Build deb wazuh-dashboard on amd64 - is stage - checksum 4.10.5_2026-08-25_07-00-50-531 #510
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # This workflow automates the build of the Wazuh Dashboard package along with | ||
| # its plugins. | ||
| # | ||
| # This workflow: | ||
| # - Download, build, package, test, and upload the Wazuh dashboard along | ||
| # with its plugins. | ||
| # - Customizable through inputs to adapt to different environments | ||
| # (production, staging, various architectures). | ||
| # - Ensure that each component is built with the exact reference provided and | ||
| # validated before the final packaging. | ||
| # | ||
| # - Allows customization of: | ||
| # - Operating system (`deb` or `rpm`) | ||
| # - Architecture (`amd64`, `x86_64`) | ||
| # - Package revision | ||
| # - Plugin references (branches, tags, or commits) | ||
| # - Staging, upload, and checksum options. | ||
| run-name: Build ${{ inputs.system }} wazuh-dashboard on ${{ inputs.architecture }} ${{ inputs.is_stage && '- is stage' || '' }} ${{ inputs.checksum && '- checksum' || '' }} ${{ inputs.id }} | ||
| name: (4.x) Build Wazuh dashboard package with plugins (on demand) | ||
| on: | ||
| workflow_dispatch: | ||
| inputs: | ||
| system: | ||
| type: choice | ||
| description: 'Package OS' | ||
| required: true | ||
| options: | ||
| - deb | ||
| - rpm | ||
| default: 'deb' | ||
| architecture: | ||
| type: choice | ||
| description: 'Package architecture' | ||
| required: true | ||
| options: | ||
| - amd64 | ||
| - x86_64 | ||
| default: amd64 | ||
| revision: | ||
| type: string | ||
| description: 'Package revision' | ||
| required: true | ||
| default: '0' | ||
| reference_security_plugins: | ||
| type: string | ||
| description: 'Branch/tag/commit of the wazuh-security-dashboards-plugin repository to build the security plugin' | ||
| required: true | ||
| default: 'master' | ||
| reference_wazuh_plugins: | ||
| type: string | ||
| description: 'Branch/tag/commit of the wazuh-dashboard-plugins repository to build the main plugins' | ||
| required: true | ||
| default: 'master' | ||
| is_stage: | ||
| type: boolean | ||
| description: 'Set production nomenclature' | ||
| required: true | ||
| default: false | ||
| checksum: | ||
| type: boolean | ||
| description: 'Generate package checksum' | ||
| required: true | ||
| default: false | ||
| id: | ||
| description: 'ID used to identify the workflow uniquely.' | ||
| type: string | ||
| required: false | ||
| workflow_call: | ||
| inputs: | ||
| system: | ||
| type: string | ||
| required: true | ||
| default: 'deb' | ||
| architecture: | ||
| type: string | ||
| required: true | ||
| default: amd64 | ||
| revision: | ||
| type: string | ||
| required: true | ||
| default: '0' | ||
| reference_security_plugins: | ||
| type: string | ||
| required: true | ||
| default: 'master' | ||
| reference_wazuh_plugins: | ||
| type: string | ||
| required: true | ||
| default: 'master' | ||
| is_stage: | ||
| type: boolean | ||
| required: true | ||
| default: false | ||
| checksum: | ||
| type: boolean | ||
| required: true | ||
| default: false | ||
| id: | ||
| type: string | ||
| required: false | ||
| env: | ||
| CI_DEV_INTERNAL_BUCKET: ${{ secrets.CI_DEV_INTERNAL_BUCKET }} | ||
| EXECUTION_REPOSITORY: wazuh-dashboard/4_builderpackage_dashboard | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| jobs: | ||
| setup-variables: | ||
| runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }} | ||
| name: Setup variables | ||
| outputs: | ||
| VERSION: ${{ steps.setup-variables.outputs.VERSION }} | ||
| REVISION: ${{ steps.setup-variables.outputs.REVISION }} | ||
| COMMIT_SHA: ${{ steps.setup-variables.outputs.COMMIT_SHA }} | ||
| PRODUCTION: ${{ steps.setup-variables.outputs.PRODUCTION }} | ||
| WAZUH_DASHBOARD_SLIM: ${{ steps.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }} | ||
| WAZUH_SECURITY_PLUGIN: ${{ steps.setup-variables.outputs.WAZUH_SECURITY_PLUGIN }} | ||
| WAZUH_PLUGINS_WAZUH: ${{ steps.setup-variables.outputs.WAZUH_PLUGINS_WAZUH }} | ||
| WAZUH_PLUGINS_CORE: ${{ steps.setup-variables.outputs.WAZUH_PLUGINS_CORE }} | ||
| WAZUH_PLUGINS_CHECK_UPDATES: ${{ steps.setup-variables.outputs.WAZUH_PLUGINS_CHECK_UPDATES }} | ||
| PACKAGE_NAME: ${{ steps.setup-variables.outputs.PACKAGE_NAME }} | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| - name: Setup Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version-file: '.nvmrc' | ||
| registry-url: 'https://registry.npmjs.org' | ||
| - name: Setup variables | ||
| id: setup-variables | ||
| run: | | ||
| VERSION=$(tail -c +2 VERSION) | ||
| REVISION=$(yarn --silent wzd-revision) | ||
| COMMIT_SHA=$(git rev-parse --short HEAD) | ||
| if [ "${{ inputs.is_stage }}" = "true" ]; then | ||
| PRODUCTION=--production | ||
| else | ||
| PRODUCTION="" | ||
| fi | ||
| WAZUH_DASHBOARD_SLIM=wazuh-dashboard_${VERSION}-${REVISION}_x64.tar.gz | ||
| WAZUH_SECURITY_PLUGIN=wazuh-security-dashboards-plugin_${VERSION}-${REVISION}_$(echo ${{ inputs.reference_security_plugins }} | sed 's/\//-/g').zip | ||
| WAZUH_PLUGINS_WAZUH=wazuh-dashboard-plugins_wazuh_${VERSION}-${REVISION}_$(echo ${{ inputs.reference_wazuh_plugins }} | sed 's/\//-/g').zip | ||
| WAZUH_PLUGINS_CORE=wazuh-dashboard-plugins_wazuh-core_${VERSION}-${REVISION}_$(echo ${{ inputs.reference_wazuh_plugins }} | sed 's/\//-/g').zip | ||
| WAZUH_PLUGINS_CHECK_UPDATES=wazuh-dashboard-plugins_wazuh-check-updates_${VERSION}-${REVISION}_$(echo ${{ inputs.reference_wazuh_plugins }} | sed 's/\//-/g').zip | ||
| if [ "${{ inputs.system }}" = "deb" ]; then | ||
| if [ "${{ inputs.is_stage }}" = "true" ]; then | ||
| PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}.deb | ||
| else | ||
| PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}_${COMMIT_SHA}.deb | ||
| fi | ||
| else | ||
| if [ "${{ inputs.is_stage }}" = "true" ]; then | ||
| PACKAGE_NAME=wazuh-dashboard-${VERSION}-${{ inputs.revision }}.${{ inputs.architecture }}.rpm | ||
| else | ||
| PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}_${COMMIT_SHA}.rpm | ||
| fi | ||
| fi | ||
| echo "VERSION=$VERSION" >> $GITHUB_OUTPUT | ||
| echo "REVISION=$REVISION" >> $GITHUB_OUTPUT | ||
| echo "COMMIT_SHA=$COMMIT_SHA" >> $GITHUB_OUTPUT | ||
| echo "PRODUCTION=$PRODUCTION" >> $GITHUB_OUTPUT | ||
| echo "WAZUH_DASHBOARD_SLIM=$WAZUH_DASHBOARD_SLIM" >> $GITHUB_OUTPUT | ||
| echo "WAZUH_SECURITY_PLUGIN=$WAZUH_SECURITY_PLUGIN" >> $GITHUB_OUTPUT | ||
| echo "WAZUH_PLUGINS_WAZUH=$WAZUH_PLUGINS_WAZUH" >> $GITHUB_OUTPUT | ||
| echo "WAZUH_PLUGINS_CORE=$WAZUH_PLUGINS_CORE" >> $GITHUB_OUTPUT | ||
| echo "WAZUH_PLUGINS_CHECK_UPDATES=$WAZUH_PLUGINS_CHECK_UPDATES" >> $GITHUB_OUTPUT | ||
| echo "PACKAGE_NAME=$PACKAGE_NAME" >> $GITHUB_OUTPUT | ||
| validate-job: | ||
| runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }} | ||
| needs: setup-variables | ||
| name: Validate inputs | ||
| steps: | ||
| - name: Validate inputs | ||
| run: | | ||
| if [ "${{ inputs.architecture }}" = "amd64" ] && [ "${{ inputs.system }}" = "rpm" ]; then | ||
| echo "Invalid combination of architecture and system" | ||
| exit 1 | ||
| fi | ||
| if [ "${{ inputs.architecture }}" = "x86_64" ] && [ "${{ inputs.system }}" = "deb" ]; then | ||
| echo "Invalid combination of architecture and system" | ||
| exit 1 | ||
| fi | ||
| - name: Set up AWS CLI | ||
| uses: aws-actions/configure-aws-credentials@v4 | ||
| with: | ||
| aws-access-key-id: ${{ secrets.CI_INTERNAL_DEVELOPMENT_BUCKET_USER_ACCESS_KEY }} | ||
| aws-secret-access-key: ${{ secrets.CI_INTERNAL_DEVELOPMENT_BUCKET_USER_SECRET_KEY }} | ||
| aws-region: ${{ secrets.CI_AWS_REGION }} | ||
| build-base: | ||
| needs: [validate-job] | ||
| name: Build dashboard | ||
| uses: wazuh/wazuh-dashboard/.github/workflows/4_builderpackage_dashboard_core.yml@4.10.5 | ||
| with: | ||
| CHECKOUT_TO: ${{ github.head_ref || github.ref_name }} | ||
| execution_repository: 'wazuh-dashboard/4_builderpackage_dashboard' | ||
| secrets: inherit | ||
| build-main-plugins: | ||
| needs: [validate-job] | ||
| name: Build plugins | ||
| permissions: | ||
| pull-requests: write | ||
| id-token: write | ||
| uses: wazuh/wazuh-dashboard-plugins/.github/workflows/4_builderpackage_plugins.yml@4.10.5 | ||
| with: | ||
| reference: ${{ inputs.reference_wazuh_plugins }} | ||
| execution_repository: 'wazuh-dashboard/4_builderpackage_dashboard' | ||
| secrets: inherit | ||
| build-security-plugin: | ||
| needs: [validate-job] | ||
| name: Build security plugin | ||
| permissions: | ||
| pull-requests: write | ||
| id-token: write | ||
| uses: wazuh/wazuh-security-dashboards-plugin/.github/workflows/4_builderpackage_security_plugin.yml@4.10.5 | ||
| with: | ||
| reference: ${{ inputs.reference_security_plugins }} | ||
| execution_repository: 'wazuh-dashboard/4_builderpackage_dashboard' | ||
|
Check failure on line 231 in .github/workflows/4_builderpackage_dashboard.yml
|
||
| secrets: inherit | ||
| build-and-test-package: | ||
| needs: [setup-variables, build-main-plugins, build-base, build-security-plugin] | ||
| runs-on: 'codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}' | ||
| name: Generate packages | ||
| steps: | ||
| - name: Checkout code | ||
| uses: actions/checkout@v4 | ||
| - name: Setup Node | ||
| uses: actions/setup-node@v4 | ||
| with: | ||
| node-version-file: '.nvmrc' | ||
| registry-url: 'https://registry.npmjs.org' | ||
| - name: Configure AWS credentials | ||
| uses: aws-actions/configure-aws-credentials@v6 | ||
| with: | ||
| role-to-assume: ${{ secrets.AWS_IAM_ROLE }} | ||
| aws-region: ${{ secrets.AWS_REGION }} | ||
| - name: Download artifacts from S3 | ||
| run: | | ||
| aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }} ${{ github.workspace }}/artifacts/dashboard/${{ needs.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }} | ||
| aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.setup-variables.outputs.WAZUH_SECURITY_PLUGIN }} ${{ github.workspace }}/artifacts/security-plugin/${{ needs.setup-variables.outputs.WAZUH_SECURITY_PLUGIN }} | ||
| aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_WAZUH }} ${{ github.workspace }}/artifacts/plugins/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_WAZUH }} | ||
| aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_CORE }} ${{ github.workspace }}/artifacts/plugins/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_CORE }} | ||
| aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_CHECK_UPDATES }} ${{ github.workspace }}/artifacts/plugins/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_CHECK_UPDATES }} | ||
| echo "Dashboard artifact: ${{ github.workspace }}/artifacts/dashboard/${{ needs.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }}" | ||
| echo "Security plugin artifact: ${{ github.workspace }}/artifacts/security-plugin/${{ needs.setup-variables.outputs.WAZUH_SECURITY_PLUGIN }}" | ||
| echo "Main plugin artifact: ${{ github.workspace }}/artifacts/plugins/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_WAZUH }}" | ||
| echo "Core plugin artifact: ${{ github.workspace }}/artifacts/plugins/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_CORE }}" | ||
| echo "Check updates plugin artifact: ${{ github.workspace }}/artifacts/plugins/${{ needs.setup-variables.outputs.WAZUH_PLUGINS_CHECK_UPDATES }}" | ||
| - name: Zip plugins | ||
| run: | | ||
| zip -r -j ${{ github.workspace }}/artifacts/wazuh-package.zip ${{ github.workspace }}/artifacts/plugins | ||
| zip -r -j ${{ github.workspace }}/artifacts/security-package.zip ${{ github.workspace }}/artifacts/security-plugin | ||
| zip -r -j ${{ github.workspace }}/artifacts/dashboard-package.zip ${{ github.workspace }}/artifacts/dashboard/${{ needs.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }} | ||
| # Workaround: AWS CodeBuild runners hit Docker Hub anonymous pull rate limits | ||
| - name: Login to Docker Hub | ||
| uses: docker/login-action@v3 | ||
| with: | ||
| username: ${{ secrets.DOCKERHUB_USERNAME }} | ||
| password: ${{ secrets.DOCKERHUB_TOKEN }} | ||
| # Workaround: Docker containers run as root internally, so output files are root-owned on the host. Create a non-root user to run the build and test steps. | ||
| - name: Create non-root build user | ||
| run: | | ||
| useradd -m builduser | ||
| usermod -aG docker builduser | ||
| chown -R builduser:builduser ${{ github.workspace }} | ||
| # Copy Docker Hub credentials so builduser can pull authenticated images | ||
| mkdir -p /home/builduser/.docker | ||
| cp /root/.docker/config.json /home/builduser/.docker/config.json | ||
| chown -R builduser:builduser /home/builduser/.docker | ||
| - name: Build package | ||
| run: | | ||
| cd ${{ github.workspace }}/dev-tools/build-packages | ||
| sudo -u builduser -H env PATH="$PATH" bash ./build-packages.sh \ | ||
| -v ${{ needs.setup-variables.outputs.VERSION }} \ | ||
| -r ${{ inputs.revision }} \ | ||
| -a file://${{github.workspace}}/artifacts/wazuh-package.zip \ | ||
| -s file://${{github.workspace}}/artifacts/security-package.zip \ | ||
| -b file://${{github.workspace}}/artifacts/dashboard-package.zip \ | ||
| --${{ inputs.system }} ${{ needs.setup-variables.outputs.PRODUCTION }} | ||
| # Workaround: Docker containers run as root internally, so output files are root-owned on the host. | ||
| chown -R builduser:builduser output 2>/dev/null || true | ||
| - name: Test package | ||
| run: | | ||
| cd ${{ github.workspace }}/dev-tools/test-packages | ||
| ls -la ${{ github.workspace }}/dev-tools/build-packages/output/${{ inputs.system }} | ||
| sudo -u builduser -H env PATH="$PATH" cp ${{ github.workspace }}/dev-tools/build-packages/output/${{ inputs.system }}/${{needs.setup-variables.outputs.PACKAGE_NAME}} ${{ github.workspace }}/dev-tools/test-packages/${{ inputs.system }} | ||
| sudo -u builduser -H env PATH="$PATH" bash ./test-packages.sh \ | ||
| -p ${{needs.setup-variables.outputs.PACKAGE_NAME}} | ||
| - name: Set up AWS CLI | ||
| uses: aws-actions/configure-aws-credentials@v6 | ||
| with: | ||
| role-to-assume: ${{ secrets.AWS_IAM_ROLE }} | ||
| aws-region: ${{ secrets.AWS_REGION }} | ||
| - name: Upload package | ||
| run: | | ||
| echo "Uploading package" | ||
| aws s3 cp ${{ github.workspace }}/dev-tools/build-packages/output/${{ inputs.system }}/${{needs.setup-variables.outputs.PACKAGE_NAME}} s3://xdrsiem-packages-dev-internal/development/wazuh/4.x/main/packages/ | ||
| s3uri="s3://xdrsiem-packages-dev-internal/development/wazuh/4.x/main/packages/${{needs.setup-variables.outputs.PACKAGE_NAME}}" | ||
| echo "S3 URI: ${s3uri}" | ||
| - name: Upload SHA512 | ||
| if: ${{ inputs.checksum }} | ||
| run: | | ||
| echo "Uploading checksum" | ||
| aws s3 cp ${{ github.workspace }}/dev-tools/build-packages/output/${{ inputs.system }}/${{needs.setup-variables.outputs.PACKAGE_NAME}}.sha512 s3://xdrsiem-packages-dev-internal/development/wazuh/4.x/main/packages/ | ||
| s3uri="s3://xdrsiem-packages-dev-internal/development/wazuh/4.x/main/packages/${{needs.setup-variables.outputs.PACKAGE_NAME}}.sha512" | ||
| echo "S3 sha512 URI: ${s3uri}" | ||
| - name: Upload package to S3 internal repository | ||
| run: | | ||
| echo "Uploading package to internal repository" | ||
| artifact_path="${{ github.workspace }}/dev-tools/build-packages/output/${{ inputs.system }}/${{ needs.setup-variables.outputs.PACKAGE_NAME }}" | ||
| bucket_path="${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.setup-variables.outputs.PACKAGE_NAME }}" | ||
| aws s3 cp $artifact_path $bucket_path | ||
| echo "Artifact uploaded to S3: $bucket_path" | ||
| - name: Upload SHA512 to S3 internal repository | ||
| if: ${{ inputs.checksum }} | ||
| run: | | ||
| echo "Uploading checksum to internal repository" | ||
| artifact_path="${{ github.workspace }}/dev-tools/build-packages/output/${{ inputs.system }}/${{ needs.setup-variables.outputs.PACKAGE_NAME }}.sha512" | ||
| bucket_path="${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.setup-variables.outputs.PACKAGE_NAME }}.sha512" | ||
| aws s3 cp $artifact_path $bucket_path | ||
| echo "Artifact uploaded to S3: $bucket_path" | ||
