Skip to content

Build rpm wazuh-dashboard on x86_64 - is stage - checksum 5.0.0_2026-09-05_01-09-50-148 #2560

Build rpm wazuh-dashboard on x86_64 - is stage - checksum 5.0.0_2026-09-05_01-09-50-148

Build rpm wazuh-dashboard on x86_64 - is stage - checksum 5.0.0_2026-09-05_01-09-50-148 #2560

# This workflow automates the build of the Wazuh Dashboard package along with
# its plugins.
#
# This workflow:
# - Download, build, package, test, and upload the Wazuh dashboard along
# with its plugins.
# - Customizable through inputs to adapt to different environments
# (production, staging, various architectures).
# - Ensure that each component is built with the exact reference provided and
# validated before the final packaging.
#
# - Allows customization of:
# - Operating system (`deb` or `rpm`)
# - Architecture (`amd64`, `x86_64`, `aarch64`, `arm64`)
# - Package revision
# - Plugin references (branches, tags, or commits)
# - Staging, upload, and checksum options.
run-name: Build ${{ inputs.system }} wazuh-dashboard on ${{ inputs.architecture }} ${{ inputs.is_stage && '- is stage' || '' }} ${{ inputs.checksum && '- checksum' || '' }} ${{ inputs.id }}
name: (5.x) Build Wazuh dashboard package with plugins (on demand)
on:
workflow_dispatch:
inputs:
system:
type: choice
description: 'Package OS'
required: true
options:
- deb
- rpm
default: 'deb'
architecture:
type: choice
description: 'Package architecture'
required: true
options:
- amd64
- x86_64
- aarch64
- arm64
default: amd64
revision:
type: string
description: 'Package revision'
required: true
default: '0'
reference_plugins:
type: string
description: 'Git ref (branch/tag) to use for all plugins'
required: false
is_stage:
type: boolean
description: 'Set production nomenclature'
required: true
default: false
checksum:
type: boolean
description: 'Generate package checksum'
required: true
default: false
id:
description: 'ID used to identify the workflow uniquely.'
type: string
required: false
workflow_call:
inputs:
system:
type: string
required: true
default: 'deb'
architecture:
type: string
required: true
default: amd64
revision:
type: string
required: true
default: '0'
reference_plugins:
type: string
description: 'Git ref (branch/tag) to use for all plugins'
required: false
is_stage:
type: boolean
required: true
default: false
checksum:
type: boolean
required: true
default: false
id:
type: string
required: false
permissions:
id-token: write
contents: read
env:
CI_DEV_INTERNAL_BUCKET: ${{ secrets.CI_DEV_INTERNAL_BUCKET }}
EXECUTION_REPOSITORY: wazuh-dashboard/5_builderpackage_dashboard
jobs:
validate-job:
runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
name: Validate inputs
steps:
- name: Validate inputs
run: |
if [[ "${{ inputs.architecture }}" == "amd64" || "${{ inputs.architecture }}" == "arm64" ]] && [[ "${{ inputs.system }}" == "rpm" ]]; then
echo "Invalid combination of architecture and system"
exit 1
fi
if [[ "${{ inputs.architecture }}" == "x86_64" || "${{ inputs.architecture }}" == "aarch64" ]] && [[ "${{ inputs.system }}" == "deb" ]]; then
echo "Invalid combination of architecture and system"
exit 1
fi
- name: Set up AWS CLI
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: ${{ secrets.AWS_REGION }}
# This job retrieves the necessary information about the plugins to be used in the build process.
# if need to add more plugins:
# - Add them to the matrix (name: <plugin-name>, packageName: <plugin-package-name>, repository: <plugin-repo-url>, outputNamePackge: <plugin-output-name>, outputSHA: <plugin-output-sha>)
# - If need to add more plugins from the wazuh-dashboard-plugins repo, outputSHA can be omitted because it will be retrieved from the main plugin
# - Add them to the outputs section (NAME_PLUGIN_... and WAZUH_..._SHA)
get-outputs-plugins:
runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
name: get-outputs-plugins
needs: [validate-job]
outputs:
VERSION: ${{ steps.get-version.outputs.VERSION }}
VERSION_OPENSEARCH: ${{ steps.get-version.outputs.VERSION_OPENSEARCH }}
REVISION: ${{ steps.get-version.outputs.REVISION }}
NAME_PLUGIN_WAZUH: ${{ steps.get-plugins.outputs.NAME_PLUGIN_WAZUH }}
NAME_PLUGIN_CORE: ${{ steps.get-plugins.outputs.NAME_PLUGIN_CORE }}
NAME_PLUGIN_CHECK_UPDATES: ${{ steps.get-plugins.outputs.NAME_PLUGIN_CHECK_UPDATES }}
NAME_PLUGIN_AI_ASSISTANT: ${{ steps.get-plugins.outputs.NAME_PLUGIN_AI_ASSISTANT }}
NAME_PLUGIN_SECURITY: ${{ steps.get-plugins.outputs.NAME_PLUGIN_SECURITY }}
NAME_PLUGIN_REPORTING: ${{ steps.get-plugins.outputs.NAME_PLUGIN_REPORTING }}
NAME_PLUGIN_SECURITY_ANALYTICS: ${{ steps.get-plugins.outputs.NAME_PLUGIN_SECURITY_ANALYTICS }}
NAME_PLUGIN_ALERTING: ${{ steps.get-plugins.outputs.NAME_PLUGIN_ALERTING }}
NAME_PLUGIN_NOTIFICATIONS: ${{ steps.get-plugins.outputs.NAME_PLUGIN_NOTIFICATIONS }}
strategy:
fail-fast: true
matrix:
plugin:
- name: security # this is for reference only,
packageName: wazuh-security-dashboards-plugin # this is for the name of the plugin
repository: https://github.com/wazuh/wazuh-security-dashboards-plugin.git
outputNamePackage: NAME_PLUGIN_SECURITY # this is for the output name of the plugin
- name: plugins-main
packageName: wazuh-dashboard-plugins_wazuh
repository: https://github.com/wazuh/wazuh-dashboard-plugins.git
outputNamePackage: NAME_PLUGIN_WAZUH
- name: plugins-core
packageName: wazuh-dashboard-plugins_core
repository: https://github.com/wazuh/wazuh-dashboard-plugins.git
outputNamePackage: NAME_PLUGIN_CORE
- name: plugins-check-updates
packageName: wazuh-dashboard-plugins_wazuh-check-updates
repository: https://github.com/wazuh/wazuh-dashboard-plugins.git
outputNamePackage: NAME_PLUGIN_CHECK_UPDATES
- name: plugins-ai-assistant
packageName: wazuh-dashboard-plugins_wazuh-ai-assistant
repository: https://github.com/wazuh/wazuh-dashboard-plugins.git
outputNamePackage: NAME_PLUGIN_AI_ASSISTANT
- name: reporting
packageName: wazuh-dashboard-reporting
repository: https://github.com/wazuh/wazuh-dashboard-reporting.git
outputNamePackage: NAME_PLUGIN_REPORTING
- name: security-analytics
packageName: wazuh-dashboard-security-analytics
repository: https://github.com/wazuh/wazuh-dashboard-security-analytics.git
outputNamePackage: NAME_PLUGIN_SECURITY_ANALYTICS
- name: alerting
packageName: wazuh-dashboard-alerting
repository: https://github.com/wazuh/wazuh-dashboard-alerting.git
outputNamePackage: NAME_PLUGIN_ALERTING
- name: notifications
packageName: wazuh-dashboard-notifications
repository: https://github.com/wazuh/wazuh-dashboard-notifications.git
outputNamePackage: NAME_PLUGIN_NOTIFICATIONS
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version-file: '.nvmrc'
registry-url: 'https://registry.npmjs.org'
- name: Get VERSION and REVISION
id: get-version
run: |
VERSION=$(jq -r '.version' VERSION.json)
VERSION_OPENSEARCH=$(jq -r '.version' package.json)
# Workaround: AWS CodeBuild runners do not have yarn pre-installed, use jq instead
REVISION=$(jq -r '.wazuh.revision' package.json)
echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
echo "VERSION_OPENSEARCH=$VERSION_OPENSEARCH" >> $GITHUB_OUTPUT
echo "REVISION=$REVISION" >> $GITHUB_OUTPUT
- name: Get outputs of wazuh-dashboard-plugins
id: get-plugins
run: |
REPOSITORY=${{ matrix.plugin.repository }}
REFERENCE="${{ inputs.reference_plugins }}"
if [ -z "$REFERENCE" ]; then
echo "No plugin reference provided, using github.ref_name: ${{ github.ref_name }}"
REFERENCE="${{ github.ref_name }}"
PACKAGE_NAME=${{matrix.plugin.packageName}}_${{ steps.get-version.outputs.VERSION }}-${{ steps.get-version.outputs.REVISION }}_$(echo $REFERENCE | sed 's/\//-/g').zip
else
echo "Using reference: $REFERENCE"
PACKAGE_NAME=${{matrix.plugin.packageName}}_${{ steps.get-version.outputs.VERSION }}-${{ steps.get-version.outputs.REVISION }}_$(echo $REFERENCE | sed 's/\//-/g').zip
fi
echo "${{matrix.plugin.outputNamePackage}}=$PACKAGE_NAME" >> $GITHUB_OUTPUT
setup-variables:
runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
needs: [validate-job, get-outputs-plugins]
name: Setup variables
outputs:
VERSION: ${{ steps.setup-variables.outputs.VERSION }}
PREVIOUS: ${{ steps.setup-variables.outputs.PREVIOUS }}
REVISION: ${{ steps.setup-variables.outputs.REVISION }}
PRODUCTION: ${{ steps.setup-variables.outputs.PRODUCTION }}
WAZUH_DASHBOARD_SLIM: ${{ steps.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }}
ARCHITECTURE_FLAG: ${{ steps.setup-variables.outputs.ARCHITECTURE_FLAG }}
VERSION_OPENSEARCH: ${{ steps.setup-variables.outputs.VERSION_OPENSEARCH }}
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup variables
id: setup-variables
run: |
VERSION=${{ needs.get-outputs-plugins.outputs.VERSION }}
VERSION_OPENSEARCH=${{ needs.get-outputs-plugins.outputs.VERSION_OPENSEARCH }}
REVISION=${{ needs.get-outputs-plugins.outputs.REVISION }}
# Check the corresponding previous version to be used in the upgrade test
sudo curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && sudo chmod 644 /usr/share/keyrings/wazuh.gpg
sudo echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee -a /etc/apt/sources.list.d/wazuh.list
sudo apt-get update || sudo apt-get update
PREVIOUS=$(apt-cache madison wazuh-dashboard | grep -A 1 "$VERSION" | tail -1 | awk '{print $3}')
if [ -z "$PREVIOUS" ]; then
MAJOR_MINOR=$(echo "$VERSION" | cut -d '.' -f 1,2)$(echo ".")
PREVIOUS=$(apt-cache madison wazuh-dashboard | grep "$MAJOR_MINOR" | head -1 | awk '{print $3}')
fi
if [ -z "$PREVIOUS" ]; then
PREVIOUS=$(apt-cache madison wazuh-dashboard | head -1 | awk '{print $3}')
fi
if [ -z "$PREVIOUS" ]; then
echo "::warning No previous version::No previous version found for this architecture. Upgrade test will be skipped."
fi
if [ "${{ inputs.is_stage }}" = "true" ]; then
PRODUCTION=--production
else
PRODUCTION=""
fi
WAZUH_DASHBOARD_SLIM=wazuh-dashboard_${VERSION}-${REVISION}_${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'x64' || 'arm64' }}.tar.gz
if [[ "${{ inputs.architecture }}" == "x86_64" || "${{ inputs.architecture }}" == "amd64" ]]; then
ARCHITECTURE_FLAG=""
else
ARCHITECTURE_FLAG=--arm
fi
echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
echo "VERSION_OPENSEARCH=$VERSION_OPENSEARCH" >> $GITHUB_OUTPUT
echo "PREVIOUS=$PREVIOUS" >> $GITHUB_OUTPUT
echo "REVISION=$REVISION" >> $GITHUB_OUTPUT
echo "PRODUCTION=$PRODUCTION" >> $GITHUB_OUTPUT
echo "WAZUH_DASHBOARD_SLIM=$WAZUH_DASHBOARD_SLIM" >> $GITHUB_OUTPUT
echo "ARCHITECTURE_FLAG=$ARCHITECTURE_FLAG" >> $GITHUB_OUTPUT
build-dashboard:
needs: [validate-job, setup-variables]
name: Build dashboard
uses: ./.github/workflows/5_builderpackage_dashboard_core.yml
with:
CHECKOUT_TO: ${{ github.ref_name }}
ARCHITECTURE: ${{ inputs.architecture }}
execution_repository: wazuh-dashboard/5_builderpackage_dashboard
secrets: inherit
# Build plugins in parallel to the dashboard build
# If need to add more plugins from the wazuh-dashboard-plugins repo:
# - Add them to the matrix (name: <plugin-name>, packageName: <plugin-package-name>, repo: <owner/repo>, pathPlugin: <path-to-repo>, path: <path-to-plugin>)
# If need to add more forked plugins:
# - Add them to the matrix (name: <plugin-name>, packageName: <plugin-package-name>, repo: <owner/repo>)
build-plugins:
needs: [setup-variables, validate-job, get-outputs-plugins]
strategy:
fail-fast: true
matrix:
plugin:
- name: wazuh-dashboard-plugins_wazuh
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_WAZUH }}
repo: wazuh/wazuh-dashboard-plugins
pathPlugin: plugins/wazuh-dashboard-plugins
path: plugins/main
- name: wazuh-dashboard-plugins_wazuh-check-updates
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_CHECK_UPDATES }}
repo: wazuh/wazuh-dashboard-plugins
pathPlugin: plugins/wazuh-dashboard-plugins
path: plugins/wazuh-check-updates
- name: wazuh-dashboard-plugins_wazuh-core
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_CORE }}
repo: wazuh/wazuh-dashboard-plugins
pathPlugin: plugins/wazuh-dashboard-plugins
path: plugins/wazuh-core
- name: wazuh-dashboard-plugins_wazuh-ai-assistant
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_AI_ASSISTANT }}
repo: wazuh/wazuh-dashboard-plugins
pathPlugin: plugins/wazuh-dashboard-plugins
path: plugins/wazuh-ai-assistant
- name: reports-dashboards
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_REPORTING }}
repo: wazuh/wazuh-dashboard-reporting
- name: wazuh-security-dashboards-plugin
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_SECURITY }}
repo: wazuh/wazuh-security-dashboards-plugin
- name: security-analytics-dashboards
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_SECURITY_ANALYTICS }}
repo: wazuh/wazuh-dashboard-security-analytics
- name: wazuh-dashboard-alerting
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_ALERTING }}
repo: wazuh/wazuh-dashboard-alerting
- name: wazuh-dashboard-notifications
packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_NOTIFICATIONS }}
repo: wazuh/wazuh-dashboard-notifications
uses: ./.github/workflows/5_builderpackage_dashboard_plugins.yml
with:
reference_plugins: ${{ inputs.reference_plugins }}
version_opensearch: ${{ needs.setup-variables.outputs.VERSION_OPENSEARCH }}
name: ${{ matrix.plugin.name }}
packageName: ${{ matrix.plugin.packageName }}
path: ${{ matrix.plugin.path }}
repo: ${{ matrix.plugin.repo }}
pathPlugin: ${{ matrix.plugin.pathPlugin }}
execution_repository: wazuh-dashboard/5_builderpackage_dashboard
secrets: inherit
build-package:
needs: [setup-variables, get-outputs-plugins, build-dashboard, build-plugins]
runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
name: Generate packages
outputs:
PACKAGE_NAME: ${{ steps.get-package-name.outputs.PACKAGE_NAME }}
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Setup Node
uses: actions/setup-node@v4
with:
node-version-file: '.nvmrc'
registry-url: 'https://registry.npmjs.org'
- name: Set up AWS CLI
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: ${{ secrets.AWS_REGION }}
- name: Download artifacts from S3
run: |
folders=$(aws s3 ls "${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/" | grep PRE | awk '{print $2}' | tr -d '/')
for folder in $folders; do
echo "Downloading artifacts from S3 for folder: $folder"
if [[ "$folder" == wazuh-dashboard-plugins* ]]; then
aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/$folder ${{ github.workspace }}/artifacts/wazuh-dashboard-plugins --recursive
echo "Downloaded artifacts for wazuh-dashboard-plugins:"
ls -l ${{ github.workspace }}/artifacts/wazuh-dashboard-plugins
else
aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/$folder ${{ github.workspace }}/artifacts/$folder --recursive
echo "Downloaded artifacts for $folder:"
ls -l ${{ github.workspace }}/artifacts/$folder
fi
done
- name: Generate all commits SHAs
id: get-all-commit-shas
run: |
DASHBOARD_SHA=$(git rev-parse --short HEAD)
SECURITY_PLUGIN_SHA=$(jq -r '.commit_sha' ${{ github.workspace }}/artifacts/wazuh-security-dashboards-plugin/metadata.json)
MAIN_PLUGIN_SHA=$(jq -r '.commit_sha' ${{ github.workspace }}/artifacts/wazuh-dashboard-plugins/metadata.json)
REPORTING_PLUGIN_SHA=$(jq -r '.commit_sha' ${{ github.workspace }}/artifacts/reports-dashboards/metadata.json)
SECURITY_ANALYTICS_PLUGIN_SHA=$(jq -r '.commit_sha' ${{ github.workspace }}/artifacts/security-analytics-dashboards/metadata.json)
ALERTING_PLUGIN_SHA=$(jq -r '.commit_sha' ${{ github.workspace }}/artifacts/wazuh-dashboard-alerting/metadata.json)
NOTIFICATIONS_PLUGIN_SHA=$(jq -r '.commit_sha' ${{ github.workspace }}/artifacts/wazuh-dashboard-notifications/metadata.json)
ALL_SHAS="$DASHBOARD_SHA-$MAIN_PLUGIN_SHA-$SECURITY_PLUGIN_SHA-$REPORTING_PLUGIN_SHA-$SECURITY_ANALYTICS_PLUGIN_SHA-$ALERTING_PLUGIN_SHA-$NOTIFICATIONS_PLUGIN_SHA"
echo "DASHBOARD_SHA=$DASHBOARD_SHA"
echo "SECURITY_PLUGIN_SHA=$SECURITY_PLUGIN_SHA"
echo "MAIN_PLUGIN_SHA=$MAIN_PLUGIN_SHA"
echo "REPORTING_PLUGIN_SHA=$REPORTING_PLUGIN_SHA"
echo "SECURITY_ANALYTICS_PLUGIN_SHA=$SECURITY_ANALYTICS_PLUGIN_SHA"
echo "ALERTING_PLUGIN_SHA=$ALERTING_PLUGIN_SHA"
echo "NOTIFICATIONS_PLUGIN_SHA=$NOTIFICATIONS_PLUGIN_SHA"
echo "ALL_COMMIT_SHAS=$ALL_SHAS"
echo "ALL_COMMIT_SHAS=$ALL_SHAS" >> $GITHUB_OUTPUT
# Remove metadata.json from the plugin artifacts to avoid issues with the build script
echo "Removing metadata.json from plugin artifacts to avoid issues with the build script"
find ${{ github.workspace }}/artifacts -name "metadata.json" -type f -print -delete
# Workaround: AWS CodeBuild ARM runners do not have zip pre-installed
- name: Install zip
if: ${{ inputs.architecture == 'arm64' || inputs.architecture == 'aarch64' }}
run: sudo apt-get update && sudo apt-get install -y zip
- name: Zip plugins
run: |
zip -r -j ${{ github.workspace }}/artifacts/wazuh-package.zip ${{ github.workspace }}/artifacts/wazuh-dashboard-plugins
zip -r -j ${{ github.workspace }}/artifacts/security-package.zip ${{ github.workspace }}/artifacts/wazuh-security-dashboards-plugin
zip -r -j ${{ github.workspace }}/artifacts/report-package.zip ${{ github.workspace }}/artifacts/reports-dashboards
zip -r -j ${{ github.workspace }}/artifacts/dashboard-package.zip ${{ github.workspace }}/artifacts/dashboard/${{ needs.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }}
zip -r -j ${{ github.workspace }}/artifacts/security-analytics-package.zip ${{ github.workspace }}/artifacts/security-analytics-dashboards
zip -r -j ${{ github.workspace }}/artifacts/alerting-package.zip ${{ github.workspace }}/artifacts/wazuh-dashboard-alerting
zip -r -j ${{ github.workspace }}/artifacts/notifications-package.zip ${{ github.workspace }}/artifacts/wazuh-dashboard-notifications
# Workaround: AWS CodeBuild runners hit Docker Hub anonymous pull rate limits
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
# Workaround: AWS CodeBuild runners do not start the Docker daemon automatically
- name: Start Docker daemon
if: ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG == '--arm' }}
run: |
sudo nohup dockerd --storage-driver vfs > /var/log/dockerd.log 2>&1 &
timeout 60 bash -c 'until docker info &>/dev/null 2>&1; do sleep 1; done'
- name: Build package
run: |
cd ${{ github.workspace }}/dev-tools/build-packages
bash ./build-packages.sh \
-r ${{ inputs.revision }} ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG }} \
-a file://${{ github.workspace }}/artifacts/wazuh-package.zip \
-s file://${{ github.workspace }}/artifacts/security-package.zip \
-b file://${{ github.workspace }}/artifacts/dashboard-package.zip \
-rp file://${{ github.workspace }}/artifacts/report-package.zip \
-sa file://${{ github.workspace }}/artifacts/security-analytics-package.zip \
-al file://${{ github.workspace }}/artifacts/alerting-package.zip \
-no file://${{ github.workspace }}/artifacts/notifications-package.zip \
--commit-sha ${{steps.get-all-commit-shas.outputs.ALL_COMMIT_SHAS}} \
--${{ inputs.system }} ${{ needs.setup-variables.outputs.PRODUCTION }} --debug
- name: Get package name
id: get-package-name
run: |
VERSION=${{ needs.setup-variables.outputs.VERSION }}
if [ "${{ inputs.system }}" = "deb" ]; then
if [ "${{ inputs.is_stage }}" = "true" ]; then
PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}.deb
else
PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}_${{ steps.get-all-commit-shas.outputs.ALL_COMMIT_SHAS }}.deb
fi
else
if [ "${{ inputs.is_stage }}" = "true" ]; then
PACKAGE_NAME=wazuh-dashboard-${VERSION}-${{ inputs.revision }}.${{ inputs.architecture }}.rpm
else
PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}_${{ steps.get-all-commit-shas.outputs.ALL_COMMIT_SHAS }}.rpm
fi
fi
echo "PACKAGE_NAME=$PACKAGE_NAME" >> $GITHUB_OUTPUT
echo "PACKAGE_NAME_PATH=${{ github.workspace }}/dev-tools/build-packages/output/${PACKAGE_NAME}" >> $GITHUB_OUTPUT
- name: Upload package to S3
if: success()
run: |
aws s3 cp ${{steps.get-package-name.outputs.PACKAGE_NAME_PATH}} ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{steps.get-package-name.outputs.PACKAGE_NAME}}
if [ "${{ inputs.checksum }}" = "true" ]; then
aws s3 cp ${{steps.get-package-name.outputs.PACKAGE_NAME_PATH}}.sha512 ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{steps.get-package-name.outputs.PACKAGE_NAME}}.sha512
fi
test-package:
needs: [setup-variables, build-package]
runs-on: ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG == '--arm' && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
strategy:
fail-fast: false
name: Test package
permissions:
id-token: write
steps:
- name: Checkout code
uses: actions/checkout@v4
# Workaround: AWS CodeBuild runners hit Docker Hub anonymous pull rate limits
- name: Login to Docker Hub
uses: docker/login-action@v3
with:
username: ${{ secrets.DOCKERHUB_USERNAME }}
password: ${{ secrets.DOCKERHUB_TOKEN }}
# Workaround: AWS CodeBuild runners do not start the Docker daemon automatically
- name: Start Docker daemon
run: |
sudo nohup dockerd --storage-driver vfs > /var/log/dockerd.log 2>&1 &
timeout 60 bash -c 'until docker info &>/dev/null 2>&1; do sleep 1; done'
- name: Set up AWS CLI
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: ${{ secrets.AWS_REGION }}
- name: Download artifact from S3
run: |
aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.build-package.outputs.PACKAGE_NAME }} ${{ github.workspace }}/dev-tools/test-packages/${{ inputs.system }}/
- name: Test package integrity
run: |
cd ${{ github.workspace }}/dev-tools/test-packages
bash ./test-packages.sh \
-p ${{needs.build-package.outputs.PACKAGE_NAME}}
- name: Test package negative (5.x install blocked when 4.x present)
run: |
cd ${{ github.workspace }}/dev-tools/test-packages
bash ./test-packages.sh --block-4x-install \
-p ${{needs.build-package.outputs.PACKAGE_NAME}}
- name: Test package negative (5.x install blocked when remnants exist but version unknown)
run: |
cd ${{ github.workspace }}/dev-tools/test-packages
bash ./test-packages.sh --block-unknown-install \
-p ${{needs.build-package.outputs.PACKAGE_NAME}}
- name: Test package reinstall (5.x install over 5.x succeeds)
run: |
cd ${{ github.workspace }}/dev-tools/test-packages
bash ./test-packages.sh --allow-same-major-reinstall \
-p ${{needs.build-package.outputs.PACKAGE_NAME}}
- name: DEB - Test package install/uninstall
if: ${{ inputs.system == 'deb' }}
run: |
bash ${{ github.workspace }}/dev-tools/test-packages/run_in_systemd_container.sh \
"${{ github.workspace }}" \
"bash /test-packages/deb-test-install-uninstall.sh '${{needs.build-package.outputs.PACKAGE_NAME}}'"
- name: DEB - Test package upgrade
if: ${{ needs.setup-variables.outputs.PREVIOUS != '' && inputs.system == 'deb' }}
run: |
# Skip when previous and current major differ (pre-install guard blocks cross-major upgrades)
VERSION_MAJOR=$(echo "${{needs.setup-variables.outputs.VERSION}}" | cut -d. -f1)
PREVIOUS_MAJOR=$(echo "${{needs.setup-variables.outputs.PREVIOUS}}" | cut -d. -f1)
if [ "$VERSION_MAJOR" != "$PREVIOUS_MAJOR" ]; then
echo "Skipping upgrade test — different major ($PREVIOUS_MAJOR -> $VERSION_MAJOR)"
exit 0
fi
bash ${{ github.workspace }}/dev-tools/test-packages/run_in_systemd_container.sh \
"${{ github.workspace }}" \
"bash /test-packages/deb-test-upgrade.sh \
'${{needs.build-package.outputs.PACKAGE_NAME}}' \
'${{needs.setup-variables.outputs.PREVIOUS}}' \
'${{needs.setup-variables.outputs.VERSION}}'"
- name: DEB - Verify cross-major upgrade is blocked
if: ${{ needs.setup-variables.outputs.PREVIOUS != '' && inputs.system == 'deb' }}
run: |
bash ${{ github.workspace }}/dev-tools/test-packages/run_in_systemd_container.sh \
"${{ github.workspace }}" \
"bash /test-packages/deb-test-cross-major-blocked.sh \
'${{needs.build-package.outputs.PACKAGE_NAME}}' \
'${{needs.setup-variables.outputs.PREVIOUS}}'"
- name: RPM - Clone automation repo
if: ${{ inputs.system == 'rpm' }}
env:
username: 'wazuh-devel-xdrsiem-dashboard'
run: |
git clone https://${{ env.username }}:${{ secrets.DASHBOARD_BOT_SMOKE_TEST_TOKEN }}@github.com/wazuh/wazuh-automation.git
# Workaround: AWS CodeBuild ARM runners do not have pip3 or openssh-client pre-installed
if ! command -v pip3 &>/dev/null || ! command -v ssh &>/dev/null; then
sudo apt-get update
command -v pip3 &>/dev/null || sudo apt-get install -y python3-pip
command -v ssh &>/dev/null || sudo apt-get install -y openssh-client
fi
cd wazuh-automation
pip3 install --retries 3 -r deployability/deps/requirements.txt
- name: RPM - Configure AWS credentials
uses: aws-actions/configure-aws-credentials@v6
if: ${{ inputs.system == 'rpm' }}
with:
aws-region: 'us-east-1'
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
role-session-name: 'Dashboard-smoke-test'
- name: RPM - Setup environment
if: ${{ inputs.system == 'rpm' }}
run: |
if [ "${{ inputs.architecture }}" = "x86_64" ]; then
INSTANCE_NAME="centos_9_amd_large_aws"
COMPOSITE_NAME="centos_stream-9-amd64"
else
INSTANCE_NAME="centos_8_arm_large_aws"
COMPOSITE_NAME="centos_stream-8-arm64"
fi
python3 wazuh-automation/deployability/modules/allocation/main.py --action create --provider aws --size large --composite-name "${COMPOSITE_NAME}" --instance-name "${INSTANCE_NAME}" --inventory-output "/tmp/inventory.yaml" --track-output "/tmp/track.yaml" --label-team dashboard --label-termination-date 1d --label-creator github-actions --working-dir /tmp/dashboard --custom-tags "Product:wazuh-dashboard,Purpose:package-build,ExecutionId:${{ github.run_id }},Stage:ci"
ansible_host=$(grep 'ansible_host:' /tmp/inventory.yaml | sed 's/.*: *//')
ansible_port=$(grep 'ansible_port:' /tmp/inventory.yaml | sed 's/.*: *//')
ansible_user=$(grep 'ansible_user:' /tmp/inventory.yaml | sed 's/.*: *//')
ansible_ssh_private_key_file=$(grep 'ansible_ssh_private_key_file:' /tmp/inventory.yaml | sed 's/.*: *//')
ssh_command="ssh -o StrictHostKeyChecking=no -i $ansible_ssh_private_key_file -p $ansible_port $ansible_user@$ansible_host"
scp_command="scp -o StrictHostKeyChecking=no -i $ansible_ssh_private_key_file -P $ansible_port"
echo "ansible_host=$ansible_host" >> $GITHUB_OUTPUT
echo "ansible_port=$ansible_port" >> $GITHUB_OUTPUT
echo "ansible_user=$ansible_user" >> $GITHUB_OUTPUT
echo "ansible_ssh_private_key_file=$ansible_ssh_private_key_file" >> $GITHUB_OUTPUT
echo "ssh_command=$ssh_command" >> $GITHUB_OUTPUT
echo "scp_command=$scp_command" >> $GITHUB_OUTPUT
id: setup_rpm_env
- name: RPM - Test package install/uninstall
if: ${{ inputs.system == 'rpm' }}
run: |
# echo 'Installing package...' is necessary to init the ssh connection prior to running scp
${{ steps.setup_rpm_env.outputs.ssh_command }} "echo 'Installing package...'"
${{ steps.setup_rpm_env.outputs.scp_command }} ${{ github.workspace }}/dev-tools/test-packages/rpm/${{needs.build-package.outputs.PACKAGE_NAME}} ${{ steps.setup_rpm_env.outputs.ansible_user }}@${{ steps.setup_rpm_env.outputs.ansible_host }}:/home/${{ steps.setup_rpm_env.outputs.ansible_user }}/
${{ steps.setup_rpm_env.outputs.ssh_command }} "sudo rpm -i ./${{needs.build-package.outputs.PACKAGE_NAME}}; \
if rpm -q wazuh-dashboard &>/dev/null; then \
echo 'Package installed'; \
else \
echo 'Package not installed'; \
exit 1; \
fi; \
sudo systemctl daemon-reload;\
sudo systemctl enable wazuh-dashboard;\
sudo systemctl start wazuh-dashboard;\
if sudo systemctl status wazuh-dashboard | grep -q 'active (running)'; then \
echo 'Service running'; \
else \
echo 'Service not running' ;\
exit 1 ;\
fi; \
if sudo runuser wazuh-dashboard --shell='/bin/bash' \
--command='/usr/share/wazuh-dashboard/bin/opensearch-dashboards-keystore list' \
| grep -q '^wazuh_ai_assistant.encryptionKey$'; then \
echo 'AI assistant encryption key present in keystore'; \
else \
echo 'AI assistant encryption key missing from keystore'; \
exit 1; \
fi; \
sudo yum remove wazuh-dashboard -y ;\
sudo rm -rf /var/lib/wazuh-dashboard/ ; \
sudo rm -rf /usr/share/wazuh-dashboard/ ; \
sudo rm -rf /etc/wazuh-dashboard/; \
if rpm -q wazuh-dashboard &>/dev/null; then \
echo 'Package not uninstalled'; \
exit 1; \
else \
echo 'Package uninstalled'; \
fi
"
- name: RPM - Test package upgrade
if: ${{ needs.setup-variables.outputs.PREVIOUS != '' && inputs.system == 'rpm' }}
run: |
# Skip when previous and current major differ (pre-install guard blocks cross-major upgrades)
VERSION_MAJOR=$(echo "${{needs.setup-variables.outputs.VERSION}}" | cut -d. -f1)
PREVIOUS_MAJOR=$(echo "${{needs.setup-variables.outputs.PREVIOUS}}" | cut -d. -f1)
if [ "$VERSION_MAJOR" != "$PREVIOUS_MAJOR" ]; then
echo "Skipping upgrade test — different major ($PREVIOUS_MAJOR -> $VERSION_MAJOR)"
exit 0
fi
${{ steps.setup_rpm_env.outputs.ssh_command }} "sudo yum install libcap; \
sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH; \
sudo echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1' | sudo tee /etc/yum.repos.d/wazuh.repo; \
sudo yum install -y wazuh-dashboard-${{needs.setup-variables.outputs.PREVIOUS}}; \
sudo systemctl daemon-reload; \
sudo systemctl enable wazuh-dashboard; \
sudo systemctl start wazuh-dashboard; \
sudo yum install -y ${{needs.build-package.outputs.PACKAGE_NAME}}; \
sudo systemctl restart wazuh-dashboard; \
if rpm -q wazuh-dashboard | grep -q '${{needs.setup-variables.outputs.VERSION}}'; then \
echo 'Package upgraded'; \
else \
echo 'Package not upgraded'; \
exit 1; \
fi; \
if sudo systemctl status wazuh-dashboard | grep -q 'active (running)'; then \
echo 'Service running'; \
else \
echo 'Service not running'; \
exit 1; \
fi
"
- name: RPM - Verify cross-major upgrade is blocked
if: ${{ needs.setup-variables.outputs.PREVIOUS != '' && inputs.system == 'rpm' }}
run: |
${{ steps.setup_rpm_env.outputs.ssh_command }} "sudo yum install libcap; \
sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH; \
sudo echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1' | sudo tee /etc/yum.repos.d/wazuh.repo; \
sudo yum install -y wazuh-dashboard-${{needs.setup-variables.outputs.PREVIOUS}}; \
sudo systemctl daemon-reload; \
sudo systemctl enable wazuh-dashboard; \
sudo systemctl start wazuh-dashboard; \
if sudo systemctl status wazuh-dashboard | grep -q 'active (running)'; then \
echo 'Service running'; \
else \
echo 'ERROR: Service not running'; \
exit 1; \
fi"
set +e
OUTPUT=$(${{ steps.setup_rpm_env.outputs.ssh_command }} "sudo yum install -y ${{needs.build-package.outputs.PACKAGE_NAME}} 2>&1")
EXIT_CODE=$?
set -e
if [ "$EXIT_CODE" -eq 0 ]; then
echo "ERROR: Installation should have been blocked but succeeded"
exit 1
fi
if echo "$OUTPUT" | grep -F -q "ERROR: Upgrade from Wazuh dashboard versions prior to 5.x is not supported."; then
echo "TEST: Cross-major upgrade correctly blocked"
echo "$OUTPUT"
else
echo "ERROR: Expected block message not found"
echo "$OUTPUT"
exit 1
fi
- name: Destroy Allocator Machine
#DO NOT DELETE. This ensures that the generated instance is destroyed even if the job fails.
if: ${{ always() }}
########################################
run: |
if [ "${{ inputs.system }}" = "rpm" ]; then
echo "Destroying Allocator Machine"
cd wazuh-automation/deployability
python3 modules/allocation/main.py --action delete --track-output "/tmp/track.yaml"
fi
upload-package:
needs: [build-package, test-package]
runs-on: ${{ inputs.architecture == 'arm64' && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
name: Upload package
steps:
- name: Set up AWS CLI
uses: aws-actions/configure-aws-credentials@v6
with:
role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
aws-region: ${{ secrets.AWS_REGION }}
- name: Download artifacts from S3
run: |
aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.build-package.outputs.PACKAGE_NAME }} ./
if [ "${{ inputs.checksum }}" = "true" ]; then
aws s3 cp ${{ env.CI_DEV_INTERNAL_BUCKET }}/${{ env.EXECUTION_REPOSITORY }}/${{ github.run_id }}/${{ needs.build-package.outputs.PACKAGE_NAME }}.sha512 ./
fi
- name: Upload package
run: |
echo "Uploading package"
aws s3 cp ./${{needs.build-package.outputs.PACKAGE_NAME}} s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/
s3uri="s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/${{needs.build-package.outputs.PACKAGE_NAME}}"
echo "S3 URI: ${s3uri}"
- name: Upload SHA512
if: ${{ inputs.checksum }}
run: |
echo "Uploading checksum"
aws s3 cp ./${{needs.build-package.outputs.PACKAGE_NAME}}.sha512 s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/
s3uri="s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/${{needs.build-package.outputs.PACKAGE_NAME}}.sha512"
echo "S3 sha512 URI: ${s3uri}"