Merge 5.0.1 into main

.github/workflows/4_builderpackage_dev_docker_image.yml

@@ -0,0 +1,148 @@
+# This workflow automates the build and push of Wazuh dashboard development
+# Docker images for different architectures (amd64 and arm64).
+#
+# This workflow:
+# - Builds multi-architecture Docker images for Wazuh dashboard development.
+# - Pushes individual architecture images to Quay.io registry.
+# - Creates and pushes a multi-arch manifest combining both architectures.
+# - Automatically extracts the Node.js version from .nvmrc and the OpenSearch
+#   Dashboards version from package.json.
+# - Uses the branch the workflow runs on for wazuh-dashboard, and a single
+#   optional input for the branch/tag of the plugin repositories
+#   (wazuh-security-dashboards-plugin and wazuh-dashboard-plugins), which
+#   defaults to that same branch when not provided.
+
+name: (4.14.x) Build and Push Dev Image
+
+on:
+  workflow_dispatch:
+    inputs:
+      plugins_branch:
+        description: 'Branch/tag/commit of wazuh-security-dashboards-plugin and wazuh-dashboard-plugins (defaults to the branch this workflow runs on)'
+        required: false
+        default: ''
+        type: string
+      tag:
+        description: 'Tag for the Docker image'
+        required: false
+        default: ''
+        type: string
+
+jobs:
+  extract-versions:
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    outputs:
+      node_version: ${{ steps.versions.outputs.node_version }}
+      opensearch_version: ${{ steps.versions.outputs.opensearch_version }}
+      tag: ${{ steps.versions.outputs.tag }}
+      wazuh_branch: ${{ steps.versions.outputs.wazuh_branch }}
+      plugins_branch: ${{ steps.versions.outputs.plugins_branch }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Extract versions from repository
+        id: versions
+        run: |
+          OPENSEARCH_VERSION=$(node -p "require('./package.json').version")
+          NODE_VERSION=$(cat .nvmrc)
+
+          WAZUH_BRANCH="${{ github.ref_name }}"
+          PLUGINS_BRANCH="${{ inputs.plugins_branch || github.ref_name }}"
+
+          TAG="${{ inputs.tag }}"
+          if [ -z "$TAG" ]; then
+            TAG="$OPENSEARCH_VERSION"
+          fi
+
+          echo "node_version=${NODE_VERSION}" >> $GITHUB_OUTPUT
+          echo "opensearch_version=${OPENSEARCH_VERSION}" >> $GITHUB_OUTPUT
+          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+          echo "wazuh_branch=${WAZUH_BRANCH}" >> $GITHUB_OUTPUT
+          echo "plugins_branch=${PLUGINS_BRANCH}" >> $GITHUB_OUTPUT
+
+          echo "📦 OpenSearch Dashboards Version: ${OPENSEARCH_VERSION}"
+          echo "🏷️  Tag: ${TAG}"
+          echo "📟 Node Version: ${NODE_VERSION}"
+          echo "🌿 Wazuh Dashboard Branch: ${WAZUH_BRANCH}"
+          echo "🌿 Plugins Branch: ${PLUGINS_BRANCH}"
+
+  build:
+    runs-on: ${{ matrix.runner }}
+    needs: [extract-versions]
+    strategy:
+      matrix:
+        include:
+          - platform: linux/amd64
+            runner: ${{ format('codebuild-github-actions-codebuild-runner-dashboard-amd-{0}-{1}', github.run_id, github.run_attempt) }}
+            arch: amd64
+          - platform: linux/arm64
+            runner: ${{ format('codebuild-github-actions-codebuild-runner-dashboard-arm-{0}-{1}', github.run_id, github.run_attempt) }}
+            arch: arm64
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      # Workaround: AWS CodeBuild runners do not start the Docker daemon automatically
+      - name: Start Docker daemon
+        run: |
+          sudo nohup dockerd --storage-driver vfs > /var/log/dockerd.log 2>&1 &
+          timeout 60 bash -c 'until docker info &>/dev/null 2>&1; do sleep 1; done'
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver-opts: |
+            network=host
+
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Build ${{ matrix.arch }} image
+        run: |
+          chmod +x ./dev-tools/build-dev-image/build-multiarch.sh
+          cd ./dev-tools/build-dev-image
+
+          ./build-multiarch.sh \
+            --node-version "${{ needs.extract-versions.outputs.node_version }}" \
+            --wazuh-branch "${{ needs.extract-versions.outputs.wazuh_branch }}" \
+            --security-branch "${{ needs.extract-versions.outputs.plugins_branch }}" \
+            --plugins-branch "${{ needs.extract-versions.outputs.plugins_branch }}" \
+            --tag "${{ needs.extract-versions.outputs.tag }}-${{ matrix.arch }}" \
+            --platform "${{ matrix.platform }}" \
+            --push
+
+  create-manifest:
+    runs-on: codebuild-github-actions-codebuild-runner-dashboard-amd-${{ github.run_id }}-${{ github.run_attempt }}
+    needs: [extract-versions, build]
+    steps:
+      # Workaround: AWS CodeBuild runners do not start the Docker daemon automatically
+      - name: Start Docker daemon
+        run: |
+          sudo nohup dockerd --storage-driver vfs > /var/log/dockerd.log 2>&1 &
+          timeout 60 bash -c 'until docker info &>/dev/null 2>&1; do sleep 1; done'
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Quay.io
+        uses: docker/login-action@v3
+        with:
+          registry: quay.io
+          username: ${{ secrets.QUAY_USERNAME }}
+          password: ${{ secrets.QUAY_TOKEN }}
+
+      - name: Create and push multi-arch manifest
+        run: |
+          TAG="${{ needs.extract-versions.outputs.tag }}"
+
+          docker buildx imagetools create -t quay.io/wazuh/osd-dev:${TAG} \
+            quay.io/wazuh/osd-dev:${TAG}-amd64 \
+            quay.io/wazuh/osd-dev:${TAG}-arm64
+
+          echo "✅ Multi-arch manifest created and pushed!"
+          echo "📦 Image available at: quay.io/wazuh/osd-dev:${TAG}"

dev-tools/build-packages/deb/debian/changelog

@@ -14,7 +14,7 @@ wazuh-dashboard (5.0.0-RELEASE) stable; urgency=low
 
   * More info: https://documentation.wazuh.com/current/release-notes/release-5-0-0.html
 
- -- Wazuh, Inc <info@wazuh.com>  Wed, 09 Sep 2026 12:00:00 +0000
+ -- Wazuh, Inc <info@wazuh.com>  Wed, 23 Sep 2026 12:00:00 +0000
 
 wazuh-dashboard (4.14.9-RELEASE) stable; urgency=low
 

dev-tools/build-packages/rpm/wazuh-dashboard.spec

@@ -481,12 +481,12 @@ rm -fr %{buildroot}
 %changelog
 * Wed Sep 30 2026 support <info@wazuh.com> - 5.1.0
 - More info: https://documentation.wazuh.com/current/release-notes/release-5-1-0.html
+* Wed Sep 23 2026 support <info@wazuh.com> - 5.0.0
+- More info: https://documentation.wazuh.com/current/release-notes/release-5-0-0.html
 * Wed Sep 16 2026 support <info@wazuh.com> - 4.14.9
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-14-9.html
 * Wed Sep 09 2026 support <info@wazuh.com> - 5.0.1
 - More info: https://documentation.wazuh.com/current/release-notes/release-5-0-1.html
-* Wed Sep 09 2026 support <info@wazuh.com> - 5.0.0
-- More info: https://documentation.wazuh.com/current/release-notes/release-5-0-0.html
 * Thu Sep 03 2026 support <info@wazuh.com> - 4.10.5
 - More info: https://documentation.wazuh.com/current/release-notes/release-4-10-5.html
 * Wed Sep 02 2026 support <info@wazuh.com> - 4.14.8

tools/repository_bumper.sh

@@ -532,21 +532,37 @@ update_build_docker_dev_multiarch_readme() {
 # Function to convert date from yyyy-mm-dd to RPM format (e.g., "Thu Sep 04 2025")
 convert_date_to_rpm_format() {
   local input_date="$1"
-  # Use date command to convert and format with English locale
-  LC_ALL=C date -d "$input_date" "+%a %b %d %Y" 2>/dev/null || {
-    log "ERROR: Invalid date format: $input_date"
-    exit 1
-  }
+  # Use date command to convert and format with English locale (GNU date on Linux, BSD date on macOS)
+  if [[ "$OSTYPE" == "darwin"* ]]; then
+    LC_ALL=C date -j -f "%Y-%m-%d" "$input_date" "+%a %b %d %Y" 2>/dev/null && return 0
+  else
+    LC_ALL=C date -d "$input_date" "+%a %b %d %Y" 2>/dev/null && return 0
+  fi
+  log "ERROR: Invalid date format: $input_date"
+  return 1
+}
+
+# Function to convert an RPM changelog date (e.g. "Thu Sep 10 2026") to epoch seconds, for ordering comparisons
+rpm_date_to_epoch() {
+  local rpm_date="$1"
+  if [[ "$OSTYPE" == "darwin"* ]]; then
+    LC_ALL=C date -j -f "%a %b %d %Y" "$rpm_date" "+%s" 2>/dev/null
+  else
+    LC_ALL=C date -d "$rpm_date" "+%s" 2>/dev/null
+  fi
 }
 
 # Function to convert date from yyyy-mm-dd to Debian RFC 2822 format (e.g., "Thu, 04 Sep 2025 12:00:00 +0000")
 convert_date_to_deb_format() {
   local input_date="$1"
-  # Use date command to convert and format with English locale
-  LC_ALL=C date -d "$input_date" "+%a, %d %b %Y 12:00:00 +0000" 2>/dev/null || {
-    log "ERROR: Invalid date format: $input_date"
-    exit 1
-  }
+  # Use date command to convert and format with English locale (GNU date on Linux, BSD date on macOS)
+  if [[ "$OSTYPE" == "darwin"* ]]; then
+    LC_ALL=C date -j -f "%Y-%m-%d" "$input_date" "+%a, %d %b %Y 12:00:00 +0000" 2>/dev/null && return 0
+  else
+    LC_ALL=C date -d "$input_date" "+%a, %d %b %Y 12:00:00 +0000" 2>/dev/null && return 0
+  fi
+  log "ERROR: Invalid date format: $input_date"
+  return 1
 }
 
 # Function to update RPM changelog
@@ -564,24 +580,50 @@ update_rpm_changelog() {
 
   log "Updating RPM changelog..."
 
-  local rpm_date=$(convert_date_to_rpm_format "$DATE")
+  local rpm_date
+  rpm_date=$(convert_date_to_rpm_format "$DATE") || exit 1
   local changelog_entry="* $rpm_date support <info@wazuh.com> - $VERSION"
   local more_info_entry="- More info: https://documentation.wazuh.com/current/release-notes/release-$(echo $VERSION | tr '.' '-').html"
 
+  local new_epoch
+  new_epoch=$(rpm_date_to_epoch "$rpm_date") || exit 1
+
   # Check if entry already exists
-  if grep -q "* .* support <info@wazuh.com> - $VERSION" "$RPM_CHANGELOG"; then
-    log "RPM changelog entry for version $VERSION already exists. Updating date..."
-    # Update existing entry date
-    sed -i "s/^\* .* support <info@wazuh.com> - $VERSION$/$changelog_entry/" "$RPM_CHANGELOG"
-    log "Successfully updated RPM changelog date for version $VERSION"
+  if grep -q "^\* .* support <info@wazuh.com> - $VERSION\$" "$RPM_CHANGELOG"; then
+    log "RPM changelog entry for version $VERSION already exists. Repositioning it with the updated date..."
+    # Remove the existing entry (its changelog line and following "More info" line);
+    # it gets reinserted below at the position matching its (possibly new) date, so
+    # entries stay in descending order regardless of where the old entry used to sit.
+    sed_inplace "/^\* .* support <info@wazuh.com> - $VERSION\$/,+1d" "$RPM_CHANGELOG"
   else
     log "Adding new RPM changelog entry for version $VERSION..."
-    # Find the %changelog line and add new entry after it
-    sed -i "/^%changelog$/a\\
+  fi
+
+  # Entries must stay in descending date order (rpmbuild enforces it), so insert the
+  # entry right before the first existing entry whose date is not newer than it.
+  local insert_before_line=""
+  local line_num=0
+  while IFS= read -r line; do
+    line_num=$((line_num + 1))
+    if [[ "$line" =~ ^\*\ (.*)\ support ]]; then
+      local existing_epoch
+      existing_epoch=$(rpm_date_to_epoch "${BASH_REMATCH[1]}") || continue
+      if [ "$existing_epoch" -le "$new_epoch" ]; then
+        insert_before_line=$line_num
+        break
+      fi
+    fi
+  done < "$RPM_CHANGELOG"
+
+  if [ -n "$insert_before_line" ]; then
+    sed_inplace "${insert_before_line}i\\
 $changelog_entry\\
 $more_info_entry" "$RPM_CHANGELOG"
-    log "Successfully added new RPM changelog entry for version $VERSION"
+  else
+    # New entry is older than every existing one (or there are no entries yet): goes last
+    printf '%s\n%s\n' "$changelog_entry" "$more_info_entry" >> "$RPM_CHANGELOG"
   fi
+  log "Successfully updated RPM changelog entry for version $VERSION"
 }
 
 # Function to update Debian changelog
@@ -599,7 +641,8 @@ update_deb_changelog() {
 
   log "Updating Debian changelog..."
 
-  local deb_date=$(convert_date_to_deb_format "$DATE")
+  local deb_date
+  deb_date=$(convert_date_to_deb_format "$DATE") || exit 1
   local package_version="$VERSION-RELEASE"
   local changelog_header="wazuh-dashboard ($package_version) stable; urgency=low"
   local more_info_entry="  * More info: https://documentation.wazuh.com/current/release-notes/release-$(echo $VERSION | tr '.' '-').html"
@@ -613,7 +656,7 @@ update_deb_changelog() {
     log "Debian changelog entry for version $VERSION already exists. Updating date..."
     # Update existing entry date
     # Find the line with the version and then find the next maintainer line to update
-    sed -i "/wazuh-dashboard ($escaped_package_version)/,/^ *-- Wazuh, Inc/ s|^ *-- Wazuh, Inc <info@wazuh.com> .*|$maintainer_line|" "$DEB_CHANGELOG"
+    sed_inplace "/wazuh-dashboard ($escaped_package_version)/,/^ *-- Wazuh, Inc/ s|^ *-- Wazuh, Inc <info@wazuh.com> .*|$maintainer_line|" "$DEB_CHANGELOG"
     log "Successfully updated Debian changelog date for version $VERSION"
   else
     log "Adding new Debian changelog entry for version $VERSION..."