Merge branch 'develop'

# Conflicts:
#	.github/workflows/build.packages.yml
#	.github/workflows/tests.all.yml
#	version.sbt

Author: alexandre-teilhet_stb

.github/workflows/build.docker.baselayer.yml

@@ -18,7 +18,7 @@ jobs:
       actions: read
       contents: read
       packages: write
-    runs-on: [ linux ]
+    runs-on: [ ubuntu-latest ]
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/build.docker.yml

@@ -1,19 +1,10 @@
 name: build.docker.image.cortex
 on:
   workflow_dispatch:
-    inputs:
-      is_prod:
-        description: "Publish docker image in dockerhub?"
-        type: boolean
-        default: false
   workflow_call:
     inputs:
-      is_prod:
-        description: "Publish docker image in dockerhub?"
-        type: boolean
-        default: false
-      override_version:
-        description: "Override version tag (e.g., pr-60 for pull requests)"
+      version:
+        description: "Version to be used (passed as input variable from other workflows)"
         type: string
         required: false
     outputs:
@@ -44,10 +35,9 @@ jobs:
       image_version: ${{ steps.get_version.outputs.app_version }}
     steps:
       - uses: actions/checkout@v4
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
       - uses: ./.github/actions/get_code_version
         id: get_version
+        if: github.event_name != 'workflow_call'
 
   build:
     needs:
@@ -56,12 +46,13 @@ jobs:
       actions: read
       contents: read
       packages: write
+      id-token: write
     runs-on: [ self-hosted, linux, domain=sb ]
     outputs:
-      image_id: ${{ steps.push.outputs.imageid }}
-      image_digest: ${{ steps.push.outputs.digest }}
-      image_metadata: ${{ steps.push.outputs.metadata }}
-      image_version: ${{ inputs.override_version || needs.prepare.outputs.image_version }}
+      image_id: ${{ steps.docker-build.outputs.image_id }}
+      image_digest: ${{ steps.docker-build.outputs.image_digest }}
+      image_metadata: ${{ steps.docker-build.outputs.image_metadata }}
+      image_version: ${{ inputs.version || needs.prepare.outputs.image_version }}
     steps:
       - name: Set up Python
         uses: actions/setup-python@v5
@@ -102,9 +93,6 @@ jobs:
 
       - uses: actions/checkout@v4
 
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-
       - uses: coursier/setup-action@v1
         with:
           jvm: corretto:11
@@ -124,45 +112,38 @@ jobs:
       - name: Build packages
         run: sbt Docker/stage
 
-      - name: setup vault token
-        if: inputs.is_prod
-        run: echo "VAULT_TOKEN=$VAULT_TOKEN" >> $GITHUB_ENV
-
-      - name: Import prod secrets
-        if: inputs.is_prod
-        id: secrets_prod
-        uses: hashicorp/vault-action@v2.5.0
-        with:
-          url: https://vault.service.infra.sb:8200
-          token: ${{ env.VAULT_TOKEN }}
-          tlsSkipVerify: true
-          secrets: |
-            infra/data/ci/dockerhub username   | DOCKERHUB_USERNAME;
-            infra/data/ci/dockerhub token      | DOCKERHUB_TOKEN;
+      - name: Compute clean version (strip -rcN suffix)
+        if: ${{ inputs.version != '' }}
+        id: clean_version
+        env:
+          VERSION: ${{ inputs.version }}
+        run: |
+          clean=$(echo "$VERSION" | sed 's/-rc[0-9]*$//')
+          echo "clean_version=$clean" >> $GITHUB_OUTPUT
 
       - name: Generate docker tags for PR builds
-        if: ${{ inputs.override_version != '' }}
+        if: ${{ inputs.version != '' }}
         id: meta_pr
         uses: docker/metadata-action@v4
         with:
           images: |
             name=${{ vars.SB_GHCR }}/cortex
           tags: |
-            type=raw,value=${{ inputs.override_version }}
+            type=raw,value=${{ inputs.version }}
+            type=raw,value=${{ steps.clean_version.outputs.clean_version }}
           labels: |
             org.opencontainers.image.title=cortex
             org.opencontainers.image.description=A Powerful Observable Analysis and Active Response Engine
             org.opencontainers.image.vendor=StrangeBee
-            org.opencontainers.image.version=${{ inputs.override_version }}
+            org.opencontainers.image.version=${{ steps.clean_version.outputs.clean_version }}
 
       - name: Generate full docker tags for releases
-        if: ${{ inputs.override_version == '' }}
+        if: ${{ inputs.version == '' }}
         id: meta_release
         uses: docker/metadata-action@v4
         with:
           images: |
             name=${{ vars.SB_GHCR }}/cortex
-            name=thehiveproject/cortex,enable=${{ inputs.is_prod }}
           tags: |
             type=raw,value=${{ fromJson(steps.image_details.outputs.image_details)['core_version'] }}
             type=raw,value=${{ needs.prepare.outputs.image_version }}
@@ -174,27 +155,15 @@ jobs:
             org.opencontainers.image.vendor=StrangeBee
             org.opencontainers.image.version=${{ needs.prepare.outputs.image_version }}
 
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
-      - name: Login to GitHub Container Registry
-        if: inputs.is_prod
-        uses: docker/login-action@v3
-        with:
-          username: ${{ steps.secrets_prod.outputs.DOCKERHUB_USERNAME }}
-          password: ${{ steps.secrets_prod.outputs.DOCKERHUB_TOKEN }}
-
-      - name: Build and push docker image
-        uses: docker/build-push-action@v3
-        id: push
+      - name: Build and push Docker image
+        id: docker-build
+        uses: StrangeBee/ci-resources/.github/actions/generic_docker_build@main
         with:
-          no-cache: 'true'
-          context: target/docker/stage
-          push: true
-          platforms: linux/amd64,linux/arm64
-          tags: ${{ inputs.override_version != '' && steps.meta_pr.outputs.tags || steps.meta_release.outputs.tags }}
-          labels: ${{ inputs.override_version != '' && steps.meta_pr.outputs.labels || steps.meta_release.outputs.labels }}
+          skip_checkout: "true"
+          registry_username: ${{ github.actor }}
+          registry_password: ${{ secrets.GITHUB_TOKEN }}
+          image_name: ${{ vars.SB_GHCR }}/cortex
+          docker_context_path: target/docker/stage
+          docker_file_path: target/docker/stage/Dockerfile
+          computed_tags: ${{ inputs.version != '' && steps.meta_pr.outputs.tags || steps.meta_release.outputs.tags }}
+          computed_labels: ${{ inputs.version != '' && steps.meta_pr.outputs.labels || steps.meta_release.outputs.labels }}

.github/workflows/build.docs.yaml

@@ -0,0 +1,44 @@
+---
+name: BuildDocumentation
+on:
+  push:
+    branches:
+      - develop
+    paths:
+      - docs/**
+      - .github/workflows/build.docs.yaml
+permissions:
+  contents: read
+  pages: write
+  id-token: write
+jobs:
+  Deploy:
+    outputs:
+      url: ${{ steps.deployment.outputs.page_url }}
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/configure-pages@v5
+      - uses: actions/checkout@v5
+      - name: Install uv
+        uses: astral-sh/setup-uv@v7
+        with:
+          version: "0.9.18"
+      - run: uvx zensical build --clean
+      - uses: actions/upload-pages-artifact@v4
+        with:
+          path: .site
+      - uses: actions/deploy-pages@v4
+        id: deployment
+  NotifySuccess:
+    if: success()
+    runs-on: ubuntu-latest
+    needs:
+      - Deploy
+    steps:
+      - uses: marocchino/sticky-pull-request-comment@v2
+        with:
+          message: |
+            :rocket: New version of website available at ${{ needs.deploy.outputs.url }}

.github/workflows/build.packages.yml

@@ -1,35 +1,33 @@
 name: Build packages
 on:
-  push:
-    tags: ["*"]
   workflow_dispatch:
+  workflow_call:
     inputs:
-      is_prod:
-        description: Push to prod ?
-        type: boolean
-
-env:
-  AWS_REGION: 'us-east-1'
-  AWS_CONFIG_FILE: "${{ github.workspace }}/.aws/config"
+      version:
+        description: Version to use (e.g. 4.0.1-1-rc3)
+        type: string
+        required: false
+        default: ""
 
 jobs:
   build:
     name: Build
-    runs-on: [linux, self-hosted, domain=sb]
+    runs-on: [self-hosted, domain=sb]
     steps:
       - uses: actions/checkout@v3
 
       - name: Import secrets
         id: secrets
         uses: hashicorp/vault-action@v3
-        if: ${{ github.ref_type == 'tag' || github.event.inputs.is_prod == 'true' }}
         with:
           url: https://vault.service.infra.sb:8200
+          method: token
           token: ${{ secrets.VAULT_TOKEN }}
           tlsSkipVerify: true
           secrets: |
             aws/data/packages/sb-cortex-packages-preprod access_key | AWS_ACCESS_KEY_PREPROD;
             aws/data/packages/sb-cortex-packages-preprod secret_key | AWS_SECRET_KEY_PREPROD;
+            infra/data/ci/pgp private_key | PGP_KEY;
 
       - uses: coursier/setup-action@v1
         with:
@@ -45,7 +43,7 @@ jobs:
           apt install -y rpm dpkg-dev gnupg2 fakeroot
 
       - name: Setup node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v3
         timeout-minutes: 15
         continue-on-error: true
         with:
@@ -55,16 +53,19 @@ jobs:
         run: npm install -g bower
 
       - name: Import PGP Key
-        run: |
-          export GPG_TTY=$(tty)
-          gpg --batch --import - <<< $PGP_KEY
-        env:
-          PGP_KEY: ${{ secrets.PGP_KEY }}
+        uses: crazy-max/ghaction-import-gpg@v6
+        with:
+          gpg_private_key: ${{ steps.secrets.outputs.PGP_KEY }}
+
+      - name: Get code version
+        id: get_version
+        if: github.event_name != 'workflow_call'
+        uses: ./.github/actions/get_code_version
 
       - name: Write version
         id: version
         run: |
-          V=$(sbt -no-colors --error "print version" | awk 'END{print $1}')
+          V="${{ inputs.version || steps.get_version.outputs.app_version }}"
           echo "version=$V"
           echo "version=$V" >> $GITHUB_OUTPUT
 
@@ -77,18 +78,6 @@ jobs:
           mv target/universal/cortex*.zip target/
           ls -al target/
 
-      - name: Make github release
-        if: ${{ github.ref_type == 'tag' }}
-        uses: "softprops/action-gh-release@v1"
-        id: make-release
-        with:
-          generate_release_notes: true
-          files: |
-            target/cortex*.deb
-            target/cortex*.rpm
-            target/cortex*.zip
-            target/cortex*.bom.xml
-
       - name: Store artifacts
         uses: actions/upload-artifact@v4
         with:
@@ -100,47 +89,17 @@ jobs:
             target/cortex*.bom.xml
           retention-days: 3
 
-      - name: Set up Python3
-        if: ${{ github.ref_type == 'tag' || github.event.inputs.is_prod == 'true' }}
-        uses: actions/setup-python@v5
-        with:
-          python-version: 3
+      - name: ls packages
+        run: ls -l target/
 
-      - name: Setup s3
-        if: ${{ github.ref_type == 'tag' || github.event.inputs.is_prod == 'true' }}
-        id: aws
-        shell: bash
-        run: |
-          python3 -m venv "${{ github.workspace }}/.venv"
-          "${{ github.workspace }}/.venv/bin/pip" install awscli
-          AWS="${{ github.workspace }}/.venv/bin/aws"
-          echo "aws=$AWS" >> $GITHUB_OUTPUT
-
-          "$AWS" configure set region "${{ env.AWS_REGION }}" --profile ci
-          "$AWS" configure set output "json"                  --profile ci
-
-          "$AWS" configure set aws_access_key_id     "${{ steps.secrets.outputs.AWS_ACCESS_KEY_PREPROD }}" --profile ci
-          "$AWS" configure set aws_secret_access_key "${{ steps.secrets.outputs.AWS_SECRET_KEY_PREPROD }}" --profile ci
-
-      - name: Upload packages
-        if: ${{ github.ref_type == 'tag' || github.event.inputs.is_prod == 'true' }}
-        run: |
-          cd target
-          AWS="${{ steps.aws.outputs.aws }}"
-          version="$(awk -F. '{print $1"."$2}' <<< ${{ steps.version.outputs.version }})"
-
-          for I in cortex*.bom.xml cortex*.zip cortex*.deb cortex*.rpm
-          do
-            type="${I##*.}"
-            key="${version}/${type}/$I"
-
-            gpg --output "$I.asc" --armor --detach-sig "$I"
-            sha256sum "$I" > "$I.sha256"
-
-            "$AWS" s3 cp --profile ci "$I"        "s3://sb-cortex-packages-preprod/${key}"
-            "$AWS" s3 cp --profile ci "$I.sha256" "s3://sb-cortex-packages-preprod/${version}/sha256/$I.sha256"
-            "$AWS" s3 cp --profile ci "$I.asc"    "s3://sb-cortex-packages-preprod/${version}/asc/$I.asc"
-          done
+      - name: Upload packages to S3
+        uses: StrangeBee/ci-resources/.github/actions/upload.packages.s3@main
+        with:
+          aws-access-key-id: ${{ steps.secrets.outputs.AWS_ACCESS_KEY_PREPROD }}
+          aws-secret-access-key: ${{ steps.secrets.outputs.AWS_SECRET_KEY_PREPROD }}
+          s3-bucket: sb-cortex-packages-preprod
+          version: ${{ steps.version.outputs.version }}
+          product: cortex
 
   notify:
     needs: [ build ]
@@ -155,4 +114,4 @@ jobs:
           channel: "#ci-cortex"
           name: Cortex build
           include_commit_message: true
-          include_jobs: true
+          include_jobs: true

.github/workflows/deploy.nomad.yml

@@ -30,8 +30,7 @@ jobs:
     if: ${{ (github.event.label.name == 'ci:deploy' || contains(github.event.pull_request.labels.*.name, 'ci:deploy')) || github.event_name == 'workflow_dispatch' }}
     uses: ./.github/workflows/build.docker.yml
     with:
-      is_prod: false
-      override_version: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || '' }}
+      version: ${{ github.event_name == 'pull_request' && format('pr-{0}', github.event.number) || '' }}
     secrets: inherit
 
   prepare:
@@ -62,6 +61,7 @@ jobs:
   deploy:
     if: ${{ (github.event.label.name == 'ci:deploy' || contains(github.event.pull_request.labels.*.name, 'ci:deploy')) || github.event_name == 'workflow_dispatch' }}
     needs:
+      - build
       - prepare
     permissions:
       actions: read