From 60e29c4c56258cca762fc3375afaaf24d0279dad Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 09:17:34 -0300 Subject: [PATCH 1/9] Added bumped workflow --- .github/workflows/4_bumper_repository.yml | 132 ++++++++++++++++++ .../repository_bumper.sh | 6 +- 2 files changed, 135 insertions(+), 3 deletions(-) create mode 100644 .github/workflows/4_bumper_repository.yml rename tools/{ => github/github-branch-maintenance}/repository_bumper.sh (95%) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml new file mode 100644 index 00000000..27604238 --- /dev/null +++ b/.github/workflows/4_bumper_repository.yml @@ -0,0 +1,132 @@ +name: Repository bumper +run-name: Bump ${{ github.ref_name }} (${{ inputs.id }}) + +on: + workflow_dispatch: + inputs: + version: + description: 'Target version (e.g. 4.13.0)' + default: '' + required: false + type: string + stage: + description: 'Version stage (e.g. alpha0)' + default: '' + required: false + type: string + issue-link: + description: 'Issue link in format https://github.com/wazuh//issues/' + required: true + type: string + id: + description: 'Optional identifier for the run' + required: false + type: string + push: + +jobs: + bump: + name: Repository bumper + runs-on: ubuntu-latest + permissions: + contents: write + pull-requests: write + + env: + CI_COMMIT_AUTHOR: wazuhci + CI_COMMIT_EMAIL: 22834044+wazuhci@users.noreply.github.com + CI_GPG_PRIVATE_KEY: ${{ secrets.CI_WAZUHCI_GPG_PRIVATE }} + GH_TOKEN: ${{ secrets.CI_WAZUHCI_BUMPER_TOKEN }} + BUMP_SCRIPT_PATH: tools/github/github-branch-maintenance/repository_bumper.sh + BUMP_LOG_PATH: tools/github/github-branch-maintenance + + steps: + - name: Dump event payload + run: | + cat $GITHUB_EVENT_PATH | jq '.inputs' + + - name: Set up GPG key + id: signing_setup + run: | + echo "${{ env.CI_GPG_PRIVATE_KEY }}" | gpg --batch --import + KEY_ID=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec/ {print $5; exit}') + echo "gpg_key_id=$KEY_ID" >> $GITHUB_OUTPUT + + - name: Set up git + run: | + git config --global user.name "${{ env.CI_COMMIT_AUTHOR }}" + git config --global user.email "${{ env.CI_COMMIT_EMAIL }}" + git config --global commit.gpgsign true + git config --global user.signingkey "${{ steps.signing_setup.outputs.gpg_key_id }}" + echo "use-agent" >> ~/.gnupg/gpg.conf + echo "pinentry-mode loopback" >> ~/.gnupg/gpg.conf + echo "allow-loopback-pinentry" >> ~/.gnupg/gpg-agent.conf + echo RELOADAGENT | gpg-connect-agent + export DEBIAN_FRONTEND=noninteractive + export GPG_TTY=$(tty) + + - name: Checkout repository + uses: actions/checkout@v4 + + - name: Determine branch name + id: vars + env: + VERSION: ${{ inputs.version }} + STAGE: ${{ inputs.stage }} + run: | + script_params="" + version=${{ env.VERSION }} + stage=${{ env.STAGE }} + + # Both version and stage provided + if [[ -n "$version" && -n "$stage" ]]; then + script_params="--version ${version} --stage ${stage}" + elif [[ -z "$version" && -n "$stage" ]]; then + script_params="--stage ${stage}" + fi + + issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}') + BRANCH_NAME="enhancement/ansible${issue_number}-bump-${{ github.ref_name }}" + echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT + echo "script_params=${script_params}" >> $GITHUB_OUTPUT + + - name: Create and switch to bump branch + run: | + git checkout -b ${{ steps.vars.outputs.branch_name }} + + - name: Make version bump changes + run: | + echo "Running bump script" + bash ${{ env.BUMP_SCRIPT_PATH }} ${{ steps.vars.outputs.script_params }} + + - name: Commit and push changes + run: | + git add . + git commit -m "feat: bump ${{ github.ref_name }}" + git push origin ${{ steps.vars.outputs.branch_name }} + + - name: Create pull request + id: create_pr + run: | + gh auth setup-git + PR_URL=$(gh pr create \ + --title "Bump ${{ github.ref_name }} branch" \ + --body "Issue: ${{ inputs.issue-link }}" \ + --base ${{ github.ref_name }} \ + --head ${{ steps.vars.outputs.branch_name }}) + + echo "Pull request created: ${PR_URL}" + echo "pull_request_url=${PR_URL}" >> $GITHUB_OUTPUT + + - name: Merge pull request + run: | + # Any checks for the PR are bypassed since the branch is expected to be functional (i.e. the bump process does not introduce any bugs) + gh pr merge "${{ steps.create_pr.outputs.pull_request_url }}" --merge + + - name: Show logs + run: | + echo "Bump complete." + echo "Branch: ${{ steps.vars.outputs.branch_name }}" + echo "PR: https://github.com/${{ github.repository }}/pull/${{ steps.create_pr.outputs.pull_request_number }}" + echo "Bumper scripts logs:" + cat ${BUMP_LOG_PATH}/repository_bumper*log diff --git a/tools/repository_bumper.sh b/tools/github/github-branch-maintenance/repository_bumper.sh similarity index 95% rename from tools/repository_bumper.sh rename to tools/github/github-branch-maintenance/repository_bumper.sh index 30c5285f..886a8347 100644 --- a/tools/repository_bumper.sh +++ b/tools/github/github-branch-maintenance/repository_bumper.sh @@ -5,12 +5,12 @@ # Usage: ./repository_bumper.sh # Global variables -DIR=$(dirname "$(pwd)") -LOG_FILE="${DIR}/tools/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log" +DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)" +LOG_FILE="${DIR}/tools/github/github-branch-maintenance/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log" VERSION="" STAGE="" FILES_EDITED=() -FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh"' +FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" -exclude="4_bumper_repository.yml' get_old_version_and_stage() { local VERSION_FILE="${DIR}/VERSION.json" From e2d3e24892bed41649b9cb648f5f7f64b5804b2e Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 09:31:25 -0300 Subject: [PATCH 2/9] Updated path --- .github/workflows/4_bumper_repository.yml | 5 ++--- .../github-branch-maintenance => }/repository_bumper.sh | 6 +++--- 2 files changed, 5 insertions(+), 6 deletions(-) rename tools/{github/github-branch-maintenance => }/repository_bumper.sh (95%) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml index 27604238..1a6f8a0c 100644 --- a/.github/workflows/4_bumper_repository.yml +++ b/.github/workflows/4_bumper_repository.yml @@ -22,7 +22,6 @@ on: description: 'Optional identifier for the run' required: false type: string - push: jobs: bump: @@ -37,8 +36,8 @@ jobs: CI_COMMIT_EMAIL: 22834044+wazuhci@users.noreply.github.com CI_GPG_PRIVATE_KEY: ${{ secrets.CI_WAZUHCI_GPG_PRIVATE }} GH_TOKEN: ${{ secrets.CI_WAZUHCI_BUMPER_TOKEN }} - BUMP_SCRIPT_PATH: tools/github/github-branch-maintenance/repository_bumper.sh - BUMP_LOG_PATH: tools/github/github-branch-maintenance + BUMP_SCRIPT_PATH: tools/repository_bumper.sh + BUMP_LOG_PATH: tools steps: - name: Dump event payload diff --git a/tools/github/github-branch-maintenance/repository_bumper.sh b/tools/repository_bumper.sh similarity index 95% rename from tools/github/github-branch-maintenance/repository_bumper.sh rename to tools/repository_bumper.sh index 886a8347..be7def50 100644 --- a/tools/github/github-branch-maintenance/repository_bumper.sh +++ b/tools/repository_bumper.sh @@ -5,12 +5,12 @@ # Usage: ./repository_bumper.sh # Global variables -DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../.." && pwd)" -LOG_FILE="${DIR}/tools/github/github-branch-maintenance/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log" +DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +LOG_FILE="${DIR}/tools/repository_bumper_$(date +"%Y-%m-%d_%H-%M-%S-%3N").log" VERSION="" STAGE="" FILES_EDITED=() -FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" -exclude="4_bumper_repository.yml' +FILES_EXCLUDED='--exclude="repository_bumper_*.log" --exclude="CHANGELOG.md" --exclude="repository_bumper.sh" --exclude="4_bumper_repository.yml"' get_old_version_and_stage() { local VERSION_FILE="${DIR}/VERSION.json" From 57027801b317fcbcc9f64c91c5f5423301de8520 Mon Sep 17 00:00:00 2001 From: c-bordon Date: Thu, 5 Jun 2025 09:50:38 -0300 Subject: [PATCH 3/9] Updated changelog --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index c030709a..62be9657 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file. ### Added +- Integrate bumper script via GitHub action. ([#1676](https://github.com/wazuh/wazuh-ansible/pull/1676)) - Added repository_bumper.sh script. ([#1621](https://github.com/wazuh/wazuh-ansible/pull/1621)) ### Changed From 0bd12ca20be713e78e2fb9e9382406af9dc6dd99 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Mon, 9 Jun 2025 11:00:51 -0300 Subject: [PATCH 4/9] Add missing malicious-ioc ruleset lists --- roles/wazuh/ansible-wazuh-manager/defaults/main.yml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 408468f9..8438c7ce 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -296,6 +296,9 @@ wazuh_manager_ruleset: - 'audit-keys' - 'security-eventchannel' - 'amazon/aws-eventnames' + - 'malicious-ioc/malicious-ip' + - 'malicious-ioc/malicious-domains' + - 'malicious-ioc/malware-hashes' wazuh_manager_rule_exclude: - '0215-policy_rules.xml' From 74d210ffb95ae7e77f18113bb743ac03b67283f6 Mon Sep 17 00:00:00 2001 From: fcaffieri Date: Mon, 9 Jun 2025 18:22:13 -0300 Subject: [PATCH 5/9] Update CHANGELOG --- CHANGELOG.md | 1 + 1 file changed, 1 insertion(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 17848515..0ba3c2bf 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -5,6 +5,7 @@ All notable changes to this project will be documented in this file. ### Added +- Add missing malicious-ioc ruleset lists ([#1685](https://github.com/wazuh/wazuh-ansible/pull/1685)) - Integrate bumper script via GitHub action. ([#1676](https://github.com/wazuh/wazuh-ansible/pull/1676)) - Added repository_bumper.sh script. ([#1621](https://github.com/wazuh/wazuh-ansible/pull/1621)) From 241e237502198032dbef5f60c83ba45b8853f846 Mon Sep 17 00:00:00 2001 From: Raul Del Pozo Moreno <14913942+rauldpm@users.noreply.github.com> Date: Tue, 10 Jun 2025 11:39:25 +0200 Subject: [PATCH 6/9] fix: fixed env secret --- .github/workflows/4_bumper_repository.yml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml index 1a6f8a0c..ad727021 100644 --- a/.github/workflows/4_bumper_repository.yml +++ b/.github/workflows/4_bumper_repository.yml @@ -5,7 +5,7 @@ on: workflow_dispatch: inputs: version: - description: 'Target version (e.g. 4.13.0)' + description: 'Target version (e.g. 4.12.0)' default: '' required: false type: string @@ -26,7 +26,7 @@ on: jobs: bump: name: Repository bumper - runs-on: ubuntu-latest + runs-on: ubuntu-22.04 permissions: contents: write pull-requests: write @@ -66,6 +66,10 @@ jobs: - name: Checkout repository uses: actions/checkout@v4 + with: + # Using workflow-specific GITHUB_TOKEN because currently CI_WAZUHCI_BUMPER_TOKEN + # doesn't have all the necessary permissions + token: ${{ env.GH_TOKEN }} - name: Determine branch name id: vars @@ -85,7 +89,7 @@ jobs: fi issue_number=$(echo "${{ inputs.issue-link }}" | awk -F'/' '{print $NF}') - BRANCH_NAME="enhancement/ansible${issue_number}-bump-${{ github.ref_name }}" + BRANCH_NAME="enhancement/wqa${issue_number}-bump-${{ github.ref_name }}" echo "branch_name=$BRANCH_NAME" >> $GITHUB_OUTPUT echo "script_params=${script_params}" >> $GITHUB_OUTPUT @@ -126,6 +130,6 @@ jobs: run: | echo "Bump complete." echo "Branch: ${{ steps.vars.outputs.branch_name }}" - echo "PR: https://github.com/${{ github.repository }}/pull/${{ steps.create_pr.outputs.pull_request_number }}" + echo "PR: ${{ steps.create_pr.outputs.pull_request_url }}" echo "Bumper scripts logs:" cat ${BUMP_LOG_PATH}/repository_bumper*log From 365898aa87c04c82382b2fc714265a49d8632d99 Mon Sep 17 00:00:00 2001 From: Raul Del Pozo Moreno <14913942+rauldpm@users.noreply.github.com> Date: Tue, 10 Jun 2025 12:27:10 +0200 Subject: [PATCH 7/9] chore: abstracted version --- .github/workflows/4_bumper_repository.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/4_bumper_repository.yml b/.github/workflows/4_bumper_repository.yml index ad727021..3b4dd269 100644 --- a/.github/workflows/4_bumper_repository.yml +++ b/.github/workflows/4_bumper_repository.yml @@ -5,7 +5,7 @@ on: workflow_dispatch: inputs: version: - description: 'Target version (e.g. 4.12.0)' + description: 'Target version (e.g. 1.2.3)' default: '' required: false type: string From 477407e1236190e757b2d4b34984f046b8d94113 Mon Sep 17 00:00:00 2001 From: Enrique Araque Date: Wed, 11 Jun 2025 10:21:21 +0200 Subject: [PATCH 8/9] Bump revision for 4.13.0-alpha1 --- VERSION.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/VERSION.json b/VERSION.json index dfee93c3..bbeb2678 100644 --- a/VERSION.json +++ b/VERSION.json @@ -1,4 +1,4 @@ { "version": "4.13.0", - "stage": "alpha0" + "stage": "alpha1" } From dc7d404bf50d2f1d72dc93b511447765d22c21cd Mon Sep 17 00:00:00 2001 From: wazuhci <22834044+wazuhci@users.noreply.github.com> Date: Fri, 13 Jun 2025 11:23:40 +0000 Subject: [PATCH 9/9] feat: bump 4.13.1 --- CHANGELOG.md | 18 ++++++++++++++++++ VERSION.json | 4 ++-- .../ansible-kibana/defaults/main.yml | 2 +- .../ansible-filebeat-oss/defaults/main.yml | 2 +- .../ansible-wazuh-agent/defaults/main.yml | 2 +- .../ansible-wazuh-manager/defaults/main.yml | 2 +- roles/wazuh/check-packages/defaults/main.yml | 2 +- roles/wazuh/wazuh-dashboard/defaults/main.yml | 4 ++-- roles/wazuh/wazuh-dashboard/vars/debian.yml | 2 +- roles/wazuh/wazuh-indexer/defaults/main.yml | 2 +- 10 files changed, 29 insertions(+), 11 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0ba3c2bf..2c1d4d91 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,6 +1,24 @@ # Change Log All notable changes to this project will be documented in this file. +## [4.13.1] + +### Added + +- None + +### Changed + +- None + +### Fixed + +- None + +### Deleted + +- None + ## [4.13.0] ### Added diff --git a/VERSION.json b/VERSION.json index bbeb2678..73d6ac89 100644 --- a/VERSION.json +++ b/VERSION.json @@ -1,4 +1,4 @@ { - "version": "4.13.0", - "stage": "alpha1" + "version": "4.13.1", + "stage": "alpha0" } diff --git a/roles/elastic-stack/ansible-kibana/defaults/main.yml b/roles/elastic-stack/ansible-kibana/defaults/main.yml index 29ddb4e8..7df63db0 100644 --- a/roles/elastic-stack/ansible-kibana/defaults/main.yml +++ b/roles/elastic-stack/ansible-kibana/defaults/main.yml @@ -7,7 +7,7 @@ kibana_server_host: "0.0.0.0" kibana_server_port: "5601" kibana_conf_path: /etc/kibana elastic_stack_version: 7.10.2 -wazuh_version: 4.13.0 +wazuh_version: 4.13.1 wazuh_app_url: https://packages.wazuh.com/4.x/ui/kibana/wazuh_kibana elasticrepo: diff --git a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml index 70a645ea..4f94f0c9 100644 --- a/roles/wazuh/ansible-filebeat-oss/defaults/main.yml +++ b/roles/wazuh/ansible-filebeat-oss/defaults/main.yml @@ -1,7 +1,7 @@ --- filebeat_version: 7.10.2 -wazuh_template_branch: v4.13.0 +wazuh_template_branch: v4.13.1 filebeat_node_name: node-1 diff --git a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml index a8fb2354..2a693ba1 100644 --- a/roles/wazuh/ansible-wazuh-agent/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-agent/defaults/main.yml @@ -1,5 +1,5 @@ --- -wazuh_agent_version: 4.13.0 +wazuh_agent_version: 4.13.1 # Custom packages installation diff --git a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml index 8438c7ce..e5d5b7a1 100644 --- a/roles/wazuh/ansible-wazuh-manager/defaults/main.yml +++ b/roles/wazuh/ansible-wazuh-manager/defaults/main.yml @@ -1,5 +1,5 @@ --- -wazuh_manager_version: 4.13.0 +wazuh_manager_version: 4.13.1 wazuh_manager_fqdn: "wazuh-server" wazuh_manager_package_state: present diff --git a/roles/wazuh/check-packages/defaults/main.yml b/roles/wazuh/check-packages/defaults/main.yml index 0694a697..124126cc 100644 --- a/roles/wazuh/check-packages/defaults/main.yml +++ b/roles/wazuh/check-packages/defaults/main.yml @@ -1,2 +1,2 @@ --- -wazuh_version: 4.13.0 +wazuh_version: 4.13.1 diff --git a/roles/wazuh/wazuh-dashboard/defaults/main.yml b/roles/wazuh/wazuh-dashboard/defaults/main.yml index 08d4a424..f8503b4c 100644 --- a/roles/wazuh/wazuh-dashboard/defaults/main.yml +++ b/roles/wazuh/wazuh-dashboard/defaults/main.yml @@ -8,12 +8,12 @@ dashboard_node_name: node-1 dashboard_server_host: "0.0.0.0" dashboard_server_port: "443" dashboard_server_name: "dashboard" -wazuh_version: 4.13.0 +wazuh_version: 4.13.1 indexer_cluster_nodes: - 127.0.0.1 # The Wazuh dashboard package repository -dashboard_version: "4.13.0" +dashboard_version: "4.13.1" # API credentials wazuh_api_credentials: diff --git a/roles/wazuh/wazuh-dashboard/vars/debian.yml b/roles/wazuh/wazuh-dashboard/vars/debian.yml index baa259ee..129d02a0 100644 --- a/roles/wazuh/wazuh-dashboard/vars/debian.yml +++ b/roles/wazuh/wazuh-dashboard/vars/debian.yml @@ -1,2 +1,2 @@ --- -dashboard_version: 4.13.0 +dashboard_version: 4.13.1 diff --git a/roles/wazuh/wazuh-indexer/defaults/main.yml b/roles/wazuh/wazuh-indexer/defaults/main.yml index 9a15df43..a52ac817 100644 --- a/roles/wazuh/wazuh-indexer/defaults/main.yml +++ b/roles/wazuh/wazuh-indexer/defaults/main.yml @@ -1,6 +1,6 @@ --- # Cluster Settings -indexer_version: 4.13.0 +indexer_version: 4.13.1 single_node: false indexer_node_name: node-1