fk-wazuh/.github/workflows/Procedure_push_docker_images.yml

run-name: Launch Push Docker Images - ${{ inputs.id }}
name: Push Docker Images

on:
  workflow_dispatch:
    inputs:
      image_tag:
        description: 'Docker image tag'
        default: '5.0.0'
        required: true
      docker_reference:
        description: 'wazuh-docker reference'
        required: true
      revision:
        description: 'Package revision'
        default: '1'
        required: true
      reference:
        description: 'Dev reference'
        type: string
        default: latest 
      id:
        description: "ID used to identify the workflow uniquely."
        type: string
        required: false
      dev:
        description: "Add tag suffix '-dev' to the image tag ?"
        type: boolean
        default: true
        required: false
  workflow_call:
    inputs:
      image_tag:
        description: 'Docker image tag'
        default: '5.0.0'
        required: true
        type: string
      docker_reference:
        description: 'wazuh-docker reference'
        required: false
        type: string
      revision:
        description: 'Package revision'
        default: '1'
        required: true
        type: string
      reference:
        description: 'Dev reference'
        type: string
        default: latest 
      id:
        description: "ID used to identify the workflow uniquely."
        type: string
        required: false
      dev:
        description: "Add tag suffix '-dev' to the image tag ?"
        type: boolean
        default: false
        required: false

jobs:
  build-and-push:
    runs-on: ubuntu-22.04

    permissions:
      id-token: write
      contents: read

    env:
      IMAGE_REGISTRY: ${{ inputs.dev && vars.IMAGE_REGISTRY_DEV || vars.IMAGE_REGISTRY_PROD }}
      IMAGE_TAG: ${{ inputs.image_tag }}
      REVISION: ${{ inputs.revision }}

    steps:
    - name: Print inputs
      run: |
        echo "---------------------------------------------"
        echo "Running Procedure_push_docker_images workflow"
        echo "---------------------------------------------"
        echo "* BRANCH: ${{ github.ref }}"
        echo "* COMMIT: ${{ github.sha }}"
        echo "---------------------------------------------"
        echo "Inputs provided:"
        echo "---------------------------------------------"
        echo "* id: ${{ inputs.id }}"
        echo "* image_tag: ${{ inputs.image_tag }}"
        echo "* docker_reference: ${{ inputs.docker_reference }}"
        echo "* filebeat_module_version: ${{ inputs.filebeat_module_version }}"
        echo "* revision: ${{ inputs.revision }}"
        echo "* dev: ${{ inputs.dev }}"
        echo "* dev reference: ${{ inputs.reference }}"
        echo "---------------------------------------------"

    - name: Checkout repository
      uses: actions/checkout@v4
      with:
        ref: ${{ inputs.docker_reference }}

    - name: free disk space
      uses: ./.github/free-disk-space
    
    - name: Set up QEMU
      uses: docker/setup-qemu-action@v3

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Configure aws credentials
      if: ${{ inputs.dev == true }}
      uses: aws-actions/configure-aws-credentials@v4
      with:
        role-to-assume: ${{ secrets.AWS_IAM_DOCKER_ROLE }}
        aws-region: "${{ secrets.AWS_REGION }}"

    - name: Log in to Amazon ECR
      if: ${{ inputs.dev == true }}
      uses: aws-actions/amazon-ecr-login@v2

    - name: Log in to Docker Hub
      if: ${{ inputs.dev == false }}
      uses: docker/login-action@v3
      with:
        username: ${{ secrets.DOCKERHUB_USERNAME }}
        password: ${{ secrets.DOCKERHUB_PASSWORD }}

    - name: Downoad artifact_urls.yml from S3 and replace variables
      shell: python
      env:
        CONTEXT_VARS: ${{ toJson(vars) }}
      run: |
          import os
          import re
          import json
          import subprocess

          filename = "artifact_urls.yml"
          bucket_path = "s3://xdrsiem-devops-wazuh-artifacts/deployment/artifact_urls.yml"

          subprocess.run(f"aws s3 cp {bucket_path} ./{filename}", shell=True, check=True)

          try:
              repo_vars = json.loads(os.environ.get('CONTEXT_VARS', '{}'))
          except:
              repo_vars = {}

          def replace_match(match):
              prefix = match.group(1)
              key = match.group(2)
              
              value = None
              if prefix == 'env':
                  value = os.environ.get(key)
              elif prefix == 'vars':
                  value = repo_vars.get(key)
              
              if value is not None:
                  return value
              else:
                  return match.group(0)

          with open(filename, 'r') as f:
              content = f.read()

          pattern = r'\$\{\{\s*(env|vars)\.([\w_]+)\s*\}\}'
          
          new_content = re.sub(pattern, replace_match, content)

          with open(filename, 'w') as f:
              f.write(new_content)
      working-directory: ./build-docker-images

    - name: Verify content (Debug)
      run: |
        cat artifact_urls.yml
        mv artifact_urls.yml packages_url.yml
      working-directory: ./build-docker-images

    - name: Build Wazuh images
      run: |
        if [ "${{ inputs.dev }}" = true ]; then
          IMAGE_TAG="${{ inputs.image_tag }}-${{ inputs.reference }}"
          ./build-images.sh -v ${{ inputs.image_tag }} -r $REVISION -d "dev" -rg $IMAGE_REGISTRY -m -ref ${{ inputs.reference }}
        else  
          if [[ "$IMAGE_TAG" == *"-"* ]]; then
            IFS='-' read -r -a tokens <<< "$IMAGE_TAG"
            if [ -z "${tokens[1]}" ]; then
              echo "Invalid image tag: $IMAGE_TAG"
              exit 1
            fi
            DEV_STAGE=${tokens[1]}
            WAZUH_VER=${tokens[0]}
            ./build-images.sh -v $WAZUH_VER -r $REVISION -d $DEV_STAGE -rg $IMAGE_REGISTRY -m
          else
            ./build-images.sh -v $IMAGE_TAG -r $REVISION -rg $IMAGE_REGISTRY -m
          fi
        fi
        # Save .env file (generated by build-images.sh) contents to $GITHUB_ENV
        ENV_FILE_PATH="../.env"

        if [ -f $ENV_FILE_PATH ]; then
          while IFS= read -r line || [ -n "$line" ]; do
            echo "$line" >> $GITHUB_ENV
          done < $ENV_FILE_PATH
        else
          echo "The environment file $ENV_FILE_PATH does not exist!"
          exit 1
        fi
      working-directory: ./build-docker-images