wooo/awoooi
1
1
Fork 0
Code Issues 2 Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity

fix(iwooos): repair wazuh host trust and retry
All checks were successful
CD Pipeline / workflow-shape (push) Successful in 0s
Details
CD Pipeline / cancel-stale-cd (push) Has been skipped
Details
CD Pipeline / tests (push) Successful in 2m27s
Details
CD Pipeline / build-and-deploy (push) Successful in 6m53s
Details
AWOOOI Harbor 110 Local Repair / workflow-shape (push) Successful in 0s
Details
AWOOOI Harbor 110 Local Repair / harbor-110-local-repair (push) Successful in 1m4s
Details
CD Pipeline / post-deploy-checks (push) Successful in 1m51s
Details

Browse Source
This commit is contained in:
ogt
2026-07-11 10:13:02 +08:00
parent 707846474f
commit 4a4b95e513
11 changed files with 401 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

83
apps/api/src/jobs/awooop_ansible_candidate_backfill_job.py
View File

@@ -10,6 +10,7 @@ from __future__ import annotations
import asyncio
import json
import os
import random
from collections.abc import Awaitable, Callable
from types import SimpleNamespace
@@ -350,10 +351,16 @@ async def enqueue_ai_decision_ansible_candidate(
def _wazuh_posture_incident(
*, automation_run_id: str, bucket_ref: str
*,
automation_run_id: str,
bucket_ref: str,
attempt_ref: str | None = None,
) -> dict[str, Any]:
receipt_ref = (
f"{bucket_ref}-{attempt_ref.upper()}" if attempt_ref else bucket_ref
)
return {
"incident_id": f"IWZ-POSTURE-{bucket_ref}",
"incident_id": f"IWZ-POSTURE-{receipt_ref}",
"project_id": "awoooi",
"status": "INVESTIGATING",
"severity": "low",
@@ -363,7 +370,7 @@ def _wazuh_posture_incident(
"trace_id": automation_run_id,
"run_id": automation_run_id,
"work_item_id": _WAZUH_POSTURE_WORK_ITEM_ID,
"source_receipt_ref": f"scheduled-wazuh-manager-posture:{bucket_ref}",
"source_receipt_ref": f"scheduled-wazuh-manager-posture:{receipt_ref}",
"asset_scope_aliases": [_WAZUH_POSTURE_PUBLIC_ASSET_ALIAS],
"affected_services": ["wazuh-manager", "siem"],
"signals": [
@@ -411,14 +418,24 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
existing = await db.execute(
text("""
SELECT
op_id::text AS op_id,
status,
input ->> 'automation_run_id' AS automation_run_id
FROM automation_operation_log
WHERE operation_type = 'ansible_candidate_matched'
AND input -> 'executor_candidates' @> CAST(:catalog_match AS jsonb)
AND created_at >= NOW() - (:freshness_hours * INTERVAL '1 hour')
ORDER BY created_at DESC
candidate.op_id::text AS op_id,
candidate.status AS candidate_status,
candidate.input ->> 'automation_run_id' AS automation_run_id,
candidate.input ->> 'source_receipt_ref' AS source_receipt_ref,
check_mode.status AS latest_check_status
FROM automation_operation_log candidate
LEFT JOIN LATERAL (
SELECT check_receipt.status
FROM automation_operation_log check_receipt
WHERE check_receipt.parent_op_id = candidate.op_id
AND check_receipt.operation_type = 'ansible_check_mode_executed'
ORDER BY check_receipt.created_at DESC
LIMIT 1
) check_mode ON TRUE
WHERE candidate.operation_type = 'ansible_candidate_matched'
AND candidate.input -> 'executor_candidates' @> CAST(:catalog_match AS jsonb)
AND candidate.created_at >= NOW() - (:freshness_hours * INTERVAL '1 hour')
ORDER BY candidate.created_at DESC
LIMIT 1
"""),
{
@@ -429,7 +446,8 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
},
)
existing_row = existing.mappings().first()
if existing_row:
retry_attempt_ref: str | None = None
if existing_row and existing_row.get("latest_check_status") != "failed":
return {
"status": "fresh_candidate_already_present",
"queued": 0,
@@ -443,6 +461,34 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
"work_item_id": _WAZUH_POSTURE_WORK_ITEM_ID,
"active_blockers": [],
}
if existing_row:
source_sha = os.getenv("AWOOOI_BUILD_COMMIT_SHA", "").strip().lower()
retry_attempt_ref = (
source_sha[:12]
if len(source_sha) >= 12
and all(character in "0123456789abcdef" for character in source_sha)
else "runtime-retry"
)
existing_source_ref = str(
existing_row.get("source_receipt_ref") or ""
).lower()
if existing_source_ref.endswith(f"-{retry_attempt_ref.lower()}"):
return {
"status": "failed_check_retry_already_attempted_for_deploy",
"queued": 0,
"existing": 1,
"evidence_ready": 1,
"automation_run_id": str(
existing_row.get("automation_run_id")
or existing_row.get("op_id")
or ""
),
"work_item_id": _WAZUH_POSTURE_WORK_ITEM_ID,
"retry_of_failed_check_mode": True,
"active_blockers": [
"bounded_retry_already_attempted_for_deploy"
],
}
now = now_taipei()
bucket_hour = (now.hour // freshness_hours) * freshness_hours
@@ -450,12 +496,14 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
automation_run_id = str(
uuid5(
NAMESPACE_URL,
f"awoooi:iwooos:wazuh-manager-posture:{bucket.isoformat()}",
"awoooi:iwooos:wazuh-manager-posture:"
f"{bucket.isoformat()}:{retry_attempt_ref or 'initial'}",
)
)
incident = _wazuh_posture_incident(
automation_run_id=automation_run_id,
bucket_ref=bucket.strftime("%Y%m%d%H"),
attempt_ref=retry_attempt_ref,
)
try:
snapshot = await evidence_collector(
@@ -490,10 +538,14 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
)
return {
"status": (
"queued_for_controlled_executor"
"queued_for_controlled_executor_retry"
if queued and evidence_ready and retry_attempt_ref
else "queued_for_controlled_executor"
if queued and evidence_ready
else (
"queued_for_controlled_executor_with_degraded_context"
"queued_for_controlled_executor_retry_with_degraded_context"
if queued and retry_attempt_ref
else "queued_for_controlled_executor_with_degraded_context"
if queued
else "candidate_race_deduplicated"
)
@@ -503,6 +555,7 @@ async def enqueue_iwooos_wazuh_manager_posture_candidate_once(
"evidence_ready": 1 if evidence_ready else 0,
"automation_run_id": automation_run_id,
"work_item_id": _WAZUH_POSTURE_WORK_ITEM_ID,
"retry_of_failed_check_mode": bool(retry_attempt_ref),
"active_blockers": (
[] if evidence_ready else ["predecision_mcp_or_log_evidence_missing"]
),