kibana-mitre-update.yml

name: Check MITRE ATT&CK Version Updates Are Synced

on:
  workflow_dispatch:
    inputs:
      branches:
        description: 'List of branches to lock versions (ordered, comma separated)'
        required: true
        default: 'issue-3100'
  pull_request:
    paths:
       - 'detection_rules/etc/attack-v*.json.gz'

jobs:
  create_issue:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout code
        uses: actions/checkout@v4

      - name: Get MITRE Attack changed files
        id: changed-attack-files
        uses: tj-actions/changed-files@v44

      - name: Extract version from file name
        id: extract_version
        if: steps.changed-attack-files.outputs.any_changed == 'true'
        env:
          ALL_CHANGED_FILES: ${{ steps.changed-attack-files.outputs.all_changed_files }}
        run: |
          echo "List all the files that have changed: $ALL_CHANGED_FILES"
          for file in ${ALL_CHANGED_FILES}; do
            VERSION=$(echo $FILENAME | grep -o 'v[^.]*')
            echo "::set-output name=version::$VERSION"
          done

      - name: Create issue in elastic/kibana repository
        run: |
          ISSUE_TITLE="Update MITRE ATT&CK to ${{ steps.extract_version.outputs.version }}"
          ISSUE_BODY="The detection rules MITRE ATT&CK version has been updated to ${{ steps.extract_version.outputs.version }}. Please update the MITRE ATT&CK version in Kibana accordingly."
          
          echo "Creating issue with title: $ISSUE_TITLE"
          echo "Creating issue with body: $ISSUE_BODY"

        env:
          GITHUB_TOKEN: ${{ secrets.PROTECTIONS_MACHINE_TOKEN }}