- Instead, changes to activity will be specified as a PR to
`audit-logs.md` in the reference doc release branch just like API and
YAML (GitOps) changes
Ran `yarn upgrade` to catch things up. Seeing if tests pass, then will
add other items on top.
---------
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
We're no longer maintaining the tool, it's not tested against current
versions of Fleet, and customer use has been replaced with other
tooling. Removing this so it doesn't keep collecting npm
vulnerabilities.
**Related issue:** Resolves#32999
- Enhanced internal code quality tooling by implementing a custom
linting build configuration.
- Updated continuous integration workflow to utilize the new custom
build process for improved code analysis and consistency checks.
### Confirmed that running local custom `golangci-lint` build with
`nilaway` plugin catches lots of issues when run on `fleet/`:
<img width="1555" height="939" alt="Screenshot 2026-01-29 at 2 47 50 PM"
src="https://github.com/user-attachments/assets/c6a18400-fdf0-4104-97d8-e117efc28ed6"
/>
<img width="301" height="109" alt="Screenshot 2026-01-29 at 2 48 36 PM"
src="https://github.com/user-attachments/assets/b459ee7b-b391-457a-9191-17d56a80c783"
/>
### Confirmed that new incremental CI step using custom `golangci-lint`
build with `nilaway` plugin _does not_ check any `.go` files when none
have been modified, and so passes successfully (incremental check works
as expected):
<img width="337" height="197" alt="Screenshot 2026-01-29 at 2 45 24 PM"
src="https://github.com/user-attachments/assets/c7ae585e-2e10-4ebf-a3a3-96c26063f1e4"
/>
### Confirmed that new incremental CI step using custom `golangci-lint`
build with `nilaway` plugin _does_ check modified lines of `.go` files,
and so successfully flags a potentially unsafe dereference and fails the
job (incremental check works as expected):
<img width="825" height="491" alt="Screenshot 2026-01-29 at 5 50 01 PM"
src="https://github.com/user-attachments/assets/82bc5616-6fb9-4357-b8bc-c7eebc42c2d8"
/>
### Honorable mention:
`nilaway` agrees that `listHostSoftware` is a wild beast:
<img width="1277" height="190" alt="Screenshot 2026-01-29 at 5 52 32 PM"
src="https://github.com/user-attachments/assets/dfade2a8-fbcc-4bae-98f9-6bf1089620d2"
/>
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Fleet dev cycle reliability improvements**
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
Updated permissions changes section to include a link to the
documentation for easy reference.
The term "Manage access" isn't referenced on the permissions/role-based
access page, and it wasn't clear in a search of the docs that you should
go to the role-based access doc. Using redirect url and term
"permissions" in case we change the name of this doc again in the
future.
Automates bug triage by tagging issues based on age: `~old bug` for bugs
≥180 days, `~aging bug` for bugs ≥90 days.
Relates to #39155.
## Changes
**New workflow: `.github/workflows/tag-aging-bugs.yml`**
- Runs daily at 8:06 UTC via cron, supports manual dispatch
- Dry run mode (default: false) logs actions without modifying labels
- Two-pass processing:
1. Bugs ≥180 days: adds `~old bug`, removes `~aging bug` if present
2. Bugs ≥90 days without either label: adds `~aging bug`
- Uses github-script with pagination for scalability
- Follows repo patterns (harden-runner, proper permissions)
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] QA'd all new/changed functionality manually
<!-- START COPILOT CODING AGENT SUFFIX -->
<!-- START COPILOT ORIGINAL PROMPT -->
<details>
<summary>Original prompt</summary>
> Add a GitHub Actions workflow that runs daily at 8:06am UTC, and can
be manually dispatched. In that workflow, retrieve all issues labelled
`bug` created >= 180 days ago that don't include the `~old bug` tag,
then for each bug add the `~old bug` tag and remove `~aging bug` if it
is applied. Then retrieve all issues labelled `bug` created >= 90 days
ago that has neither `~aging bug` nor `~old bug` tags, and add the
`~aging bug` tag. Include a dry run workflow parameter, default off,
that logs rather than setting the label.
</details>
<!-- START COPILOT CODING AGENT TIPS -->
---
💬 We'd love your input! Share your thoughts on Copilot coding agent in
our [2 minute survey](https://gh.io/copilot-coding-agent-survey).
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
This pull request updates the logic used to check whether macOS
applications (1Password, Firefox, and Slack) are up to date. The new
queries simplify and improve accuracy by directly identifying outdated
app versions, rather than relying on a combination of existence and
version checks.
**Policy query logic updates:**
* Updated the query in `update-1password.yml` to directly select hosts
with outdated 1Password versions, making the check more precise.
* Updated the query in `update-firefox.yml` to directly select hosts
with outdated Firefox versions, improving accuracy.
* Updated the query in `update-slack.yml` to directly select hosts with
outdated Slack versions, ensuring more reliable detection.
**Script logic update:**
* Changed the query line construction in
`.github/scripts/dogfood-policy-updater-latest-1password-macos.sh` to
match the new logic for identifying outdated 1Password installations.
Resolves#35299.
Triggers on issue create. Tested the same code in
https://github.com/iansltx/fleet/actions/workflows/auto-tag-unreleased-bugs.yml;
check the associated issues on that repo for the comments (or lack
thereof). Grabbed a bunch of issues from this repo to properly catch
edge cases. This only looks at issue body so the titles including
released/unreleased are for testing convenience and have no effect on
whether a comment happens either way.
I expect we'll need to dial this in further but this errs on the side of
categorizing something as unreleased because shipping regressions due to
mis-triage is worse than finding out a bug is released when we weren't
sure to begin with.
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
Co-authored-by: Ian Littman <iansltx@gmail.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
This pull request introduces new configuration profiles to support Okta
conditional access for macOS devices, specifically targeting the
Information Technology department. It also updates the GitHub Actions
workflow to include a new secret for the Okta CA certificate.
Additionally, it removes the `workstations-canary` team configuration,
likely as part of a cleanup or migration.
The most important changes are:
**Conditional Access and Okta Integration:**
* Added a new configuration profile,
`fleet-okta-conditional-access.mobileconfig`, to manage trusted CA
certificates, SCEP enrollment, mTLS identity preferences, and Chrome
mTLS auto-selection for Okta conditional access on macOS. This profile
is applied to devices labeled with "Department: Information Technology".
[[1]](diffhunk://#diff-904aba5588b0d2c8dc325414aa1e8f2cd8a324602ac8e0c1cd2a5dff28db357bR1-R157)
[[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R77)
* Added a new configuration profile,
`okta-verify-settings.mobileconfig`, to configure privacy preferences,
managed login items, notification settings, and Okta Verify app settings
for macOS devices in the Information Technology department.
[[1]](diffhunk://#diff-b321656e070ad9cb0727fe7ced60565d88bf31d236ac2642d3192fcb375fa4b2R1-R129)
[[2]](diffhunk://#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bdR72-R77)
**Workflow and Secrets Management:**
* Updated the GitHub Actions workflow (`dogfood-gitops.yml`) to include
the `DOGFOOD_OKTA_CA_CERTIFICATE` secret, supporting the new Okta
conditional access configuration.
**Configuration Cleanup:**
* Removed the `workstations-canary.yml` team configuration, eliminating
its policies, software, scripts, and settings.
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Resolves#38484. This includes a CI job change to make sure we don't
introduce any more env vars that don't get proxied (and thus turned off
outside `--dev`).
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
## Testing
- [x] Added/updated automated tests
Manual QA touched hot paths, but did _not_ manually test every
FLEET_DEV_* environment variable change.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Centralized dev-mode environment management for consistent FLEET_DEV_*
handling and test-friendly overrides.
* Dev-mode allows targeted overrides for certain dev-only configuration
when running with --dev.
* **Chores**
* Migrated environment access to the centralized dev-mode helper across
the codebase.
* Added CI checks to enforce proper usage of FLEET_DEV_* variables.
* **Documentation**
* Added guidance on dev-mode environment variable rules and overrides.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Victor Lyuboslavsky <2685025+getvictor@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Upgraded security protections across build and deployment workflows
for enhanced runner environment hardening.
* Strengthened CI/CD infrastructure security measures throughout
automated processes.
* No direct user-facing changes.
<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request simplifies and improves the automation for updating
Safari version policies on macOS by switching from a multi-line YAML
query to a single-line query and streamlining the associated update
script. The changes make the update process more robust, easier to
maintain, and less error-prone, especially when parsing and updating the
policy file.
**Policy and script simplification:**
* Converted the `query` field in `update-safari.yml` from a multi-line
YAML block to a single-line statement, reducing complexity and making it
easier to update programmatically.
**Script robustness and maintainability:**
* Updated `.github/scripts/dogfood-policy-updater-latest-safari.sh` to
extract and update the single-line `query` instead of handling a
multi-line block, greatly simplifying the parsing and replacement logic.
[[1]](diffhunk://#diff-87712030515d50f6a970f044127d52639dac98021cf573f214f8f36cb1273c17L26-R37)
[[2]](diffhunk://#diff-87712030515d50f6a970f044127d52639dac98021cf573f214f8f36cb1273c17L97-R123)
* Improved error handling for environment variables, requiring only the
essential `DOGFOOD_AUTOMATION_TOKEN` to be set, and clarified error
messages.
* Enhanced validation of the Safari feed response by checking for valid
JSON and explicit API errors using `jq`, making the update process more
reliable.
* Changed the update workflow to write changes directly to the file and
rely on GitHub Actions to create pull requests, removing the script's
own git and PR logic for a cleaner CI/CD process.
This pull request improves the robustness of the
`.github/scripts/dogfood-policy-updater-latest-safari.sh` script for
handling YAML query sections, especially when dealing with indentation
and extracting Safari version numbers. The main changes focus on making
the script more resilient to formatting variations and updating its
logic to match the current query structure.
**Query section handling improvements:**
* Updated the extraction of the `query_section` to correctly handle
indented queries in YAML, ensuring the multiline block is accurately
captured until the next key at the same indentation level.
* Improved the replacement logic for the query section using `awk` to
robustly detect and replace indented query blocks, skipping lines within
the query block until the next key at the same indentation.
**Safari version extraction updates:**
* Modified the logic for extracting Safari 18 and Safari 26 version
numbers to use `version LIKE '15.%'` and `version LIKE '26.%'` instead
of the previous `version >= '15.0'` and `version >= '26.0'` checks,
matching the updated query syntax.
**Formatting and documentation:**
* Added comments to clarify the handling of indentation for the new
query section and to document the changes in logic for extracting and
replacing the query block.
[[1]](diffhunk://#diff-87712030515d50f6a970f044127d52639dac98021cf573f214f8f36cb1273c17R100)
[[2]](diffhunk://#diff-87712030515d50f6a970f044127d52639dac98021cf573f214f8f36cb1273c17R115-R140)
This pull request introduces automation for keeping the Fleet macOS
Safari update policy current, along with a new script for updating
Safari on endpoints. The main changes include a new GitHub Actions
workflow step to run an automated script that checks for the latest
Safari versions, updates the policy YAML if needed, and creates a pull
request with the changes. Additionally, a new endpoint script is added
to perform Safari updates via `softwareupdate`.
**Automation for Safari Policy Updates:**
* Added `.github/scripts/dogfood-policy-updater-latest-safari.sh`, a
script that fetches the latest Safari versions from the SOFA feed,
compares them to the versions in `update-safari.yml`, updates the YAML
if necessary, and automatically creates a pull request with reviewers
assigned.
* Updated `.github/workflows/dogfood-automated-policy-updates.yml` to
add a step that runs the new Safari version update script as part of the
workflow, using the required automation secrets.
**Policy and Endpoint Script Enhancements:**
* Added a new policy to
`it-and-security/lib/macos/policies/update-safari.yml` that checks if
the installed Safari version matches the latest for macOS 15 (Safari
18.6) and macOS 26 (Safari 26.1).
* Introduced `it-and-security/lib/macos/scripts/update-safari.sh`, a
script for endpoints that runs `softwareupdate` with the `--safari-only`
flag, logging the outcome and requiring root privileges.
This pull request improves the robustness and reliability of the script
and workflows that detect changed or new maintained apps in pull
requests. The main focus is on making the detection script pass
validation when the test is triggered but no new FMAs are detected.
**Script robustness and error handling:**
* The `.github/scripts/detect-new-fmas-in-pr.sh` script is updated to
always exit successfully (status 0) when no changes are detected, and
only exit with error (status 1) for critical failures like missing `jq`.
A new `safe_exit` function is introduced to standardize output and
ensure graceful exits.
[[1]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dR7-R11)
[[2]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dL21-R39)
* Improved error handling for missing files, empty variables, and failed
commands throughout the script, including handling cases where
`merge-base`, `git show`, or `jq` fail, and ensuring empty or missing
data does not cause the script to error out.
[[1]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dL32-R66)
[[2]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dR87-R108)
[[3]](diffhunk://#diff-f9bbb0340f504713c99d610f3c64bf281fc13ed3cb8a1c06a5366272c9828a8dL75-R155)
**Workflow improvements:**
* The `test-fma-darwin-pr-only.yml` and `test-fma-windows-pr-only.yml`
workflows are updated to default to "no changes" if the detection step
fails or does not set the expected output, preventing false positives or
workflow failures.
[[1]](diffhunk://#diff-28b30c8601cb7662d59efbfbbcf800cae91455fd3d875627659dced8c1257a24L70-R72)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaL76-R78)
This pull request adds support for managing 7-Zip as a maintained
Windows application. The changes include configuration for installation
and uninstallation, workflow updates to handle 7-Zip specifically in CI,
and a new icon for the frontend. These updates ensure that 7-Zip can be
detected, installed, uninstalled, and visually represented in the
software management system.
**Windows workflow and detection updates:**
- Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes related to 7-Zip, set a `has_7zip` output variable, and add a
step to remove pre-installed 7-Zip versions before proceeding with
further app verification. This prevents conflicts with pre-existing
installations during CI runs.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR91)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR117-R124)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR164-R227)
**7-Zip application configuration:**
- Added `ee/maintained-apps/inputs/winget/7-zip.json` to define 7-Zip as
a maintained app with metadata such as slug, package identifier,
installer type, and categories.
- Added `ee/maintained-apps/outputs/7-zip/windows.json` with version
info, installation and uninstallation scripts, SHA256, and upgrade code
for 7-Zip, enabling automated install/uninstall flows.
- Updated `ee/maintained-apps/outputs/apps.json` to include 7-Zip in the
list of available apps, with a description and unique identifier for
display and selection.
**Frontend icon support:**
- Added a new React SVG icon component for 7-Zip at
`frontend/pages/SoftwarePage/components/icons/7Zip.tsx`.
- Registered the 7-Zip icon in the icon index and mapped it in
`SOFTWARE_NAME_TO_ICON_MAP` to display the icon for 7-Zip in the UI.
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR7)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR224)
This is to avoid a similar issue that we just faced in the future.
The issue was this PR https://github.com/fleetdm/fleet/pull/37118 was
merged, but all checks passed since it was a html file only PR, go tests
did not run. So we did not catch the integration tests asserting content
in these files was broken.
The following PR fixed it: https://github.com/fleetdm/fleet/pull/37196
This PR proposes to add those two files to GO test triggers in CI to
avoid breaking the tests accidentally in the future.
Resolves#36909.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
Lucas Manuel Rodriguez