Fixes:
https://github.com/fleetdm/fleet/actions/runs/30519842615/job/90797961257.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved end-to-end test packaging reliability on macOS by adding a
retry mechanism with delays and failing after repeated unsuccessful
attempts.
* Updated end-to-end test environment hostname setup on Ubuntu to use a
transient hostname derived from the target architecture.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** #47725 moved the script but didn't update the
workflow
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
N/A - CI-only change, no user-visible impact.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] QA'd all new/changed functionality manually
**How this was tested:**
1. Confirmed `uninstall-fleetd-windows.ps1` does not exist at the old
path (`it-and-security/lib/windows/scripts/`) on `main` -- reproduces
the `CommandNotFoundException`.
2. Confirmed the file exists at the new path
(`docs/solutions/windows/scripts/`).
3. Ran sparse-checkout simulations locally: old path yields no script
file, new path successfully pulls it.
4. Compared old vs new script -- the new version adds an MDM
unenrollment step that is a no-op in E2E (no MDM enrolled), so behavior
is equivalent.
5. Triggered the full E2E agent workflow on this PR branch to verify all
32 Windows jobs pass the "Uninstall Orbit" step.
## Root cause
PR #47725 ("Fix unenroll Windows instructions", merged June 19) moved
`uninstall-fleetd-windows.ps1` from
`it-and-security/lib/windows/scripts/` to
`docs/solutions/windows/scripts/` as part of merging the "turn off MDM"
and "uninstall fleetd" scripts into one. However,
`.github/workflows/e2e-agent.yml` was not updated to reflect the new
path.
This broke all 32 Windows E2E jobs (windows-2025 and windows-11-arm, all
channel/update combinations) at the "Uninstall Orbit" step. The nightly
run has been failing for 2 consecutive cycles (June 20 and 21),
exhausting all 4 retry attempts each time.
## Fix
Update the sparse-checkout path and PowerShell run command in
`e2e-agent.yml` to the new location.
## Note: inconsistent uninstall script locations
After #47725, the uninstall scripts are now in different directories per
OS:
| OS | Uninstall script location |
|---|---|
| macOS | `it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh`
|
| Linux | `it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh`
|
| Windows |
`docs/solutions/windows/scripts/uninstall-fleetd-windows.ps1` |
macOS and Linux remain in `it-and-security/lib/` (Fleet's dogfooding
GitOps config). Windows was moved to `docs/solutions/` (user-facing
documentation). This inconsistency may warrant a follow-up to decide on
a canonical location.
- misfeature — rule enabled, waived only for the 6 Windows shell: cmd
workflows (catches any future misuse elsewhere).
- excessive-permissions and artipacked — fixed and fully enforced
(removed from gate).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD security by disabling credential persistence across
many workflows.
* Tightened workflow permissions to least-privilege for selected build
and analysis jobs.
* Made runner hardening and credential handling explicit in several
deployment and test workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated security hardening tools across multiple GitHub Actions
workflows to the latest available version for enhanced CI/CD
infrastructure protection and resilience.
* Enabled additional security validation rules in workflow configuration
to strengthen infrastructure oversight and improve vulnerability
detection capabilities across build and deployment pipelines.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to, but does not resolve, #45267
Adds a 12h cooldown period such that when npm is resolving dependencies
it will not resolve anything released less than 12 hours ago. This
doesn't apply globally within the fleet project because some portions
use yarn which #45267 will take care of however this does add it to our
CI jobs and the .npmrc files for projects that use npm
I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but
that won't automatically set it on every runner so leaving it in here
for now
As far as QA local builds and CI are both green. Tested
NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally
using the npm package feed https://registry.npmjs.org/-/rss to verify
that recently updated packages either chose an older version OR the
update was blocked if I tried to choose a newer one
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced npm supply-chain security by implementing package
installation policies across build workflows and configuration files to
exclude packages released within the last 12 hours.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add nightly testing across the following:
OS: mac/Linux/Windows
Updates: enabled/disabled
Channels (for each of orbit/osquery\desktop): edge/stable
Arch: arm/x86
Failures are alerted to Slack.
Lucas Manuel Rodriguez
