Extracts the MySQL datastore initialization out of `runServeCmd` and
into a new `cmd/fleet/datastore.go`. Same pattern as the prior
extractions on this issue (#44929, #45343, #45583, #46166, #46421,
#46517). Continues the path toward `serve.go` >60% coverage per the
discussion on #33370.
Three functions come out of the inline block:
- `initDatastore` — builds the shared DB connections, the datastore, and
the carve store (S3-backed when configured, otherwise the datastore
itself).
- `buildMySQLOpts` — assembles the DB options: base logger and config,
plus the optional read replica, dev SQL interceptor, and tracing.
- `evalMigrationStatus` — prints any operator guidance for the migration
status and returns whether `runServeCmd` should exit. The `os.Exit`
stays in `runServeCmd`, so the boot/refuse-to-boot decision becomes
unit-testable without the function terminating the test binary.
Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, the migration-exit conditions are unchanged, and the
full `cmd/fleet` suite passes against MySQL + Redis. `initDatastore`
returns early after `initFatal` so it's safe when the caller's
`initFatal` doesn't terminate (the case in tests).
On test scope: `TestEvalMigrationStatus` covers every migration status
code across the dev-mode and allow-missing-migrations combinations —
that's the real decision logic. I deliberately didn't add unit tests for
`initDatastore`/`buildMySQLOpts`: their only failure paths are paranoid
`initFatal` wrapping around constructors that don't dial at construction
time, and the option builder returns opaque option closures. Those
success paths are already exercised by booting the server, so a full
datastore mock wasn't worth it for coverage's sake.
Remaining slice per the broader plan: Redis init.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Refactor**
* Reorganized database startup initialization and migration status
evaluation for improved maintainability.
* **Tests**
* Added comprehensive test coverage for database migration status
handling across various scenarios.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
@allenhouchins Documenting our VDP
## Summary
- Adds a pointer to Fleet's public Bugbop Vulnerability Disclosure
Program from `SECURITY.md` and `handbook/it/security.md`.
- Documents the program's in-scope, out-of-scope, and
typically-not-eligible categories so researchers can self-triage before
submitting.
- Keeps `security@fleetdm.com` as the channel for coordinated,
non-public disclosure.
Motivation: two recent informal disclosures (missing CAA, missing
MTA-STS) revealed that our published policy made no mention of the VDP
or its scope, which left the boundary ambiguous when declining
out-of-scope submissions.
## Test plan
- [ ] Verify rendered `SECURITY.md` on the repo's Security tab links to
the Bugbop program.
- [ ] Verify the handbook page renders the new VDP paragraph in the
"Disclosure" section without breaking surrounding structure.
- [ ] Confirm no internal/private program details are referenced.
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** Resolves#45022
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Prevented intermittent Android profile failures during host/team
transfers by ensuring pending Android certificates are created for
transferred devices before dependent profiles are applied. Profiles now
apply reliably, including when devices are moved off a team.
* **Tests**
* Added and updated tests to cover Android certificate provisioning
during host transfers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated security hardening tools across multiple GitHub Actions
workflows to the latest available version for enhanced CI/CD
infrastructure protection and resilience.
* Enabled additional security validation rules in workflow configuration
to strengthen infrastructure oversight and improve vulnerability
detection capabilities across build and deployment pipelines.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46567 and Resolves#46737
Solution for the agressive polling:
- no WNS (although we could add it later as another avenue for
notifications)
- fleetd advertises a sync capability, persisted as
`mdm_windows_enrollments.fleetd_sync_capable`
- The management session relaxes the DMClient poll
(`poll_schedule_relaxed`)
- When an MDM command is queued, `has_pending_commands` flips, the next
orbit check-in returns `WindowsMDMSyncRequest`, and fleetd runs
`deviceenroller` to deliver it immediately
- older fleetd versions keep the 1-minute poll
Docs: https://github.com/fleetdm/fleet/pull/46780
Changes to osquery_perf and any additional changes after loadtesting
will be done in a separate PR.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [x] Verified that fleetd runs on macOS, Linux and Windows
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* On-demand Windows MDM sync: servers can request immediate delivery of
queued MDM commands to Windows clients; Orbit triggers client-side sync
on Windows.
* **Enhancements**
* Orbit throttles per-device on-demand sync to avoid excessive runs.
* Server reconciles and persists device poll schedule (fast vs relaxed)
and exposes consolidated host MDM state (awaiting-configuration +
has-pending-commands).
* **Tests**
* Added tests covering host config state, pending-command flows,
poll-schedule toggling, and on-demand sync behavior.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Fixing/enabling these zizmor checks:
- dependabot-cooldown
- secrets-inherit
- unpinned-uses
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refined secret handling in CI test workflows: replaced inherited
secrets with explicit secret mappings and conditional forwarding
(scheduled runs vs others).
* Declared additional callable secrets for the reusable test suite: a
GitHub token and a Slack webhook for scheduled-run notifications.
* Updated blocking gate configuration: adjusted which rules are shown as
disabled and updated finding count comments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Disabled Go toolchain/module caching across CI build, release, and
publish workflows.
* Disabled Node package-manager caching in relevant publish workflows.
* **Security**
* Re-enabled the cache-poisoning gate rule so cache-poisoning checks can
now block failing runs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- "encourages" in the "Why handbook-first strategy?" section was linked
to a youtube video that is now set to private, so the link should be
removed.
- Link describing editing in markdown was linking to the main company
page instead of to the markdown section of the writing page.
### Not sure if small text changes need to be documented in the
changelog? I can add this item if needed.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
Noting for next time: I'll make sure to give my branch an actual name
that means something. 🤣
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42508
Renames abm/apple_business_manager to ab/apple_business in API and
fleetctl. Uses existing renameto logic with a slight twist: added
"inline" option to handle cases particularly where a single object tree
has renames in multiple versions so that we don't break backwards
compatibiility since the default behavior when you have multi-level
renames is a new/old split at the top level
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Canonical Apple Business (AB) API endpoints and CLI:
/api/v1/fleet/ab_tokens, /api/v1/fleet/mdm/apple/ab_public_key, plus new
fleetctl get mdm-ab and fleetctl generate mdm-ab
* New GitOps/config key: mdm.apple_business
* Admin UI updated to show Apple Business tokens with fleet-based
associations and updated labels
* **Deprecations**
* Legacy ABM endpoints, CLI aliases, and config keys remain supported
but emit deprecation warnings pointing to the new AB equivalents
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#42818.
(I explicitly removed all checklist items.)
This is the least destructing approach to solve the issue.
Other approaches require like moving all Go code under a sub-directory
or keeping these docs/ directories free from invalid characters.
## Problem
[Publishing of Fleet's go
module](https://github.com/fleetdm/fleet/actions/runs/23857371168/job/69554220876)
is failing with the following error:
```
Run GOPROXY=proxy.golang.org go list -m github.com/fleetdm/fleet/v4@v4.83.0
go: github.com/fleetdm/fleet/v4@v4.83.0: reading https://proxy.golang.org/github.com/fleetdm/fleet/v4/@v/v4.83.0.info: 404 Not Found
server response:
not found: create zip: docs/solutions/windows/configuration-profiles/allow network connectivity during connected standby – [ACConnectivityInStandby_2, DCConnectivityInStandby_2].xml: malformed file path "docs/solutions/windows/configuration-profiles/allow network connectivity during connected standby – [ACConnectivityInStandby_2, DCConnectivityInStandby_2].xml": invalid char '–'
[Truncated: too long.]
```
## Summary
Root cause
The [publish go module
step](https://github.com/fleetdm/fleet/blob/main/.github/workflows/publish-go-module.yml)
asks proxy.golang.org to build a module zip for the v4.X.Y tag. That
build was failing on two independent, each-fatal issues — both stemming
from the monorepo carrying non-Go content that violates Go module zip
rules:
1. Invalid path characters — 35 tracked files with characters Go module
zips forbid: en-dash – in 32
docs/solutions/windows/configuration-profiles/*.xml files (the one in
your error), emoji 📜 in 2 handbook/company/legal/ files, and an
apostrophe in 1 website/assets/ image. This is the literal create zip: …
invalid char '–' error.
2. Source tree too large — 582 MiB tracked vs Go's hard 500 MiB limit;
website/ alone is 318.7 MiB.
## Fix
Added a go.mod to website/, docs/, and handbook/, turning each into a
nested module that x/mod/zip omits from the published v4 module — the
same pattern Fleet already uses under tools/. One move solves both: all
35 bad filenames live in those three dirs, and excluding them drops the
module to 207 MiB tracked → 112 MiB zipped.
Files created:
- website/go.mod, docs/go.mod, handbook/go.mod (module markers, each
with a comment explaining why)
Verified safe: no .go files and no //go:embed references in those dirs,
and go list ./... still resolves all 491 packages.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added standalone module configurations for documentation, handbook,
and website directories.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds a load test metrics tool under
[`tools/loadtest/metrics/`](tools/loadtest/metrics/) for capturing and
comparing AWS CloudWatch metrics across Fleet load test runs.
- **`collect-metrics.sh`** — discovers a load test environment's AWS
resources from its Terraform workspace name, pulls CloudWatch metrics
over a lookback interval, and writes a `.json` data file plus a
human-readable `.md` synopsis (with threshold alerts). Supports a
`--category` flag (`baseline` | `migration` | `mdm`) that files output
under `runs/<category>/<workspace>/`.
- **`compare-metrics.sh`** — diffs two or more runs side by side and
flags deltas as `ok` / `WARN` / `ALERT`. Searches `runs/` recursively,
and `--filter` doubles as a category selector thanks to the naming
conventions.
- **`runs/`** — committed historical runs, organized by category:
`baseline/`, `migration/`, `mdm/`.
- New `README.md` documenting usage, run organization, and how to submit
results; linked from the root `tools/README.md`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated metrics tooling for AWS load-test environments —
collects ECS/RDS/Redis/ALB/network metrics, Performance Insights
top-SQL, CloudWatch Logs error samples, produces consolidated JSON +
Markdown summaries, and performs threshold checks with alerts.
* Added a metrics comparison tool to detect regressions across runs with
run selection, deduplication, per-metric comparisons, percent-change,
and aggregated alert synopsis.
* **Tests**
* Added numerous baseline and sample load-test metrics reports covering
multiple workspaces, intervals, and scenarios for validation and
regression analysis.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#36087 (one of several PRs).
## Testing
- [x] QA'd all new/changed functionality manually.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Dry-run support when creating secret variables.
* **Improvements**
* Standardized API models for secret-variables and targets for more
consistent behavior.
* List secret variables now includes pagination metadata.
* More consistent error reporting across secret-variables and targets
APIs.
* Target search/count behavior refined: pre-selected built-in labels are
omitted as expected.
* **Tests**
* Integration tests updated to validate the new request/response
behavior and target-selection logic.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46196?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Enhanced file-path validation for improved handling
* Resolved Fleet Desktop startup issues on openSUSE Leap systems
* Updated Orbit identifier token rotation behavior
* **New Features**
* Added Adobe plugins detection table to identify plug-ins on macOS and
Windows
* **Chores**
* Updated Go version to 1.26.3
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This workflow has been flaky for years.
I've added inline comments explaining the changes.
This is important as a regression test now that we get more code changes
(AI) to review in fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped osquery used in integration tests (5.9.1 → 5.23.0).
* Release tooling now updates the integration-test workflow when
releasing osqueryd.
* **Tests**
* Improved integration tests: refined trigger paths, separated service
startup, skipped frontend bundling for faster CI, more robust
host-enrollment detection and teardown.
* Limited package build targets (removed RPM) and added sparse checkout
for macOS uninstall script.
* **Stability**
* Added macOS osquery warm-up to prevent startup timeouts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46722
This PR modifies both the FE and BE so that we do not fire a single
request for each software policy automation row. Instead, we build the
custom icon url (if any) into the main `policies` endpoint response.
This also prevents 404ing when there's no custom icon uploaded for the
associated software title.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
#### Before (main branch)
https://github.com/user-attachments/assets/fa358e90-dc08-45e0-8c4d-b8a8b57a6c98
#### After
https://github.com/user-attachments/assets/4ca7b931-a10b-4d57-96b1-ba5a88e04de5
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Policy automations now show software icons when available (custom
installer icons, VPP app icons, and patch icons), sourced from the
server with graceful fallback when missing.
* **Tests**
* Added/updated tests to verify icon propagation and rendering behavior
across policy lists and automation views.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Fleet version bumped to v4.86.1 across Helm charts, Terraform
configurations, and fleetctl package manager to ensure consistent
deployment versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated maintained application versions: Opera to 132.0, Prisma
Browser to 149.10.3.53, Stats to 2.12.16, Tor Browser to 15.0.15, and
Visual Studio Code to 1.123.0 with corresponding installer URLs and
integrity checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added SF Symbols application support for macOS with automated version
detection and comprehensive installation/uninstall management
capabilities.
* Integrated SF Symbols icon component to the software catalog user
interface for improved visual identification and user experience.
* SF Symbols is now registered as a managed application with
Productivity category classification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <32207388+allenhouchins@users.noreply.github.com>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added VirtualBuddy application to the supported software catalog for
macOS (Apple Silicon compatible).
* Users can now discover, install, and manage VirtualBuddy with
automated installation and uninstallation capabilities.
* Version 2.1 is available with integrated app icon and security
verification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A
Restores the "Wipe pending" and "Wiped" status badges for Linux hosts on
the host details page.
These badges were requested to be hidden as part of work on #43116 and
later requested to be re instated after review.
Manually tested by triggering a wipe on a Linux host and confirming the
badge appears correctly.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Linux hosts now correctly display device wipe status in the host
details view. Wipe status indicators such as "Wipe pending" and "Wiped"
now appear consistently across all platforms. Previously, this
information was not visible for Linux hosts, resulting in incomplete
status visibility during device operations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#45180
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [x] Confirmed that the fix is not expected to adversely impact load
test results
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* MDM profiles can combine label inclusion (include-all/include-any)
with exclusion (exclude-any) so you can target hosts by labels while
excluding specific labeled hosts.
* Profile validation now enforces a single include-mode and explicitly
rejects any label used in both include and exclude lists.
* **Bug Fixes**
* Deleting a label that’s referenced by an MDM configuration profile or
declaration is blocked and returns an error to prevent broken targeting.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated 8x8 Virtual Office macOS application metadata from version
8.33.2 to 8.34.1, including updated installer package and verification
checksum.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
Extracts the Apple MDM initialization out of `runServeCmd` into testable
functions in a new `cmd/fleet/mdm_apple.go`. Continues the chain of
extractions on this issue (#44929, #45343, #45583, #46166, #46421)
toward the `serve.go` >60% coverage target discussed on #33370.
Five functions come out of the inline block:
- `initAppleMDMStorages` — constructs the MDM, DEP, and SCEP storages.
- `initAppleMDMPushService` — picks the no-op pusher under
`FLEET_DEV_MDM_APPLE_DISABLE_PUSH=1`, otherwise the real APNs pusher.
- `checkMDMAssetsExist` — promotes the inline `checkMDMAssets` closure
to a package function. It was already used at several call sites; they
now all share this one.
- `reconcileAppleMDMAPNsAndSCEPAssets` / `reconcileAppleMDMABMAssets` —
the APNs/SCEP and ABM asset reconciliation blocks.
Behavior is preserved — `runServeCmd` calls these in the same order with
the same arguments, and the full `cmd/fleet` suite passes unchanged
against MySQL + Redis. Each function returns early after `initFatal` so
it's also safe when the caller's `initFatal` doesn't terminate (the case
in tests).
On test scope: the new unit tests cover the dev-mode push gate, all four
branches of `checkMDMAssetsExist`, and the no-op and missing-private-key
paths of both reconcilers. The storage construction and the actual
asset-insert paths need a real datastore, so those stay covered by the
existing integration tests rather than new unit tests — I didn't want to
stand up a full datastore mock for paths that are already exercised
end-to-end.
**Related issue:** Refs #33370
# Checklist for submitter
- [x] Added/updated automated tests
- Changes file: not applicable — internal refactor with no user-visible
behavior change
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Apple MDM initialization and configuration management for APNs,
SCEP, and Apple Business Manager with automatic reconciliation of
missing assets and a dev-mode option to disable push.
* **Tests**
* Added unit tests covering push-service behavior, asset-existence
checks, reconciliation logic, and fail-fast handling when required key
material is missing.
* **Refactor**
* Simplified Apple MDM initialization flow by extracting initialization,
push-service, and reconciliation logic into helpers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Fixes#46190
- Added a package init() to load the catalog from the embedded YAML
once.
- Init() now no longer runs any initialization logic just validation, so
it was renamed to Validate.
Fixes#46639
Hard-coded "/" and "/login" strings bypassed the URL prefix when Fleet
is deployed behind a reverse proxy at a subpath. Replaced with
PATHS.ROOT / PATHS.LOGIN, which embed URL_PREFIX, so redirects now land
at the correct subpath.
Fixes#46640
The root IndexRedirect used an absolute path ("/dashboard"), causing
React Router to push /dashboard to history regardless of the URL prefix.
This made the app fall through to the 404 route when Fleet was deployed
at a subpath (FLEET_SERVER_URL_PREFIX). Removing the leading slash lets
React Router resolve the redirect relative to the mounted route.
Automated ingestion of latest Fleet-maintained app data.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated application package definitions for 14 software applications
including 8x8 Work, AWS CLI, Chrome Remote Desktop, Claude, DBeaver
Community, Duo Desktop, Genesys Cloud, GitHub Desktop, GitKraken, Google
Chrome, Ollama, and Postman to their latest available versions with
corresponding installers and checksums.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Co-authored-by: allenhouchins <32207388+allenhouchins@users.noreply.github.com>
**Related issue:** Resolves#45182
## What this does
Changes the foreign key constraints on
`mdm_configuration_profile_labels` and `mdm_declaration_labels` from `ON
DELETE CASCADE` (or no restriction) to `ON DELETE RESTRICT`. This
prevents a label from being deleted while it is still referenced by an
MDM configuration profile or declaration.
Previously, deleting a label that was targeted by a profile would
silently remove the label reference, leaving the profile in a \"broken\"
state in the UI (showing a \"Label deleted\" warning with no way to
recover without re-uploading the profile). With this change, Fleet
returns an error when attempting to delete a label that is in use by a
profile, prompting the user to remove the profile's label targeting
first.
## Why
This is part of a broader set of changes (CPIE include/exclude label
targeting) that introduces combined include+exclude label targeting on
profiles. Allowing silent label deletion would cause ambiguous broken
states when both include and exclude labels are in use on a single
profile.
## Testing
- Migration tested via the accompanying `_test.go` file, which covers:
- Label deletion is blocked when referenced by a configuration profile
label row
- Label deletion is blocked when referenced by a declaration label row
- Label deletion succeeds when not referenced by any profile or
declaration
- Verified that the `ALTER TABLE` DDL change does not trigger `ON UPDATE
CURRENT_TIMESTAMP` on `mdm_configuration_profile_labels.updated_at` (DDL
does not fire row-level triggers)
# Checklist for submitter
## Testing
- [x] Added/updated automated tests
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42651
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
## New Fleet configuration settings
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added "Continuous" option for policy automations to re-run
script/software automations on every subsequent failure.
* Editable automations available directly from policy create, edit, and
details pages.
* New modal and field flows for managing automations (webhook/ticket,
calendar, conditional access) and a Patch automation CTA for patch
policies.
* **Improvements**
* Redesigned automations UI, table cell rendering, and list/footer
messaging for clarity.
* Various styling and layout refinements for consistent behavior and
overflow prevention.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#34668
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Bug Fixes**
* Fixed profile resend behavior so configuration profiles are retried
using available identity attributes when a host has no linked IdP user
or the referenced IdP user is missing.
* Ensured profile resend markers are cleaned so pending resends behave
correctly after identity changes.
* **Tests**
* Improved test coverage to validate profile resend and status reset
when device mappings or identity links change.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Rajendra kadam
