars.outputs.branch_name }})
@@ -140,14 +197,25 @@ jobs:
           echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT
 
       - name: Merge pull request
+        if: inputs.revert != true || (inputs.revert == true && steps.revert_step.outputs.has_changes == 'true')
         run: |
-          # Any checks for the PR are bypassed since the branch is expected to be functional (i.e. the bump process does not introduce any bugs)
+          # Any checks for the PR are bypassed since the branch is expected to be functional
           gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge --admin
 
       - name: Show logs
+        if: inputs.revert != true
         run: |
           echo "Bump complete."
           echo "Branch: ${{ steps.vars.outputs.branch_name }}"
           echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
           echo "Bumper scripts logs:"
-          cat ${BUMP_LOG_PATH}/repository_bumper*log
+          cat ${BUMP_LOG_PATH}/repository_bumper*log
+
+      - name: Show revert logs
+        if: inputs.revert == true
+        run: |
+          echo "Revert bump complete."
+          echo "Branch: ${{ steps.vars.outputs.branch_name }}"
+          echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}"
+          echo "Revert bumper scripts logs:"
+          cat ${BUMP_LOG_PATH}/repository_bumper*log || true

.github/workflows/Procedure_push_docker_images.yml

@@ -90,6 +90,7 @@ jobs:
     outputs:
       WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
       COMMIT_LIST: ${{ steps.compute-outputs.outputs.COMMIT_LIST }}
+      ALL_PRODUCTS_SELECTED: ${{ steps.compute-outputs.outputs.ALL_PRODUCTS_SELECTED }}
 
     steps:
     - name: Print inputs
@@ -115,24 +116,22 @@ jobs:
     - name: Set up variables
       id: compute-outputs
       run: |
-        # Set WAZUH_COMPONENTS
-        WC_JSON_ARRAY=""
-        if [[ "${{ inputs.products }}" != "null" && "${{ inputs.products }}" != "" ]]; then
-          # Convert comma-separated list to JSON array format
-          IFS=',' read -ra COMPONENTS <<< "${{ inputs.products }}"
-          WC_JSON_ARRAY="["
-          for i in "${!COMPONENTS[@]}"; do
-            if [ $i -gt 0 ]; then
-              WC_JSON_ARRAY+=","
-            fi
-            WC_JSON_ARRAY+="\"${COMPONENTS[$i]}\""
-          done
-          WC_JSON_ARRAY+="]"
-        else
-          WC_JSON_ARRAY='["wazuh-manager","wazuh-dashboard","wazuh-indexer","wazuh-agent"]'
+        # Use the default list if products is empty
+        PRODUCTS="${{ inputs.products }}"
+        if [[ -z "$PRODUCTS" || "$PRODUCTS" == "null" ]]; then
+          PRODUCTS="wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
         fi
-        echo "Products to build: $WC_JSON_ARRAY"
-        echo "WAZUH_COMPONENTS=$WC_JSON_ARRAY" >> $GITHUB_OUTPUT
+        # Check if all 4 core components are present in the string
+        if [[ "$PRODUCTS" == *"wazuh-manager"* && "$PRODUCTS" == *"wazuh-dashboard"* && "$PRODUCTS" == *"wazuh-indexer"* && "$PRODUCTS" == *"wazuh-agent"* ]]; then
+          echo "ALL_PRODUCTS_SELECTED=true" >> $GITHUB_OUTPUT
+        else
+          echo "ALL_PRODUCTS_SELECTED=false" >> $GITHUB_OUTPUT
+        fi
+        # Set WAZUH_COMPONENTS
+        # Convert to JSON for the matrix (Your existing logic)
+        IFS=',' read -ra COMPONENTS <<< "$PRODUCTS"
+        JSON_ARRAY=$(printf '%s\n' "${COMPONENTS[@]}" | jq -R . | jq -s -c .)
+        echo "WAZUH_COMPONENTS=$JSON_ARRAY" >> $GITHUB_OUTPUT
 
         # Set COMMIT_LIST
         WC_COMMIT_LIST=""
@@ -234,6 +233,11 @@ jobs:
           source ${{ env.WORKFLOW_VENV }}/bin/activate
           WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
           COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
+          SCRIPT_PARAMS="--process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \
+                            --wazuh-version ${{ env.WAZUH_VERSION }} \
+                            --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \
+                            --assistant-revision $ASSISTANT_REVISION "
+
 
           # Parse components and their revisions
           COMPONENTS=($(echo "$WAZUH_COMPONENTS" | jq -r '.[]'))
@@ -252,29 +256,22 @@ jobs:
           for i in "${!COMPONENTS[@]}"; do
           case "${COMPONENTS[$i]}" in
             wazuh-manager)
-            MANAGER_REVISION="${REVISIONS[$i]}"
+            SCRIPT_PARAMS+="--manager-revision ${REVISIONS[$i]} "
             ;;
             wazuh-dashboard)
-            DASHBOARD_REVISION="${REVISIONS[$i]}"
+            SCRIPT_PARAMS+="--dashboard-revision ${REVISIONS[$i]} "
             ;;
             wazuh-indexer)
-            INDEXER_REVISION="${REVISIONS[$i]}"
+            SCRIPT_PARAMS+="--indexer-revision ${REVISIONS[$i]} "
             ;;
             wazuh-agent)
-            AGENT_REVISION="${REVISIONS[$i]}"
+            SCRIPT_PARAMS+="--agent-revision ${REVISIONS[$i]} "
             ;;
           esac
           done
 
           python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \
-              --process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \
-              --wazuh-version ${{ env.WAZUH_VERSION }} \
-              --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \
-              --indexer-revision   $INDEXER_REVISION \
-              --manager-revision   $MANAGER_REVISION \
-              --dashboard-revision $DASHBOARD_REVISION \
-              --agent-revision     $AGENT_REVISION \
-              --assistant-revision $ASSISTANT_REVISION
+              $SCRIPT_PARAMS
 
       - name: Save presigned URLs file to artifact
         if: ${{ inputs.dev == true }}
@@ -366,6 +363,7 @@ jobs:
               -d $DEV_STAGE \
               -rg $IMAGE_REGISTRY \
               -m \
+              --dev \
               -refs "$COMPONENT_REFS_JSON" \
               -c ${{ matrix.wazuh_component }}
           else
@@ -382,6 +380,7 @@ jobs:
               -v $IMAGE_TAG \
               -rg $IMAGE_REGISTRY \
               -m \
+              --dev \
               -refs "$COMPONENT_REFS_JSON" \
               -c ${{ matrix.wazuh_component }}
           else
@@ -405,11 +404,19 @@ jobs:
         fi
       working-directory: ./build-docker-images
 
+
+  notify:
+    runs-on: ubuntu-22.04
+    needs: [setup, build-and-push]
+    # Only run if NOT dev AND all products were selected
+    if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}
+
+    steps:
     - name: Image exists validation
-      if: ${{ inputs.dev == false }}
       id: validation
       run: |
         IMAGE_TAG=${{ inputs.image_tag }}
+        IMAGE_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
         PURPOSE=""
 
         if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -431,12 +438,15 @@ jobs:
         echo "purpose=$PURPOSE" >> $GITHUB_OUTPUT
 
     - name: GH issue notification
-      if: ${{ inputs.dev == false && steps.validation.outputs.purpose != '' }}
+      if: ${{ steps.validation.outputs.purpose != '' }}
+      env:
+        GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
       run: |
         IMAGE_TAG=${{ inputs.image_tag }}
+        PURPOSE="${{ steps.validation.outputs.purpose }}"
+
         GH_TITLE=""
         GH_MESSAGE=""
-        PURPOSE="${{ steps.validation.outputs.purpose }}"
 
         ## Setting GH issue title
         GH_TITLE="Artifactory vulnerabilities update \`v$IMAGE_TAG\`"
@@ -487,6 +497,3 @@ jobs:
           gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_OPTION_ID }}
           ## Setting Subteam
           gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_OPTION_ID }}
-
-      env:
-        GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}

CHANGELOG.md

@@ -5,11 +5,14 @@ All notable changes to this project will be documented in this file.
 
 ### Added
 
-- None
+- Add revert option into bumper workflow ([#2330](https://github.com/wazuh/wazuh-docker/pull/2330))
+- Add checks for artifact_urls.yaml download ([#2315](https://github.com/wazuh/wazuh-docker/pull/2315))
+- Add set_as_main option ([#2293](https://github.com/wazuh/wazuh-docker/pull/2293))
 
 ### Changed
 
-- Add set_as_main option ([#2293](https://github.com/wazuh/wazuh-docker/pull/2293))
+- Add new path on artifact_urls file ([#2344](https://github.com/wazuh/wazuh-docker/pull/2344))
+- Presigned URLs generation enhancement ([#2346](https://github.com/wazuh/wazuh-docker/pull/2346))
 - Adapt bumper workflows to change main branch ([#2294](https://github.com/wazuh/wazuh-docker/pull/2294))
 - Delete all API user and password references and Wazuh agent references ([#2289](https://github.com/wazuh/wazuh-docker/pull/2289))
 - Create certificate directory with default user and group ([#2287](https://github.com/wazuh/wazuh-docker/pull/2287))
@@ -48,6 +51,9 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
+- Delete setcap command on deprecated file ([#2345](https://github.com/wazuh/wazuh-docker/pull/2345))
+- Modify the choice of a correct tag ([#2313](https://github.com/wazuh/wazuh-docker/pull/2313))
+- Artifact URL download fix ([#2306](https://github.com/wazuh/wazuh-docker/pull/2306))
 - Change API query method. ([#2275](https://github.com/wazuh/wazuh-docker/pull/2275))
 - Change Wazuh manager Healthcheck. ([#2272](https://github.com/wazuh/wazuh-docker/pull/2272))
 - Delete WAZUH_AGENT_GROUP variable. ([#2263](https://github.com/wazuh/wazuh-docker/pull/2263))
@@ -57,6 +63,24 @@ All notable changes to this project will be documented in this file.
 
 - None
 
+## [4.14.6]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- GH issue notification fix ([#2312](https://github.com/wazuh/wazuh-docker/pull/2312))
+
+### Deleted
+
+- None
+
 ## [4.14.5]
 
 ### Added

VERSION.json

@@ -1,4 +1,4 @@
 {
     "version": "5.0.0",
-    "stage": "alpha0"
-}
+    "stage": "beta1"
+}

build-docker-images/build-images.sh

@@ -17,6 +17,7 @@ WAZUH_REGISTRY=docker.io
 WAZUH_IMAGE_VERSION="5.0.0"
 WAZUH_DEV_STAGE=""
 WAZUH_COMPONENTS_COMMIT_LIST=''
+IS_DEV_BUILD=""
 
 # -----------------------------------------------------------------------------
 
@@ -46,41 +47,70 @@ build() {
     WAZUH_STAGE=$(jq -r '.stage' ../VERSION.json)
     # ARTIFACT_URLS_FILE: The name of the artifact URLs file.
     ARTIFACT_URLS_FILE="artifact_urls.yaml"
+    # ARTIFACT_URLS_DIR: The name of the artifact URLs directory.
+    ARTIFACT_URLS_DIR="artifact_urls"
 
     # Check if the artifact file already exists to prevent redundant downloads
     if [[ -f "$ARTIFACT_URLS_FILE" ]]; then
         echo "$ARTIFACT_URLS_FILE exists. Using existing file."
     else
-        # Prepare logic to fetch the artifact from Wazuh's infrastructure
+        # GitHub URL for exact Release Tag lookup
         TAG="v${WAZUH_IMAGE_VERSION}"
         REPO="wazuh/wazuh-docker"
-        GH_URL="https://api.github.com/repos/${REPO}/git/refs/tags/${TAG}"
+        GH_URL="https://api.github.com/repos/${REPO}/releases/tags/${TAG}"
 
-        # Use GitHub API to check if the tag exists publicly.
-        # This determines if we should look for production or staging artifacts.
-        if curl -fsSL "$GH_URL" >/dev/null 2>&1; then
-            # CASE: Production (Tag exists in the official repository)
-            ARTIFACT_URLS_DOWNLOAD=artifact_urls_${WAZUH_IMAGE_VERSION}.yaml
-            PACKAGE_URL=packages.wazuh.com
-            RELEASE_STAGE=production
+        # Fetch the HTTP status code to determine release environment.
+        # Using -L to follow redirects (GitHub may return 301/302 for some endpoints).
+        HTTP_STATUS=$(curl -sL -o /dev/null -w "%{http_code}" "$GH_URL")
+
+        if [ "$HTTP_STATUS" -eq 200 ]; then
+            # CASE: Production (Tag and Release exist)
+            echo "Release $TAG found. Setting Production environment."
+            ARTIFACT_URLS_DOWNLOAD="artifact_urls_${WAZUH_IMAGE_VERSION}.yaml"
+            PACKAGE_URL="packages.wazuh.com"
+            RELEASE_STAGE="production"
+        elif [ "$HTTP_STATUS" -eq 403 ]; then
+            # CASE: GitHub API rate limit hit — fall back to pre-release to avoid
+            # incorrectly skipping staging artifacts.
+            echo "Warning: GitHub API rate limit reached (403). Assuming pre-release environment." >&2
+            PACKAGE_URL="packages-staging.xdrsiem.wazuh.info"
+            RELEASE_STAGE="pre-release"
+            if [ -n "$WAZUH_STAGE" ] && [ "$WAZUH_STAGE" != "null" ]; then
+                ARTIFACT_URLS_DOWNLOAD="artifact_urls_${WAZUH_IMAGE_VERSION}-${WAZUH_STAGE}.yaml"
+            else
+                ARTIFACT_URLS_DOWNLOAD="artifact_urls_${WAZUH_IMAGE_VERSION}.yaml"
+            fi
         else
-            # CASE: Pre-release/Staging (Tag not found, fall back to staging environment)
-            # Includes the WAZUH_STAGE suffix (e.g., artifact_urls_5.0.0-alpha0.yaml)
-            ARTIFACT_URLS_DOWNLOAD=artifact_urls_${WAZUH_IMAGE_VERSION}-${WAZUH_STAGE}.yaml
-            PACKAGE_URL=packages-staging.xdrsiem.wazuh.info
-            RELEASE_STAGE=pre-release
+            # CASE: Pre-release/Staging (404 Not Found or any other non-200 status)
+            echo "Release $TAG not found (HTTP status: $HTTP_STATUS). Setting Pre-release environment."
+            PACKAGE_URL="packages-staging.xdrsiem.wazuh.info"
+            RELEASE_STAGE="pre-release"
+            if [ -n "$WAZUH_STAGE" ] && [ "$WAZUH_STAGE" != "null" ]; then
+                ARTIFACT_URLS_DOWNLOAD="artifact_urls_${WAZUH_IMAGE_VERSION}-${WAZUH_STAGE}.yaml"
+            else
+                ARTIFACT_URLS_DOWNLOAD="artifact_urls_${WAZUH_IMAGE_VERSION}.yaml"
+            fi
         fi
+
         # Final download using dynamic variables based on the release type.
         # Pattern: server / stage / major_version.x / filename
-        curl -fsSL -o "$ARTIFACT_URLS_FILE" "https://${PACKAGE_URL}/${RELEASE_STAGE}/${WAZUH_MAJOR_VERSION}.x/${ARTIFACT_URLS_DOWNLOAD}"
+        FULL_URL="https://${PACKAGE_URL}/${RELEASE_STAGE}/${WAZUH_MAJOR_VERSION}.x/${ARTIFACT_URLS_DIR}/${ARTIFACT_URLS_DOWNLOAD}"
+        echo "Attempting to download: $FULL_URL"
+        curl -fsSL -o "$ARTIFACT_URLS_FILE" "$FULL_URL" || {
+            echo "Error: Failed to download artifact URLs from $FULL_URL" >&2
+            clean 1
+        }
     fi
 
     awk -F':' '!/^#/ && NF>1 {name=$1; val=substr($0,length(name)+3); gsub(/[-.]/,"_",name); print name "=\"" val "\""}' $ARTIFACT_URLS_FILE > artifacts_env.txt
 
-    # Set component commit references for development builds
-    if [ -n "${WAZUH_DEV_STAGE}" ]; then
+    # Set component commit references for development builds.
+    # Commits are only resolved (and later appended to the image tag) when --dev is
+    # explicitly passed. Production and stage builds (dev=false) never include a
+    # commit suffix even if -refs is provided. Manual local builds also omit it.
+    if [ -n "${IS_DEV_BUILD}" ]; then
         if [ -z "${WAZUH_COMPONENTS_COMMIT_LIST}" ]; then
-            # Set default to 'latest' for all components if no specific references are provided
+            # Default to 'latest' for all components if no specific references are provided
             INDEXER_COMMIT="latest"
             MANAGER_COMMIT="latest"
             DASHBOARD_COMMIT="latest"
@@ -101,7 +131,6 @@ build() {
                 fi
 
                 # Set all component commits
-
                 INDEXER_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[0]')"
                 MANAGER_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[1]')"
                 DASHBOARD_COMMIT="$(printf '%s' "${WAZUH_COMPONENTS_COMMIT_LIST}" | jq -r '.[2]')"
@@ -204,8 +233,18 @@ build() {
         # Get component-specific commit reference
         COMPONENT_COMMIT=$(get_component_commit "${component}")
 
-        # Generate component-specific IMAGE_TAG
-        IMAGE_TAG="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}-${COMPONENT_COMMIT}}"
+        # Generate component-specific IMAGE_TAG.
+        # The commit suffix is only appended when --dev was passed, which maps
+        # directly to inputs.dev=true in the workflow. This ensures:
+        #   dev=false, tag=5.0.0       → 5.0.0
+        #   dev=false, tag=5.0.0-beta1 → 5.0.0-beta1
+        #   dev=true,  tag=5.0.0       → 5.0.0-latest
+        #   dev=true,  tag=5.0.0-beta1 → 5.0.0-beta1-latest
+        if [ -n "${IS_DEV_BUILD}" ]; then
+            IMAGE_TAG="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}-${COMPONENT_COMMIT}"
+        else
+            IMAGE_TAG="${WAZUH_IMAGE_VERSION}${WAZUH_DEV_STAGE:+-${WAZUH_DEV_STAGE,,}}"
+        fi
         echo "Using IMAGE_TAG: ${IMAGE_TAG} for ${component}"
         export IMAGE_TAG="$IMAGE_TAG"
 
@@ -264,8 +303,9 @@ help() {
     echo
     echo "Usage: $0 [OPTIONS]"
     echo
-    echo "    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default."
-    echo "    -refs, --references <refs>   [Optional] [Only for Dev] JSON array of commit refs for components to be build (indexer, manager, dashboard, agent) in order. Defaults to latest."
+    echo "    -d, --dev-stage <ref>        [Optional] Set the pre-release stage suffix (e.g. beta1, rc2). Not used by default."
+    echo "    --dev                        [Optional] Mark as a development build: appends the commit ref to the image tag. Controlled by inputs.dev in the workflow."
+    echo "    -refs, --references <refs>   [Optional] [Only with --dev] JSON array of commit refs for components (indexer, manager, dashboard, agent) in order. Defaults to 'latest'."
     echo "    -rg, --registry <reg>        [Optional] Set the Docker registry to push the images."
     echo "    -c, --component <comp>       [Required] Set the Wazuh component to build. Accepted values: 'wazuh-indexer', 'wazuh-manager', 'wazuh-dashboard', 'wazuh-agent'."
     echo "    -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, ${WAZUH_IMAGE_VERSION}."
@@ -284,7 +324,7 @@ main() {
         "-h"|"--help")
             help 0
             ;;
-        "-d"|"--dev")
+        "-d"|"--dev-stage")
             if [ -n "${2}" ]; then
                 WAZUH_DEV_STAGE="${2}"
                 shift 2
@@ -292,6 +332,10 @@ main() {
                 help 1
             fi
             ;;
+        "--dev")
+            IS_DEV_BUILD="true"
+            shift
+            ;;
         "-m"|"--multiarch")
             MULTIARCH="true"
                 shift

build-docker-images/wazuh-dashboard/Dockerfile

@@ -24,7 +24,6 @@ RUN mkdir -p $INSTALL_DIR/data/wazuh && chmod -R 775 $INSTALL_DIR/data/wazuh
 RUN mkdir -p $INSTALL_DIR/data/wazuh/config && chmod -R 775 $INSTALL_DIR/data/wazuh/config
 RUN mkdir -p $INSTALL_DIR/data/wazuh/logs && chmod -R 775 $INSTALL_DIR/data/wazuh/logs
 RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/bin/node
-RUN setcap 'cap_net_bind_service=-ep' /usr/share/wazuh-dashboard/node/fallback/bin/node
 
 ################################################################################
 # Build stage 1 (the current Wazuh dashboard image):
@@ -63,13 +62,13 @@ RUN yum install shadow-utils -y && \
     yum clean all && \
     getent group $GROUP || groupadd -r -g 1000 $GROUP && \
     useradd --system \
-            --uid 1000 \
-            --no-create-home \
-            --home-dir $INSTALL_DIR \
-            --gid $GROUP \
-            --shell /sbin/nologin \
-            --comment "$USER user" \
-            $USER && \
+    --uid 1000 \
+    --no-create-home \
+    --home-dir $INSTALL_DIR \
+    --gid $GROUP \
+    --shell /sbin/nologin \
+    --comment "$USER user" \
+    $USER && \
     chmod 700 /entrypoint.sh && \
     chmod 700 /wazuh_dashboard_config.sh && \
     mkdir -p $INSTALL_DIR && \