wazuh · asteriscos · Jun 22, 2026 · Jun 18, 2026 · Jun 18, 2026 · Jun 18, 2026
diff --git a/.github/workflows/4_builderpackage_dashboard.yml b/.github/workflows/4_builderpackage_dashboard.yml
@@ -110,7 +110,7 @@ permissions:
 
 jobs:
   setup-variables:
-    runs-on: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     name: Setup variables
     outputs:
       CURRENT_DIR: ${{ steps.setup-variables.outputs.CURRENT_DIR }}
@@ -226,7 +226,7 @@ jobs:
           echo "ARCHITECTURE_FLAG=$ARCHITECTURE_FLAG" >> $GITHUB_OUTPUT
 
   validate-job:
-    runs-on: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: setup-variables
     name: Validate inputs
     steps:
@@ -276,7 +276,7 @@ jobs:
 
   build-package:
     needs: [setup-variables, build-main-plugins, build-base, build-security-plugin]
-    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && 'wz-linux-arm64' || 'wz-linux-amd64' }}
+    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
     name: Generate packages
     steps:
       - name: Checkout code
@@ -353,7 +353,7 @@ jobs:
 
   test-package:
     needs: [setup-variables, build-package]
-    runs-on: ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG == '--arm' && 'wz-linux-arm64' || 'wz-linux-amd64' }}
+    runs-on: ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG == '--arm' && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
     strategy:
       fail-fast: false
     name: Test package
@@ -545,7 +545,7 @@ jobs:
 
   upload-package:
     needs: [setup-variables, test-package]
-    runs-on: ${{ inputs.architecture == 'arm64' && 'wz-linux-arm64' || 'wz-linux-amd64' }}
+    runs-on: ${{ inputs.architecture == 'arm64' && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
     name: Upload package
     steps:
       - name: Set up AWS CLI

diff --git a/.github/workflows/4_builderpackage_dashboard_core.yml b/.github/workflows/4_builderpackage_dashboard_core.yml
@@ -38,7 +38,7 @@ on:
 
 jobs:
   build:
-    runs-on: ${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'wz-linux-amd64' || 'wz-linux-arm64' }}
+    runs-on: ${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) }}
     name: Build
     defaults:
       run:

diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml
@@ -36,7 +36,7 @@ on:
 jobs:
   bump:
     name: Repository bumper
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
       pull-requests: write

diff --git a/.github/workflows/5_builderpackage_dashboard.yml b/.github/workflows/5_builderpackage_dashboard.yml
diff --git a/.github/workflows/5_builderpackage_dashboard_core.yml b/.github/workflows/5_builderpackage_dashboard_core.yml
@@ -38,7 +38,7 @@ on:
 
 jobs:
   build:
-    runs-on: ${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'wz-linux-amd64' || 'wz-linux-arm64' }}
+    runs-on: ${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) }}
     name: Build
     defaults:
       run:
@@ -88,14 +88,23 @@ jobs:
         run: |
           echo "ARTIFACT_BUILD_NAME=wazuh-dashboard_${{ env.WZD_VERSION }}-${{ env.WZD_REVISION }}_${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'x64' || 'arm64' }}.${{ matrix.DISTRIBUTION }}" >> $GITHUB_ENV
 
+      # Workaround: AWS CodeBuild runners execute as root; OpenSearch Dashboards refuses to run as root
+      - name: Create non-root build user
+        run: |
+          useradd -m builduser
+          chown -R builduser:builduser .
+
       - name: Run bootstrap
-        run: yarn osd bootstrap || yarn osd bootstrap
+        run: |
+          chown -R builduser:builduser "$YARN_CACHE_LOCATION" 2>/dev/null || true
+          sudo -u builduser -H env PATH="$PATH" yarn osd bootstrap || \
+          sudo -u builduser -H env PATH="$PATH" yarn osd bootstrap
 
       - name: Build
-        run: yarn build-platform --${{(inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'linux' || 'linux-arm'}} --skip-os-packages --release
+        run: sudo -u builduser -H env PATH="$PATH" yarn build-platform --${{(inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'linux' || 'linux-arm'}} --skip-os-packages --release
 
       - name: Rename artifact
-        run: mv /home/runner/work/wazuh-dashboard/wazuh-dashboard/artifacts/target/opensearch-dashboards-${{ env.VERSION }}-linux-${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'x64' || 'arm64' }}.${{ matrix.DISTRIBUTION }} /home/runner/work/wazuh-dashboard/wazuh-dashboard/artifacts/target/${{ env.ARTIFACT_BUILD_NAME }}
+        run: mv target/opensearch-dashboards-${{ env.VERSION }}-linux-${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'x64' || 'arm64' }}.${{ matrix.DISTRIBUTION }} target/${{ env.ARTIFACT_BUILD_NAME }}
 
       - uses: actions/upload-artifact@v4
         if: success()

diff --git a/.github/workflows/5_builderpackage_dashboard_plugins.yml b/.github/workflows/5_builderpackage_dashboard_plugins.yml
@@ -35,7 +35,7 @@ on:
 jobs:
   build-plugins:
     name: Build Plugin ${{ inputs.name }}
-    runs-on: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     env:
       PLUGIN_REF: ${{ inputs.reference_plugins }}
     steps:
@@ -113,18 +113,27 @@ jobs:
           mv ${{inputs.pathPlugin}}/${{ inputs.path }} plugins/${{ inputs.name }}
           rm -rf ${{inputs.pathPlugin}}
 
+      # Workaround: AWS CodeBuild runners execute as root; OpenSearch Dashboards refuses to run as root
+      - name: Create non-root build user
+        run: |
+          useradd -m builduser
+          chown -R builduser:builduser .
+
       - name: Bootstrap with Plugins
         env:
           GIT_REF: ${{ env.PLUGIN_REF }}
-        run: yarn osd bootstrap --single-version=loose || yarn osd bootstrap --single-version=loose
+        run: |
+          chown -R builduser:builduser "$YARN_CACHE_LOCATION" 2>/dev/null || true
+          sudo -u builduser -H env PATH="$PATH" GIT_REF="$GIT_REF" yarn osd bootstrap --single-version=loose || \
+          sudo -u builduser -H env PATH="$PATH" GIT_REF="$GIT_REF" yarn osd bootstrap --single-version=loose
 
       - name: Build Plugin
         working-directory: plugins/${{ inputs.name }}
         env:
           GIT_REF: ${{ env.PLUGIN_REF }}
         run: |
           set -o pipefail
-          OPENSEARCH_DASHBOARDS_VERSION=${{ inputs.version_opensearch }} yarn build 2>&1 | tee build.log
+          sudo -u builduser -H env PATH="$PATH" GIT_REF="$GIT_REF" OPENSEARCH_DASHBOARDS_VERSION="${{ inputs.version_opensearch }}" yarn build 2>&1 | tee build.log
 
       - name: Build metadata
         if: success()

diff --git a/.github/workflows/5_builderpackage_dev_docker_image.yml b/.github/workflows/5_builderpackage_dev_docker_image.yml
@@ -38,7 +38,7 @@ on:
 
 jobs:
   extract-versions:
-    runs-on: ubuntu-24.04
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     outputs:
       opensearch_version: ${{ steps.versions.outputs.opensearch_version }}
       tag: ${{ steps.versions.outputs.tag }}
@@ -95,10 +95,10 @@ jobs:
       matrix:
         include:
           - platform: linux/amd64
-            runner: ubuntu-24.04
+            runner: ${{ format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
             arch: amd64
           - platform: linux/arm64
-            runner: ubuntu-24.04-arm
+            runner: ${{ format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) }}
             arch: arm64
     steps:
       - name: Checkout code
@@ -153,7 +153,7 @@ jobs:
             --push
 
   create-manifest:
-    runs-on: ubuntu-24.04
+    runs-on: ${{ format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
     needs: [extract-versions, build]
 
     steps:

diff --git a/.github/workflows/5_bumper_repository.yml b/.github/workflows/5_bumper_repository.yml
@@ -50,7 +50,7 @@ on:
 jobs:
   bump:
     name: Repository bumper
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
       pull-requests: write

diff --git a/.github/workflows/6_builderpackage_dashboard.yml b/.github/workflows/6_builderpackage_dashboard.yml
@@ -127,7 +127,7 @@ jobs:
     #   - Final package name based on system, architecture and stage.
     #   - Architecture flags.
     #   - Version, revision and commit SHA information.
-    runs-on: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     name: Setup variables
     outputs:
       CURRENT_DIR: ${{ steps.setup-variables.outputs.CURRENT_DIR }}
@@ -235,7 +235,7 @@ jobs:
   validate-job:
     # 1. Validates valid combinations of system and architecture.
     # 2. Sets up AWS CLI for future uploads if needed.
-    runs-on: wz-linux-amd64
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     needs: setup-variables
     name: Validate job
     steps:
@@ -296,7 +296,7 @@ jobs:
     # 7. Finally, upload the resulting package as an artifact.
     needs:
       [setup-variables, build-main-plugins, build-base, build-security-plugin, build-report-plugin]
-    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && 'wz-linux-arm64' || 'wz-linux-amd64' }}
+    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) || format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
     name: Generate packages
     steps:
       - name: Checkout code

diff --git a/.github/workflows/6_builderpackage_dashboard_core.yml b/.github/workflows/6_builderpackage_dashboard_core.yml
@@ -38,7 +38,7 @@ on:
 
 jobs:
   build:
-    runs-on: ${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'wz-linux-amd64' || 'wz-linux-arm64' }}
+    runs-on: ${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}' || 'codebuild-github-actions-codebuild-runner-dashboard-arm-${{ github.run_id }}-${{ github.run_attempt }}' }}
     name: Build
     defaults:
       run:

diff --git a/.github/workflows/6_bumper_repository.yml b/.github/workflows/6_bumper_repository.yml
@@ -36,7 +36,7 @@ on:
 jobs:
   bump:
     name: Repository bumper
-    runs-on: ubuntu-22.04
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
     permissions:
       contents: write
       pull-requests: write

diff --git a/.github/workflows/build_base.yml b/.github/workflows/build_base.yml
@@ -30,7 +30,7 @@ on:
 
 jobs:
   build:
-    runs-on: ${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'ubuntu-latest' || 'wz-linux-arm64' }}
+    runs-on: ${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && format('github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) || format('github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) }}
     name: Build
     defaults:
       run:

diff --git a/.github/workflows/build_wazuh_dashboard_with_plugins.yml b/.github/workflows/build_wazuh_dashboard_with_plugins.yml
@@ -254,7 +254,7 @@ jobs:
 
   build-package:
     needs: [setup-variables, build-main-plugins, build-base, build-security-plugin]
-    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && 'wz-linux-arm64' || 'ubuntu-22.04' }}
+    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && format('github-actions-codebuild-runner-dashboard-arm-${{ github.run_id }}-${{ github.run_attempt }}') || format('github-actions-codebuild-runner-dashboard-amd64-${{ github.run_id }}-${{ github.run_attempt }}') }}
     name: Generate packages
     steps:
       - name: Checkout code
@@ -336,7 +336,7 @@ jobs:
 
   test-package:
     needs: [setup-variables, build-package]
-    runs-on: ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG == '--arm' && 'ubuntu-24.04-arm' || 'ubuntu-24.04' }}
+    runs-on: ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG == '--arm' && format('github-actions-codebuild-runner-dashboard-arm-${{ github.run_id }}-${{ github.run_attempt }}') || format('github-actions-codebuild-runner-dashboard-amd64-${{ github.run_id }}-${{ github.run_attempt }}') }}
     strategy:
       fail-fast: false
     name: Test package

diff --git a/dev-tools/test-packages/builder/systemd-test.Dockerfile b/dev-tools/test-packages/builder/systemd-test.Dockerfile
@@ -0,0 +1,29 @@
+# Minimal systemd-enabled Ubuntu image for DEB package tests, booted with
+# /sbin/init. Built from AWS ECR Public to avoid Docker Hub unauthenticated
+# pull-rate limits on CodeBuild runners.
+FROM public.ecr.aws/ubuntu/ubuntu:jammy
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV container=docker
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        systemd \
+        systemd-sysv \
+        dbus \
+        curl \
+        ca-certificates \
+        gnupg \
+        apt-transport-https \
+        libcap2-bin && \
+    apt-get clean && \
+    rm -rf /var/lib/apt/lists/* && \
+    # Drop units that are pointless (and slow/noisy) inside a container.
+    rm -f /lib/systemd/system/systemd-update-utc* \
+          /lib/systemd/system/systemd-tmpfiles-setup* \
+          /lib/systemd/system/sysinit.target.wants/systemd-firstboot.service \
+          /lib/systemd/system/multi-user.target.wants/systemd-update-utmp-runlevel.service
+
+STOPSIGNAL SIGRTMIN+3
+
+CMD ["/sbin/init"]
diff --git a/dev-tools/test-packages/deb-test-cross-major-blocked.sh b/dev-tools/test-packages/deb-test-cross-major-blocked.sh
@@ -0,0 +1,50 @@
+#!/bin/bash
+# Runs inside the systemd container started by run_in_systemd_container.sh.
+# Tests that installing a 5.x package over a running 4.x installation is blocked.
+#
+# Usage: deb-test-cross-major-blocked.sh <package-name> <previous-4x-version>
+
+set -euo pipefail
+
+PACKAGE_NAME="$1"
+PREVIOUS="$2"
+
+apt-get update
+apt-get install -y debhelper tar curl libcap2-bin gnupg apt-transport-https
+curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH \
+  | gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
+chmod 644 /usr/share/keyrings/wazuh.gpg
+echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" \
+  | tee -a /etc/apt/sources.list.d/wazuh.list
+apt-get update
+apt-get -y install "wazuh-dashboard=${PREVIOUS}"
+
+systemctl daemon-reload
+systemctl enable wazuh-dashboard
+systemctl start wazuh-dashboard
+if systemctl status wazuh-dashboard | grep -q "active (running)"; then
+  echo "Service running"
+else
+  echo "ERROR: Service not running"
+  exit 1
+fi
+
+# Attempt 5.x upgrade — MUST fail
+set +e
+OUTPUT=$(dpkg -i "/test-packages/${PACKAGE_NAME}" 2>&1)
+EXIT_CODE=$?
+set -e
+
+if [ "$EXIT_CODE" -eq 0 ]; then
+  echo "ERROR: Installation should have been blocked but succeeded"
+  exit 1
+fi
+
+if echo "$OUTPUT" | grep -F -q "ERROR: Upgrade from Wazuh dashboard versions prior to 5.x is not supported."; then
+  echo "TEST: Cross-major upgrade correctly blocked"
+  echo "$OUTPUT"
+else
+  echo "ERROR: Expected block message not found"
+  echo "$OUTPUT"
+  exit 1
+fi
diff --git a/dev-tools/test-packages/deb-test-install-uninstall.sh b/dev-tools/test-packages/deb-test-install-uninstall.sh
@@ -0,0 +1,35 @@
+#!/bin/bash
+# Runs inside the systemd container started by run_in_systemd_container.sh.
+# Tests that the package installs, the service starts, and the package uninstalls cleanly.
+#
+# Usage: deb-test-install-uninstall.sh <package-name>
+
+set -euo pipefail
+
+PACKAGE_NAME="$1"
+
+dpkg -i "/test-packages/${PACKAGE_NAME}"
+if dpkg-query -W -f='${Status}' wazuh-dashboard 2>/dev/null | grep -q "install ok installed"; then
+  echo "Package installed"
+else
+  echo "Package not installed"
+  exit 1
+fi
+
+systemctl daemon-reload
+systemctl enable wazuh-dashboard
+systemctl start wazuh-dashboard
+if systemctl status wazuh-dashboard | grep -q "active (running)"; then
+  echo "Service running"
+else
+  echo "Service not running"
+  exit 1
+fi
+
+apt-get remove --purge wazuh-dashboard -y
+if dpkg-query -W -f='${Status}' wazuh-dashboard 2>/dev/null | grep -q "install ok installed"; then
+  echo "Package not uninstalled"
+  exit 1
+else
+  echo "Package uninstalled"
+fi