Skip to content

Commit da0a77f

Browse files
shashank-elasticshashank-elastic
authored
Merge branch 'main' into renovate/tj-actions-changed-files-46.x
2 parents 0685eef + c6f1c90 commit da0a77f

File tree

325 files changed

+12281
-2563
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

325 files changed

+12281
-2563
lines changed

‎.github/workflows/add-guidelines.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ jobs:
99
runs-on: ubuntu-latest
1010
steps:
1111
- name: Check out the repository
12-
uses: actions/checkout@v4
12+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
1313

1414
- name: Set environment variable for early exit control
1515
id: check_label
@@ -47,14 +47,14 @@ jobs:
4747
4848
- name: Fail if no relevant labels are found
4949
if: env.GUIDELINES_FILE == ''
50-
uses: actions/github-script@v7
50+
uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
5151
with:
5252
script: |
5353
core.setFailed('No appropriate GitHub label found in the PR. Failing the job.')
5454
5555
- name: Add Guidelines Comment
5656
if: env.CONTINUE_JOB == 'true' && (github.event.action == 'opened' || github.event.action == 'labeled')
57-
uses: mshick/add-pr-comment@v2
57+
uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2
5858
with:
5959
message-path: ${{ env.GUIDELINES_FILE }}
6060
repo-token: ${{ secrets.GITHUB_TOKEN }}

‎.github/workflows/backport.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
github.event.pull_request.state == 'open' && !github.event.pull_request.draft
2222
steps:
2323
- name: 'Apply default "backport: auto" label'
24-
uses: actions/github-script@v4
24+
uses: actions/github-script@10b53a9ec6c222bb4ce97aa6bd2b5f739696b536 # v4
2525
if: |
2626
!contains(github.event.pull_request.labels.*.name, 'backport: auto') &&
2727
!contains(github.event.pull_request.labels.*.name, 'backport: skip')
@@ -34,7 +34,7 @@ jobs:
3434
labels: ['backport: auto']
3535
})
3636
- name: 'Remove "backport: auto" if "backport: skip" is set'
37-
uses: actions/github-script@v4
37+
uses: actions/github-script@10b53a9ec6c222bb4ce97aa6bd2b5f739696b536 # v4
3838
if: |
3939
contains(github.event.pull_request.labels.*.name, 'backport: auto') &&
4040
contains(github.event.pull_request.labels.*.name, 'backport: skip')
@@ -65,7 +65,7 @@ jobs:
6565

6666
steps:
6767
- name: Checkout repo
68-
uses: actions/checkout@v4
68+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
6969
with:
7070
token: ${{ secrets.WRITE_TRADEBOT_DETECTION_RULES_TOKEN }}
7171
ref: main
@@ -91,7 +91,7 @@ jobs:
9191
git reset --soft HEAD^
9292
9393
- name: Setup Python 3.12
94-
uses: actions/setup-python@v5
94+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
9595
with:
9696
python-version: '3.12'
9797

@@ -159,7 +159,7 @@ jobs:
159159
git push
160160
161161
- name: "Notify slack on failure"
162-
uses: craftech-io/slack-action@v1
162+
uses: craftech-io/slack-action@fb1d4e50375d7758efb90fa0564734bae931f84f # v1
163163
with:
164164
slack_webhook_url: ${{ secrets.EXTERNAL_SLACK_DETECTION_RULES_URL }}
165165
status: failure

‎.github/workflows/branch-status-checks.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,14 @@ jobs:
1818
steps:
1919
- name: Get Backport Status
2020
id: get_backport_status
21-
uses: fjogeleit/http-request-action@v1
21+
uses: fjogeleit/http-request-action@bf78da14118941f7e940279dd58f67e863cbeff6 # v1
2222
with:
2323
url: "https://api.github.com/repos/elastic/detection-rules/actions/workflows/pythonpackage.yml/runs?per_page=1&branch=${{matrix.target_branch}}"
2424
method: 'GET'
2525
bearerToken: ${{ secrets.READ_ELASTIC_DETECTION_RULES_ORG_TOKEN }}
2626

2727
- name: Check Backport Status
28-
uses: actions/github-script@v6
28+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
2929
with:
3030
script: |
3131
const workflow_status = ${{ toJSON(fromJSON(steps.get_backport_status.outputs.response).workflow_runs[0].status) }}

‎.github/workflows/code-checks.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,12 +17,12 @@ jobs:
1717
runs-on: ubuntu-latest
1818

1919
steps:
20-
- uses: actions/checkout@v4
20+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
2121
with:
2222
fetch-depth: 1
2323

2424
- name: Set up Python 3.13
25-
uses: actions/setup-python@v5
25+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
2626
with:
2727
python-version: '3.13'
2828

‎.github/workflows/community.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ jobs:
1212
runs-on: ubuntu-latest
1313
steps:
1414
- name: Check if member of elastic org
15-
uses: actions/github-script@v6
15+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
1616
id: membership
1717
with:
1818
github-token: ${{ secrets.READ_ELASTIC_DETECTION_RULES_ORG_TOKEN }}
@@ -40,7 +40,7 @@ jobs:
4040
4141
4242
- name: Add label for community members
43-
uses: actions/github-script@v6
43+
uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6
4444
if: ${{ steps.membership.outputs.result == 'notMember' }}
4545
with:
4646
script: |

‎.github/workflows/esql-validation.yml‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
name: ES|QL Validation
2+
on:
3+
pull_request:
4+
branches: [ "*" ]
5+
jobs:
6+
build-and-validate:
7+
runs-on: ubuntu-latest
8+
9+
steps:
10+
- name: Setup Detection Rules
11+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
12+
with:
13+
fetch-depth: 0
14+
path: detection-rules
15+
16+
- name: Check if new or modified rule files are ESQL rules
17+
id: check-esql
18+
run: |
19+
cd detection-rules
20+
21+
# Check if the event is a push
22+
if [ "${{ github.event_name }}" = "push" ]; then
23+
echo "Triggered by a push event. Setting run_esql=true."
24+
echo "run_esql=true" >> $GITHUB_ENV
25+
exit 0
26+
fi
27+
28+
MODIFIED_FILES=$(git diff --name-only --diff-filter=AM HEAD~1 | grep '^rules/.*\.toml$' || true)
29+
if [ -z "$MODIFIED_FILES" ]; then
30+
echo "No modified or new .toml files found. Skipping workflow."
31+
echo "run_esql=false" >> $GITHUB_ENV
32+
exit 0
33+
fi
34+
35+
if ! grep -q 'type = "esql"' $MODIFIED_FILES; then
36+
echo "No 'type = \"esql\"' found in the modified .toml files. Skipping workflow."
37+
echo "run_esql=false" >> $GITHUB_ENV
38+
exit 0
39+
fi
40+
41+
echo "run_esql=true" >> $GITHUB_ENV
42+
43+
- name: Check out repository
44+
env:
45+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id }}
46+
DR_API_KEY: ${{ secrets.dr_api_key }}
47+
if: ${{ !env.DR_CLOUD_ID && !env.DR_API_KEY && env.run_esql == 'true' }}
48+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
49+
with:
50+
path: elastic-container
51+
repository: peasead/elastic-container
52+
53+
- name: Build and run containers
54+
env:
55+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id }}
56+
DR_API_KEY: ${{ secrets.dr_api_key }}
57+
if: ${{ !env.DR_CLOUD_ID && !env.DR_API_KEY && env.run_esql == 'true' }}
58+
run: |
59+
cd elastic-container
60+
GENERATED_PASSWORD=$(openssl rand -base64 16)
61+
sed -i "s|changeme|$GENERATED_PASSWORD|" .env
62+
echo "::add-mask::$GENERATED_PASSWORD"
63+
echo "GENERATED_PASSWORD=$GENERATED_PASSWORD" >> $GITHUB_ENV
64+
set -x
65+
bash elastic-container.sh start
66+
67+
- name: Get API Key and setup auth
68+
env:
69+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id }}
70+
DR_API_KEY: ${{ secrets.dr_api_key }}
71+
DR_ELASTICSEARCH_URL: "https://localhost:9200"
72+
ES_USER: "elastic"
73+
ES_PASSWORD: ${{ env.GENERATED_PASSWORD }}
74+
if: ${{ !env.DR_CLOUD_ID && !env.DR_API_KEY && env.run_esql == 'true' }}
75+
run: |
76+
cd detection-rules
77+
response=$(curl -k -X POST -u "$ES_USER:$ES_PASSWORD" -H "Content-Type: application/json" -d '{
78+
"name": "tmp-api-key",
79+
"expiration": "1d"
80+
}' "$DR_ELASTICSEARCH_URL/_security/api_key")
81+
82+
DR_API_KEY=$(echo "$response" | jq -r '.encoded')
83+
echo "::add-mask::$DR_API_KEY"
84+
echo "DR_API_KEY=$DR_API_KEY" >> $GITHUB_ENV
85+
86+
- name: Set up Python 3.13
87+
if: ${{ env.run_esql == 'true' }}
88+
uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6
89+
with:
90+
python-version: '3.13'
91+
92+
- name: Install dependencies
93+
if: ${{ env.run_esql == 'true' }}
94+
run: |
95+
cd detection-rules
96+
python -m pip install --upgrade pip
97+
pip cache purge
98+
pip install .[dev]
99+
100+
- name: Remote Test ESQL Rules
101+
if: ${{ env.run_esql == 'true' }}
102+
env:
103+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id || '' }}
104+
DR_KIBANA_URL: ${{ secrets.dr_cloud_id == '' && 'https://localhost:5601' || '' }}
105+
DR_ELASTICSEARCH_URL: ${{ secrets.dr_cloud_id == '' && 'https://localhost:9200' || '' }}
106+
DR_API_KEY: ${{ secrets.dr_api_key || env.DR_API_KEY }}
107+
DR_IGNORE_SSL_ERRORS: ${{ secrets.dr_cloud_id == '' && 'true' || '' }}
108+
run: |
109+
cd detection-rules
110+
python -m detection_rules dev test esql-remote-validation

‎.github/workflows/get-target-branches.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -14,10 +14,10 @@ jobs:
1414
outputs:
1515
matrix: ${{ steps.get-branch-list.outputs.matrix }}
1616
steps:
17-
- uses: actions/checkout@v4
17+
- uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
1818

1919
- name: Set up Python 3.12
20-
uses: actions/setup-python@v5
20+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
2121
with:
2222
python-version: '3.12'
2323

‎.github/workflows/kibana-mitre-update.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ jobs:
1414
KIBANA_ISSUE_NUMBER: 166152 # Define the Kibana issue number as a variable
1515
steps:
1616
- name: Checkout code
17-
uses: actions/checkout@v4
17+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
1818

1919
- name: Get MITRE Attack changed files
2020
id: changed-attack-files

‎.github/workflows/lock-versions.yml‎

Lines changed: 62 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,28 +6,28 @@ on:
66
description: 'List of branches to lock versions (ordered, comma separated)'
77
required: true
88
# 7.17 was intentionally skipped because it was added late and was bug fix only
9-
default: '8.18,8.19,9.0,9.1'
9+
default: '8.19,9.0,9.1,9.2'
1010

1111
jobs:
1212
pr:
1313
runs-on: ubuntu-latest
1414

1515
steps:
1616
- name: Validate the source branch
17-
uses: actions/github-script@v3
17+
uses: actions/github-script@ffc2c79a5b2490bd33e0a41c1de74b877714d736 # v3
1818
with:
1919
script: |
2020
if ('refs/heads/main' !== '${{github.event.ref}}') {
2121
core.setFailed('Forbidden branch, expected "main"')
2222
}
2323
2424
- name: Checkout detection-rules
25-
uses: actions/checkout@v4
25+
uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
2626
with:
2727
fetch-depth: 0
2828

2929
- name: Set up Python 3.12
30-
uses: actions/setup-python@v5
30+
uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
3131
with:
3232
python-version: '3.12'
3333

@@ -37,7 +37,57 @@ jobs:
3737
pip cache purge
3838
pip install .[dev]
3939
40+
- name: Check out container repository
41+
env:
42+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id }}
43+
DR_API_KEY: ${{ secrets.dr_api_key }}
44+
if: ${{ !env.DR_CLOUD_ID && !env.DR_API_KEY }}
45+
uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
46+
with:
47+
path: elastic-container
48+
repository: peasead/elastic-container
49+
50+
- name: Build and run containers
51+
env:
52+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id }}
53+
DR_API_KEY: ${{ secrets.dr_api_key }}
54+
if: ${{ !env.DR_CLOUD_ID && !env.DR_API_KEY }}
55+
run: |
56+
cd elastic-container
57+
GENERATED_PASSWORD=$(openssl rand -base64 16)
58+
sed -i "s|changeme|$GENERATED_PASSWORD|" .env
59+
echo "::add-mask::$GENERATED_PASSWORD"
60+
echo "GENERATED_PASSWORD=$GENERATED_PASSWORD" >> $GITHUB_ENV
61+
set -x
62+
bash elastic-container.sh start
63+
64+
- name: Get API Key and setup auth
65+
env:
66+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id }}
67+
DR_API_KEY: ${{ secrets.dr_api_key }}
68+
DR_ELASTICSEARCH_URL: "https://localhost:9200"
69+
ES_USER: "elastic"
70+
ES_PASSWORD: ${{ env.GENERATED_PASSWORD }}
71+
if: ${{ !env.DR_CLOUD_ID && !env.DR_API_KEY }}
72+
run: |
73+
cd detection-rules
74+
response=$(curl -k -X POST -u "$ES_USER:$ES_PASSWORD" -H "Content-Type: application/json" -d '{
75+
"name": "tmp-api-key",
76+
"expiration": "1d"
77+
}' "$DR_ELASTICSEARCH_URL/_security/api_key")
78+
79+
DR_API_KEY=$(echo "$response" | jq -r '.encoded')
80+
echo "::add-mask::$DR_API_KEY"
81+
echo "DR_API_KEY=$DR_API_KEY" >> $GITHUB_ENV
82+
4083
- name: Build release package with navigator files
84+
env:
85+
DR_REMOTE_ESQL_VALIDATION: "true"
86+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id || '' }}
87+
DR_KIBANA_URL: ${{ secrets.dr_cloud_id == '' && 'https://localhost:5601' || '' }}
88+
DR_ELASTICSEARCH_URL: ${{ secrets.dr_cloud_id == '' && 'https://localhost:9200' || '' }}
89+
DR_API_KEY: ${{ secrets.dr_api_key || env.DR_API_KEY }}
90+
DR_IGNORE_SSL_ERRORS: ${{ secrets.dr_cloud_id == '' && 'true' || '' }}
4191
run: |
4292
python -m detection_rules dev build-release --generate-navigator
4393
@@ -56,13 +106,19 @@ jobs:
56106
- name: Lock the versions
57107
env:
58108
BRANCHES: "${{github.event.inputs.branches}}"
109+
DR_REMOTE_ESQL_VALIDATION: "true"
110+
DR_CLOUD_ID: ${{ secrets.dr_cloud_id || '' }}
111+
DR_KIBANA_URL: ${{ secrets.dr_cloud_id == '' && 'https://localhost:5601' || '' }}
112+
DR_ELASTICSEARCH_URL: ${{ secrets.dr_cloud_id == '' && 'https://localhost:9200' || '' }}
113+
DR_API_KEY: ${{ secrets.dr_api_key || env.DR_API_KEY }}
114+
DR_IGNORE_SSL_ERRORS: ${{ secrets.dr_cloud_id == '' && 'true' || '' }}
59115
run: |
60116
./detection_rules/etc/lock-multiple.sh $BRANCHES
61117
git add detection_rules/etc/version.lock.json
62118
63119
- name: Create Pull Request
64120
id: cpr
65-
uses: peter-evans/create-pull-request@v3
121+
uses: peter-evans/create-pull-request@18f7dc018cc2cd597073088f7c7591b9d1c02672 # v3
66122
with:
67123
assignees: '${{github.actor}}'
68124
delete-branch: true
@@ -78,7 +134,7 @@ jobs:
78134
labels: "backport: auto"
79135

80136
- name: Archive production artifacts
81-
uses: actions/upload-artifact@v4
137+
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
82138
with:
83139
name: release-files
84140
path: |

0 commit comments

Comments
 (0)