Merge pull request #2516 from wazuh/enhancement/wqa2477-bump-bug/2477-test-bumper

Bump bug/2477-test-bumper branch

.github/workflows/4_build_and_push_images.yml

@@ -0,0 +1,305 @@
+run-name: (4.x) Build and push images - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
+name: (4.x) Build and push images
+
+on:
+  workflow_dispatch:
+    inputs:
+      image_tag:
+        description: 'Docker image tag'
+        default: '4.14.7'
+        required: true
+      docker_reference:
+        description: 'wazuh-docker reference'
+        required: true
+      filebeat_module_version:
+        description: 'Filebeat module version'
+        default: '0.5'
+        required: true
+        type: string
+      products:
+        description: 'Comma-separated list of the image names to build and push'
+        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
+        required: false
+        type: string
+      revision:
+        description: 'Package revision'
+        default: '1'
+        required: true
+      id:
+        description: "ID used to identify the workflow uniquely."
+        type: string
+        required: false
+      dev:
+        description: "Add tag suffix '-dev' to the image tag ?"
+        type: boolean
+        default: true
+        required: false
+  workflow_call:
+    inputs:
+      image_tag:
+        description: 'Docker image tag'
+        default: '4.14.7'
+        required: true
+        type: string
+      docker_reference:
+        description: 'wazuh-docker reference'
+        required: false
+        type: string
+      filebeat_module_version:
+        description: 'Filebeat module version'
+        default: '0.5'
+        required: true
+        type: string
+      products:
+        description: 'Comma-separated list of the image names to build and push'
+        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
+        required: false
+        type: string
+      revision:
+        description: 'Package revision'
+        default: '1'
+        required: true
+        type: string
+      id:
+        description: "ID used to identify the workflow uniquely."
+        type: string
+        required: false
+      dev:
+        description: "Add tag suffix '-dev' to the image tag ?"
+        type: boolean
+        default: false
+        required: false
+
+jobs:
+  setup:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+
+    permissions:
+      id-token: write
+      contents: read
+
+    env:
+      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
+      IMAGE_TAG: ${{ inputs.image_tag }}
+      FILEBEAT_MODULE_VERSION: ${{ inputs.filebeat_module_version }}
+      REVISION: ${{ inputs.revision }}
+
+    outputs:
+      WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
+      ALL_PRODUCTS_SELECTED: ${{ steps.compute-outputs.outputs.ALL_PRODUCTS_SELECTED }}
+
+    steps:
+    - name: Print inputs
+      run: |
+        echo "---------------------------------------------"
+        echo "Running 4_build_and_push_images workflow"
+        echo "---------------------------------------------"
+        echo "* BRANCH: ${{ github.ref }}"
+        echo "* COMMIT: ${{ github.sha }}"
+        echo "---------------------------------------------"
+        echo "Inputs provided:"
+        echo "---------------------------------------------"
+        echo "* id: ${{ inputs.id }}"
+        echo "* image_tag: ${{ inputs.image_tag }}"
+        echo "* docker_reference: ${{ inputs.docker_reference }}"
+        echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
+        echo "* products: ${{ inputs.products }}"
+        echo "* revision: ${{ inputs.revision }}"
+        echo "* dev: ${{ inputs.dev }}"
+        echo "---------------------------------------------"
+
+    - name: Set up variables
+      id: compute-outputs
+      run: |
+        # Use the default list if products is empty
+        PRODUCTS="${{ inputs.products }}"
+        if [[ -z "$PRODUCTS" || "$PRODUCTS" == "null" ]]; then
+          PRODUCTS="wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
+        fi
+
+        # Check if all 4 core components are present in the string
+          if [[ "$PRODUCTS" == *"wazuh-manager"* && "$PRODUCTS" == *"wazuh-dashboard"* && "$PRODUCTS" == *"wazuh-indexer"* && "$PRODUCTS" == *"wazuh-agent"* ]]; then
+            echo "ALL_PRODUCTS_SELECTED=true" >> $GITHUB_OUTPUT
+          else
+            echo "ALL_PRODUCTS_SELECTED=false" >> $GITHUB_OUTPUT
+          fi
+
+        # Convert to JSON for the matrix (Your existing logic)
+        IFS=',' read -ra COMPONENTS <<< "$PRODUCTS"
+        JSON_ARRAY=$(printf '%s\n' "${COMPONENTS[@]}" | jq -R . | jq -s -c .)
+        echo "WAZUH_COMPONENTS=$JSON_ARRAY" >> $GITHUB_OUTPUT
+
+  build-and-push:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+
+    permissions:
+      id-token: write
+      contents: read
+
+    needs:
+      - setup
+
+    strategy:
+      fail-fast: false # all jobs will run even if one fails
+      matrix:
+        wazuh_component: ${{ fromJson(needs.setup.outputs.WAZUH_COMPONENTS) }}
+
+    env:
+      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
+      IMAGE_TAG: ${{ inputs.image_tag }}
+      REVISION: ${{ inputs.revision }}
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v6
+      with:
+        ref: ${{ inputs.docker_reference }}
+
+    - name: Set up QEMU
+      uses: docker/setup-qemu-action@v4
+
+    - name: Set up Docker Buildx
+      uses: docker/setup-buildx-action@v4
+
+    - name: Configure aws credentials
+      if: ${{ inputs.dev == true }}
+      uses: aws-actions/configure-aws-credentials@v6
+      with:
+        role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
+        aws-region: "${{ secrets.AWS_REGION }}"
+
+    - name: Log in to Amazon ECR
+      if: ${{ inputs.dev == true }}
+      uses: aws-actions/amazon-ecr-login@v2
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    - name: Build Wazuh images
+      run: |
+        IMAGE_TAG="${{ inputs.image_tag }}"
+        FILEBEAT_MODULE_VERSION=${{ inputs.filebeat_module_version }}
+        REVISION=${{ inputs.revision }}
+
+        if [[ "$IMAGE_TAG" == *"-"* ]]; then
+          IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
+          if [ -z "${tokens[1]}" ]; then
+            echo "Invalid image tag: $IMAGE_TAG"
+            exit 1
+          fi
+          DEV_STAGE=${tokens[1]}
+          WAZUH_VER=${tokens[0]}
+          ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }}
+        else
+          ./build-images.sh -v $IMAGE_TAG -r $REVISION -f $FILEBEAT_MODULE_VERSION -rg $IMAGE_REGISTRY -m -c ${{ matrix.wazuh_component }}
+        fi
+
+        # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
+        ENV_FILE_PATH="../.env"
+
+        if [ -f $ENV_FILE_PATH ]; then
+          while IFS= read -r line || [ -n "$line" ]; do
+            echo "$line" >> $GITHUB_ENV
+          done < $ENV_FILE_PATH
+        else
+          echo "The environment file $ENV_FILE_PATH does not exist!"
+          exit 1
+        fi
+      working-directory: ./build-docker-images
+
+
+  notify:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    needs: [setup, build-and-push]
+    # Only run if NOT dev AND all products were selected
+    if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}
+
+    steps:
+    - name: Image exists validation
+      id: validation
+      run: |
+        IMAGE_TAG=${{ inputs.image_tag }}
+        IMAGE_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
+        PURPOSE=""
+
+        if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          if docker manifest inspect $IMAGE_REGISTRY/wazuh/wazuh-manager:$IMAGE_TAG > /dev/null 2>&1; then
+            PURPOSE="regeneration"
+            echo "Image wazuh/wazuh-manager:$IMAGE_TAG exists. Setting PURPOSE to 'regeneration'"
+          else
+            PURPOSE="new release"
+            echo "Image wazuh/wazuh-manager:$IMAGE_TAG does NOT exist. Setting PURPOSE to 'new release'"
+          fi
+          echo "✅ Release tag: '$IMAGE_TAG'"
+        elif [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)[0-9]+$ ]]; then
+          PURPOSE="new stage"
+          echo "✅ Stage tag: '$IMAGE_TAG'. Setting PURPOSE to 'new stage'"
+        else
+          echo "❌ No release or stage tag ('$IMAGE_TAG'), the GH issue will not be created"
+        fi
+
+        echo "purpose=$PURPOSE" >> $GITHUB_OUTPUT
+
+    - name: GH issue notification
+      if: ${{ steps.validation.outputs.purpose != '' }}
+      env:
+        GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
+      run: |
+        IMAGE_TAG=${{ inputs.image_tag }}
+        PURPOSE="${{ steps.validation.outputs.purpose }}"
+
+        GH_TITLE=""
+        GH_MESSAGE=""
+
+        ## Setting GH issue title
+        GH_TITLE="Artifactory vulnerabilities update \`v$IMAGE_TAG\`"
+
+        ## Setting GH issue body
+        GH_MESSAGE=$(cat <<- EOF | tr -d '\r' | sed 's/^[[:space:]]*//'
+        ### Description
+        - [ ] Update the [Artifactory vulnerabilities](${{ secrets.NOTIFICATION_SHEET_URL }}) sheet with the \`v$IMAGE_TAG\` vulnerabilities.
+
+        **Purpose**: $PURPOSE
+        >[!NOTE]
+        >To update the \`Tentative Release\` column, follow these steps:
+        https://github.com/wazuh/${{ secrets.NOTIFICATION_REPO }}/issues/2049#issuecomment-2671590268
+        EOF
+        )
+
+        # Print the GH Variables content
+        echo "--- Variable Content ---"
+        echo "$GH_TITLE"
+        echo "------------------------"
+
+        echo "--- Variable Content ---"
+        echo "$GH_MESSAGE"
+        echo "------------------------"
+
+        ## GH issue creation
+        ISSUE_URL=$(gh issue create \
+          -R wazuh/${{ secrets.NOTIFICATION_REPO }} \
+          --title "$GH_TITLE" \
+          --body "$GH_MESSAGE" \
+          --label "level/task" \
+          --label "type/maintenance" \
+          --label "request/operational")
+
+        ## Adding the issue to the team project
+        PROJECT_ITEM_ID=$(gh project item-add \
+          ${{ secrets.NOTIFICATION_PROJECT_NUMBER }} \
+          --url $ISSUE_URL \
+          --owner wazuh \
+          --format json \
+          | jq -r '.id')
+
+          ## Setting Objective
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_OBJECTIVE_ID }} --text  "Security scans"
+          ## Setting Priority
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_OPTION_ID }}
+          ## Setting Size
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_OPTION_ID }}
+          ## Setting Subteam
+          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_OPTION_ID }}

.github/workflows/4_bumper_repository.yml

@@ -1,4 +1,4 @@
-name: Repository bumper 4.x
+name: (4.x) Repository bumper
 run-name: Bump ${{ github.ref_name }} (${{ inputs.id }})
 
 on:
@@ -31,7 +31,7 @@ on:
 jobs:
   bump:
     name: Repository bumper 4.x
-    runs-on: ubuntu-24.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
       pull-requests: write

.github/workflows/4_pr_check.yml

@@ -0,0 +1,383 @@
+name: (4.x) Docker PR check
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - 4.*
+    paths:
+      - 'build-docker-images/**'
+      - 'multi-node/**'
+      - 'single-node/**'
+      - 'wazuh-agent/**'
+      - '.github/**'
+
+jobs:
+  build-docker-images:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v6
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    - name: Build Wazuh images
+      run: ./build-images.sh
+      working-directory: ./build-docker-images
+
+    - name: Create enviroment variables
+      run: cat .env > $GITHUB_ENV
+
+    - name: Create backup Docker images
+      run: |
+        mkdir -p /home/runner/work/wazuh-docker/wazuh-docker/docker-images/
+        docker save wazuh/wazuh-manager:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
+        docker save wazuh/wazuh-indexer:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
+        docker save wazuh/wazuh-dashboard:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
+        docker save wazuh/wazuh-agent:${{env.WAZUH_IMAGE_VERSION}} -o /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
+
+    - name: Temporarily save Wazuh manager Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: docker-artifact-manager
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-manager.tar
+        retention-days: 1
+
+    - name: Temporarily save Wazuh indexer Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: docker-artifact-indexer
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-indexer.tar
+        retention-days: 1
+
+    - name: Temporarily save Wazuh dashboard Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: docker-artifact-dashboard
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-dashboard.tar
+        retention-days: 1
+
+    - name: Temporarily save Wazuh agent Docker image
+      uses: actions/upload-artifact@v7
+      with:
+        name: docker-artifact-agent
+        path: /home/runner/work/wazuh-docker/wazuh-docker/docker-images/wazuh-agent.tar
+        retention-days: 1
+
+  check-single-node:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    needs: build-docker-images
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v6
+
+    - name: Create enviroment variables
+      run: cat .env > $GITHUB_ENV
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    - name: Retrieve saved Wazuh indexer Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-indexer
+
+    - name: Retrieve saved Wazuh manager Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-manager
+
+    - name: Retrieve saved Wazuh dashboard Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-dashboard
+
+    - name: Retrieve saved Wazuh agent Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-agent
+
+    - name: Docker load
+      run: |
+        docker load --input ./wazuh-indexer.tar
+        docker load --input ./wazuh-dashboard.tar
+        docker load --input ./wazuh-manager.tar
+        docker load --input ./wazuh-agent.tar
+
+    - name: Create single node certficates
+      run: docker compose -f single-node/generate-indexer-certs.yml run --rm generator
+
+    - name: Start single node stack
+      run: docker compose -f single-node/docker-compose.yml up -d
+
+    - name: Check Wazuh indexer start
+      run: |
+       sleep 60
+       status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
+       if [[ $status_green -eq 1 ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+       status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
+       status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep "green" | wc -l`"
+       if [[ $status_index_green -eq $status_index ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+
+
+    - name: Check Wazuh indexer nodes
+      run: |
+       nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
+       if [[ $nodes -eq 1 ]]; then
+        echo "Wazuh indexer nodes: ${nodes}"
+       else
+        echo "Wazuh indexer nodes: ${nodes}"
+        exit 1
+       fi
+
+    - name: Check Wazuh templates
+      run: |
+       qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics" | wc -l`"
+       templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep -P "wazuh|wazuh-agent|wazuh-statistics"`"
+       if [[ $qty_templates -gt 3 ]]; then
+        echo "wazuh templates:"
+        echo "${templates}"
+       else
+        echo "wazuh templates:"
+        echo "${templates}"
+        exit 1
+       fi
+
+    - name: Check Wazuh manager start
+      run: |
+        services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
+        if [[ $services -gt 9 ]]; then
+          echo "Wazuh Manager Services: ${services}"
+          echo "OK"
+        else
+          echo "Wazuh indexer nodes: ${nodes}"
+          curl -k -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
+          exit 1
+        fi
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check filebeat output
+      run: ./.github/single-node-filebeat-check.sh
+
+    - name: Check Wazuh dashboard service URL
+      run: |
+       status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I -s | grep -E "^HTTP" | awk  '{print $2}')
+       if [[ $status -eq 200 ]]; then
+        echo "Wazuh dashboard status: ${status}"
+       else
+        echo "Wazuh dashboard status: ${status}"
+        exit 1
+       fi
+
+    - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
+      run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
+
+    - name: Start Wazuh agent
+      run: docker compose -f wazuh-agent/docker-compose.yml up -d
+
+    - name: Check Wazuh agent enrollment
+      run: |
+        sleep 20
+        curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check documents into wazuh-alerts index
+      run: |
+       sleep 120
+       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
+       if [[ $docs -gt 0 ]]; then
+        echo "wazuh-alerts index documents: ${docs}"
+       else
+        echo "wazuh-alerts index documents: ${docs}"
+        exit 1
+       fi
+
+    - name: Check errors in ossec.log for Wazuh manager
+      run: ./.github/single-node-log-check.sh
+
+  check-multi-node:
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    needs: build-docker-images
+    steps:
+
+    - name: Check out code
+      uses: actions/checkout@v6
+
+    - name: Create enviroment variables
+      run: cat .env > $GITHUB_ENV
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
+    - name: Retrieve saved Wazuh dashboard Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-dashboard
+
+    - name: Retrieve saved Wazuh manager Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-manager
+
+    - name: Retrieve saved Wazuh indexer Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-indexer
+
+    - name: Retrieve saved Wazuh agent Docker image
+      uses: actions/download-artifact@v8
+      with:
+        name: docker-artifact-agent
+
+    - name: Docker load
+      run: |
+        docker load --input ./wazuh-manager.tar
+        docker load --input ./wazuh-indexer.tar
+        docker load --input ./wazuh-dashboard.tar
+        docker load --input ./wazuh-agent.tar
+        rm -rf wazuh-manager.tar wazuh-indexer.tar wazuh-dashboard.tar wazuh-agent.tar
+
+    - name: Create multi node certficates
+      run: docker compose -f multi-node/generate-indexer-certs.yml run --rm generator
+
+    - name: Start multi node stack
+      run: docker compose -f multi-node/docker-compose.yml up -d
+
+    - name: Check Wazuh indexer start
+      run: |
+       until [[ `curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`  -eq 1 ]]
+       do
+         echo 'Waiting for Wazuh indexer start'
+         free -m
+         df -h
+         sleep 120
+       done
+       status_green="`curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s | grep green | wc -l`"
+       if [[ $status_green -eq 1 ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cluster/health" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+       status_index="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | wc -l`"
+       status_index_green="`curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s | grep -E "green" | wc -l`"
+       if [[ $status_index_green -eq $status_index ]]; then
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+       else
+        curl -XGET "https://0.0.0.0:9200/_cat/indices" -u admin:SecretPassword -k -s
+        exit 1
+       fi
+
+    - name: Check Wazuh indexer nodes
+      run: |
+       nodes="`curl -XGET "https://0.0.0.0:9200/_cat/nodes" -u admin:SecretPassword -k -s | grep -E "indexer" | wc -l`"
+       if [[ $nodes -eq 3 ]]; then
+        echo "Wazuh indexer nodes: ${nodes}"
+       else
+        echo "Wazuh indexer nodes: ${nodes}"
+        exit 1
+       fi
+
+    - name: Check Wazuh templates
+      run: |
+       qty_templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh" | wc -l`"
+       templates="`curl -XGET "https://0.0.0.0:9200/_cat/templates" -u admin:SecretPassword -k -s | grep "wazuh"`"
+       if [[ $qty_templates -gt 3 ]]; then
+        echo "wazuh templates:"
+        echo "${templates}"
+       else
+        echo "wazuh templates:"
+        echo "${templates}"
+        exit 1
+       fi
+
+    - name: Check Wazuh manager start
+      run: |
+        services="`curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items | grep running | wc -l`"
+        if [[ $services -gt 10 ]]; then
+          echo "Wazuh Manager Services: ${services}"
+          echo "OK"
+        else
+          echo "Wazuh indexer nodes: ${nodes}"
+          curl -k -s -X GET "https://0.0.0.0:55000/manager/status?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}" | jq -r .data.affected_items
+          exit 1
+        fi
+        nodes=$(curl -k -s -X GET "https://0.0.0.0:55000/cluster/nodes" -H "Authorization: Bearer ${{env.TOKEN}}" | jq -r ".data.affected_items[].name" | wc -l)
+        if [[ $nodes -eq 2 ]]; then
+         echo "Wazuh manager nodes: ${nodes}"
+        else
+         echo "Wazuh manager nodes: ${nodes}"
+         exit 1
+        fi
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check filebeat output
+      run: ./.github/multi-node-filebeat-check.sh
+
+    - name: Check Wazuh dashboard service URL
+      run: |
+       status=$(curl -XGET --silent  https://0.0.0.0:443/app/status -k -u admin:SecretPassword -I | grep -E "^HTTP" | awk  '{print $2}')
+       if [[ $status -eq 200 ]]; then
+        echo "Wazuh dashboard status: ${status}"
+       else
+        echo "Wazuh dashboard status: ${status}"
+        exit 1
+       fi
+
+    - name: Modify Docker endpoint into Wazuh agent docker-compose.yml file
+      run: sed -i "s/<WAZUH_MANAGER_IP>/$(ip addr show docker0 | grep 'inet ' | awk '{print $2}' | cut -d'/' -f1)/g" wazuh-agent/docker-compose.yml
+
+    - name: Start Wazuh agent
+      run: docker compose -f wazuh-agent/docker-compose.yml up -d
+
+    - name: Check Wazuh agent enrollment
+      run: |
+        sleep 20
+        curl -k -s -X GET "https://localhost:55000/agents?pretty=true" -H  "Authorization: Bearer ${{env.TOKEN}}"
+      env:
+        TOKEN: $(curl -s -u wazuh-wui:MyS3cr37P450r.*- -k -X GET "https://0.0.0.0:55000/security/user/authenticate?raw=true")
+
+    - name: Check documents into wazuh-alerts index
+      run: |
+       until [[ $(``curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"``)  -gt 0 ]]
+       do
+         echo 'Waiting for Wazuh indexer events'
+         free -m
+         df -h
+         sleep 10
+       done
+       docs="`curl -XGET "https://0.0.0.0:9200/wazuh-alerts*/_count" -u admin:SecretPassword -k -s | jq -r ".count"`"
+       if [[ $docs -gt 0 ]]; then
+        echo "wazuh-alerts index documents: ${docs}"
+       else
+        echo "wazuh-alerts index documents: ${docs}"
+        exit 1
+       fi
+
+    - name: Check errors in ossec.log for Wazuh manager
+      run: ./.github/multi-node-log-check.sh

.github/workflows/5_build_and_push_images.yml

@@ -1,12 +1,12 @@
-run-name: Launch Push Docker Images - ${{ inputs.id }}
-name: Push Docker Images
+run-name: Build and push images 8.x - ${{ inputs.dev && 'dev' || 'release' }} - ${{ inputs.id }}
+name: (8.x) Build and push images
 
 on:
   workflow_dispatch:
     inputs:
       image_tag:
         description: 'Docker image tag'
-        default: 'v5.0.0-beta2'
+        default: '5.0.0'
         required: true
       docker_reference:
         description: 'wazuh-docker reference'
@@ -14,7 +14,7 @@ on:
       wazuh_automation_reference:
         description: 'Branch or tag of the wazuh-automation repository'
         required: false
-        default: 'v5.0.0-beta2'
+        default: '5.0.0'
       products:
         description: 'Comma-separated list of the image names to build and push'
         default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
@@ -42,7 +42,7 @@ on:
     inputs:
       image_tag:
         description: 'Docker image tag'
-        default: 'v5.0.0-beta2'
+        default: '5.0.0'
         required: true
         type: string
       docker_reference:
@@ -52,7 +52,7 @@ on:
       wazuh_automation_reference:
         description: 'Branch or tag of the wazuh-automation repository'
         required: false
-        default: 'v5.0.0-beta2'
+        default: '5.0.0'
         type: string
       products:
         description: 'Comma-separated list of the image names to build and push'
@@ -84,8 +84,7 @@ permissions:
 
 jobs:
   setup:
-    runs-on:
-      group: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
 
     outputs:
       WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
@@ -96,7 +95,7 @@ jobs:
     - name: Print inputs
       run: |
         echo "---------------------------------------------"
-        echo "Running Procedure_push_docker_images workflow"
+        echo "Running 5_build_and_push_images workflow"
         echo "---------------------------------------------"
         echo "* BRANCH: ${{ github.ref }}"
         echo "* COMMIT: ${{ github.sha }}"
@@ -115,9 +114,13 @@ jobs:
 
     - name: Set up variables
       id: compute-outputs
+      env:
+        PRODUCTS_INPUT: ${{ inputs.products }}
+        DEV_INPUT: ${{ inputs.dev }}
+        COMMIT_LIST_INPUT: ${{ inputs.commit_list }}
       run: |
         # Use the default list if products is empty
-        PRODUCTS="${{ inputs.products }}"
+        PRODUCTS="$PRODUCTS_INPUT"
         if [[ -z "$PRODUCTS" || "$PRODUCTS" == "null" ]]; then
           PRODUCTS="wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
         fi
@@ -135,9 +138,9 @@ jobs:
 
         # Set COMMIT_LIST
         WC_COMMIT_LIST=""
-        if [[ "${{ inputs.dev }}" == "true" ]]; then
-          if [[ "${{ inputs.commit_list }}" != "null" && "${{ inputs.commit_list }}" != "" ]]; then
-            WC_COMMIT_LIST='${{ inputs.commit_list }}'
+        if [[ "$DEV_INPUT" == "true" ]]; then
+          if [[ "$COMMIT_LIST_INPUT" != "null" && "$COMMIT_LIST_INPUT" != "" ]]; then
+            WC_COMMIT_LIST="$COMMIT_LIST_INPUT"
           else
             # Set commit list to "latest" for all components using WAZUH_COMPONENTS
             COMPONENTS=($(echo "$WC_JSON_ARRAY" | jq -r '.[]'))
@@ -156,8 +159,7 @@ jobs:
 
   package-urls:
     name: generate package urls
-    runs-on:
-      group: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: setup
 
     env:
@@ -174,6 +176,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           ref: ${{ inputs.docker_reference }}
+          persist-credentials: false
 
       - name: Checkout wazuh/wazuh-automation repository
         if: ${{ inputs.dev == true }}
@@ -183,6 +186,7 @@ jobs:
           ref: ${{ inputs.wazuh_automation_reference }}
           token: ${{ secrets.GH_CLONE_TOKEN }}
           path: wazuh-automation
+          persist-credentials: false
 
       - name: Configure AWS credentials
         if: ${{ inputs.dev == true }}
@@ -215,11 +219,15 @@ jobs:
         if: ${{ inputs.dev == true }}
         run: |
           WAZUH_VERSION=$(jq -r '.version' VERSION.json)
+          if ! [[ "$WAZUH_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            echo "Invalid version format: $WAZUH_VERSION"
+            exit 1
+          fi
           WAZUH_MAJOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1)
           WAZUH_MINOR=$(echo "$WAZUH_VERSION" | cut -d '.' -f 1-2)
-          echo WAZUH_VERSION=$WAZUH_VERSION >> $GITHUB_ENV
-          echo WAZUH_MAJOR=$WAZUH_MAJOR >> $GITHUB_ENV
-          echo WAZUH_MINOR=$WAZUH_MINOR >> $GITHUB_ENV
+          echo "WAZUH_VERSION=$WAZUH_VERSION" >> $GITHUB_ENV
+          echo "WAZUH_MAJOR=$WAZUH_MAJOR" >> $GITHUB_ENV
+          echo "WAZUH_MINOR=$WAZUH_MINOR" >> $GITHUB_ENV
 
       - name: Get artifacts URLs file
         if: ${{ inputs.dev == true }}
@@ -229,13 +237,14 @@ jobs:
 
       - name: Generate presigned URLs for artifacts for dev packages
         if: ${{ inputs.dev == true }}
+        env:
+          WAZUH_COMPONENTS: ${{ needs.setup.outputs.WAZUH_COMPONENTS }}
+          COMMIT_LIST: ${{ needs.setup.outputs.COMMIT_LIST }}
         run: |
-          source ${{ env.WORKFLOW_VENV }}/bin/activate
-          WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
-          COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
-          SCRIPT_PARAMS="--process ${{ env.PRESIGNED_URLS_SCRIPT_PROCESS }} \
-                            --wazuh-version ${{ env.WAZUH_VERSION }} \
-                            --aws-s3-bucket-dev ${{ env.LOCAL_AWS_S3_BUCKET_DEV }} \
+          source "$WORKFLOW_VENV/bin/activate"
+          SCRIPT_PARAMS="--process $PRESIGNED_URLS_SCRIPT_PROCESS \
+                            --wazuh-version $WAZUH_VERSION \
+                            --aws-s3-bucket-dev $LOCAL_AWS_S3_BUCKET_DEV \
                             --assistant-revision $ASSISTANT_REVISION "
 
 
@@ -270,7 +279,7 @@ jobs:
           esac
           done
 
-          python ${{ env.GENERATE_PRESIGNED_URLS_SCRIPT_PATH }} \
+          python "$GENERATE_PRESIGNED_URLS_SCRIPT_PATH" \
               $SCRIPT_PARAMS
 
       - name: Save presigned URLs file to artifact
@@ -281,8 +290,7 @@ jobs:
           path: ${{ env.LOCAL_ARTIFACT_URLS_FILEPATH }}
 
   build-and-push:
-    runs-on:
-      group: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
 
     needs:
       - setup
@@ -302,6 +310,13 @@ jobs:
       uses: actions/checkout@v6
       with:
         ref: ${{ inputs.docker_reference }}
+        persist-credentials: false
+
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
     - name: Set up QEMU
       uses: docker/setup-qemu-action@v4
@@ -320,13 +335,6 @@ jobs:
       if: ${{ inputs.dev == true }}
       uses: aws-actions/amazon-ecr-login@v2
 
-    - name: Log in to Docker Hub
-      if: ${{ inputs.dev == false }}
-      uses: docker/login-action@v4
-      with:
-        username: ${{ secrets.DOCKERHUB_USERNAME }}
-        password: ${{ secrets.DOCKERHUB_PASSWORD }}
-
     - name: Download artifact_urls.yaml (dev)
       if: ${{ inputs.dev == true }}
       uses: actions/download-artifact@v4
@@ -336,11 +344,11 @@ jobs:
 
     - name: Compute component reference (dev)
       if: ${{ inputs.dev == true }}
+      env:
+        COMPONENT: ${{ matrix.wazuh_component }}
+        WAZUH_COMPONENTS: ${{ needs.setup.outputs.WAZUH_COMPONENTS }}
+        COMMIT_LIST: ${{ needs.setup.outputs.COMMIT_LIST }}
       run: |
-        COMPONENT='${{ matrix.wazuh_component }}'
-        WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
-        COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'
-
         idx=$(jq -r --arg c "$COMPONENT" 'index($c)' <<<"$WAZUH_COMPONENTS")
         ref=$(jq -r --argjson i "$idx" '.[ $i ]' <<<"$COMMIT_LIST")
 
@@ -348,6 +356,9 @@ jobs:
         echo "Using component ref for $COMPONENT: $ref"
 
     - name: Build Wazuh images
+      env:
+        DEV: ${{ inputs.dev }}
+        WAZUH_COMPONENT: ${{ matrix.wazuh_component }}
       run: |
         if [[ "$IMAGE_TAG" == *"-"* ]]; then
           IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
@@ -357,7 +368,7 @@ jobs:
           fi
           DEV_STAGE=${tokens[1]}
           WAZUH_VER=${tokens[0]}
-          if [ "${{ inputs.dev }}" = true ]; then
+          if [ "$DEV" = true ]; then
             ./build-images.sh \
               -v $WAZUH_VER \
               -d $DEV_STAGE \
@@ -365,30 +376,30 @@ jobs:
               -m \
               --dev \
               -refs "$COMPONENT_REFS_JSON" \
-              -c ${{ matrix.wazuh_component }}
+              -c $WAZUH_COMPONENT
           else
             ./build-images.sh \
               -v $WAZUH_VER \
               -d $DEV_STAGE \
               -rg $IMAGE_REGISTRY \
               -m \
-              -c ${{ matrix.wazuh_component }}
+              -c $WAZUH_COMPONENT
           fi
         else
-          if [ "${{ inputs.dev }}" = true ]; then
+          if [ "$DEV" = true ]; then
             ./build-images.sh \
               -v $IMAGE_TAG \
               -rg $IMAGE_REGISTRY \
               -m \
               --dev \
               -refs "$COMPONENT_REFS_JSON" \
-              -c ${{ matrix.wazuh_component }}
+              -c $WAZUH_COMPONENT
           else
             ./build-images.sh \
               -v $IMAGE_TAG \
               -rg $IMAGE_REGISTRY \
               -m \
-              -c ${{ matrix.wazuh_component }}
+              -c $WAZUH_COMPONENT
           fi
         fi
         # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
@@ -406,7 +417,7 @@ jobs:
 
 
   notify:
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: [setup, build-and-push]
     # Only run if NOT dev AND all products were selected
     if: ${{ inputs.dev == false && needs.setup.outputs.ALL_PRODUCTS_SELECTED == 'true' }}
@@ -414,9 +425,10 @@ jobs:
     steps:
     - name: Image exists validation
       id: validation
+      env:
+        IMAGE_TAG: ${{ inputs.image_tag }}
+        IMAGE_REGISTRY: ${{ vars.IMAGE_REGISTRY_PROD }}
       run: |
-        IMAGE_TAG=${{ inputs.image_tag }}
-        IMAGE_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
         PURPOSE=""
 
         if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
@@ -441,9 +453,9 @@ jobs:
       if: ${{ steps.validation.outputs.purpose != '' }}
       env:
         GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}
+        IMAGE_TAG: ${{ inputs.image_tag }}
+        PURPOSE: ${{ steps.validation.outputs.purpose }}
       run: |
-        IMAGE_TAG=${{ inputs.image_tag }}
-        PURPOSE="${{ steps.validation.outputs.purpose }}"
 
         GH_TITLE=""
         GH_MESSAGE=""

.github/workflows/5_bumper_repository.yml

@@ -1,4 +1,4 @@
-name: Repository bumper 5.x
+name: (5.x) Repository bumper
 run-name: Bump ${{ github.ref_name }} (${{ inputs.id }})
 
 on:
@@ -40,7 +40,7 @@ on:
 jobs:
   bump:
     name: Repository bumper 5.x
-    runs-on: ubuntu-24.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
       pull-requests: write
@@ -96,18 +96,24 @@ jobs:
           version=${{ env.VERSION }}
           stage=${{ env.STAGE }}
           tag=${{ env.TAG }}
-
           set_as_main=${{ inputs.set_as_main }}
 
-          if [[ "$set_as_main" == "true" ]]; then
-            script_params="--set-as-main"
+          if [[ -n "$version" && -n "$stage" && "$tag" != "true" ]]; then
+            script_params="--version ${version} --stage ${stage}"
+          elif [[ -n "$version" && -n "$stage" && "$tag" == "true" ]]; then
+            script_params="--version ${version} --stage ${stage} --tag"
+          elif [[ -z "$version" && -n "$stage" && "$tag" == "true" ]]; then
+            script_params="--stage ${stage} --tag"
+          elif [[ -z "$version" && -z "$stage" && "$tag" == "true" ]]; then
+            script_params="--tag"
           fi
 
-          # Both version and stage provided
-          if [[ -n "$version" && -n "$stage" && "$tag" != "true" ]]; then
-            script_params+=" --version ${version} --stage ${stage}"
-          elif [[ -n "$version" && -n "$stage" && "$tag" == "true" ]]; then
-            script_params+=" --version ${version} --stage ${stage} --tag ${tag}"
+          if [[ "$set_as_main" == "true" ]]; then
+            if [[ -z "$version" || -z "$stage" ]]; then
+              echo "Error: set_as_main requires both version and stage inputs."
+              exit 1
+            fi
+            script_params="${script_params} --set-as-main"
           fi
 
           issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}')

.github/workflows/5_check_integration_tools.yml

@@ -0,0 +1,881 @@
+run-name: >-
+  ${{ github.event_name == 'workflow_dispatch'
+    && format('Docker Integration Test - Manual {0} on {1}', inputs.deployment_type, inputs.pr_head_ref)
+    || format('Docker Integration Test - #{0} {1}', github.event.issue.number, github.event.issue.title) }}
+name: (8.x) PR Check - Docker Integration Tests
+
+on:
+  issue_comment:
+    types: [created]
+  workflow_dispatch:
+    inputs:
+      pr_head_ref:
+        description: 'Branch of wazuh-docker to test'
+        required: true
+        type: string
+      automation_reference:
+        description: 'Branch of wazuh-automation to use'
+        required: false
+        default: '5.0.0'
+        type: string
+      deployment_type:
+        description: 'Deployment type to test'
+        required: true
+        type: choice
+        options:
+          - single-node
+          - multi-node
+          - both
+      version:
+        description: 'Image version to test (e.g. 5.0.0).'
+        required: false
+        type: string
+      stage:
+        description: 'Image stage suffix (e.g. beta1, beta2-latest, beta2-<commit>). Required when version is set.'
+        required: false
+        type: string
+      registry:
+        description: 'Docker registry. ECR for dev versions, DockerHub for prod versions.'
+        required: false
+        type: choice
+        options:
+          - ECR
+          - DockerHub
+
+permissions:
+  id-token: write
+  contents: read
+  pull-requests: write
+  issues: write
+  checks: write
+
+env:
+  AUTOMATION_REFERENCE: ${{ inputs.automation_reference || 'main' }}
+  ALLOCATOR_PATH: /tmp/allocator_instance
+  REGION: us-east-1
+
+jobs:
+  # -------------------------------------------------------------------------
+  # Job 1: Parse PR info and determine which deployment(s) to test
+  #
+  # Available commands:
+  #   /test-docker-single  — test single-node deployment
+  #   /test-docker-multi   — test multi-node deployment
+  #   /test-docker         — test both single-node and multi-node
+  # -------------------------------------------------------------------------
+  get_pr_info:
+    if: |
+      github.event_name == 'issue_comment' &&
+      github.event.issue.pull_request &&
+      github.event.issue.state == 'open' &&
+      !github.event.issue.draft &&
+      (contains(github.event.comment.body, '/test-docker-single') ||
+       contains(github.event.comment.body, '/test-docker-multi') ||
+       contains(github.event.comment.body, '/test-docker'))
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      pr_number: ${{ steps.pr_data.outputs.pr_number }}
+      pr_head_ref: ${{ steps.pr_data.outputs.pr_head_ref }}
+      pr_head_sha: ${{ steps.pr_data.outputs.pr_head_sha }}
+      check_run_id: ${{ steps.create_check.outputs.result }}
+      deployment_matrix: ${{ steps.parse_command.outputs.deployment_matrix }}
+      check_name: ${{ steps.parse_command.outputs.check_name }}
+
+    steps:
+      - name: React to comment
+        uses: actions/github-script@v7
+        with:
+          script: |
+            await github.rest.reactions.createForIssueComment({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              comment_id: context.payload.comment.id,
+              content: 'rocket'
+            });
+
+      - name: Extract PR data
+        id: pr_data
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          PR_NUMBER="${{ github.event.issue.number }}"
+          PR_DATA=$(gh api repos/${{ github.repository }}/pulls/${PR_NUMBER})
+          PR_HEAD_REF=$(echo "$PR_DATA" | jq -r '.head.ref')
+          PR_HEAD_SHA=$(echo "$PR_DATA" | jq -r '.head.sha')
+          echo "pr_number=${PR_NUMBER}" >> $GITHUB_OUTPUT
+          echo "pr_head_ref=${PR_HEAD_REF}" >> $GITHUB_OUTPUT
+          echo "pr_head_sha=${PR_HEAD_SHA}" >> $GITHUB_OUTPUT
+
+      - name: Parse command and set deployment metadata
+        id: parse_command
+        env:
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        run: |
+          if echo "$COMMENT_BODY" | grep -q '/test-docker-single'; then
+            echo 'deployment_matrix=["single-node"]'                >> $GITHUB_OUTPUT
+            echo 'check_name=Docker Integration Check (Single-Node)' >> $GITHUB_OUTPUT
+          elif echo "$COMMENT_BODY" | grep -q '/test-docker-multi'; then
+            echo 'deployment_matrix=["multi-node"]'                 >> $GITHUB_OUTPUT
+            echo 'check_name=Docker Integration Check (Multi-Node)'  >> $GITHUB_OUTPUT
+          elif echo "$COMMENT_BODY" | grep -q '/test-docker'; then
+            echo 'deployment_matrix=["single-node","multi-node"]'   >> $GITHUB_OUTPUT
+            echo 'check_name=Docker Integration Check'               >> $GITHUB_OUTPUT
+          fi
+
+      - name: Create check run
+        id: create_check
+        uses: actions/github-script@v7
+        env:
+          HEAD_SHA: ${{ steps.pr_data.outputs.pr_head_sha }}
+          CHECK_NAME: ${{ steps.parse_command.outputs.check_name }}
+          COMMENT_BODY: ${{ github.event.comment.body }}
+        with:
+          script: |
+            const { data: check } = await github.rest.checks.create({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: process.env.CHECK_NAME,
+              head_sha: process.env.HEAD_SHA,
+              status: 'in_progress',
+              started_at: new Date().toISOString(),
+              details_url: `https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
+              output: {
+                title: `🔨 Running ${process.env.CHECK_NAME}...`,
+                summary: `Triggered by comment: \`${process.env.COMMENT_BODY}\``,
+                text: 'Allocating instance and running Docker integration tests'
+              }
+            });
+            console.log('Check run created:', check.id);
+            return check.id;
+
+  # -------------------------------------------------------------------------
+  # Job 2: Prepare context (pr_head_ref + deployment matrix) for both triggers.
+  # -------------------------------------------------------------------------
+  prepare:
+    needs: [get_pr_info]
+    if: |
+      always() &&
+      (needs.get_pr_info.result == 'success' || github.event_name == 'workflow_dispatch')
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      pr_head_ref: ${{ steps.ctx.outputs.pr_head_ref }}
+      deployment_matrix: ${{ steps.ctx.outputs.deployment_matrix }}
+      wazuh_version: ${{ steps.version.outputs.wazuh_version }}
+      wazuh_stage: ${{ steps.version.outputs.wazuh_stage }}
+
+    steps:
+      - name: Resolve context
+        id: ctx
+        run: |
+          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
+            echo "pr_head_ref=${{ inputs.pr_head_ref }}" >> $GITHUB_OUTPUT
+            DEPLOY_TYPE="${{ inputs.deployment_type }}"
+            if [ "$DEPLOY_TYPE" = "both" ]; then
+              echo 'deployment_matrix=["single-node","multi-node"]' >> $GITHUB_OUTPUT
+            else
+              echo "deployment_matrix=[\"${DEPLOY_TYPE}\"]" >> $GITHUB_OUTPUT
+            fi
+          else
+            echo "pr_head_ref=${{ needs.get_pr_info.outputs.pr_head_ref }}" >> $GITHUB_OUTPUT
+            echo "deployment_matrix=${{ needs.get_pr_info.outputs.deployment_matrix }}" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Checkout wazuh-docker PR branch (VERSION.json only)
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.ctx.outputs.pr_head_ref }}
+          sparse-checkout: |
+            VERSION.json
+          sparse-checkout-cone-mode: false
+
+      - name: Read version info from VERSION.json
+        id: version
+        run: |
+          VERSION=$(python3 -c "import json; d=json.load(open('VERSION.json')); print(d['version'])")
+          STAGE=$(python3 -c "import json; d=json.load(open('VERSION.json')); print(d.get('stage',''))")
+          echo "wazuh_version=${VERSION}" >> $GITHUB_OUTPUT
+          echo "wazuh_stage=${STAGE}"     >> $GITHUB_OUTPUT
+          echo "Version: ${VERSION}  Stage: ${STAGE:-<release>}"
+
+      - name: Show test plan
+        run: |
+          WAZUH_VERSION="${{ steps.version.outputs.wazuh_version }}"
+          WAZUH_STAGE="${{ steps.version.outputs.wazuh_stage }}"
+          INPUT_VERSION="${{ inputs.version }}"
+          INPUT_STAGE="${{ inputs.stage }}"
+          INPUT_REGISTRY="${{ inputs.registry }}"
+
+          # Determine effective case
+          if [ -z "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
+            DOCKER_VERSION="$WAZUH_VERSION"
+            DOCKER_STAGE_DISPLAY="${WAZUH_STAGE}"
+            if [ "$INPUT_REGISTRY" = "ECR" ] || [ "${{ github.event_name }}" = "issue_comment" ]; then
+              CASE="a.1 — No version/stage → BUILD images from PR → push to ECR"
+              ACTION="BUILD + push to ECR"
+              EFFECTIVE_TAG="${DOCKER_VERSION}${DOCKER_STAGE_DISPLAY:+-${DOCKER_STAGE_DISPLAY}}-latest"
+              EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
+            else
+              CASE="a.2 — No version/stage → PULL from DockerHub"
+              ACTION="PULL (no build)"
+              EFFECTIVE_TAG="${DOCKER_VERSION}${DOCKER_STAGE_DISPLAY:+-${DOCKER_STAGE_DISPLAY}}"
+              EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
+            fi
+          elif [ -n "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
+            DOCKER_VERSION="$INPUT_VERSION"
+            ACTION="PULL (no build)"
+            if [ "$INPUT_REGISTRY" = "ECR" ]; then
+              CASE="b.1 — Version only, ECR → tag = version-latest"
+              EFFECTIVE_TAG="${DOCKER_VERSION}-latest"
+              EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
+            else
+              CASE="b.2 — Version only, DockerHub → tag = version"
+              EFFECTIVE_TAG="${DOCKER_VERSION}"
+              EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
+            fi
+          else
+            CASE="c — Version + stage provided as-is (no -latest appended)"
+            ACTION="PULL (no build)"
+            DOCKER_VERSION="${INPUT_VERSION:-${WAZUH_VERSION}}"
+            EFFECTIVE_TAG="${DOCKER_VERSION}-${INPUT_STAGE}"
+            if [ "$INPUT_REGISTRY" = "ECR" ]; then
+              EFFECTIVE_REGISTRY="ECR (${{ vars.IMAGE_REGISTRY_DEV }})"
+            else
+              EFFECTIVE_REGISTRY="DockerHub (${{ vars.IMAGE_REGISTRY_PROD }})"
+            fi
+          fi
+
+          # Log to stdout
+          echo "============================================="
+          echo "  DOCKER INTEGRATION TEST PLAN"
+          echo "============================================="
+          echo "Branch:        ${{ steps.ctx.outputs.pr_head_ref }}"
+          echo "Trigger:       ${{ github.event_name }}"
+          echo "Deployments:   ${{ steps.ctx.outputs.deployment_matrix }}"
+          echo "Case:          ${CASE}"
+          echo "Action:        ${ACTION}"
+          echo "Registry:      ${EFFECTIVE_REGISTRY}"
+          echo "Image tag:     ${EFFECTIVE_TAG}"
+          echo "Example:       wazuh/wazuh-manager:${EFFECTIVE_TAG}"
+          echo "============================================="
+
+          # Write to step summary
+          {
+            echo "## Docker Integration Test Plan"
+            echo ""
+            echo "| | |"
+            echo "|---|---|"
+            echo "| **Branch** | \`${{ steps.ctx.outputs.pr_head_ref }}\` |"
+            echo "| **Trigger** | \`${{ github.event_name }}\` |"
+            echo "| **Deployments** | \`${{ steps.ctx.outputs.deployment_matrix }}\` |"
+            echo "| **Case** | ${CASE} |"
+            echo "| **Action** | ${ACTION} |"
+            echo ""
+            echo "### Image configuration"
+            echo ""
+            echo "| | |"
+            echo "|---|---|"
+            echo "| **Registry** | ${EFFECTIVE_REGISTRY} |"
+            echo "| **Tag** | \`${EFFECTIVE_TAG}\` |"
+            echo "| **Example image** | \`wazuh/wazuh-manager:${EFFECTIVE_TAG}\` |"
+            echo ""
+            echo "### Parameters"
+            echo ""
+            echo "| | |"
+            echo "|---|---|"
+            echo "| **VERSION.json version** | \`${WAZUH_VERSION}\` |"
+            echo "| **VERSION.json stage** | \`${WAZUH_STAGE:-<release>}\` |"
+            echo "| **Input version** | \`${INPUT_VERSION:-<not set>}\` |"
+            echo "| **Input stage** | \`${INPUT_STAGE:-<not set>}\` |"
+            echo "| **Input registry** | \`${INPUT_REGISTRY:-<not set>}\` |"
+          } >> "$GITHUB_STEP_SUMMARY"
+
+  # -------------------------------------------------------------------------
+  # Job 3: Build Docker images (only for ECR, when no explicit version/stage provided).
+  #         Calls 5_build_and_push_images.yml and pushes to the dev registry.
+  # -------------------------------------------------------------------------
+  build_images:
+    name: Build Docker images
+    needs: [prepare]
+    if: |
+      always() &&
+      needs.prepare.result == 'success' &&
+      inputs.version == '' &&
+      inputs.stage == '' &&
+      (inputs.registry == 'ECR' || github.event_name == 'issue_comment')
+    uses: ./.github/workflows/5_build_and_push_images.yml
+    with:
+      image_tag: "${{ needs.prepare.outputs.wazuh_version }}-${{ needs.prepare.outputs.wazuh_stage }}"
+      docker_reference: ${{ needs.prepare.outputs.pr_head_ref }}
+      wazuh_automation_reference: ${{ inputs.automation_reference || 'main' }}
+      products: "wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent"
+      dev: true
+      id: "docker-integration-${{ github.run_id }}"
+    secrets: inherit
+
+  # -------------------------------------------------------------------------
+  # Job 4: For each deployment type — provision VM, deploy Docker stack, test,
+  #         collect results, and clean up.
+  # -------------------------------------------------------------------------
+  docker_test:
+    needs: [get_pr_info, prepare, build_images]
+    if: |
+      always() &&
+      needs.prepare.result == 'success' &&
+      (needs.build_images.result == 'success' || needs.build_images.result == 'skipped')
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    strategy:
+      fail-fast: false
+      matrix:
+        deployment_type: ${{ fromJSON(needs.prepare.outputs.deployment_matrix) }}
+
+    steps:
+      # -----------------------------------------------------------------------
+      # Setup
+      # -----------------------------------------------------------------------
+      - name: Checkout wazuh-automation
+        uses: actions/checkout@v6
+        with:
+          repository: wazuh/wazuh-automation
+          ref: ${{ env.AUTOMATION_REFERENCE }}
+          token: ${{ secrets.GH_CLONE_TOKEN }}
+          path: wazuh-automation
+
+      - name: Checkout wazuh-docker PR branch
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ needs.prepare.outputs.pr_head_ref }}
+          path: wazuh-docker
+
+      - name: Resolve image configuration
+        run: |
+          WAZUH_VERSION="${{ needs.prepare.outputs.wazuh_version }}"
+          WAZUH_STAGE="${{ needs.prepare.outputs.wazuh_stage }}"
+          INPUT_VERSION="${{ inputs.version }}"
+          INPUT_STAGE="${{ inputs.stage }}"
+
+          # Map registry choice to actual URL (defined once)
+          if [ "${{ inputs.registry }}" = "ECR" ]; then
+            SELECTED_REGISTRY="${{ vars.IMAGE_REGISTRY_DEV }}"
+          else
+            SELECTED_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
+          fi
+
+          if [ -z "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
+            DOCKER_VERSION="$WAZUH_VERSION"
+            DOCKER_STAGE="$WAZUH_STAGE"
+            if [ "${{ inputs.registry }}" = "ECR" ] || [ "${{ github.event_name }}" = "issue_comment" ]; then
+              # Case a.1: ECR / PR comment — images were built by build_images job → tag = version-stage-latest
+              DOCKER_REGISTRY="${{ vars.IMAGE_REGISTRY_DEV }}"
+              DOCKER_TAG="${DOCKER_VERSION}${DOCKER_STAGE:+-${DOCKER_STAGE}}-latest"
+            else
+              DOCKER_REGISTRY="${{ vars.IMAGE_REGISTRY_PROD }}"
+              DOCKER_TAG="${DOCKER_VERSION}${DOCKER_STAGE:+-${DOCKER_STAGE}}"
+            fi
+          elif [ -n "$INPUT_VERSION" ] && [ -z "$INPUT_STAGE" ]; then
+            DOCKER_VERSION="$INPUT_VERSION"
+            DOCKER_STAGE=""
+            DOCKER_REGISTRY="$SELECTED_REGISTRY"
+            if [ "${{ inputs.registry }}" = "ECR" ]; then
+              DOCKER_TAG="${DOCKER_VERSION}-latest"
+            else
+              DOCKER_TAG="${DOCKER_VERSION}"
+            fi
+          else
+            DOCKER_VERSION="${INPUT_VERSION:-${WAZUH_VERSION}}"
+            DOCKER_STAGE="$INPUT_STAGE"
+            DOCKER_REGISTRY="$SELECTED_REGISTRY"
+            DOCKER_TAG="${DOCKER_VERSION}-${DOCKER_STAGE}"
+          fi
+
+          echo "WAZUH_VERSION=${WAZUH_VERSION}"     >> $GITHUB_ENV
+          echo "WAZUH_STAGE=${WAZUH_STAGE}"         >> $GITHUB_ENV
+          echo "DOCKER_VERSION=${DOCKER_VERSION}"   >> $GITHUB_ENV
+          echo "DOCKER_STAGE=${DOCKER_STAGE}"       >> $GITHUB_ENV
+          echo "DOCKER_REGISTRY=${DOCKER_REGISTRY}" >> $GITHUB_ENV
+          echo "DOCKER_TAG=${DOCKER_TAG}"           >> $GITHUB_ENV
+
+          echo "=== Resolved image configuration ==="
+          echo "Registry: ${DOCKER_REGISTRY}"
+          echo "Tag:      ${DOCKER_TAG}"
+          echo "Example:  wazuh/wazuh-manager:${DOCKER_TAG}"
+
+      - name: Set up Python 3.12
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install requirements
+        run: |
+          pip install -r wazuh-automation/deployability/deps/requirements.txt
+          pip install -r wazuh-automation/integration-test-module/requirements.txt
+          pip install -e wazuh-automation/integration-test-module/
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
+          role-session-name: docker-test-${{ github.run_id }}-${{ matrix.deployment_type }}
+          aws-region: ${{ env.REGION }}
+
+      # -----------------------------------------------------------------------
+      # Provision: allocate VM and extract SSH credentials
+      # -----------------------------------------------------------------------
+      - name: Allocate instance
+        id: allocate
+        run: |
+          mkdir -p ${{ env.ALLOCATOR_PATH }}
+          python3 wazuh-automation/deployability/modules/allocation/main.py \
+            --action create \
+            --provider aws \
+            --size large \
+            --composite-name ubuntu-24-amd64 \
+            --working-dir ${{ env.ALLOCATOR_PATH }} \
+            --track-output ${{ env.ALLOCATOR_PATH }}/track.yml \
+            --inventory-output ${{ env.ALLOCATOR_PATH }}/inventory.yml \
+            --instance-name gha_${{ github.run_id }}_docker_${{ matrix.deployment_type }} \
+            --label-team devops \
+            --label-termination-date 1d
+
+          sed -n '/hosts:/,/^[^ ]/p' ${{ env.ALLOCATOR_PATH }}/inventory.yml \
+            | grep "ansible_" \
+            | sed 's/^[ ]*//g' \
+            > ${{ env.ALLOCATOR_PATH }}/inventory_vars_raw.yml
+          sed 's/: */=/g' ${{ env.ALLOCATOR_PATH }}/inventory_vars_raw.yml \
+            > ${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
+          sed -i 's/-o StrictHostKeyChecking=no/"-o StrictHostKeyChecking=no"/g' \
+            ${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
+
+      - name: Set SSH credentials from inventory
+        run: |
+          find ${{ env.ALLOCATOR_PATH }} -name '*-key-*' -exec chmod 600 {} \;
+          source ${{ env.ALLOCATOR_PATH }}/inventory_vars.yml
+          echo "SSH_HOST=$ansible_host"                >> $GITHUB_ENV
+          echo "SSH_PORT=$ansible_port"                >> $GITHUB_ENV
+          echo "SSH_USER=$ansible_user"                >> $GITHUB_ENV
+          echo "SSH_KEY=$ansible_ssh_private_key_file" >> $GITHUB_ENV
+
+      - name: Set SSH/SCP helper env vars
+        run: |
+          echo "SSH_OPTS=-o StrictHostKeyChecking=no -o ServerAliveInterval=60 -o ServerAliveCountMax=20 -p ${{ env.SSH_PORT }} -i ${{ env.SSH_KEY }}" >> $GITHUB_ENV
+          echo "SCP_OPTS=-o StrictHostKeyChecking=no -P ${{ env.SSH_PORT }} -i ${{ env.SSH_KEY }}"                                                      >> $GITHUB_ENV
+          echo "REMOTE=${{ env.SSH_USER }}@${{ env.SSH_HOST }}"                                                                                          >> $GITHUB_ENV
+
+      # -----------------------------------------------------------------------
+      # Install Docker CE on the remote VM
+      # -----------------------------------------------------------------------
+      - name: Install Docker CE
+        run: |
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            curl -fsSL https://get.docker.com | sudo sh
+            sudo systemctl enable --now docker
+          "
+
+      - name: Login VM to ECR registry
+        if: inputs.registry == 'ECR' || github.event_name == 'issue_comment'
+        run: |
+          ECR_REGISTRY="${{ env.DOCKER_REGISTRY }}"
+          ECR_REGION=$(echo "$ECR_REGISTRY" | cut -d. -f4)
+          ECR_PASS=$(aws ecr get-login-password --region "$ECR_REGION")
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" \
+            "echo '${ECR_PASS}' | sudo docker login --username AWS --password-stdin ${ECR_REGISTRY}"
+
+      # -----------------------------------------------------------------------
+      # Deploy: patch image tags, copy wazuh-docker and start the stack
+      # -----------------------------------------------------------------------
+      - name: Patch image tags
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          COMPOSE="wazuh-docker/${DEPLOYMENT}/docker-compose.yml"
+          TAG="${{ env.DOCKER_TAG }}"
+          REGISTRY="${{ env.DOCKER_REGISTRY }}"
+
+          if [ "$REGISTRY" = "${{ vars.IMAGE_REGISTRY_PROD }}" ] || [ -z "$REGISTRY" ]; then
+            echo "Patching ${COMPOSE}: wazuh/wazuh-*:${TAG} (DockerHub, no registry prefix)"
+            sed -i -E "s|(image: wazuh/wazuh-[^:]+:)[^ ]+|\1${TAG}|g" "$COMPOSE"
+          else
+            echo "Patching ${COMPOSE}: ${REGISTRY}/wazuh/wazuh-*:${TAG}"
+            sed -i -E "s|image: (wazuh/wazuh-[^:]+):[^ ]+|image: ${REGISTRY}/\1:${TAG}|g" "$COMPOSE"
+          fi
+          echo "=== Patched image lines ==="
+          grep 'image:' "$COMPOSE"
+
+      - name: Prepare cert tool and config
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          VERSION="${{ env.WAZUH_VERSION }}"
+          STAGE="${{ env.WAZUH_STAGE }}"
+          MAJOR=$(echo "$VERSION" | cut -d. -f1)
+
+          echo "Cert tool: ${VERSION}-${STAGE}  Docker image: ${{ env.DOCKER_TAG }}"
+
+          # Download cert tool once on the runner
+          if [ -n "$STAGE" ]; then
+            CERT_TOOL_URL="https://packages-staging.xdrsiem.wazuh.info/pre-release/${MAJOR}.x/installation-assistant/wazuh-certs-tool-${VERSION}-${STAGE}.sh"
+          else
+            CERT_TOOL_URL="https://packages.wazuh.com/${MAJOR}.$(echo "$VERSION" | cut -d. -f2)/wazuh-certs-tool-${VERSION}-1.sh"
+          fi
+          echo "Downloading cert tool: $CERT_TOOL_URL"
+          curl -fsSL -o "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh" "$CERT_TOOL_URL"
+          chmod +x "wazuh-docker/${DEPLOYMENT}/wazuh-certs-tool.sh"
+          echo "Downloaded OK"
+
+          # Write config.yml directly into the deployment directory
+          if [ "$DEPLOYMENT" = "single-node" ]; then
+            printf '%s\n' \
+              'nodes:' \
+              '  indexer:' \
+              '    - name: wazuh.indexer' \
+              '      dns: wazuh.indexer' \
+              '  manager:' \
+              '    - name: wazuh.manager' \
+              '      dns: wazuh.manager' \
+              '  dashboard:' \
+              '    - name: wazuh.dashboard' \
+              '      dns: wazuh.dashboard' \
+              > "wazuh-docker/${DEPLOYMENT}/config.yml"
+          else
+            printf '%s\n' \
+              'nodes:' \
+              '  indexer:' \
+              '    - name: wazuh1.indexer' \
+              '      dns: wazuh1.indexer' \
+              '    - name: wazuh2.indexer' \
+              '      dns: wazuh2.indexer' \
+              '    - name: wazuh3.indexer' \
+              '      dns: wazuh3.indexer' \
+              '  manager:' \
+              '    - name: wazuh.master' \
+              '      dns: wazuh.master' \
+              '      node_type: master' \
+              '    - name: wazuh.worker' \
+              '      dns: wazuh.worker' \
+              '      node_type: worker' \
+              '  dashboard:' \
+              '    - name: wazuh.dashboard' \
+              '      dns: wazuh.dashboard' \
+              > "wazuh-docker/${DEPLOYMENT}/config.yml"
+          fi
+          echo "=== config.yml ==="
+          cat "wazuh-docker/${DEPLOYMENT}/config.yml"
+          echo "=== Files ready to copy ==="
+          ls -la "wazuh-docker/${DEPLOYMENT}/"
+
+      - name: Copy wazuh-docker to VM
+        run: |
+          scp ${{ env.SCP_OPTS }} -r wazuh-docker "${{ env.REMOTE }}:/tmp/wazuh-docker"
+
+      - name: Show deployment config
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            echo '=== Files in deployment directory ==='
+            ls -la /tmp/wazuh-docker/${DEPLOYMENT}/
+            echo ''
+            echo '=== Images referenced in docker-compose.yml ==='
+            grep 'image:' /tmp/wazuh-docker/${DEPLOYMENT}/docker-compose.yml || echo '(none found)'
+            echo ''
+            echo '=== Docker version ==='
+            sudo docker version --format 'Client: {{.Client.Version}}  Server: {{.Server.Version}}'
+          "
+
+      - name: Configure VM for Wazuh Indexer
+        run: |
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            sudo sysctl -w vm.max_map_count=262144
+            echo 'vm.max_map_count = '\$(cat /proc/sys/vm/max_map_count)
+          "
+
+      - name: Generate SSL certificates
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            set -e
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            echo '=== Running certificate generation ==='
+            sudo bash /tmp/wazuh-docker/tools/utils/deployment/certificates-conf.sh --cert --copy
+            echo ''
+            echo '=== Generated certificate files ==='
+            find ./config -name '*.pem' | sort
+            echo ''
+            echo '=== Certificate subjects ==='
+            for pem in \$(find ./config -name '*.pem' ! -name '*-key.pem' | sort); do
+              echo -n \"\$pem: \"
+              sudo openssl x509 -in \"\$pem\" -noout -subject -issuer 2>/dev/null || echo '(not a cert / key file)'
+            done
+          "
+
+      - name: Start Docker Compose
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            set -eo pipefail
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            sudo docker compose up -d 2>&1 | tee /tmp/docker-compose-up.log
+            echo ''
+            echo '=== Initial container status ==='
+            sudo docker compose ps
+          "
+
+      - name: Show indexer logs on failure
+        if: failure()
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            echo '=== docker compose ps ==='
+            sudo docker compose ps
+            echo ''
+            echo '=== wazuh.indexer logs ==='
+            sudo docker compose logs wazuh.indexer 2>&1
+          " || true
+
+      - name: Wait for containers healthy
+        timeout-minutes: 15
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+
+            echo '=== Verifying containers started ==='
+            TOTAL=\$(sudo docker compose ps 2>/dev/null | tail -n +2 | wc -l | tr -d ' ')
+            if [ \"\$TOTAL\" -eq 0 ]; then
+              echo 'ERROR: No containers are running — docker compose up may have failed'
+              sudo docker compose ps
+              sudo docker compose logs --no-color 2>&1 | tail -50
+              exit 1
+            fi
+            echo \"Found \$TOTAL container(s), waiting for healthy status...\"
+            echo ''
+
+            for i in \$(seq 1 90); do
+              NOT_HEALTHY=\$(sudo docker compose ps 2>/dev/null \
+                | tail -n +2 \
+                | grep -v 'nginx' \
+                | grep -vcE '(healthy|\(healthy\))')
+              if [ \"\$NOT_HEALTHY\" -eq 0 ]; then
+                echo \"All containers healthy after \${i} x 10s attempts\"
+                sudo docker compose ps
+                exit 0
+              fi
+              echo \"  attempt \$i/90: \$NOT_HEALTHY container(s) not yet healthy\"
+              if [ \"\$(( i % 6 ))\" -eq 0 ]; then
+                echo '  --- current status ---'
+                sudo docker compose ps
+              fi
+              sleep 10
+            done
+            echo 'ERROR: containers not healthy after 15 minutes'
+            sudo docker compose ps
+            sudo docker compose logs --no-color 2>&1 | tail -100
+            exit 1
+          "
+
+      - name: Cluster warm-up wait
+        run: |
+          if [ "${{ matrix.deployment_type }}" = "multi-node" ]; then
+            WAIT=90
+          else
+            WAIT=60
+          fi
+          echo "Waiting ${WAIT}s for services to reach steady state..."
+          sleep $WAIT
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            echo '=== Container status after warm-up ==='
+            sudo docker compose ps
+          "
+
+      # -----------------------------------------------------------------------
+      # Run integration tests
+      # -----------------------------------------------------------------------
+      - name: Run tests
+        id: run_tests
+        continue-on-error: true
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          test_runner \
+            --test-type "docker-${DEPLOYMENT}" \
+            --deployment-type "docker-${DEPLOYMENT}" \
+            --ssh-host "${{ env.SSH_HOST }}" \
+            --ssh-port "${{ env.SSH_PORT }}" \
+            --ssh-key-path "${{ env.SSH_KEY }}" \
+            --ssh-username "${{ env.SSH_USER }}" \
+            --version "${{ env.DOCKER_VERSION }}" \
+            --log-level INFO \
+            --output github \
+            --output-file "test-results-docker-${DEPLOYMENT}.github"
+
+      # -----------------------------------------------------------------------
+      # Collect logs on failure
+      # -----------------------------------------------------------------------
+      - name: Show test outcome
+        if: always()
+        run: |
+          echo "Run tests outcome: ${{ steps.run_tests.outcome }}"
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          if [ -f "test-results-docker-${DEPLOYMENT}.github" ]; then
+            echo "=== Test results file ==="
+            cat "test-results-docker-${DEPLOYMENT}.github"
+          else
+            echo "WARNING: no test results file found (test_runner may have failed before writing output)"
+          fi
+
+      - name: Collect Docker logs on failure
+        if: failure() || steps.run_tests.outcome == 'failure'
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT}
+            sudo docker compose logs --no-color 2>&1
+          " > docker-logs-${DEPLOYMENT}.txt || true
+
+      - name: Upload Docker logs
+        if: failure() || steps.run_tests.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: docker-logs-${{ matrix.deployment_type }}-${{ github.run_id }}
+          path: docker-logs-*.txt
+          retention-days: 7
+
+      # -----------------------------------------------------------------------
+      # Reporting
+      # -----------------------------------------------------------------------
+      - name: Create step summary
+        if: always()
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          echo "## Docker Integration Test Results — ${DEPLOYMENT}" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ -f "test-results-docker-${DEPLOYMENT}.github" ]; then
+            cat "test-results-docker-${DEPLOYMENT}.github" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "No test results file found." >> $GITHUB_STEP_SUMMARY
+          fi
+
+      - name: Post PR comment with results
+        if: always() && github.event_name == 'issue_comment'
+        uses: actions/github-script@v7
+        env:
+          DEPLOYMENT: ${{ matrix.deployment_type }}
+          RUN_OUTCOME: ${{ steps.run_tests.outcome }}
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            const fs = require('fs');
+            const deployment = process.env.DEPLOYMENT;
+            const outcome = process.env.RUN_OUTCOME;
+            const marker = `<!-- docker-integration-check-${deployment} -->`;
+
+            let body = `${marker}\n## Docker Integration Tests — \`${deployment}\`\n\n`;
+            body += outcome === 'success'
+              ? '✅ **All tests passed!**\n\n'
+              : '❌ **Some tests failed**\n\n';
+
+            const resultsFile = `test-results-docker-${deployment}.github`;
+            try {
+              if (fs.existsSync(resultsFile)) {
+                body += '### Results\n\n' + fs.readFileSync(resultsFile, 'utf8') + '\n\n';
+              }
+            } catch (e) {
+              console.log('Could not read results file:', e.message);
+            }
+            body += `- **Workflow:** [View Details](${context.payload.repository.html_url}/actions/runs/${context.runId})\n`;
+
+            const { data: comments } = await github.rest.issues.listComments({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              issue_number: context.issue.number,
+            });
+
+            const existing = comments.find(c =>
+              c.user.type === 'Bot' && c.body.includes(marker)
+            );
+
+            if (existing) {
+              await github.rest.issues.updateComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                comment_id: existing.id,
+                body: body,
+              });
+            } else {
+              await github.rest.issues.createComment({
+                owner: context.repo.owner,
+                repo: context.repo.repo,
+                issue_number: context.issue.number,
+                body: body,
+              });
+            }
+
+      - name: Upload test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: test-results-docker-${{ matrix.deployment_type }}-${{ github.run_id }}
+          path: test-results-docker-${{ matrix.deployment_type }}.github
+          retention-days: 7
+
+      # -----------------------------------------------------------------------
+      # Cleanup: always stop stack and deallocate VM
+      # -----------------------------------------------------------------------
+      - name: Stop Docker Compose
+        if: always()
+        run: |
+          DEPLOYMENT="${{ matrix.deployment_type }}"
+          ssh ${{ env.SSH_OPTS }} "${{ env.REMOTE }}" "
+            cd /tmp/wazuh-docker/${DEPLOYMENT} && sudo docker compose down -v || true
+          " || true
+
+      - name: Configure AWS credentials for cleanup
+        if: always()
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
+          role-session-name: docker-cleanup-${{ github.run_id }}-${{ matrix.deployment_type }}
+          aws-region: ${{ env.REGION }}
+
+      - name: Deallocate instance
+        if: always()
+        run: |
+          python3 wazuh-automation/deployability/modules/allocation/main.py \
+            --action delete \
+            --track-output ${{ env.ALLOCATOR_PATH }}/track.yml
+
+  # -------------------------------------------------------------------------
+  # Job 4: Update the GitHub check run (issue_comment trigger only)
+  # -------------------------------------------------------------------------
+  update_check:
+    needs: [get_pr_info, prepare, build_images, docker_test]
+    if: always() && github.event_name == 'issue_comment' && needs.get_pr_info.result == 'success'
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    steps:
+      - name: Update check run
+        uses: actions/github-script@v7
+        env:
+          DOCKER_RESULT: ${{ needs.docker_test.result }}
+          CHECK_NAME: ${{ needs.get_pr_info.outputs.check_name }}
+          CHECK_RUN_ID: ${{ needs.get_pr_info.outputs.check_run_id }}
+        with:
+          script: |
+            const result = process.env.DOCKER_RESULT;
+            const conclusionMap = {
+              success:   { conclusion: 'success',   icon: '✅', summary: 'All Docker integration tests passed.' },
+              failure:   { conclusion: 'failure',   icon: '❌', summary: 'One or more Docker integration tests failed.' },
+              cancelled: { conclusion: 'cancelled', icon: '⏹️', summary: 'Workflow was cancelled.' },
+            };
+            const { conclusion, icon, summary } = conclusionMap[result] ?? conclusionMap.failure;
+            const label = conclusion.charAt(0).toUpperCase() + conclusion.slice(1);
+            await github.rest.checks.update({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              check_run_id: parseInt(process.env.CHECK_RUN_ID),
+              status: 'completed',
+              conclusion,
+              completed_at: new Date().toISOString(),
+              output: {
+                title: `${icon} ${process.env.CHECK_NAME} — ${label}`,
+                summary,
+                text: `[View workflow run](https://github.com/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId})`
+              }
+            });

.github/workflows/5_pr_check.yml

@@ -1,10 +1,19 @@
-name: Wazuh Docker pipeline
+name: (8.x) Docker PR check
 permissions:
   contents: read
   id-token: write
 on:
   pull_request:
     types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - 5.*
+      - main
+    paths:
+      - 'build-docker-images/**'
+      - 'multi-node/**'
+      - 'single-node/**'
+      - 'wazuh-agent/**'
+      - '.github/**'
   workflow_dispatch:
     inputs:
       docker_reference:
@@ -16,7 +25,7 @@ jobs:
 
   prepare-variables:
     if: ${{ !github.event.pull_request.draft }}
-    runs-on: ubuntu-latest
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     outputs:
       WAZUH_VERSION: ${{ steps.dotenv.outputs.WAZUH_VERSION }}
       WAZUH_IMAGE_VERSION: ${{ steps.dotenv.outputs.WAZUH_IMAGE_VERSION }}
@@ -41,12 +50,12 @@ jobs:
 
   build-images:
     needs: prepare-variables
-    uses: ./.github/workflows/Procedure_push_docker_images.yml
+    uses: ./.github/workflows/5_build_and_push_images.yml
     secrets: inherit
     with:
       image_tag: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
       docker_reference: ${{ github.head_ref || inputs.docker_reference }}
-      wazuh_automation_reference: 'v5.0.0-beta2'
+      wazuh_automation_reference: '5.0.0'
       commit_list: '["latest", "latest", "latest", "latest"]'
       assistant_revision: 'latest'
       id: ${{ github.run_id }}
@@ -54,7 +63,7 @@ jobs:
 
   Execute-Goss-tests:
     needs: [prepare-variables, build-images]
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}
     env:
       WAZUH_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.WAZUH_IMAGE_VERSION }}
       WAZUH_REGISTRY: ${{ needs.prepare-variables.outputs.WAZUH_REGISTRY }}
@@ -88,7 +97,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, ubuntu-22.04-arm]
+        os: ["codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}", "codebuild-github-actions-codebuild-runner-devops-arm-${{ github.run_id }}-${{ github.run_attempt }}"]
       fail-fast: false
     needs: [prepare-variables, Execute-Goss-tests]
     env:
@@ -105,9 +114,6 @@ jobs:
     - name: Check out code
       uses: actions/checkout@v4
 
-    - name: free disk space
-      uses: ./.github/free-disk-space
-
     - name: Configure aws credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -123,6 +129,12 @@ jobs:
         name: presigned-artifact-urls-${{ github.run_id }}
         path: ./single-node/
 
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
     - name: Add environment variables into GITHUB_ENV
       run: |
         # Export variables to the environment
@@ -363,7 +375,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-22.04, ubuntu-22.04-arm]
+        os: ["codebuild-github-actions-codebuild-runner-devops-amd-${{ github.run_id }}-${{ github.run_attempt }}", "codebuild-github-actions-codebuild-runner-devops-arm-${{ github.run_id }}-${{ github.run_attempt }}"]
       fail-fast: false
     needs: [prepare-variables, Execute-Goss-tests]
     env:
@@ -380,9 +392,6 @@ jobs:
     - name: Check out code
       uses: actions/checkout@v4
 
-    - name: free disk space
-      uses: ./.github/free-disk-space
-
     - name: Configure aws credentials
       uses: aws-actions/configure-aws-credentials@v4
       with:
@@ -398,6 +407,12 @@ jobs:
         name: presigned-artifact-urls-${{ github.run_id }}
         path: ./multi-node/
 
+    - name: Log in to Docker Hub
+      uses: docker/login-action@v4
+      with:
+        username: ${{ secrets.DOCKERHUB_USERNAME }}
+        password: ${{ secrets.DOCKERHUB_PASSWORD }}
+
     - name: Add environment variables into GITHUB_ENV
       run: |
         # Export variables to the environment

.github/workflows/check_integration_tools.yaml

@@ -1,32 +0,0 @@
-name: PR Check - Docker Integration Tests
-
-on:
-  workflow_dispatch:
-    inputs:
-      pr_head_ref:
-        description: 'Branch of wazuh-docker to test'
-        required: true
-        type: string
-      automation_reference:
-        description: 'Branch of wazuh-automation to use'
-        required: false
-        default: 'main'
-        type: string
-      deployment_type:
-        description: 'Deployment type to test'
-        required: true
-        type: choice
-        options:
-          - single-node
-          - multi-node
-          - both
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  placeholder:
-    runs-on: ubuntu-latest
-    steps:
-      - run: echo "Workflow registered. Use workflow_dispatch selecting the feature branch."

CHANGELOG.md

@@ -1,16 +1,55 @@
 # Change Log
 All notable changes to this project will be documented in this file.
 
+## [8.0.0]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
+## [5.9.9]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
 ## [5.0.0]
 
 ### Added
 
+- Implement the wazuh-docker integration testing module ([#2428](https://github.com/wazuh/wazuh-docker/pull/2428))
 - Add revert option into bumper workflow ([#2330](https://github.com/wazuh/wazuh-docker/pull/2330))
 - Add checks for artifact_urls.yaml download ([#2315](https://github.com/wazuh/wazuh-docker/pull/2315))
 - Add set_as_main option ([#2293](https://github.com/wazuh/wazuh-docker/pull/2293))
 
 ### Changed
 
+- Change runners on repository workflows 5.x ([#2471](https://github.com/wazuh/wazuh-docker/pull/2471))
+- PR revamp modifications 5.x ([#2446](https://github.com/wazuh/wazuh-docker/pull/2446))
 - Forbid pr_check workflow execution in draft PRs ([#2399](https://github.com/wazuh/wazuh-docker/pull/2399))
 - Unification of user UID and GID ([#2393](https://github.com/wazuh/wazuh-docker/pull/2393))
 - Add Wazuh indexer engine start on entrypoint ([#2390](https://github.com/wazuh/wazuh-docker/pull/2390))
@@ -55,6 +94,8 @@ All notable changes to this project will be documented in this file.
 
 ### Fixed
 
+- Fix WF docker images vulnerabilities ([#2444](https://github.com/wazuh/wazuh-docker/pull/2444))
+- Adapt Wazuh manager healthcheck with local binaries ([#2422](https://github.com/wazuh/wazuh-docker/pull/2422))
 - Delete setcap command on deprecated file ([#2345](https://github.com/wazuh/wazuh-docker/pull/2345))
 - Modify the choice of a correct tag ([#2313](https://github.com/wazuh/wazuh-docker/pull/2313))
 - Artifact URL download fix ([#2306](https://github.com/wazuh/wazuh-docker/pull/2306))
@@ -67,6 +108,24 @@ All notable changes to this project will be documented in this file.
 
 - None
 
+## [4.14.7]
+
+### Added
+
+- None
+
+### Changed
+
+- PR revamp modifications 4.x ([#2445](https://github.com/wazuh/wazuh-docker/pull/2445))
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
 ## [4.14.6]
 
 ### Added
@@ -75,10 +134,11 @@ All notable changes to this project will be documented in this file.
 
 ### Changed
 
-- None
+- Change runners on repository workflows ([#2470](https://github.com/wazuh/wazuh-docker/pull/2470))
 
 ### Fixed
 
+- Changed update_user function from wazuh.security to wazuh.rbac.orm module ([#2406](https://github.com/wazuh/wazuh-docker/pull/2406))
 - GH issue notification fix ([#2312](https://github.com/wazuh/wazuh-docker/pull/2312))
 
 ### Deleted
@@ -331,6 +391,81 @@ All notable changes to this project will be documented in this file.
 
 - None
 
+## [4.10.5]
+
+### Added
+
+- None
+
+### Changed
+
+- Change runner name for Codebuild ([#2474](https://github.com/wazuh/wazuh-docker/pull/2474))
+- PR revamp modifications LTS ([#2449](https://github.com/wazuh/wazuh-docker/pull/2449))
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
+## [4.10.4]
+
+### Added
+
+- None
+
+### Changed
+
+- Removed sslmanager key from the docker manager image. ([#2092](https://github.com/wazuh/wazuh-docker/pull/2092))
+- Backport 4.13.0 changes: Modify wazuh-keystore use ([#2036](https://github.com/wazuh/wazuh-docker/pull/2036)) \- (wazuh-keystore)
+
+### Fixed
+
+- Changed update_user function from wazuh.security to wazuh.rbac.orm module ([#2405](https://github.com/wazuh/wazuh-docker/pull/2405))
+- Add wazuh-template.json into permanent data exception ([#1967](https://github.com/wazuh/wazuh-docker/pull/1967))
+
+### Deleted
+
+- None
+
+## [4.10.3]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- None
+
+### Deleted
+
+- None
+
+## [4.10.2]
+
+### Added
+
+- None
+
+### Changed
+
+- None
+
+### Fixed
+
+- Updated docker/login-action module ([#1837](https://github.com/wazuh/wazuh-docker/pull/1837))
+
+### Deleted
+
+- None
+
 ## [4.10.1]
 
 ### Added

VERSION.json

@@ -1,4 +1,4 @@
 {
-    "version": "5.0.0",
-    "stage": "beta2"
-}
+    "version": "8.0.0",
+    "stage": "rc8"
+}

build-docker-images/build-images.sh

@@ -42,7 +42,7 @@ build() {
     WAZUH_MINOR_VERSION="${WAZUH_IMAGE_VERSION%.*}"
     # WAZUH_MAJOR_VERSION: Extracts major version only (e.g., 5.0.0 -> 5)
     WAZUH_MAJOR_VERSION="${WAZUH_IMAGE_VERSION%%.*}"
-    # WAZUH_STAGE: Extract the 'stage' (e.g., alpha0, beta2, rc2) from the local JSON metadata file.
+    # WAZUH_STAGE: Extract the 'stage' (e.g., alpha0, beta1, rc2) from the local JSON metadata file.
     # Note: This is primarily used for pre-release package naming.
     WAZUH_STAGE=$(jq -r '.stage' ../VERSION.json)
     # ARTIFACT_URLS_FILE: The name of the artifact URLs file.
@@ -193,9 +193,9 @@ build() {
     # Generate per-component image tags.
     # The commit suffix is only appended when --dev is passed. This ensures:
     #   dev=false, tag=5.0.0       → 5.0.0
-    #   dev=false, tag=5.0.0-beta2 → 5.0.0-beta2
+    #   dev=false, tag=5.0.0-beta1 → 5.0.0-beta1
     #   dev=true,  tag=5.0.0       → 5.0.0-latest
-    #   dev=true,  tag=5.0.0-beta2 → 5.0.0-beta2-latest
+    #   dev=true,  tag=5.0.0-beta1 → 5.0.0-beta1-latest
     make_tag() {
         local commit=$1
         if [ -n "${IS_DEV_BUILD}" ]; then
@@ -248,7 +248,7 @@ help() {
     echo
     echo "Usage: $0 [OPTIONS]"
     echo
-    echo "    -d, --dev-stage <ref>        [Optional] Set the pre-release stage suffix (e.g. beta2, rc2). Not used by default."
+    echo "    -d, --dev-stage <ref>        [Optional] Set the pre-release stage suffix (e.g. beta1, rc2). Not used by default."
     echo "    --dev                        [Optional] Mark as a development build: appends the commit ref to the image tag. Controlled by inputs.dev in the workflow."
     echo "    -refs, --references <refs>   [Optional] [Only with --dev] JSON array of commit refs for components (indexer, manager, dashboard, agent) in order. Defaults to 'latest'."
     echo "    -rg, --registry <reg>        [Optional] Set the Docker registry to push the images."

build-docker-images/docker-bake.hcl

@@ -23,7 +23,7 @@ variable "MULTIARCH" { default = "" }
 
 # Per-component tags — all default to IMAGE_TAG.
 # In dev builds the shell script sets each one independently to append the
-# per-component commit ref (e.g. MANAGER_TAG=5.0.0-beta2-abc1234).
+# per-component commit ref (e.g. MANAGER_TAG=5.0.0-beta1-abc1234).
 variable "INDEXER_TAG"   { default = IMAGE_TAG }
 variable "MANAGER_TAG"   { default = IMAGE_TAG }
 variable "DASHBOARD_TAG" { default = IMAGE_TAG }

docs/dev/build-image.md

@@ -29,7 +29,7 @@ To get all the available script options use the `-h` or `--help` option:
 
 Usage: build-images.sh [OPTIONS]
 
-    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta2, not used by default.
+    -d, --dev <ref>              [Optional] Set the development stage you want to build, example rc2 or beta1, not used by default.
     -refs, --references <ref>    [Optional] Set each Wazuh component reference to be build (indexer, manager, dasboard and agent). By default, using the latest release: ['latest', 'latest', 'latest', 'latest']
     -rg, --registry <reg>        [Optional] Set the Docker registry to push the images.
     -v, --version <ver>          [Optional] Set the Wazuh version should be builded. By default, 5.0.0.

docs/ref/upgrade.md

@@ -24,15 +24,15 @@ Below is a step-by-step example of how to perform this update:
    ```yaml
    services:
      wazuh.manager:
-       image: wazuh/wazuh-manager:5.0.0-beta2
+       image: wazuh/wazuh-manager:5.0.0
        ...
 
      wazuh.indexer:
-       image: wazuh/wazuh-indexer:5.0.0-beta2
+       image: wazuh/wazuh-indexer:5.0.0
        ...
 
      wazuh.dashboard:
-       image: wazuh/wazuh-dashboard:5.0.0-beta2
+       image: wazuh/wazuh-dashboard:5.0.0
        ...
    ```
 
@@ -48,27 +48,27 @@ Below is a step-by-step example of how to perform this update:
    ```yaml
    services:
      wazuh.master:
-       image: wazuh/wazuh-manager:5.0.0-beta2
+       image: wazuh/wazuh-manager:5.0.0
        ...
 
      wazuh.worker:
-       image: wazuh/wazuh-manager:5.0.0-beta2
+       image: wazuh/wazuh-manager:5.0.0
        ...
 
      wazuh1.indexer:
-       image: wazuh/wazuh-indexer:5.0.0-beta2
+       image: wazuh/wazuh-indexer:5.0.0
        ...
 
      wazuh2.indexer:
-       image: wazuh/wazuh-indexer:5.0.0-beta2
+       image: wazuh/wazuh-indexer:5.0.0
        ...
 
      wazuh3.indexer:
-       image: wazuh/wazuh-indexer:5.0.0-beta2
+       image: wazuh/wazuh-indexer:5.0.0
        ...
 
      wazuh.dashboard:
-       image: wazuh/wazuh-dashboard:5.0.0-beta2
+       image: wazuh/wazuh-dashboard:5.0.0
        ...
    ```
 

multi-node/docker-compose.yml

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.master:
-    image: wazuh/wazuh-manager:5.0.0-beta2
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.master
     container_name: multi-node-wazuh.master
     restart: always
@@ -9,10 +9,11 @@ services:
       wazuh1.indexer:
         condition: service_healthy
     healthcheck:
-      test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
+      test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -q 'not running' && exit 1 || exit 0" ]
       interval: 15s
       timeout: 5s
       retries: 5
+      start_period: 60s
     ulimits:
       memlock:
         soft: -1
@@ -43,16 +44,16 @@ services:
       - ./config/wazuh_master/certs/wazuh.master-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh.worker:
-    image: wazuh/wazuh-manager:5.0.0-beta2
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.worker
     container_name: multi-node-wazuh.worker
     restart: always
     healthcheck:
-      test: [ "CMD-SHELL", "timeout 2 bash -c '</dev/tcp/localhost/1514' || exit 1" ]
-      interval: 5s
+      test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -v apid | grep -q 'not running' && exit 1 || exit 0" ]
+      interval: 15s
       timeout: 5s
-      retries: 10
-      start_period: 30s
+      retries: 5
+      start_period: 60s
     ulimits:
       memlock:
         soft: -1
@@ -82,7 +83,7 @@ services:
       - ./config/wazuh_worker/certs/wazuh.worker-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh1.indexer:
-    image: wazuh/wazuh-indexer:5.0.0-beta2
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh1.indexer
     container_name: multi-node-wazuh1.indexer
     restart: always
@@ -120,7 +121,7 @@ services:
       - ./config/wazuh1_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh2.indexer:
-    image: wazuh/wazuh-indexer:5.0.0-beta2
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh2.indexer
     container_name: multi-node-wazuh2.indexer
     restart: always
@@ -158,7 +159,7 @@ services:
       - ./config/wazuh2_indexer/certs/wazuh2.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh3.indexer:
-    image: wazuh/wazuh-indexer:5.0.0-beta2
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh3.indexer
     container_name: multi-node-wazuh3.indexer
     restart: always
@@ -196,7 +197,7 @@ services:
       - ./config/wazuh3_indexer/certs/wazuh3.indexer.pem:/usr/share/wazuh-indexer/config/certs/indexer.pem
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0-beta2
+    image: wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     container_name: multi-node-wazuh.dashboard
     restart: always

single-node/docker-compose.yml

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.manager:
-    image: wazuh/wazuh-manager:5.0.0-beta2
+    image: wazuh/wazuh-manager:5.0.0
     hostname: wazuh.manager
     container_name: single-node-wazuh.manager
     restart: always
@@ -9,10 +9,11 @@ services:
       wazuh.indexer:
         condition: service_healthy
     healthcheck:
-      test: [ "CMD-SHELL", "curl -k -s -o /dev/null https://localhost:55000 || exit 1" ]
+      test: [ "CMD-SHELL", "/var/wazuh-manager/bin/wazuh-manager-control status 2>/dev/null | grep -q 'not running' && exit 1 || exit 0" ]
       interval: 15s
       timeout: 5s
       retries: 5
+      start_period: 60s
     ulimits:
       memlock:
         soft: -1
@@ -43,7 +44,7 @@ services:
       - ./config/wazuh_manager/certs/wazuh.manager-key.pem:/var/wazuh-manager/etc/certs/manager-key.pem
 
   wazuh.indexer:
-    image: wazuh/wazuh-indexer:5.0.0-beta2
+    image: wazuh/wazuh-indexer:5.0.0
     hostname: wazuh.indexer
     container_name: single-node-wazuh.indexer
     restart: always
@@ -80,7 +81,7 @@ services:
       - ./config/wazuh_indexer/certs/admin-key.pem:/usr/share/wazuh-indexer/config/certs/admin-key.pem
 
   wazuh.dashboard:
-    image: wazuh/wazuh-dashboard:5.0.0-beta2
+    image: wazuh/wazuh-dashboard:5.0.0
     hostname: wazuh.dashboard
     container_name: single-node-wazuh.dashboard
     restart: always

tools/repository_bumper.sh

@@ -9,6 +9,8 @@ DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 LOG_FILE="${DIR}/tools/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log"
 VERSION=""
 STAGE=""
+TAG=""
+REFERENCE=""
 FILES_EDITED=()
 FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" --exclude="*_bumper_repository.yml" --exclude="mermaid-init.js" --exclude="mermaid.min.js"'
 
@@ -74,40 +76,44 @@ update_stage_in_files() {
             FILES_EDITED+=("${file}")
         fi
     done
+}
 
-    if [ $STAGE != "alpha0" ]; then
-        version_tag_string=": 'v${VERSION}'"
-        files_tag=( $(grep_command "${version_tag_string}" "${DIR}") )
-        for file in "${files_tag[@]}"; do
-            sed -i -E "s/(: )'v${VERSION}'/\1'v${VERSION}-${STAGE}'/g" "${file}"
-            if [[ $(git diff --name-only "${file}") ]]; then
-                FILES_EDITED+=("${file}")
-            fi
-        done
-
-        version_number_string=": '${VERSION}'"
-        files_version=( $(grep -RlE ": '[0-9]\.[0-9]+\.[0-9]+'" "${DIR}") )
-        for file in "${files_version[@]}"; do
-            sed -i -E "s/(: )'${VERSION}'/\1'v${VERSION}-${STAGE}'/g" "${file}"
-            if [[ $(git diff --name-only "${file}") ]]; then
-                FILES_EDITED+=("${file}")
-            fi
-        done
+# Compute the value written into branch reference defaults ("<key>: '...'").
+# Without --tag, references stay branch-like (e.g. 5.0.0).
+# With --tag, references become tag-like (e.g. v5.0.0-beta3), or a plain release
+# tag (e.g. v5.0.0) when no stage is provided.
+build_reference() {
+    if [[ -n "$TAG" ]]; then
+        if [[ -z "$STAGE" ]]; then
+            REFERENCE="v${VERSION}"
+        else
+            REFERENCE="v${VERSION}-${STAGE}"
+        fi
+    else
+        REFERENCE="${VERSION}"
     fi
 }
 
+# Tag mode only: normalize every reference to the current version
+# (branch-like "5.0.0", "v5.0.0" or "v5.0.0-<stage>") into ${REFERENCE}.
+# Matching is restricted to "<key>: '...'" entries so plain version strings
+# elsewhere in the repository are left untouched.
+update_tag_references() {
+    local V_ESC="${VERSION//./\\.}"
+    files=( $(grep_command "${VERSION}" "${DIR}") )
+    for file in "${files[@]}"; do
+        sed -Ei "s/(:[[:space:]]*')v?${V_ESC}(-[A-Za-z0-9]+)?(')/\1${REFERENCE}\3/g" "${file}"
+        if [[ $(git diff --name-only "${file}") ]]; then
+            FILES_EDITED+=("${file}")
+        fi
+    done
+}
+
 update_main_in_files() {
-    if [[ $STAGE == "alpha0" ]]; then
-            bump_value="${VERSION}"
-    else
-            bump_value="v${VERSION}"
-    fi
-    main_string=": 'main'"
+    local main_string=": 'main'"
     files=( $(grep_command "${main_string}" "${DIR}") )
     for file in "${files[@]}"; do
-        if [[ "$skip_urls" != "yes" ]]; then
-            sed -Ei "s/(:[[:space:]])'main'/\1'${bump_value}'/g" "${file}"
-        fi
+        sed -Ei "s/(:[[:space:]])'main'/\1'${REFERENCE}'/g" "${file}"
         if [[ $(git diff --name-only "${file}") ]]; then
             FILES_EDITED+=("${file}")
         fi
@@ -141,8 +147,8 @@ main() {
                 shift 2
                 ;;
             --tag)
-                TAG="$2"
-                shift 2
+                TAG="yes"
+                shift 1
                 ;;
             --set-as-main)
                 set_as_main="yes"
@@ -155,15 +161,33 @@ main() {
         esac
     done
 
-    # Validate arguments
-    if [[ -z "${VERSION}" ]]; then
-        echo "Error: --version argument is required." | tee -a "${LOG_FILE}"
+    # --tag rewrites branch references into tag-like references (e.g. v5.0.0-beta3)
+    # and re-tags the Docker images accordingly. It is mutually exclusive with
+    # --set-as-main, which keeps references on main.
+    if [[ -n "$TAG" && -n "$set_as_main" ]]; then
+        echo "Error: --tag cannot be combined with --set-as-main." | tee -a "${LOG_FILE}"
         exit 1
     fi
 
-    if [[ -z "${STAGE}" ]]; then
-        echo "Error: --stage argument is required." | tee -a "${LOG_FILE}"
-        exit 1
+    # Read the current version/stage early: tag scenarios may omit --version and/or
+    # --stage and reuse the values already stored in VERSION.json.
+    get_old_version_and_stage
+
+    # Resolve and validate arguments depending on the mode
+    if [[ -n "$TAG" ]]; then
+        # Tag mode: version defaults to the current one; stage is optional
+        # (absent yields a release tag without a stage suffix).
+        [[ -z "$VERSION" ]] && VERSION="$OLD_VERSION"
+    else
+        # Branch mode: a full version + stage bump is required
+        if [[ -z "${VERSION}" ]]; then
+            echo "Error: --version argument is required." | tee -a "${LOG_FILE}"
+            exit 1
+        fi
+        if [[ -z "${STAGE}" ]]; then
+            echo "Error: --stage argument is required." | tee -a "${LOG_FILE}"
+            exit 1
+        fi
     fi
 
     # Validate if version is in the correct format
@@ -172,28 +196,25 @@ main() {
         exit 1
     fi
 
-    # Validate if stage is in the correct format
-    STAGE=$(echo "${STAGE}" | tr '[:upper:]' '[:lower:]')
-    if ! [[ "${STAGE}" =~ ^(alpha[0-9]*|beta[0-9]*|rc[0-9]*|stable)$ ]]; then
-        echo "Error: Stage must be one of the following examples: alpha1, beta1, rc1, stable." | tee -a "${LOG_FILE}"
-        exit 1
+    # Validate if stage is in the correct format (when provided)
+    if [[ -n "${STAGE}" ]]; then
+        STAGE=$(echo "${STAGE}" | tr '[:upper:]' '[:lower:]')
+        if ! [[ "${STAGE}" =~ ^(alpha[0-9]*|beta[0-9]*|rc[0-9]*|stable)$ ]]; then
+            echo "Error: Stage must be one of the following examples: alpha1, beta1, rc1, stable." | tee -a "${LOG_FILE}"
+            exit 1
+        fi
     fi
 
-    # Set skip_urls variable based on set_as_main flag
+    # Compute the value written into branch reference defaults
+    build_reference
+    echo "Reference for branch defaults: ${REFERENCE}" | tee -a "${LOG_FILE}"
+
+    # Convert 'main' references unless they must keep pointing to main (set-as-main)
     if [[ -z "$set_as_main" ]]; then
-        echo "Updating version from main to $VERSION" | tee -a "${LOG_FILE}"
-        update_main_in_files "$VERSION" "$STAGE"
+        echo "Updating 'main' references to ${REFERENCE}" | tee -a "${LOG_FILE}"
+        update_main_in_files
     fi
 
-    # Validate if tag is true or false
-    if [[ -n "${TAG}" && ! "${TAG}" =~ ^(true|false)$ ]]; then
-        echo "Error: --tag must be either true or false." | tee -a "${LOG_FILE}"
-        exit 1
-    fi
-
-    # Get old version and stage
-    get_old_version_and_stage
-
     if [[ "${OLD_VERSION}" != "${VERSION}" ]]; then
         echo "Updating version from ${OLD_VERSION} to ${VERSION}" | tee -a "${LOG_FILE}"
         update_version_in_files "${VERSION}"
@@ -203,10 +224,13 @@ main() {
         update_stage_in_files "$VERSION" "$STAGE"
     fi
 
-    # Update Docker images tag if tag is true
-    if [[ "${TAG}" == "true" ]]; then
-        echo "Updating Docker images tag to ${VERSION}-${STAGE}" | tee -a "${LOG_FILE}"
-        update_docker_images_tag "${VERSION}-${STAGE}"
+    # Tag mode: normalize remaining version references and re-tag the Docker images
+    # (image tags carry no leading 'v', e.g. 5.0.0-beta3).
+    if [[ -n "$TAG" ]]; then
+        echo "Updating version references to tag reference ${REFERENCE}" | tee -a "${LOG_FILE}"
+        update_tag_references
+        echo "Updating Docker images tag to ${REFERENCE#v}" | tee -a "${LOG_FILE}"
+        update_docker_images_tag "${REFERENCE#v}"
     fi
 
 

wazuh-agent/docker-compose.yml

@@ -1,7 +1,7 @@
 # Wazuh App Copyright (C) 2017, Wazuh Inc. (License GPLv2)
 services:
   wazuh.agent:
-    image: wazuh/wazuh-agent:5.0.0-beta2
+    image: wazuh/wazuh-agent:5.0.0
     restart: always
     environment:
       - WAZUH_MANAGER_SERVER=<WAZUH_MANAGER_IP>