5_builderpackage_dashboard.yml

# This workflow automates the build of the Wazuh Dashboard package along with
# its plugins.
#
# This workflow:
# - Download, build, package, test, and upload the Wazuh dashboard along
#   with its plugins.
# - Customizable through inputs to adapt to different environments
#   (production, staging, various architectures).
# - Ensure that each component is built with the exact reference provided and
#   validated before the final packaging.
#
# - Allows customization of:
#   - Operating system (`deb` or `rpm`)
#   - Architecture (`amd64`, `x86_64`, `aarch64`, `arm64`)
#   - Package revision
#   - Plugin references (branches, tags, or commits)
#   - Staging, upload, and checksum options.

run-name: Build ${{ inputs.system }} wazuh-dashboard on ${{ inputs.architecture }} ${{ inputs.is_stage && '- is stage' || '' }} ${{ inputs.checksum && '- checksum' || '' }} ${{ inputs.id }}
name: (5.x) Build Wazuh dashboard package with plugins (on demand)

on:
  workflow_dispatch:
    inputs:
      system:
        type: choice
        description: 'Package OS'
        required: true
        options:
          - deb
          - rpm
        default: 'deb'
      architecture:
        type: choice
        description: 'Package architecture'
        required: true
        options:
          - amd64
          - x86_64
          - aarch64
          - arm64
        default: amd64
      revision:
        type: string
        description: 'Package revision'
        required: true
        default: '0'
      reference_plugins:
        type: string
        description: 'Git ref (branch/tag) to use for all plugins'
        required: false
      is_stage:
        type: boolean
        description: 'Set production nomenclature'
        required: true
        default: false
      checksum:
        type: boolean
        description: 'Generate package checksum'
        required: true
        default: false
      id:
        description: 'ID used to identify the workflow uniquely.'
        type: string
        required: false

  workflow_call:
    inputs:
      system:
        type: string
        required: true
        default: 'deb'
      architecture:
        type: string
        required: true
        default: amd64
      revision:
        type: string
        required: true
        default: '0'
      reference_plugins:
        type: string
        description: 'Git ref (branch/tag) to use for all plugins'
        required: false
      is_stage:
        type: boolean
        required: true
        default: false
      checksum:
        type: boolean
        required: true
        default: false
      id:
        type: string
        required: false

permissions:
  id-token: write
  contents: read

jobs:
  validate-job:
    runs-on: wz-linux-amd64
    name: Validate inputs
    steps:
      - name: Validate inputs
        run: |
          if [[ "${{ inputs.architecture }}" == "amd64" || "${{ inputs.architecture }}" == "arm64" ]] && [[ "${{ inputs.system }}" == "rpm" ]]; then
            echo "Invalid combination of architecture and system"
            exit 1
          fi
          if [[ "${{ inputs.architecture }}" == "x86_64" || "${{ inputs.architecture }}" == "aarch64" ]] && [[ "${{ inputs.system }}" == "deb" ]]; then
            echo "Invalid combination of architecture and system"
            exit 1
          fi

      - name: Set up AWS CLI
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.CI_INTERNAL_DEVELOPMENT_BUCKET_USER_ACCESS_KEY }}
          aws-secret-access-key: ${{ secrets.CI_INTERNAL_DEVELOPMENT_BUCKET_USER_SECRET_KEY }}
          aws-region: ${{ secrets.CI_AWS_REGION }}

  # This job retrieves the necessary information about the plugins to be used in the build process.
  # if need to add more plugins:
  # - Add them to the matrix (name: <plugin-name>, packageName: <plugin-package-name>, repository: <plugin-repo-url>, outputNamePackge: <plugin-output-name>, outputSHA: <plugin-output-sha>)
  #   - If need to add more plugins from the wazuh-dashboard-plugins repo, outputSHA can be omitted because it will be retrieved from the main plugin
  # - Add them to the outputs section (NAME_PLUGIN_... and WAZUH_..._SHA)
  get-outputs-plugins:
    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && 'wz-linux-arm64' || 'wz-linux-amd64' }}
    name: get-outputs-plugins
    needs: [validate-job]
    outputs:
      VERSION: ${{ steps.get-version.outputs.VERSION }}
      VERSION_OPENSEARCH: ${{ steps.get-version.outputs.VERSION_OPENSEARCH }}
      REVISION: ${{ steps.get-version.outputs.REVISION }}
      WAZUH_PLUGINS_SHA: ${{ steps.get-plugins.outputs.WAZUH_PLUGINS_SHA }}
      WAZUH_SECURITY_SHA: ${{ steps.get-plugins.outputs.WAZUH_SECURITY_SHA }}
      WAZUH_REPORTING_SHA: ${{ steps.get-plugins.outputs.WAZUH_REPORTING_SHA }}
      WAZUH_SECURITY_ANALYTICS_SHA: ${{ steps.get-plugins.outputs.WAZUH_SECURITY_ANALYTICS_SHA }}
      WAZUH_ALERTING_SHA: ${{ steps.get-plugins.outputs.WAZUH_ALERTING_SHA }}
      WAZUH_NOTIFICATIONS_SHA: ${{ steps.get-plugins.outputs.WAZUH_NOTIFICATIONS_SHA }}
      NAME_PLUGIN_WAZUH: ${{ steps.get-plugins.outputs.NAME_PLUGIN_WAZUH }}
      NAME_PLUGIN_CORE: ${{ steps.get-plugins.outputs.NAME_PLUGIN_CORE }}
      NAME_PLUGIN_CHECK_UPDATES: ${{ steps.get-plugins.outputs.NAME_PLUGIN_CHECK_UPDATES }}
      NAME_PLUGIN_SECURITY: ${{ steps.get-plugins.outputs.NAME_PLUGIN_SECURITY }}
      NAME_PLUGIN_REPORTING: ${{ steps.get-plugins.outputs.NAME_PLUGIN_REPORTING }}
      NAME_PLUGIN_SECURITY_ANALYTICS: ${{ steps.get-plugins.outputs.NAME_PLUGIN_SECURITY_ANALYTICS }}
      NAME_PLUGIN_ALERTING: ${{ steps.get-plugins.outputs.NAME_PLUGIN_ALERTING }}
      NAME_PLUGIN_NOTIFICATIONS: ${{ steps.get-plugins.outputs.NAME_PLUGIN_NOTIFICATIONS }}
    strategy:
      fail-fast: true
      matrix:
        plugin:
          - name: security # this is for reference only,
            packageName: wazuh-security-dashboards-plugin # this is for the name of the plugin
            repository: https://github.com/wazuh/wazuh-security-dashboards-plugin.git
            outputNamePackage: NAME_PLUGIN_SECURITY # this is for the output name of the plugin
            outputSHA: WAZUH_SECURITY_SHA # this is for the output sha of the plugin
          - name: plugins-main
            packageName: wazuh-dashboard-plugins_wazuh
            repository: https://github.com/wazuh/wazuh-dashboard-plugins.git
            outputNamePackage: NAME_PLUGIN_WAZUH
            outputSHA: WAZUH_PLUGINS_SHA
          - name: plugins-core
            packageName: wazuh-dashboard-plugins_core
            repository: https://github.com/wazuh/wazuh-dashboard-plugins.git
            outputNamePackage: NAME_PLUGIN_CORE
          - name: plugins-check-updates
            packageName: wazuh-dashboard-plugins_wazuh-check-updates
            repository: https://github.com/wazuh/wazuh-dashboard-plugins.git
            outputNamePackage: NAME_PLUGIN_CHECK_UPDATES
          - name: reporting
            packageName: wazuh-dashboard-reporting
            repository: https://github.com/wazuh/wazuh-dashboard-reporting.git
            outputNamePackage: NAME_PLUGIN_REPORTING
            outputSHA: WAZUH_REPORTING_SHA
          - name: security-analytics
            packageName: wazuh-dashboard-security-analytics
            repository: https://github.com/wazuh/wazuh-dashboard-security-analytics.git
            outputNamePackage: NAME_PLUGIN_SECURITY_ANALYTICS
            outputSHA: WAZUH_SECURITY_ANALYTICS_SHA
          - name: alerting
            packageName: wazuh-dashboard-alerting
            repository: https://github.com/wazuh/wazuh-dashboard-alerting.git
            outputNamePackage: NAME_PLUGIN_ALERTING
            outputSHA: WAZUH_ALERTING_SHA
          - name: notifications
            packageName: wazuh-dashboard-notifications
            repository: https://github.com/wazuh/wazuh-dashboard-notifications.git
            outputNamePackage: NAME_PLUGIN_NOTIFICATIONS
            outputSHA: WAZUH_NOTIFICATIONS_SHA
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'

      - name: Get VERSION and REVISION
        id: get-version
        run: |
          VERSION=$(jq -r '.version' VERSION.json)
          VERSION_OPENSEARCH=$(jq -r '.version' package.json)
          REVISION=$(yarn --silent wzd-revision)
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "VERSION_OPENSEARCH=$VERSION_OPENSEARCH" >> $GITHUB_OUTPUT
          echo "REVISION=$REVISION" >> $GITHUB_OUTPUT

      - name: Get outputs of wazuh-dashboard-plugins
        id: get-plugins
        run: |
          REPOSITORY=${{ matrix.plugin.repository }}
          REFERENCE="${{ inputs.reference_plugins }}"
          if [ -z "$REFERENCE" ]; then
            echo "No plugin reference provided, using github.ref_name: ${{ github.ref_name }}"
            REFERENCE="${{ github.ref_name }}"
            SHA=$(git ls-remote $REPOSITORY "$REFERENCE" | cut -f1 | cut -c1-7)
            PACKAGE_NAME=${{matrix.plugin.packageName}}_${{ steps.get-version.outputs.VERSION }}-${{ steps.get-version.outputs.REVISION }}_$(echo $REFERENCE | sed 's/\//-/g').zip
          else
            echo "Using reference: $REFERENCE"
            SHA=$(git ls-remote $REPOSITORY "$REFERENCE" | cut -f1 | cut -c1-7)
            if [ -z "$SHA" ]; then
              echo "Reference $REFERENCE not found, trying with '${{ github.ref_name }}' branch"
              REFERENCE="${{ github.ref_name }}"
              SHA=$(git ls-remote $REPOSITORY $REFERENCE | cut -f1 | cut -c1-7)
            fi
            PACKAGE_NAME=${{matrix.plugin.packageName}}_${{ steps.get-version.outputs.VERSION }}-${{ steps.get-version.outputs.REVISION }}_$(echo $REFERENCE | sed 's/\//-/g').zip
          fi
          if [ -z "$SHA" ]; then
            echo "Reference ${{ github.ref_name }} not found, check if the repository exists and the reference is correct."
            exit 1
          fi
          echo "${{matrix.plugin.outputNamePackage}}=$PACKAGE_NAME" >> $GITHUB_OUTPUT
          if [ -n "${{ matrix.plugin.outputSHA}}" ]; then
            echo "${{matrix.plugin.outputSHA}}=$SHA" >> $GITHUB_OUTPUT
          fi

  setup-variables:
    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && 'wz-linux-arm64' || 'wz-linux-amd64' }}
    needs: [validate-job, get-outputs-plugins]
    name: Setup variables
    outputs:
      CURRENT_DIR: ${{ steps.setup-variables.outputs.CURRENT_DIR }}
      VERSION: ${{ steps.setup-variables.outputs.VERSION }}
      PREVIOUS: ${{ steps.setup-variables.outputs.PREVIOUS }}
      REVISION: ${{ steps.setup-variables.outputs.REVISION }}
      ALL_COMMIT_SHAS: ${{ steps.setup-variables.outputs.ALL_COMMIT_SHAS }}
      PRODUCTION: ${{ steps.setup-variables.outputs.PRODUCTION }}
      WAZUH_DASHBOARD_SLIM: ${{ steps.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }}
      PACKAGE_NAME: ${{ steps.setup-variables.outputs.PACKAGE_NAME }}
      ARCHITECTURE_FLAG: ${{ steps.setup-variables.outputs.ARCHITECTURE_FLAG }}
      VERSION_OPENSEARCH: ${{ steps.setup-variables.outputs.VERSION_OPENSEARCH }}
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup variables
        id: setup-variables
        run: |
          CURRENT_DIR=$(pwd -P)
          VERSION=${{ needs.get-outputs-plugins.outputs.VERSION }}
          VERSION_OPENSEARCH=${{ needs.get-outputs-plugins.outputs.VERSION_OPENSEARCH }}
          REVISION=${{ needs.get-outputs-plugins.outputs.REVISION }}
          ALL_COMMIT_SHAS=$(git rev-parse --short HEAD)-${{needs.get-outputs-plugins.outputs.WAZUH_PLUGINS_SHA}}-${{needs.get-outputs-plugins.outputs.WAZUH_SECURITY_SHA}}-${{needs.get-outputs-plugins.outputs.WAZUH_REPORTING_SHA}}-${{needs.get-outputs-plugins.outputs.WAZUH_SECURITY_ANALYTICS_SHA}}-${{needs.get-outputs-plugins.outputs.WAZUH_ALERTING_SHA}}-${{needs.get-outputs-plugins.outputs.WAZUH_NOTIFICATIONS_SHA}}
          # Check the corresponding previous version to be used in the upgrade test
          sudo curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && sudo chmod 644 /usr/share/keyrings/wazuh.gpg
          sudo echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee -a /etc/apt/sources.list.d/wazuh.list
          sudo apt-get update
          PREVIOUS=$(apt-cache madison wazuh-dashboard | grep -A 1 "$VERSION" | tail -1 | awk '{print $3}')
          if [ -z "$PREVIOUS" ]; then
            MAJOR_MINOR=$(echo "$VERSION" | cut -d '.' -f 1,2)$(echo ".")
            PREVIOUS=$(apt-cache madison wazuh-dashboard | grep "$MAJOR_MINOR" | head -1 | awk '{print $3}')
          fi
          if [ -z "$PREVIOUS" ]; then
            PREVIOUS=$(apt-cache madison wazuh-dashboard | head -1 | awk '{print $3}')
          fi
          if [ -z "$PREVIOUS" ]; then
            echo "::warning No previous version::No previous version found for this architecture. Upgrade test will be skipped."
          fi
          if [ "${{ inputs.is_stage }}" = "true" ]; then
            PRODUCTION=--production
          else
            PRODUCTION=""
          fi
          WAZUH_DASHBOARD_SLIM=wazuh-dashboard_${VERSION}-${REVISION}_${{ (inputs.ARCHITECTURE == 'x86_64' || inputs.ARCHITECTURE == 'amd64') && 'x64' || 'arm64' }}.tar.gz
          if [ "${{ inputs.system }}" = "deb" ]; then
            if [ "${{ inputs.is_stage }}" = "true" ]; then
              PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}.deb
            else
              PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}_${ALL_COMMIT_SHAS}.deb
            fi
          else
            if [ "${{ inputs.is_stage }}" = "true" ]; then
              PACKAGE_NAME=wazuh-dashboard-${VERSION}-${{ inputs.revision }}.${{ inputs.architecture }}.rpm
            else
              PACKAGE_NAME=wazuh-dashboard_${VERSION}-${{ inputs.revision }}_${{ inputs.architecture }}_${ALL_COMMIT_SHAS}.rpm
            fi
          fi
          if [[ "${{ inputs.architecture }}" == "x86_64" || "${{ inputs.architecture }}" == "amd64" ]]; then
            ARCHITECTURE_FLAG=""
          else
            ARCHITECTURE_FLAG=--arm
          fi
          echo "CURRENT_DIR=$CURRENT_DIR" >> $GITHUB_OUTPUT
          echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
          echo "VERSION_OPENSEARCH=$VERSION_OPENSEARCH" >> $GITHUB_OUTPUT
          echo "PREVIOUS=$PREVIOUS" >> $GITHUB_OUTPUT
          echo "REVISION=$REVISION" >> $GITHUB_OUTPUT
          echo "ALL_COMMIT_SHAS=$ALL_COMMIT_SHAS" >> $GITHUB_OUTPUT
          echo "PRODUCTION=$PRODUCTION" >> $GITHUB_OUTPUT
          echo "WAZUH_DASHBOARD_SLIM=$WAZUH_DASHBOARD_SLIM" >> $GITHUB_OUTPUT
          echo "PACKAGE_NAME=$PACKAGE_NAME" >> $GITHUB_OUTPUT
          echo "ARCHITECTURE_FLAG=$ARCHITECTURE_FLAG" >> $GITHUB_OUTPUT

  build-dashboard:
    needs: [validate-job, setup-variables]
    name: Build dashboard
    uses: ./.github/workflows/5_builderpackage_dashboard_core.yml
    with:
      CHECKOUT_TO: ${{  github.ref_name }}
      ARCHITECTURE: ${{ inputs.architecture }}

  # Build plugins in parallel to the dashboard build
  # If need to add more plugins from the wazuh-dashboard-plugins repo:
  # - Add them to the matrix (name: <plugin-name>, packageName: <plugin-package-name>, repo: <owner/repo>, pathPlugin: <path-to-repo>, path: <path-to-plugin>)
  # If need to add more forked plugins:
  # - Add them to the matrix (name: <plugin-name>, packageName: <plugin-package-name>, repo: <owner/repo>)
  build-plugins:
    needs: [setup-variables, validate-job, get-outputs-plugins]
    strategy:
      fail-fast: true
      matrix:
        plugin:
          - name: wazuh-dashboard-plugins_wazuh
            packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_WAZUH }}
            repo: wazuh/wazuh-dashboard-plugins
            pathPlugin: plugins/wazuh-dashboard-plugins
            path: plugins/main
          - name: wazuh-dashboard-plugins_wazuh-check-updates
            packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_CHECK_UPDATES }}
            repo: wazuh/wazuh-dashboard-plugins
            pathPlugin: plugins/wazuh-dashboard-plugins
            path: plugins/wazuh-check-updates
          - name: wazuh-dashboard-plugins_wazuh-core
            packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_CORE }}
            repo: wazuh/wazuh-dashboard-plugins
            pathPlugin: plugins/wazuh-dashboard-plugins
            path: plugins/wazuh-core
          - name: reports-dashboards
            packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_REPORTING }}
            repo: wazuh/wazuh-dashboard-reporting
          - name: wazuh-security-dashboards-plugin
            packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_SECURITY }}
            repo: wazuh/wazuh-security-dashboards-plugin
          - name: security-analytics-dashboards
            packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_SECURITY_ANALYTICS }}
            repo: wazuh/wazuh-dashboard-security-analytics
          - name: wazuh-dashboard-alerting
            packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_ALERTING }}
            repo: wazuh/wazuh-dashboard-alerting
          - name: wazuh-dashboard-notifications
            packageName: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_NOTIFICATIONS }}
            repo: wazuh/wazuh-dashboard-notifications
    uses: ./.github/workflows/5_builderpackage_dashboard_plugins.yml
    with:
      reference_plugins: ${{ inputs.reference_plugins }}
      version_opensearch: ${{ needs.setup-variables.outputs.VERSION_OPENSEARCH }}
      name: ${{ matrix.plugin.name }}
      packageName: ${{ matrix.plugin.packageName }}
      path: ${{ matrix.plugin.path }}
      repo: ${{ matrix.plugin.repo }}
      pathPlugin: ${{ matrix.plugin.pathPlugin }}

  build-package:
    needs: [setup-variables, get-outputs-plugins, build-dashboard, build-plugins]
    runs-on: ${{ (inputs.architecture == 'arm64' || inputs.architecture == 'aarch64') && 'wz-linux-arm64' || 'wz-linux-amd64' }}
    name: Generate packages
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Setup Node
        uses: actions/setup-node@v4
        with:
          node-version-file: '.nvmrc'
          registry-url: 'https://registry.npmjs.org'

      - name: Download dashboard artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/dashboard

      - name: Download security plugin artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_SECURITY }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/security-plugin

      - name: Download main plugin's artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_WAZUH }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/plugins
      - name: Download core plugin's artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_CORE }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/plugins
      - name: Download check update plugin's artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_CHECK_UPDATES }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/plugins
      - name: Download report plugin artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_REPORTING }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/report-plugin
      - name: Download security analytics plugin artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_SECURITY_ANALYTICS }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/security-analytics-plugin
      - name: Download alerting plugin artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_ALERTING }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/alerting-plugin
      - name: Download notifications plugin artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{ needs.get-outputs-plugins.outputs.NAME_PLUGIN_NOTIFICATIONS }}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/notifications-plugin

      - name: Zip plugins
        run: |
          zip -r -j ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/wazuh-package.zip ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/plugins
          zip -r -j ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/security-package.zip ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/security-plugin
          zip -r -j ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/report-package.zip ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/report-plugin
          zip -r -j ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/dashboard-package.zip ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/dashboard/${{ needs.setup-variables.outputs.WAZUH_DASHBOARD_SLIM }}
          zip -r -j ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/security-analytics-package.zip ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/security-analytics-plugin
          zip -r -j ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/alerting-package.zip ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/alerting-plugin
          zip -r -j ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/notifications-package.zip ${{ needs.setup-variables.outputs.CURRENT_DIR }}/artifacts/notifications-plugin

      - name: Build package
        run: |
          cd ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/build-packages
          bash ./build-packages.sh \
            -r ${{ inputs.revision }} ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG }} \
            -a file://${{needs.setup-variables.outputs.CURRENT_DIR}}/artifacts/wazuh-package.zip \
            -s file://${{needs.setup-variables.outputs.CURRENT_DIR}}/artifacts/security-package.zip \
            -b file://${{needs.setup-variables.outputs.CURRENT_DIR}}/artifacts/dashboard-package.zip \
            -rp file://${{needs.setup-variables.outputs.CURRENT_DIR}}/artifacts/report-package.zip \
            -sa file://${{needs.setup-variables.outputs.CURRENT_DIR}}/artifacts/security-analytics-package.zip \
            -al file://${{needs.setup-variables.outputs.CURRENT_DIR}}/artifacts/alerting-package.zip \
            -no file://${{needs.setup-variables.outputs.CURRENT_DIR}}/artifacts/notifications-package.zip \
            --commit-sha ${{needs.setup-variables.outputs.ALL_COMMIT_SHAS}} \
            --${{ inputs.system }} ${{ needs.setup-variables.outputs.PRODUCTION }} --debug

      - name: Upload artifact
        uses: actions/upload-artifact@v4
        if: success()
        with:
          name: ${{needs.setup-variables.outputs.PACKAGE_NAME}}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/build-packages/output/${{needs.setup-variables.outputs.PACKAGE_NAME}}
          retention-days: 30
          overwrite: true

      - name: Upload checksum
        if: success() && ${{ inputs.checksum }}
        uses: actions/upload-artifact@v4
        with:
          name: ${{needs.setup-variables.outputs.PACKAGE_NAME}}.sha512
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/build-packages/output/${{needs.setup-variables.outputs.PACKAGE_NAME}}.sha512
          retention-days: 30
          overwrite: true

  test-package:
    needs: [setup-variables, build-package]
    runs-on: ${{ needs.setup-variables.outputs.ARCHITECTURE_FLAG == '--arm' && 'wz-linux-arm64' || 'wz-linux-amd64' }}
    strategy:
      fail-fast: false
    name: Test package
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Download  artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{needs.setup-variables.outputs.PACKAGE_NAME}}
          path: ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/test-packages

      - name: Test package integrity
        run: |
          cd ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/test-packages
          cp ./${{needs.setup-variables.outputs.PACKAGE_NAME}}  ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/test-packages/${{ inputs.system }}
          bash ./test-packages.sh \
            -p ${{needs.setup-variables.outputs.PACKAGE_NAME}}

      - name: DEB - Test package install/uninstall
        if: ${{ inputs.system == 'deb' }}
        run: |
          sudo dpkg -i ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/test-packages/${{needs.setup-variables.outputs.PACKAGE_NAME}}
          if dpkg-query -W -f='${Status}' wazuh-dashboard 2>/dev/null | grep -q "install ok installed"; then
            echo "Package installed"
          else
            echo "Package not installed"
            exit 1
          fi
          sudo  systemctl daemon-reload
          sudo  systemctl enable wazuh-dashboard
          sudo  systemctl start wazuh-dashboard
          if sudo systemctl status wazuh-dashboard | grep -q "active (running)"; then
            echo "Service running"
          else
            echo "Service not running"
            exit 1
          fi
          sudo apt-get remove --purge wazuh-dashboard -y
          if dpkg-query -W -f='${Status}' wazuh-dashboard 2>/dev/null | grep -q "install ok installed"; then
            echo "Package not uninstalled"
            exit 1
          else
            echo "Package uninstalled"
          fi

      - name: DEB - Test package upgrade
        if: ${{ needs.setup-variables.outputs.PREVIOUS != '' && inputs.system == 'deb' }}
        run: |
          sudo apt-get install debhelper tar curl libcap2-bin #debhelper version 9 or later
          sudo apt-get install gnupg apt-transport-https
          sudo curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import && sudo chmod 644 /usr/share/keyrings/wazuh.gpg
          sudo echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee -a /etc/apt/sources.list.d/wazuh.list
          sudo apt-get update
          sudo apt-get -y install wazuh-dashboard=${{needs.setup-variables.outputs.PREVIOUS}}
          sudo  systemctl daemon-reload
          sudo  systemctl enable wazuh-dashboard
          sudo  systemctl start wazuh-dashboard
          sudo dpkg -i ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/test-packages/${{needs.setup-variables.outputs.PACKAGE_NAME}}
          sudo systemctl restart wazuh-dashboard

          if dpkg -s wazuh-dashboard | grep '^Version:' | grep -q "${{needs.setup-variables.outputs.VERSION}}"; then
            echo "Package upgraded"
          else
            echo "Package not upgraded"
            exit 1
          fi

          if sudo systemctl status wazuh-dashboard | grep -q "active (running)"; then
            echo "Service running"
          else
            echo "Service not running"
            exit 1
          fi

      - name: RPM - Clone automation repo
        if: ${{ inputs.system == 'rpm' }}
        env:
          username: 'wazuh-devel-xdrsiem-dashboard'
        run: |
          git clone https://${{ env.username }}:${{ secrets.DASHBOARD_BOT_SMOKE_TEST_TOKEN }}@github.com/wazuh/wazuh-automation.git
          cd wazuh-automation
          pip3 install -r deployability/deps/requirements.txt

      - name: RPM - Configure AWS credentials
        uses: aws-actions/configure-aws-credentials@v4
        if: ${{ inputs.system == 'rpm' }}
        with:
          aws-region: 'us-east-1'
          role-to-assume: ${{ secrets.AWS_IAM_ROLE }}
          role-session-name: 'Dashboard-smoke-test'

      - name: RPM - Setup environment
        if: ${{ inputs.system == 'rpm' }}
        run: |
          if [ "${{ inputs.architecture }}" = "x86_64" ]; then
            python3 wazuh-automation/deployability/modules/allocation/main.py --action create --provider aws --size large --composite-name centos_stream-9-amd64 --instance-name "centos_9_amd_large_aws" --inventory-output "/tmp/inventory.yaml" --track-output "/tmp/track.yaml" --label-team dashboard --label-termination-date 1d --working-dir /tmp/dashboard
          else
            python3 wazuh-automation/deployability/modules/allocation/main.py --action create --provider aws --size large --composite-name centos_stream-8-arm64 --instance-name "centos_8_arm_large_aws" --inventory-output "/tmp/inventory.yaml" --track-output "/tmp/track.yaml" --label-team dashboard --label-termination-date 1d --working-dir /tmp/dashboard
          fi
          ansible_host=$(grep 'ansible_host:' /tmp/inventory.yaml | sed 's/.*: *//')
          ansible_port=$(grep 'ansible_port:' /tmp/inventory.yaml | sed 's/.*: *//')
          ansible_user=$(grep 'ansible_user:' /tmp/inventory.yaml | sed 's/.*: *//')
          ansible_ssh_private_key_file=$(grep 'ansible_ssh_private_key_file:' /tmp/inventory.yaml | sed 's/.*: *//')
          ssh_command="ssh -o StrictHostKeyChecking=no -i $ansible_ssh_private_key_file -p $ansible_port $ansible_user@$ansible_host"
          scp_command="scp -o StrictHostKeyChecking=no -i $ansible_ssh_private_key_file -P $ansible_port"
          echo "ansible_host=$ansible_host" >> $GITHUB_OUTPUT
          echo "ansible_port=$ansible_port" >> $GITHUB_OUTPUT
          echo "ansible_user=$ansible_user" >> $GITHUB_OUTPUT
          echo "ansible_ssh_private_key_file=$ansible_ssh_private_key_file" >> $GITHUB_OUTPUT
          echo "ssh_command=$ssh_command" >> $GITHUB_OUTPUT
          echo "scp_command=$scp_command" >> $GITHUB_OUTPUT
        id: setup_rpm_env

      - name: RPM - Test package install/uninstall
        if: ${{ inputs.system == 'rpm' }}
        run: |
          # echo 'Installing package...' is necessary to init the ssh connection prior to running scp
          ${{ steps.setup_rpm_env.outputs.ssh_command }} "echo 'Installing package...'"
          ${{ steps.setup_rpm_env.outputs.scp_command }} ${{ needs.setup-variables.outputs.CURRENT_DIR }}/dev-tools/test-packages/${{needs.setup-variables.outputs.PACKAGE_NAME}} ${{ steps.setup_rpm_env.outputs.ansible_user }}@${{ steps.setup_rpm_env.outputs.ansible_host }}:/home/${{ steps.setup_rpm_env.outputs.ansible_user }}/

          ${{ steps.setup_rpm_env.outputs.ssh_command }} "sudo rpm -i ./${{needs.setup-variables.outputs.PACKAGE_NAME}}; \
              if rpm -q wazuh-dashboard &>/dev/null; then \
                echo 'Package installed'; \
              else \
                echo 'Package not installed'; \
                exit 1; \
              fi; \
              sudo  systemctl daemon-reload;\
              sudo  systemctl enable wazuh-dashboard;\
              sudo  systemctl start wazuh-dashboard;\
              if sudo systemctl status wazuh-dashboard | grep -q 'active (running)'; then \
                echo 'Service running'; \
              else \
                echo 'Service not running' ;\
                exit 1 ;\
              fi; \
              sudo yum remove wazuh-dashboard -y ;\
              sudo rm -rf /var/lib/wazuh-dashboard/ ; \
              sudo rm -rf /usr/share/wazuh-dashboard/ ; \
              sudo rm -rf /etc/wazuh-dashboard/; \
              if rpm -q wazuh-dashboard &>/dev/null; then \
                echo 'Package not uninstalled'; \
                exit 1; \
              else \
                echo 'Package uninstalled'; \
              fi
              "

      - name: RPM - Test package upgrade
        if: ${{ needs.setup-variables.outputs.PREVIOUS != '' && inputs.system == 'rpm' }}
        run: |
          ${{ steps.setup_rpm_env.outputs.ssh_command }} "sudo yum install libcap; \
            sudo rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH; \
            sudo echo -e '[wazuh]\ngpgcheck=1\ngpgkey=https://packages.wazuh.com/key/GPG-KEY-WAZUH\nenabled=1\nname=EL-$releasever - Wazuh\nbaseurl=https://packages.wazuh.com/4.x/yum/\nprotect=1' | sudo tee /etc/yum.repos.d/wazuh.repo; \
            sudo yum install -y wazuh-dashboard-${{needs.setup-variables.outputs.PREVIOUS}}; \
            sudo  systemctl daemon-reload; \
            sudo  systemctl enable wazuh-dashboard; \
            sudo  systemctl start wazuh-dashboard; \
            sudo yum install -y ${{needs.setup-variables.outputs.PACKAGE_NAME}}; \
            sudo systemctl restart wazuh-dashboard; \
            if rpm -q wazuh-dashboard | grep -q '${{needs.setup-variables.outputs.VERSION}}'; then \
              echo 'Package upgraded'; \
            else \
              echo 'Package not upgraded'; \
              exit 1; \
            fi; \
            if sudo systemctl status wazuh-dashboard | grep -q 'active (running)'; then \
              echo 'Service running'; \
            else \
              echo 'Service not running'; \
              exit 1; \
            fi
            "
      - name: Destroy Allocator Machine
        #DO NOT DELETE. This ensures that the generated instance is destroyed even if the job fails.
        if: ${{ always() }}
        ########################################
        run: |
          if [ "${{ inputs.system }}" = "rpm" ]; then
            echo "Destroying Allocator Machine"
            cd wazuh-automation/deployability
            python3 modules/allocation/main.py --action delete --track-output "/tmp/track.yaml"
          fi

  upload-package:
    needs: [setup-variables, test-package]
    runs-on: ${{ inputs.architecture == 'arm64' && 'wz-linux-arm64' || 'wz-linux-amd64' }}
    name: Upload package
    steps:
      - name: Set up AWS CLI
        uses: aws-actions/configure-aws-credentials@v4
        with:
          aws-access-key-id: ${{ secrets.CI_INTERNAL_DEVELOPMENT_BUCKET_USER_ACCESS_KEY }}
          aws-secret-access-key: ${{ secrets.CI_INTERNAL_DEVELOPMENT_BUCKET_USER_SECRET_KEY }}
          aws-region: ${{ secrets.CI_AWS_REGION }}

      - name: Download  artifact
        uses: actions/download-artifact@v4
        with:
          name: ${{needs.setup-variables.outputs.PACKAGE_NAME}}
          path: ./

      - name: Download  checksum
        if: ${{ inputs.checksum }}
        uses: actions/download-artifact@v4
        with:
          name: ${{needs.setup-variables.outputs.PACKAGE_NAME}}.sha512
          path: ./

      - name: Upload package
        run: |
          echo "Uploading package"
          aws s3 cp ./${{needs.setup-variables.outputs.PACKAGE_NAME}} s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/
          s3uri="s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/${{needs.setup-variables.outputs.PACKAGE_NAME}}"
          echo "S3 URI: ${s3uri}"

      - name: Upload SHA512
        if: ${{ inputs.checksum }}
        run: |
          echo "Uploading checksum"
          aws s3 cp ./${{needs.setup-variables.outputs.PACKAGE_NAME}}.sha512 s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/
          s3uri="s3://xdrsiem-packages-dev-internal/development/wazuh/5.x/main/packages/${{needs.setup-variables.outputs.PACKAGE_NAME}}.sha512"
          echo "S3 sha512 URI: ${s3uri}"