Release 20260723

.githooks/pre-commit

@@ -0,0 +1,28 @@
+#!/usr/bin/env sh
+set -eu
+
+# Pre-commit dispatcher: runs all executable scripts in pre-commit.d/.
+#
+# Each script receives the same stdin (list of refs being committed) and the
+# same arguments. A non-zero exit from any script aborts the push.
+
+hook_dir="$(cd "$(dirname "$0")" && pwd)"
+script_dir="${hook_dir}/pre-commit.d"
+
+# Check if directory exist
+if [ ! -d "$script_dir" ]; then
+  echo "Error: directory '$script_dir' does not exist." >&2
+  exit 0
+fi
+
+# buffer stdin so every script gets the same input
+input=$(cat)
+
+exit_code=0
+for script in "$script_dir"/*; do
+  # Check if scripts are executable and run them
+  [ -x "$script" ] || continue
+  echo "$input" | "$script" "$@" || exit_code=$?
+done
+
+exit $exit_code

.githooks/pre-commit.d/01_gitleaks.sh

@@ -0,0 +1,12 @@
+#!/usr/bin/env sh
+set -eu
+
+# ensure gitleaks is available
+if ! command -v gitleaks >/dev/null 2>&1; then
+  echo "Error: gitleaks is not installed or not in PATH." >&2
+  echo "Install: https://github.com/gitleaks/gitleaks#install" >&2
+  exit 1
+fi
+
+# scan for secrets before commit
+gitleaks protect -v --staged --exit-code=2

.githooks/pre-push

@@ -0,0 +1,28 @@
+#!/usr/bin/env sh
+set -eu
+
+# Pre-push dispatcher: runs all executable scripts in pre-push.d/.
+#
+# Each script receives the same stdin (list of refs being pushed) and the
+# same arguments. A non-zero exit from any script aborts the push.
+
+hook_dir="$(cd "$(dirname "$0")" && pwd)"
+script_dir="${hook_dir}/pre-push.d"
+
+# Check if directory exist
+if [ ! -d "$script_dir" ]; then
+  echo "Error: directory '$script_dir' does not exist." >&2
+  exit 0
+fi
+
+# buffer stdin so every script gets the same input
+input=$(cat)
+
+exit_code=0
+for script in "$script_dir"/*; do
+  # Check if scripts are executable and run them
+  [ -x "$script" ] || continue
+  echo "$input" | "$script" "$@" || exit_code=$?
+done
+
+exit $exit_code

.githooks/pre-push.d/01_gitleaks.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env sh
+set -eu
+
+# Scan only the commits being pushed for secrets.
+#
+# Two traps this avoids on purpose:
+#   - --no-git scans the whole working tree, including the multi-GB data/
+#     and logs/ dirs git ignores, which hangs every push;
+#   - scanning the full history keeps re-flagging the dev-image test
+#     credentials committed long ago, which blocks every push.
+# git's pre-push contract feeds "<localref> <localsha> <remoteref>
+# <remotesha>" lines on stdin; we scan just the new range each carries.
+
+is_zero() {
+  case "$1" in
+    *[!0]*) return 1 ;;
+    *) return 0 ;;
+  esac
+}
+
+status=0
+while read -r _local_ref local_sha _remote_ref remote_sha; do
+  # Branch deletion: nothing to scan.
+  if is_zero "$local_sha"; then
+    continue
+  fi
+
+  if is_zero "$remote_sha"; then
+    # New branch: scan commits not yet present on any remote.
+    log_opts="$local_sha --not --remotes"
+  else
+    # Existing branch: scan only the newly pushed range.
+    log_opts="$remote_sha..$local_sha"
+  fi
+
+  if ! gitleaks detect \
+    --log-opts="$log_opts" \
+    --exit-code=2 \
+    --verbose \
+    --no-banner; then
+    status=1
+  fi
+done
+
+exit "$status"

.github/CODEOWNERS

@@ -1,8 +1,17 @@
-*                   @centreon/owners-lua
+*                       @centreon/owners-lua
 
-*.md                @centreon/owners-doc
-*.mdx               @centreon/owners-doc
+*.md                    @centreon/owners-doc
+*.mdx                   @centreon/owners-doc
 
-.github/**          @centreon/owners-pipelines
-packaging/**        @centreon/owners-pipelines
-selinux/**          @centreon/owners-pipelines
+packaging/**            @centreon/owners-pipelines
+selinux/**              @centreon/owners-pipelines
+
+# Pipelines Codeowners rules
+.github/**                    @centreon/owners-pipelines
+.yamlfix.toml                 @centreon/owners-pipelines
+
+# Security Codeowners rules
+.gitleaks.toml                @centreon/owners-security
+.gitleaksignore               @centreon/owners-security
+.githooks/pre-commit          @centreon/owners-security
+**/secu-*.yml                 @centreon/owners-security

.github/actions/deb-delivery/action.yml

@@ -22,24 +22,28 @@ runs:
   steps:
     - if: ${{ ! (inputs.distrib == 'jammy' && inputs.stability == 'stable') }}
       name: Use cache DEB files
-      uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ./*.deb
         key: ${{ inputs.cache_key }}
         fail-on-cache-miss: true
 
     - if: ${{ ! (inputs.distrib == 'jammy' && inputs.stability == 'stable') }}
-      uses: jfrog/setup-jfrog-cli@901bb9632db90821c2d3f076012bdeaf66598555 # v3.4.1
+      uses: jfrog/setup-jfrog-cli@1641575d87647fb969c0545f0b6a76873e328b7c # v5.0.0
       env:
         JF_URL: https://centreon.jfrog.io
         JF_ACCESS_TOKEN: ${{ inputs.artifactory_token }}
 
     - if: ${{ ! (inputs.distrib == 'jammy' && inputs.stability == 'stable') }}
       name: Publish DEBs
+      env:
+        MODULE_NAME: ${{ inputs.module_name }}
+        DISTRIB: ${{ inputs.distrib }}
+        STABILITY: ${{ inputs.stability }}
       run: |
         FILES="*.deb"
 
-        if [[ "${{ inputs.distrib }}" == "jammy" ]]; then
+        if [[ "$DISTRIB" == "jammy" || "$DISTRIB" == "noble" ]]; then
           REPO_PREFIX="ubuntu"
         else
           REPO_PREFIX="apt"
@@ -50,6 +54,6 @@ runs:
 
           ARCH=$(echo $FILE | cut -d '_' -f3 | cut -d '.' -f1)
 
-          jf rt upload "$FILE" "${REPO_PREFIX}-plugins-${{ inputs.stability }}/pool/${{ inputs.module_name }}/" --deb "${{ inputs.distrib }}/main/$ARCH"
+          jf rt upload "$FILE" "${REPO_PREFIX}-plugins-$STABILITY/pool/$MODULE_NAME/" --deb "$DISTRIB/main/$ARCH"
         done
       shell: bash

.github/actions/package-nfpm/action.yml

@@ -38,6 +38,9 @@ inputs:
   stability:
     description: "Branch stability (stable, testing, unstable, canary)"
     required: true
+  artifact_name:
+    description: The name of the uploaded artifact
+    required: false
 
 runs:
   using: composite
@@ -53,19 +56,27 @@ runs:
       env:
         RPM_GPG_SIGNING_KEY_ID: ${{ inputs.rpm_gpg_signing_key_id }}
         RPM_GPG_SIGNING_PASSPHRASE: ${{ inputs.rpm_gpg_signing_passphrase }}
+        INPUT_VERSION: ${{ inputs.version }}
+        INPUT_RELEASE: ${{ inputs.release }}
+        INPUT_ARCH: ${{ inputs.arch }}
+        INPUT_PACKAGE_EXTENSION: ${{ inputs.package_extension }}
+        INPUT_DISTRIB: ${{ inputs.distrib }}
+        INPUT_STABILITY: ${{ inputs.stability }}
+        INPUT_NFPM_FILE_PATTERN: ${{ inputs.nfpm_file_pattern }}
+        INPUT_COMMIT_HASH: ${{ inputs.commit_hash }}
       run: |
-        export VERSION="${{ inputs.version }}"
-        export RELEASE="${{ inputs.release }}"
-        export ARCH="${{ inputs.arch }}"
+        export VERSION="$INPUT_VERSION"
+        export RELEASE="$INPUT_RELEASE"
+        export ARCH="$INPUT_ARCH"
 
-        if  [ "${{ inputs.package_extension }}" = "rpm" ]; then
-          export DIST=".${{ inputs.distrib }}"
+        if [ "$INPUT_PACKAGE_EXTENSION" = "rpm" ]; then
+          export DIST=".${INPUT_DISTRIB}"
         else
           export DIST=""
-          if [ "${{ inputs.stability }}" = "unstable" ] || [ "${{ inputs.stability }}" = "canary" ]; then
-            export RELEASE="$RELEASE~${{ inputs.distrib }}"
+          if [ "$INPUT_STABILITY" = "unstable" ] || [ "$INPUT_STABILITY" = "canary" ]; then
+            export RELEASE="${RELEASE}~${INPUT_DISTRIB}"
           else
-            export RELEASE="1~${{ inputs.distrib }}"
+            export RELEASE="1~${INPUT_DISTRIB}"
           fi
         fi
 
@@ -80,29 +91,44 @@ runs:
         export RPM_SIGNING_KEY_ID="$RPM_GPG_SIGNING_KEY_ID"
         export NFPM_RPM_PASSPHRASE="$RPM_GPG_SIGNING_PASSPHRASE"
 
-        for FILE in ${{ inputs.nfpm_file_pattern }}; do
+        for FILE in $INPUT_NFPM_FILE_PATTERN; do
           DIRNAME=$(dirname $FILE)
           BASENAME=$(basename $FILE)
           cd $DIRNAME
           sed -i "s/@luaver@/$luaver/g" $BASENAME
-          sed -i "s/@COMMIT_HASH@/${{ inputs.commit_hash }}/g" $BASENAME
-          nfpm package --config $BASENAME --packager ${{ inputs.package_extension }}
+          sed -i "s/@VERSION@/${INPUT_VERSION}/g" $BASENAME
+          sed -i "s/@COMMIT_HASH@/${INPUT_COMMIT_HASH}/g" $BASENAME
+          nfpm package --config "$BASENAME" --packager "$INPUT_PACKAGE_EXTENSION"
           cd -
-          mv $DIRNAME/*.${{ inputs.package_extension }} ./
+          mv $DIRNAME/*.$INPUT_PACKAGE_EXTENSION ./
         done
       shell: bash
 
     - name: Cache packages
-      uses: actions/cache/save@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+      uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
       with:
         path: ./*.${{ inputs.package_extension }}
         key: ${{ inputs.cache_key }}
 
-    # Update if condition to true to get packages as artifacts
-    - if: ${{ false }}
+    # Add to your PR the label upload-artifacts to get packages as artifacts
+    - if: ${{ contains(github.event.pull_request.labels.*.name, 'upload-artifacts') }}
+      name: Get artifact name
+      id: get-artifact-name
+      env:
+        INPUT_ARTIFACT_NAME: ${{ inputs.artifact_name }}
+        INPUT_DISTRIB: ${{ inputs.distrib }}
+      run: |
+        if [ -z "$INPUT_ARTIFACT_NAME" ]; then
+          echo "artifact_name=packages-${INPUT_DISTRIB}" >> "$GITHUB_OUTPUT"
+        else
+          echo "artifact_name=${INPUT_ARTIFACT_NAME}" >> "$GITHUB_OUTPUT"
+        fi
+      shell: bash
+
+    - if: ${{ contains(github.event.pull_request.labels.*.name, 'upload-artifacts') }}
       name: Upload package artifacts
       uses: actions/upload-artifact@26f96dfa697d77e81fd5907df203aa23a56210a8 # v4.3.0
       with:
-        name: packages-${{ inputs.distrib }}
+        name: ${{ steps.get-artifact-name.outputs.artifact_name }}
         path: ./*.${{ inputs.package_extension}}
         retention-days: 1

.github/actions/rpm-delivery/action.yml

@@ -21,29 +21,33 @@ runs:
   using: "composite"
   steps:
     - name: Use cache RPM files
-      uses: actions/cache/restore@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ./*.rpm
         key: ${{ inputs.cache_key }}
         fail-on-cache-miss: true
 
-    - uses: jfrog/setup-jfrog-cli@901bb9632db90821c2d3f076012bdeaf66598555 # v3.4.1
+    - uses: jfrog/setup-jfrog-cli@1641575d87647fb969c0545f0b6a76873e328b7c # v5.0.0
       env:
         JF_URL: https://centreon.jfrog.io
         JF_ACCESS_TOKEN: ${{ inputs.artifactory_token }}
 
     - name: Publish RPMs
+      env:
+        MODULE_NAME: ${{ inputs.module_name }}
+        DISTRIB: ${{ inputs.distrib }}
+        STABILITY: ${{ inputs.stability }}
       run: |
         FILES="*.rpm"
 
-        echo "[DEBUG] - Distrib: ${{ inputs.distrib }}"
+        echo "[DEBUG] - Distrib: $DISTRIB"
 
-        if [ -z "${{ inputs.module_name }}" ]; then
+        if [ -z "$MODULE_NAME" ]; then
           echo "module name is required"
           exit 1
         fi
 
-        if [ -z "${{ inputs.distrib }}" ]; then
+        if [ -z "$DISTRIB" ]; then
           echo "distrib is required"
           exit 1
         fi
@@ -62,10 +66,10 @@ runs:
 
         for ARCH in "noarch" "x86_64"; do
           if [ "$(ls -A $ARCH)" ]; then
-            if [ "${{ inputs.stability }}" == "stable" ]; then
-              jf rt upload "$ARCH/*.rpm" "rpm-plugins/${{ inputs.distrib }}/${{ inputs.stability }}/$ARCH/RPMS/${{ inputs.module_name }}/" --flat
+            if [ "$STABILITY" == "stable" ]; then
+              jf rt upload "${ARCH}/*.rpm" "rpm-plugins/${DISTRIB}/${STABILITY}/${ARCH}/RPMS/${MODULE_NAME}/" --flat
             else
-              jf rt upload "$ARCH/*.rpm" "rpm-plugins/${{ inputs.distrib }}/${{ inputs.stability }}/$ARCH/${{ inputs.module_name }}/" --flat
+              jf rt upload "${ARCH}/*.rpm" "rpm-plugins/${DISTRIB}/${STABILITY}/${ARCH}/${MODULE_NAME}/" --flat
             fi
           fi
         done