run-name: Launch Push Docker Images - ${{ inputs.id }}
name: Push Docker Images

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: 'Docker image tag'
        default: '5.0.0'
        required: true
      docker_reference:
        description: 'wazuh-docker reference'
        required: true
      products:
        description: 'Comma-separated list of the image names to build and push'
        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
        required: false
        type: string
      commit_list:
        description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product'
        type: string
        default: '["latest", "latest", "latest", "latest"]'
      id:
        description: "ID used to identify the workflow uniquely."
        type: string
        required: false
      dev:
        description: "Add tag suffix '-dev' to the image tag ?"
        type: boolean
        default: true
        required: false
  workflow_call:
    inputs:
      image_tag:
        description: 'Docker image tag'
        default: '5.0.0'
        required: true
        type: string
      docker_reference:
        description: 'wazuh-docker reference'
        required: false
        type: string
      products:
        description: 'Comma-separated list of the image names to build and push'
        default: 'wazuh-manager,wazuh-dashboard,wazuh-indexer,wazuh-agent'
        required: false
        type: string
      commit_list:
        description: 'Wazuh components revisions (only for dev): json array with commit-hash for each product'
        type: string
        default: '["latest", "latest", "latest", "latest"]'
      id:
        description: "ID used to identify the workflow uniquely."
        type: string
        required: false
      dev:
        description: "Add tag suffix '-dev' to the image tag ?"
        type: boolean
        default: false
        required: false

permissions:
      id-token: write
      contents: read

jobs:
  setup:
    runs-on: ubuntu-22.04

    outputs:
      WAZUH_COMPONENTS: ${{ steps.compute-outputs.outputs.WAZUH_COMPONENTS }}
      COMMIT_LIST: ${{ steps.compute-outputs.outputs.COMMIT_LIST }}

    steps:
    - name: Print inputs
      run: |
        echo "---------------------------------------------"
        echo "Running Procedure_push_docker_images workflow"
        echo "---------------------------------------------"
        echo "* BRANCH: ${{ github.ref }}"
        echo "* COMMIT: ${{ github.sha }}"
        echo "---------------------------------------------"
        echo "Inputs provided:"
        echo "---------------------------------------------"
        echo "* id: ${{ inputs.id }}"
        echo "* image_tag: ${{ inputs.image_tag }}"
        echo "* docker_reference: ${{ inputs.docker_reference }}"
        echo "* products: ${{ inputs.products }}"
        echo "* dev: ${{ inputs.dev }}"
        echo "* commit_list: ${{ inputs.commit_list }}"
        echo "---------------------------------------------"

    - name: Set up variables
      id: compute-outputs
      run: |
        # Set WAZUH_COMPONENTS
        WC_JSON_ARRAY=""
        if [[ "${{ inputs.products }}" != "null" && "${{ inputs.products }}" != "" ]]; then
          # Convert comma-separated list to JSON array format
          IFS=',' read -ra COMPONENTS <<< "${{ inputs.products }}"
          WC_JSON_ARRAY="["
          for i in "${!COMPONENTS[@]}"; do
            if [ $i -gt 0 ]; then
              WC_JSON_ARRAY+=","
            fi
            WC_JSON_ARRAY+="\"${COMPONENTS[$i]}\""
          done
          WC_JSON_ARRAY+="]"
        else
          WC_JSON_ARRAY='["wazuh-manager","wazuh-dashboard","wazuh-indexer","wazuh-agent"]'
        fi
        echo "Products to build: $WC_JSON_ARRAY"
        echo "WAZUH_COMPONENTS=$WC_JSON_ARRAY" >> $GITHUB_OUTPUT

        # Set COMMIT_LIST
        WC_COMMIT_LIST=""
        if [[ "${{ inputs.dev }}" == "true" ]]; then
          if [[ "${{ inputs.commit_list }}" != "null" && "${{ inputs.commit_list }}" != "" ]]; then
            WC_COMMIT_LIST='${{ inputs.commit_list }}'
          else
            # Set commit list to "latest" for all components using WAZUH_COMPONENTS
            COMPONENTS=($(echo "$WC_JSON_ARRAY" | jq -r '.[]'))
            WC_COMMIT_LIST="["
            for i in "${!COMPONENTS[@]}"; do
              if [ $i -gt 0 ]; then
                WC_COMMIT_LIST+=" ,"
              fi
              WC_COMMIT_LIST+="\"latest\""
            done
            WC_COMMIT_LIST+="]"
          fi
          echo "Revision list: $WC_COMMIT_LIST"
        fi
        echo "COMMIT_LIST=$WC_COMMIT_LIST" >> $GITHUB_OUTPUT

  package-urls:
    name: generate package urls
    runs-on: ubuntu-22.04
    needs: setup

    env:
      ARTIFACT_URLS_FILE_TEMP: "/tmp/wazuh-docker/artifact_urls.yml"

    steps:
      - name: Configure AWS credentials
        if: ${{ inputs.dev == true }}
        uses: aws-actions/configure-aws-credentials@v4
        with:
          role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
          aws-region: ${{ secrets.AWS_REGION }}

      - name: Download S3 package URIs file (if applicable)
        if: ${{ inputs.dev == true }}
        run: |
          mkdir -p "$(dirname "$ARTIFACT_URLS_FILE_TEMP")"

          # Download the S3 package URIs file
          S3_BUCKET="${{ secrets.ARTIFACTS_S3_BUCKET }}"
          S3_KEY="deployment/artifact_urls.yml"
          aws s3 cp "s3://$S3_BUCKET/$S3_KEY" "$ARTIFACT_URLS_FILE_TEMP" --region us-west-1

          # Verify the file was downloaded
          if [ -f "$ARTIFACT_URLS_FILE_TEMP" ]; then
            echo "S3 package URIs file downloaded successfully."
          else
            echo "Failed to download S3 package URIs file." >&2
            exit 1
          fi

      - name: Generate the variables file (signing each package URI)
        if: ${{ inputs.dev == true }}
        run: |
          # Define necessary variables
          WAZUH_VERSION_RAW="${{ inputs.image_tag }}"
          WAZUH_VERSION="${WAZUH_VERSION_RAW%%-*}"
          WAZUH_MAJOR="${WAZUH_VERSION%%.*}"
          WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
          COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'

          INDEXER_COMMIT=""
          MANAGER_COMMIT=""
          DASHBOARD_COMMIT=""
          AGENT_COMMIT=""

          OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_processed.yml"
          PRESIGNED_OUTPUT_FILE="/tmp/wazuh-docker/artifact_urls_presigned.yml"
          mkdir -p "$(dirname "$OUTPUT_FILE")"

          : > "$OUTPUT_FILE"
          : > "$PRESIGNED_OUTPUT_FILE"

          # Validate WAZUH_COMPONENTS and COMMIT_LIST have the same length
          if [ "$(jq length <<<"$WAZUH_COMPONENTS")" -ne "$(jq length <<<"$COMMIT_LIST")" ]; then
            echo "WAZUH_COMPONENTS and COMMIT_LIST must have the same length." >&2
            exit 1
          fi

          # Verify if the input file exists
          if [ ! -f "$ARTIFACT_URLS_FILE_TEMP" ]; then
            echo "The input file $ARTIFACT_URLS_FILE_TEMP does not exist." >&2
            exit 1
          fi

          # Set each component's commit/revision based on the input lists
          for i in $(seq 0 $(($(echo "$WAZUH_COMPONENTS" | jq length) - 1))); do
            COMPONENT=$(echo "$WAZUH_COMPONENTS" | jq -r ".[$i]")
            COMMIT=$(echo "$COMMIT_LIST" | jq -r ".[$i]")

            case $COMPONENT in
              "wazuh-indexer")
                INDEXER_COMMIT="$COMMIT"
                echo "Indexer commit set to: $COMMIT"
                ;;
              "wazuh-manager")
                MANAGER_COMMIT="$COMMIT"
                echo "Manager commit set to: $COMMIT"
                ;;
              "wazuh-dashboard")
                DASHBOARD_COMMIT="$COMMIT"
                echo "Dashboard commit set to: $COMMIT"
                ;;
              "wazuh-agent")
                AGENT_COMMIT="$COMMIT"
                echo "Agent commit set to: $COMMIT"
                ;;
              *)
                echo "Unknown component: $COMPONENT."
                exit 1
                ;;
            esac
          done

          # Process the file line by line (replacing ocurrences)
          while IFS= read -r line || [ -n "$line" ]; do
            # Skip empty lines and comments
            if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
              continue
            fi

            # Replace variables with their actual values
            line=${line//\$\{\{ vars.AWS_S3_BUCKET_DEV \}\}/${{ vars.AWS_S3_BUCKET_DEV }}}
            line=${line//\$\{\{ env.MAJOR \}\}/$WAZUH_MAJOR}
            line=${line//\$\{\{ env.WAZUH_VERSION \}\}/$WAZUH_VERSION}

            # Replace component revisions
            line=${line//\$\{\{ env.INDEXER_REVISION \}\}/$INDEXER_COMMIT}
            line=${line//\$\{\{ env.MANAGER_REVISION \}\}/$MANAGER_COMMIT}
            line=${line//\$\{\{ env.DASHBOARD_REVISION \}\}/$DASHBOARD_COMMIT}
            line=${line//\$\{\{ env.AGENT_REVISION \}\}/$AGENT_COMMIT}
            line=${line//\$\{\{ env.ASSISTANT_REVISION \}\}/latest}

            # Append the processed line to the output file
            echo "$line" >> "$OUTPUT_FILE"
          done < "$ARTIFACT_URLS_FILE_TEMP"

          # Verify the output file
          if [ -f "$OUTPUT_FILE" ]; then
            echo "The downloaded file artifact_urls.yml was successfully processed at $OUTPUT_FILE."
          else
            echo "Failed to create processed artifact_urls.yml file." >&2
            exit 1
          fi

          # Generate the presigned URLs for each package
          while IFS= read -r line || [ -n "$line" ]; do
            # Skip empty lines and comments
            if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
              continue
            fi

            # Extract both package_name and package_s3_uri from the line
            if [[ "$line" =~ ^([a-zA-Z0-9_]+):[[:space:]]*\"?s3://([^\"[:space:]]+) ]]; then
              PACKAGE_NAME="${BASH_REMATCH[1]}"
              PACKAGE_S3_URI="s3://${BASH_REMATCH[2]}"

              # Check if the object exists in S3
              BUCKET_NAME=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 3)
              OBJ_KEY=$(echo "$PACKAGE_S3_URI" | cut -d '/' -f 4-)
              if ! aws s3api head-object --bucket "$BUCKET_NAME" --key "$OBJ_KEY" --region us-west-1 > /dev/null 2>&1; then
                echo "Object $PACKAGE_S3_URI does not exist. Skipping..." >&2
                continue
              fi

              # Generate a pre-signed URL for the S3 URI
              echo "Generating pre-signed URL for $PACKAGE_NAME..."
              PRESIGNED_URL=$(aws s3 presign "$PACKAGE_S3_URI" --expires-in 43200 --region us-west-1)
              presigned_url_line="$PACKAGE_NAME: \"$PRESIGNED_URL\""

              # Append the processed line to the output file
              echo "$presigned_url_line" >> "$PRESIGNED_OUTPUT_FILE"
            else
              echo "$line" >> "$PRESIGNED_OUTPUT_FILE"
              echo "Skipping line for presigning (no S3 URI found):"
              echo "$line"
            fi
          done < "$OUTPUT_FILE"

          # Verify the presigned urls file
          if [ -f "$PRESIGNED_OUTPUT_FILE" ]; then
            echo "Presigned URLs file created successfully at $PRESIGNED_OUTPUT_FILE."
          else
            echo "Failed to create presigned artifact_urls.yml file." >&2
            exit 1
          fi

          # Store file with the same name expected by build-images.sh
          cp "$PRESIGNED_OUTPUT_FILE" artifact_urls.yml

      - name: Save presigned URLs file to artifact
        if: ${{ inputs.dev == true }}
        uses: actions/upload-artifact@v4
        with:
          name: presigned-artifact-urls-${{ github.run_id }}
          path: artifact_urls.yml

  build-and-push:
    runs-on: ubuntu-22.04

    needs:
      - setup
      - package-urls

    strategy:
      fail-fast: false # all jobs will run even if one fails
      matrix:
        wazuh_component: ${{ fromJson(needs.setup.outputs.WAZUH_COMPONENTS) }}

    env:
      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
      IMAGE_TAG: ${{ inputs.image_tag }}

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        ref: ${{ inputs.docker_reference }}

    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Configure aws credentials
      if: ${{ inputs.dev == true }}
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
        aws-region: "${{ secrets.AWS_REGION }}"

    - name: Log in to Amazon ECR
      if: ${{ inputs.dev == true }}
      uses: aws-actions/amazon-ecr-login@v2

    - name: Log in to Docker Hub
      if: ${{ inputs.dev == false }}
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_PASSWORD }}

    - name: Download artifact_urls.yml (dev)
      if: ${{ inputs.dev == true }}
      uses: actions/download-artifact@v4
      with:
        name: presigned-artifact-urls-${{ github.run_id }}
        path: ./build-docker-images

    - name: Compute component reference (dev)
      if: ${{ inputs.dev == true }}
      run: |
        COMPONENT='${{ matrix.wazuh_component }}'
        WAZUH_COMPONENTS='${{ needs.setup.outputs.WAZUH_COMPONENTS }}'
        COMMIT_LIST='${{ needs.setup.outputs.COMMIT_LIST }}'

        idx=$(jq -r --arg c "$COMPONENT" 'index($c)' <<<"$WAZUH_COMPONENTS")
        ref=$(jq -r --argjson i "$idx" '.[ $i ]' <<<"$COMMIT_LIST")

        echo "COMPONENT_REFS_JSON=[\"$ref\"]" >> "$GITHUB_ENV"
        echo "Using component ref for $COMPONENT: $ref"

    - name: Build Wazuh images
      run: |
        if [[ "$IMAGE_TAG" == *"-"* ]]; then
          IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
          if [ -z "${tokens[1]}" ]; then
            echo "Invalid image tag: $IMAGE_TAG"
            exit 1
          fi
          DEV_STAGE=${tokens[1]}
          WAZUH_VER=${tokens[0]}
          if [ "${{ inputs.dev }}" = true ]; then
            ./build-images.sh \
              -v $WAZUH_VER \
              -d $DEV_STAGE \
              -rg $IMAGE_REGISTRY \
              -m \
              -refs "$COMPONENT_REFS_JSON" \
              -c ${{ matrix.wazuh_component }}
          else
            ./build-images.sh \
              -v $WAZUH_VER \
              -d $DEV_STAGE \
              -rg $IMAGE_REGISTRY \
              -m \
              -c ${{ matrix.wazuh_component }}
          fi
        else
          if [ "${{ inputs.dev }}" = true ]; then
            ./build-images.sh \
              -v $IMAGE_TAG \
              -rg $IMAGE_REGISTRY \
              -m \
              -refs "$COMPONENT_REFS_JSON" \
              -c ${{ matrix.wazuh_component }}
          else
            ./build-images.sh \
              -v $IMAGE_TAG \
              -rg $IMAGE_REGISTRY \
              -m \
              -c ${{ matrix.wazuh_component }}
          fi
        fi
        # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
        ENV_FILE_PATH="../.env"

        if [ -f $ENV_FILE_PATH ]; then
          while IFS= read -r line || [ -n "$line" ]; do
            echo "$line" >> $GITHUB_ENV
          done < $ENV_FILE_PATH
        else
          echo "The environment file $ENV_FILE_PATH does not exist!"
          exit 1
        fi
      working-directory: ./build-docker-images

    - name: Image exists validation
      if: ${{ inputs.dev == false }}
      id: validation
      run: |
        IMAGE_TAG=${{ inputs.image_tag }}
        PURPOSE=""

        if [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
          if docker manifest inspect $IMAGE_REGISTRY/wazuh/wazuh-manager:$IMAGE_TAG > /dev/null 2>&1; then
            PURPOSE="regeneration"
            echo "Image wazuh/wazuh-manager:$IMAGE_TAG exists. Setting PURPOSE to 'regeneration'"
          else
            PURPOSE="new release"
            echo "Image wazuh/wazuh-manager:$IMAGE_TAG does NOT exist. Setting PURPOSE to 'new release'"
          fi
          echo "✅ Release tag: '$IMAGE_TAG'"
        elif [[ "$IMAGE_TAG" =~ ^[0-9]+\.[0-9]+\.[0-9]+-(alpha|beta|rc)[0-9]+$ ]]; then
          PURPOSE="new stage"
          echo "✅ Stage tag: '$IMAGE_TAG'. Setting PURPOSE to 'new stage'"
        else
          echo "❌ No release or stage tag ('$IMAGE_TAG'), the GH issue will not be created"
        fi

        echo "purpose=$PURPOSE" >> $GITHUB_OUTPUT

    - name: GH issue notification
      if: ${{ inputs.dev == false && steps.validation.outputs.purpose != '' }}
      run: |
        IMAGE_TAG=${{ inputs.image_tag }}
        GH_TITLE=""
        GH_MESSAGE=""
        PURPOSE="${{ steps.validation.outputs.purpose }}"

        ## Setting GH issue title
        GH_TITLE="Artifactory vulnerabilities update \`v$IMAGE_TAG\`"

        ## Setting GH issue body
        GH_MESSAGE=$(cat <<- EOF | tr -d '\r' | sed 's/^[[:space:]]*//'
        ### Description
        - [ ] Update the [Artifactory vulnerabilities](${{ secrets.NOTIFICATION_SHEET_URL }}) sheet with the \`v$IMAGE_TAG\` vulnerabilities.

        **Purpose**: $PURPOSE
        >[!NOTE]
        >To update the \`Tentative Release\` column, follow these steps:
        https://github.com/wazuh/${{ secrets.NOTIFICATION_REPO }}/issues/2049#issuecomment-2671590268
        EOF
        )

        # Print the GH Variables content
        echo "--- Variable Content ---"
        echo "$GH_TITLE"
        echo "------------------------"

        echo "--- Variable Content ---"
        echo "$GH_MESSAGE"
        echo "------------------------"

        ## GH issue creation
        ISSUE_URL=$(gh issue create \
          -R wazuh/${{ secrets.NOTIFICATION_REPO }} \
          --title "$GH_TITLE" \
          --body "$GH_MESSAGE" \
          --label "level/task" \
          --label "type/maintenance" \
          --label "request/operational")

        ## Adding the issue to the team project
        PROJECT_ITEM_ID=$(gh project item-add \
          ${{ secrets.NOTIFICATION_PROJECT_NUMBER }} \
          --url $ISSUE_URL \
          --owner wazuh \
          --format json \
          | jq -r '.id')

          ## Setting Objective
          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_OBJECTIVE_ID }} --text  "Security scans"
          ## Setting Priority
          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_PRIORITY_OPTION_ID }}
          ## Setting Size
          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SIZE_OPTION_ID }}
          ## Setting Subteam
          gh project item-edit --id $PROJECT_ITEM_ID --project-id ${{ secrets.NOTIFICATION_PROJECT_ID }} --field-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_ID }} --single-select-option-id ${{ secrets.NOTIFICATION_PROJECT_SUBTEAM_OPTION_ID }}

      env:
        GH_TOKEN: ${{ secrets.NOTIFICATION_GH_ARTIFACT_TOKEN }}