Fixes:
https://github.com/fleetdm/fleet/actions/runs/30519842615/job/90797961257.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved end-to-end test packaging reliability on macOS by adding a
retry mechanism with delays and failing after repeated unsuccessful
attempts.
* Updated end-to-end test environment hostname setup on Ubuntu to use a
transient hostname derived from the target architecture.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
The gitops-auto-complete uses `replace github.com/fleetdm/fleet/v4 =>
../..` which means it is frequently broken whenever fleet updates shared
libraries.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added automated build and dependency verification for the GitOps
auto-complete tool.
* Updated workflow triggers so changes to the tool are checked
automatically.
* Refreshed supporting service dependencies used by the tool.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** Resolves#48007
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## What
When Dependabot opens a code-dependency PR (Go or npm), a GitHub Actions
workflow now auto-creates a QA tracking issue assigned to
@AndreyKizimenko and places it on the `:help-qa` board in "Ready"
status. Also exempts `dependabot[bot]` from the PR template check.
### Files changed
- **`.github/workflows/dependabot-qa-ticket.yml`** (new) - The core
workflow. Triggers on `pull_request_target[opened]`, filters for
code-dependency Dependabot PRs (Go modules + npm, excluding
website/slackbot), creates a QA tracking issue, comments on the PR, and
adds the issue to the `:help-qa` project board.
- **`.github/workflows/check-pr-template.yml`** - Exempts
`dependabot[bot]` from the PR description template check (Dependabot PRs
have auto-generated descriptions).
- **`.github/zizmor-gate.yml`** - Suppresses two expected zizmor
findings: `dangerous-triggers` (uses `pull_request_target` but never
checks out PR code) and `bot-conditions` (gates on `user.login` which is
not spoofable for same-repo Dependabot PRs).
- **`changes/48007-dependabot-qa-ticket`** - Release note.
## Security review
This workflow uses `pull_request_target`, a known attack surface for
GitHub Actions. A dedicated security audit was performed covering all
standard threat vectors:
| Area | Status | Details |
|------|--------|---------|
| **Code checkout injection** | SAFE | No `actions/checkout` or `git
clone`. The workflow only calls the GitHub API via
`actions/github-script`. The inline JavaScript is embedded in the
base-branch YAML, not loaded from PR code. |
| **Script/template injection** | SAFE | PR data (`pr.title`,
`pr.head.ref`) is used in JavaScript template literals passed to the
GitHub API as strings. There is no shell interpolation, no `eval()`, no
`${{ }}` expressions in `run:` blocks. |
| **Bot identity spoofing** | SAFE | Gates on
`github.event.pull_request.user.login == 'dependabot[bot]'`, which is
server-set by GitHub and cannot be spoofed. Uses `user.login`
(immutable) rather than `github.actor` (which can differ on re-runs).
The `[bot]` suffix is reserved for GitHub App accounts. |
| **Secret exposure** | SAFE | `FLEET_GITHUB_TOKEN_PROJECTS` is passed
via `env:` block, accessed as `process.env.PROJECT_TOKEN`, and used only
as an argument to `getOctokit()`. Never logged, never interpolated into
output. |
| **Permission scope** | MINIMAL | Top-level: `contents: read`.
Job-level: `contents: read` + `issues: write`. No `pull-requests: write`
(PR comments use the Issues API). |
| **Idempotency** | SAFE | Before creating an issue, searches for an
existing open issue with the same title and `dependabot` label. Prevents
duplicates on workflow re-runs. |
| **Markdown injection** | LOW (theoretical) | `pr.title` is
interpolated into issue title/body. Dependabot controls the title format
("Bump X from Y to Z") and package names are registry-constrained. Not
exploitable without compromising Dependabot itself. |
| **Denial of service** | LOW (theoretical) | Bounded by Dependabot's
own rate limits (default 5 PRs/ecosystem/day) plus the idempotency
guard. |
| **Zizmor waivers** | JUSTIFIED | `dangerous-triggers`: no code
checkout, API-only. `bot-conditions`: uses `user.login` not
`github.actor`. Both include inline rationale comments. |
| **check-pr-template.yml** | SAFE | `AUTHOR` is passed via `env:` (not
`${{ }}` in shell), double-quoted in comparison. `user.login` is
GitHub-constrained to alphanumeric + hyphens. |
**Actions are SHA-pinned** with version comments:
`step-security/harden-runner@9af8...` (v2.19.4) and
`actions/github-script@60a0...` (v7.0.1).
## Testing
- [x] QA'd all new/changed functionality manually
Since this is a GitHub Actions workflow that triggers on Dependabot PR
opens, it cannot be fully end-to-end tested without a real Dependabot
PR. The following offline validations were performed:
### 1. YAML syntax validation
```
$ ruby -e "require 'yaml'; YAML.safe_load(File.read('.github/workflows/dependabot-qa-ticket.yml')); puts 'YAML: valid'"
YAML: valid
```
### 2. Verified hardcoded GraphQL IDs against the live GitHub API
**Project board ID** (`PVT_kwDOBDAnic4A5q11`):
```
$ gh api graphql -f query='query { node(id: "PVT_kwDOBDAnic4A5q11") { ... on ProjectV2 { title number url } } }'
-> title: ":help-qa", number: 85, url: "https://github.com/orgs/fleetdm/projects/85"
```
**Status field ID** (`PVTSSF_lADOBDAnic4A5q11zgubZ6Y`) and option ID
(`f75ad846`):
```
$ gh api graphql -f query='query { node(id: "PVTSSF_lADOBDAnic4A5q11zgubZ6Y") { ... on ProjectV2SingleSelectField { name options { id name } } } }'
-> field name: "Status", option f75ad846 = "Ready" ✅
```
### 3. Verified assignee and label exist
```
$ gh api users/AndreyKizimenko --jq '.login' -> AndreyKizimenko ✅
$ gh label list --search dependabot -> dependabot ✅
```
### 4. Branch filtering logic unit tested
Extracted the JavaScript filter logic and ran it against 8 test cases
covering single-package updates, grouped updates, and exclusions:
```
$ node -e "<test script>"
PASS | dependabot/go_modules/golang.org/x/crypto-0.24.0 | match (Go single)
PASS | dependabot-go_modules-google.golang.org-grpc-1.82.1 | match (Go grouped)
PASS | dependabot/npm_and_yarn/typescript-5.5.0 | match (npm single)
PASS | dependabot-npm_and_yarn-postcss-8.5.18 | match (npm grouped)
PASS | dependabot/npm_and_yarn/website/next-14.0.0 | skip (website single)
PASS | dependabot-npm_and_yarn-website-next-14.0.0 | skip (website grouped)
PASS | dependabot/npm_and_yarn/fleet-slackbot/axios-1.7.0 | skip (slackbot single)
PASS | dependabot/github_actions/actions/checkout-4 | skip (GitHub Actions)
8/8 passed
```
### 5. Validated filter against real Dependabot PRs
Checked the 20 most recent Dependabot PRs (`gh pr list --author
'app/dependabot' --state all --limit 20`) to confirm real branch names
match the filter patterns. This revealed three bugs that were fixed:
1. **Go branch prefix was wrong**: Real branches use
`dependabot/go_modules/`, not `dependabot/gomod/`. Fixed.
2. **Grouped updates use dashes**: Real grouped branches like
`dependabot-go_modules-...` and `dependabot-npm_and_yarn-...` were not
matched. Added dash-variant prefix checks and exclusions.
3. **Status label mismatch**: The constant was named `AWAITING_QA` but
the option ID maps to "Ready" on the board (there is no "Awaiting QA"
status). Renamed to `READY` and updated comments.
### 6. CI checks
All CI checks pass (CodeQL, zizmor, dependency-review, build-binaries,
publish).
**Note:** The project board integration requires a
`FLEET_GITHUB_TOKEN_PROJECTS` repo secret with Organization Projects
read/write scope. Without it, the issue is still created but not added
to the board (a warning is logged).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added an automated GitHub Actions workflow for eligible Dependabot
update pull requests.
* Creates (and deduplicates) labeled QA issues with pull request details
and checklist content, and posts the issue back to the pull request.
* Optionally links new QA issues to project tracking with an “Awaiting
QA” status when configured.
* **Chores**
* Hardened the automation workflow’s runner and permissions.
* Updated safety-gate configuration to waive checks for the new
Dependabot QA workflow.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — fixes the `check-doc-gen` job failing on `main`
The "Check automated documentation is up-to-date" workflow has been
failing on every push to `main` (and every PR that triggers it) since
~18:30 UTC 2026-07-27. The failing step, "Verify osquery table JSON
schema is up-to-date," runs `cd website && npm install && sails run
generate-merged-schema` and fails if `git diff` is non-empty afterward.
The diff it fails on is `website/package-lock.json` itself:
`sails-hook-grunt`'s published tarball ships a `node_modules` folder
with packages that aren't part of its dependency graph (dev leftovers
like `mocha@3.0.2` and `growl@1.9.2`). Newer npm on the CI runners
records those on-disk packages in the lockfile as `"extraneous": true`
entries, so any committed lockfile that omits them (e.g. after #49852
regenerated it) no longer matches what `npm install` produces — and any
committed lockfile that *includes* them gets flagged by
`dependency-review` for the critical `growl@1.9.2` advisory
(GHSA-qh2h-chj9-jffq), even though growl is never actually installable
from the dependency graph.
This PR fixes the root cause instead of chasing npm's output:
- **`check-doc-gen` now uses `npm ci` instead of `npm install`** — `npm
ci` never rewrites `package-lock.json`, so the step's `git diff` check
only catches what it's meant to catch (schema drift), and future runner
npm upgrades can't reintroduce lockfile churn.
- **`website/package-lock.json` regenerated with `npm install
--package-lock-only`** — drops the 107 `extraneous` entries (including
`growl@1.9.2`) that were committed to pacify the old `npm install`-based
check. No dependency versions change; `npm ci --dry-run` validates the
lockfile is in sync.
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] QA'd all new/changed functionality manually — verified locally
that `npm ci --dry-run` accepts the updated lockfile and that
`growl`/`extraneous` entries are gone. Since this PR now modifies the
workflow file itself, the `pull_request` path filter triggers
`check-doc-gen` on this PR, verifying the `npm ci` path end-to-end in
CI.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved automated schema validation by using deterministic dependency
installation to reduce unnecessary lockfile churn.
* Refreshed the generated-schema failure message with the correct
regeneration steps to follow when updates are detected.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45524
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file as this is purely workflow/release changes
## Testing
Will be testing this on github as that's the only way and since this
requires testing with a tagged build I'll have to merge to main, tag,
then manually trigger
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Introduced an automated macOS Fleet Desktop release workflow for
version-tagged releases.
* Publishes the installer plus accompanying `meta.json` download
metadata, including SHA256 checksums.
* **Bug Fixes**
* Added stronger pre-release validation (tag/version match and immutable
release enforcement).
* Verifies the downloaded package and metadata against the expected
SHA256 to ensure the published artifacts are consistent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
**Related issue:** N/A — CI improvement for the FMA validation
workflows.
## Summary
Restructures the Windows and macOS Fleet-maintained app validation
workflows around a cheap Linux detect/shard job, with Windows apps
additionally routed to a CI runner whose native architecture matches the
app's installer.
**Both platforms:**
- Change detection and sharding run on `ubuntu-latest`. Expensive
Windows/macOS runners only spin up when their platform actually has
changed apps — e.g. a Windows-only letter-batch PR no longer boots a
macOS runner just to discover there's nothing to do (and vice versa) —
and they check out at depth 1 instead of full history.
- A new `.github/scripts/partition-fma-apps.sh <windows|darwin>` emits
the job matrix; validation steps move unchanged into reusable workflows
(`test-fma-windows-validate.yml`, `test-fma-darwin-validate.yml`).
- Large PRs shard into parallel jobs (Windows: 25 apps/shard, macOS:
30), and the manual full-run workflows gain a `shard_size` input
(Windows default 20 → ~20 shards over 384 apps; macOS default 25 → ~39
shards over 961 apps). Neither full run could previously finish:
hundreds of sequential installs blow the 6-hour job limit.
- Pre-installed app handling is computed per shard from that shard's
slug list — Windows removals (Chrome, 7-Zip, Firefox, Node.js,
PowerShell, R, Git) and macOS steps (Chrome, Xcode for Icon Composer,
the Fleet Desktop MDM config stub) only run on the runner validating
that app. This also brings the full-run workflows to parity with the PR
gates (they previously only removed Chrome).
- Stable summary jobs (`test-fma-pr-only`, `test-fma`) aggregate the
dynamic matrix results so branch protection / PR gating keeps a fixed
check name.
**Windows arch routing:**
- Each changed `<name>/windows` slug's `installer_arch` is read from
`ee/maintained-apps/inputs/winget/<name>.json`: `arm64` apps →
`windows-11-arm`, x64/x86/neutral apps → `windows-latest` (x64). Missing
input files default to x64 with a warning. This fixes installers that
check the native OS architecture and abort under Prism emulation on the
ARM runner (Inno Setup `ArchitecturesAllowed=x64` — GOG Galaxy, Reqable
— and Docker Desktop). Future arm64 FMAs need no workflow change —
`installer_arch: arm64` in the winget input is enough.
- macOS needs no arch matrix: `macos-latest` is arm64 and x86-only casks
run under Rosetta 2, which matches how customer Macs run them.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
## Testing
- [x] QA'd all new/changed functionality manually
Manual QA:
- Partition script is shellcheck-clean and tested against the real repo
for both platforms: empty input, mixed-platform slug lists, x86/neutral
routing to the x64 runner, single-slug arrays, missing input file
fallback, arm64/x64 split with sharding (via a synthetic arm64 input),
invalid platform/shard-size rejection, and full-catalog partitions (384
Windows apps → 20 shards, 961 darwin apps → 39 shards, all slugs
accounted for, matrix outputs well under the 1 MB job-output limit).
- All six workflows pass `actionlint` and zizmor 1.25.2 (with the repo's
`.github/zizmor-gate.yml` config) with no findings.
- The rewritten Windows PR gate ran on this PR itself: the Linux detect
job correctly found no changed Windows apps, skipped the Windows
runners, and the `test-fma-pr-only` summary check passed.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added sharded validation for maintained macOS and Windows apps to run
tests in parallel.
* Added configurable `shard_size` for manual validation runs.
* Introduced reusable validation workflows for Darwin and Windows.
* Improved Windows testing to be architecture-aware (ARM64 vs x64).
* **Bug Fixes**
* Improved pull request gating to validate only changed apps and report
results more reliably.
* Workflows now gracefully handle scenarios where no matching apps are
found (avoid unnecessary failures).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Resolves#48448.
These should help with reviewing the XAR and BOM implementations:
- https://claude.ai/code/artifact/60a78c1d-2fc9-45da-9471-1517fe77adb4.
- https://claude.ai/code/artifact/1c759a32-02f7-4a41-8611-04d7358367d7.
The darwin only tests (bom_darwin_test.go) have been executed on my
workstation.
Goal is to make sure to run the tests on macOS Github runners in
https://github.com/fleetdm/fleet/issues/33371.
- [X] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
## Testing
- [x] QA'd all new/changed functionality manually
## fleetd/orbit/Fleet Desktop
- [x] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [x] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* macOS package builds now use an internal, built-in implementation
instead of external packaging tools.
* `.pkg` installer creation no longer depends on Docker for macOS
packaging.
* **Bug Fixes**
* Improved packaging reliability by reducing platform-specific build
steps.
* Packaging test coverage was streamlined to better match the supported
build environment.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Update `it-and-security/default.yml` to include
`windows_entra_client_ids` with `$DOGFOOD_ENTRA_CLIENT_ID` alongside the
existing Entra tenant ID setting. This ensures default Windows Entra
configuration includes both required identifiers for migration/auth
setup.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Configuration**
* Added support for supplying the Entra client ID in the Windows Entra
integration configuration.
* Updated the deployment workflow to pass the configured client ID
through automatically.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This is needed to keep tools up to date with latest go.mod. Goal is for
these tools to have separate go.mod to reduce tool dependency on
production/main `go.mod`.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Expanded automated validation to cover both tool modules, including
builds, dependency tidiness checks, and applicable tests.
* Added a `make tidy-tool-modules` command to tidy supported tool
dependencies automatically.
* Added validation for tool changes and root Go module updates.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Switch the Windows Fleet-maintained app test workflows from
windows-latest to windows-11-arm so ARM-native FMAs can be validated.
Existing x86/x64 FMAs continue to install and run via Windows 11 on
ARM's Prism emulation, and detection is registry-based so it stays
architecture-agnostic.
Also make the osquery download architecture-aware: pick the native arm64
build on ARM64 runners and fall back to x86_64 otherwise, so osqueryi
runs natively rather than under emulation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Expanded test coverage to include Windows 11 ARM64 architecture. The
application is now validated on ARM-based systems in addition to
traditional x86_64 platforms.
* Updated test infrastructure to automatically detect system
architecture and download corresponding dependencies, ensuring proper
validation across both ARM64 and x86_64 Windows configurations.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Two reasons:
- It's a testing/QA tool, so it should be under `tools/`
- Reduce security-noise because it's just an internal tool (all findings
under tools/ should be ignored).
Failing dependency review expected because of the security findings in
the docker Go packages. (Which can be fixed/updated when a patch is
issued but without urgency because this is an internal tool.)
## Testing
- [x] QA'd all new/changed functionality manually
Ran:
```
cd tools/upgrade
FLEET_VERSION_A=v4.87.1 FLEET_VERSION_B=v4.88.1 go test
```
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## Summary by CodeRabbit
* **New Features**
* Added an end-to-end upgrade test scenario across two Fleet versions.
* Added a Docker Compose-based upgrade environment (Fleet, MySQL, Redis,
osquery) with local TLS certs/keys and osquery flags.
* **Tests**
* Added automated Fleet readiness checks and host enrollment
verification before and after upgrade.
* **Chores / Security**
* Updated the database upgrade test workflow and Go module tooling for
the new upgrade test setup.
* Adjusted secret scanning allow-rules and refreshed Go dependencies for
the upgrade module.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45524
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [x] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [x] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [x] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [x] Verified that the setting is exported via `fleetctl
generate-gitops`
- [x] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [x] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [x] Verified that any relevant UI is disabled when GitOps mode is
enabled
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Apple Platform SSO (PSSO) for macOS with device registration,
sign-in, and public discovery (JWKS + Apple app-site association)
protected by single-use nonces.
* Added Apple account provisioning (Platform SSO password sync)
configuration with masked client-secret handling and GitOps support.
* Added a host-scoped PSSO device registration token variable for Apple
MDM profile generation.
* **Bug Fixes**
* Fixed macOS packaging to correctly build, embed, and sign the Platform
SSO extension.
* Resetting device Apple MDM data now also clears stored PSSO enrollment
records.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Magnus Jensen <magnus@fleetdm.com>
Changes:
- Updated the "Test Fleet website" and "Deploy Fleet website" workflows
to include the full git history when checking out the repo.
- Updated the website's build-static-content script to use git to build
lastModifiedAt timestamps for Markdown and YAML files on the website.
- Updated the article template page and article category pages to show a
timestamp of when an article's Markdown file was last changed, if it was
updated >3 days after it was published.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Articles now conditionally display an **Updated** timestamp when they
were substantially modified after publication.
* The **Updated** indicator is shown on both article listing pages and
individual article pages (including mobile/desktop headers).
* **Bug Fixes**
* Timestamp rendering is now more consistent, helping readers
distinguish original publish dates from later edits.
* **Styling**
* Added styling to support the new “updated timestamp” label and
timestamp formatting within article cards.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** NA — Release QA process/template maintenance
# Description
Updates the Release QA issue template
(`.github/ISSUE_TEMPLATE/release-qa.md`) to reflect the current product
groups and to tighten the smoke tests.
Changes:
- **Assignees:** added `marcusallen97` and `thisisjoegrant`.
- **Labels:** updated to the current product groups — `#g-mdm` →
`#g-apple-at-work`, `#g-software` → `#g-auto-patching`, and added
`#g-power-to-pc`. Reordered to match the section order in the template.
- **Android:** moved the Android checks (Progress checkbox + test steps)
from **Security & Compliance** to **Power to PC**, which now owns them.
- **Fleet Free coverage:** added `Android MDM` to Power to PC's "works
normally on Free" list (where Android now lives), and scoped Apple at
Work's entry from "Apple and Android MDM" to "Apple MDM".
- **Removed the UI / UX check from all product groups.** It was too
abstract to be actionable — smoke tests should focus on specific action
items, and there was no clean way to integrate it as a concrete step. We
rely on QA noticing visual issues as we go through the specific checks,
so a separate catch-all check added no value and just took up space.
# Checklist for submitter
- [ ] QA'd all new/changed functionality manually
<sub>This is a change to the Release QA GitHub issue template only
(markdown). No code, migrations, configuration, or fleetd/orbit changes
— the remaining template checklist sections do not apply.</sub>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** #43544.
Moves `fleet-mcp` from `tools/fleet-mcp/` to `cmd/fleet-mcp/`. It is
becoming a production server used by customers, so it now lives under
`cmd/` alongside the other Fleet binaries.
Per the module strategy chosen for this move, it **remains a standalone
Go module** (keeps its own `go.mod`/`go.sum` and isolated deps such as
`mark3labs/mcp-go`, `logrus`, `gorilla/websocket`, `godotenv`) — the
root `github.com/fleetdm/fleet/v4` module is unchanged.
### What changed
- `git mv tools/fleet-mcp/ → cmd/fleet-mcp/` (history preserved as
renames).
- Updated all path references:
- Root `Makefile` `update-go` module list.
- `.github/workflows/test-fleet-mcp.yml` — trigger paths,
`go-version-file`, `working-directory`.
- `.github/dependabot.yml` — gomod directory.
- `cmd/fleet-mcp/render.yaml` — `rootDir`.
- `cmd/fleet-mcp/README.md`, `Makefile`, `schema.go` — path
comments/links.
- `articles/fleet-mcp.md` — README link.
- Removed the `fleet-mcp/` row from `tools/README.md`.
### Follow-up (not in this PR)
- The Render service's Blueprint file path must be updated from
`tools/fleet-mcp/render.yaml` to `cmd/fleet-mcp/render.yaml` in the
Render dashboard.
## Testing
- `go build .` in `cmd/fleet-mcp` — OK
- `go test -race -count=1 ./...` — `ok fleet-mcp`
- [x] QA'd all new/changed functionality manually
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#48746
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added a CI workflow to run build and race-enabled tests for dibble
changes.
* Included a dependency consistency check to ensure dibble’s Go module
files stay tidy.
* Configured CI concurrency to cancel in-progress runs for newer
changes.
* Updated dibble’s Go dependencies (indirect) to newer versions.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
**Related issue:** N/A — internal update to the release-QA issue
template
# Description
Updates the **Release QA** issue template
(`.github/ISSUE_TEMPLATE/release-qa.md`) to match current product group
naming and to tighten the release-critical issue gate.
Changes:
- **Renamed product group sections** to match the working-group names in
`handbook/company/product-groups.md`: **MDM → Apple at Work** and
**Software → Auto Patching**.
- **Moved OS updates and disk encryption checks** out of Security &
Compliance to the platform-owning groups:
- macOS OS updates + disk encryption → **Apple at Work**
- Windows OS updates + disk encryption → **Power to PC**
- Linux disk encryption stays in **Security & Compliance**
- Per-section Fleet Free premium-gating lists updated to follow the
moves.
- **Consolidated the release-critical issue check** into a single "Ready
for release" gate covering both `~unreleased bug` (regressions
introduced during the cycle — the most critical to clear) and `~release
blocker` labels. Every such issue must have a milestone, an owner, and
be moved to "Ready for release" on its product group board before the
release can proceed.
- **Removed non-functional in-issue anchor links.** GitHub only
generates heading anchors when rendering Markdown as a repo
file/wiki/Discussion, not inside issue bodies, so the previous
`#notes`-style links silently did nothing once the template became an
issue.
# Checklist for submitter
- [ ] ~Changes file added for user-visible changes~ — N/A, internal QA
issue template only (no user-visible product change).
## Testing
This is a docs-only change to a GitHub issue template; no code paths are
affected.
- [x] QA'd all new/changed functionality manually (verified rendered
Markdown, section structure, and label-filter links).
- @noahtalerman: Two checkboxes for free v. premium makes it possible to
have conflicting info in the same story. Discovered during
#g-power-to-pc standup
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** N/A — internal release-QA issue template update
## Description
Updates the **Release QA** issue template
(`.github/ISSUE_TEMPLATE/release-qa.md`) to match the format already
used by the **Release QA - fleetd** template:
- Adds a **"How to check off"** note explaining that testers tick the
per-section **Progress** checkboxes (so GitHub shows the "X of Y tasks"
tracker), and record failures under **Notes**.
- Adds a **Progress** checkbox list before each section table
(Orchestration, MDM, Power to PC, Software, Security & Compliance, All
product groups).
- Drops the **pass/fail** column from every table (now 3 columns: Test
name / Step instructions / Expected result) and removes the `$Name`
placeholder example row.
- Splits the single **Load tests** entry into **Baseline loadtest** and
**Migration loadtest** rows (and matching checkboxes), and reworks both
around the `tools/loadtest/metrics/` tooling (see below).
No code or product behavior changes — issue template only.
## New load test flow
Both load tests now use the `tools/loadtest/metrics/` scripts —
[`collect-metrics.sh`](https://github.com/fleetdm/fleet/blob/main/tools/loadtest/metrics/collect-metrics.sh)
(pulls CloudWatch metrics into a `.json` data file + `.md` synopsis) and
[`compare-metrics.sh`](https://github.com/fleetdm/fleet/blob/main/tools/loadtest/metrics/compare-metrics.sh)
(diffs two runs and flags deltas `ok` / `WARN` / `ALERT`). Condition of
satisfaction for each: collect → compare → post the comparison as an
issue comment → open a PR with the run artifacts and record results in
the metrics spreadsheet.
**Baseline loadtest** (compared against the previous release, n-1):
1. Stand up a fresh RC environment (new instance, no data) and run it
~24h.
2. Collect metrics under the `baseline` category.
3. Compare against the previous release (n-1); post the comparison as an
issue comment — deltas should be `ok`.
4. Open a PR with the run artifacts (`.json` + `.md`) under
`runs/baseline/<workspace>/` and record metrics in the spreadsheet.
**Migration loadtest** (compared before vs. after the migration):
1. Run a load test on the previous minor release (n-1); right before
migrating, collect the last 2h.
2. Migrate the environment to the RC (n).
3. Wait ~2h, then collect the past 2h (symmetric window for an
apples-to-apples diff).
4. Compare post-migration vs. pre-migration; post the comparison as an
issue comment — deltas should be `ok`.
5. Open a PR with the run artifacts under `runs/migration/<workspace>/`
and record metrics in the spreadsheet.
Example result PRs this flow produces: fleetdm/fleet#47794 (baseline),
fleetdm/fleet#47803 (migration).
# Checklist for submitter
- [ ] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated the packaged app and generated target builds to use the latest
version across supported platforms.
* Kept release automation in sync for macOS, Linux, and Windows build
outputs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## Summary
Adds `tools/hangar` — a macOS desktop control panel for working on Fleet
locally: branch management, `fleet serve` orchestration, log tail, dev
MySQL backup/restore, `fleetctl`, GitOps, and `osquery-perf`, all in one
window.
Built with **Go + [Wails 3](https://v3alpha.wails.io)** — the backend is
plain Go (`os/exec`, `syscall`, goroutines) so Fleet engineers can
contribute to it; only the desktop shell is Wails. The `internal/`
packages are pure and unit-tested.
### History note
Hangar started as a Rust/Tauri app. It was ported to Go, and **the Go
port is now the canonical `tools/hangar`**. The original Rust/Tauri
implementation has been removed from the monorepo (preserved in a
standalone repo) — so although this branch's earlier commits add and
then replace the Rust app, the net diff is just the Go app at
`tools/hangar`. The bundle identifier is `com.fleetdm.fleet-hangar`,
matching the original app so existing settings carry over.
# Checklist for submitter
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
> No `changes/` file: `tools/` is contributor tooling, not a
user-visible Fleet change. No DB migrations, no Fleet config settings,
no fleetd/orbit changes.
## Testing
- [x] Added/updated automated tests (Go unit tests across `internal/`,
including a path-traversal regression for backup deletion)
- [x] QA'd all new/changed functionality manually
## Test plan
- [x] `cd tools/hangar && task dev` launches the app (live-reload)
- [x] `task build` produces `bin/fleet-hangar`; `go test ./...` is green
- [x] First-run gate discovers a local Fleet clone and runs dep checks
- [x] Server tab can run the build chain and start `fleet serve`
- [x] Git tab branch search finds an older branch (e.g. a stale `qa-*`)
by name
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Introduced Fleet Hangar, a comprehensive desktop application for Fleet
development workflows, providing unified controls for server/database
management, git operations, configuration, logging, and troubleshooting.
* Added database backup management with metadata tracking.
* Integrated process orchestration for development services (Docker,
ngrok, Python).
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: George Karr <georgekarrv@users.noreply.github.com>
**Related issue:** #47725 moved the script but didn't update the
workflow
# Checklist for submitter
- [x] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
N/A - CI-only change, no user-visible impact.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
## Testing
- [x] QA'd all new/changed functionality manually
**How this was tested:**
1. Confirmed `uninstall-fleetd-windows.ps1` does not exist at the old
path (`it-and-security/lib/windows/scripts/`) on `main` -- reproduces
the `CommandNotFoundException`.
2. Confirmed the file exists at the new path
(`docs/solutions/windows/scripts/`).
3. Ran sparse-checkout simulations locally: old path yields no script
file, new path successfully pulls it.
4. Compared old vs new script -- the new version adds an MDM
unenrollment step that is a no-op in E2E (no MDM enrolled), so behavior
is equivalent.
5. Triggered the full E2E agent workflow on this PR branch to verify all
32 Windows jobs pass the "Uninstall Orbit" step.
## Root cause
PR #47725 ("Fix unenroll Windows instructions", merged June 19) moved
`uninstall-fleetd-windows.ps1` from
`it-and-security/lib/windows/scripts/` to
`docs/solutions/windows/scripts/` as part of merging the "turn off MDM"
and "uninstall fleetd" scripts into one. However,
`.github/workflows/e2e-agent.yml` was not updated to reflect the new
path.
This broke all 32 Windows E2E jobs (windows-2025 and windows-11-arm, all
channel/update combinations) at the "Uninstall Orbit" step. The nightly
run has been failing for 2 consecutive cycles (June 20 and 21),
exhausting all 4 retry attempts each time.
## Fix
Update the sparse-checkout path and PowerShell run command in
`e2e-agent.yml` to the new location.
## Note: inconsistent uninstall script locations
After #47725, the uninstall scripts are now in different directories per
OS:
| OS | Uninstall script location |
|---|---|
| macOS | `it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh`
|
| Linux | `it-and-security/lib/linux/scripts/uninstall-fleetd-linux.sh`
|
| Windows |
`docs/solutions/windows/scripts/uninstall-fleetd-windows.ps1` |
macOS and Linux remain in `it-and-security/lib/` (Fleet's dogfooding
GitOps config). Windows was moved to `docs/solutions/` (user-facing
documentation). This inconsistency may warrant a follow-up to decide on
a canonical location.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46937
Moves fleet desktop standalone app from
https://github.com/allenhouchins/fleet-desktop into the monorepo
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
No changes file. Do we want to create a new changes directory and
changelog for this? Unclear
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [x] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [x] Timeouts are implemented and retries are limited to avoid infinite
loops
- [x] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [x] Added/updated automated tests
- [x] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [x] QA'd all new/changed functionality manually
Downloaded build from CI, tested locally and installed via Fleet on a
mac mini. Launched and tested there - all looks good
<img width="1485" height="544" alt="Screenshot 2026-06-09 at 4 27 59 PM"
src="https://github.com/user-attachments/assets/48611808-2265-43b7-a514-afc4f578a9f8"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Launched Fleet Desktop macOS app with web-based self-service UI.
* Added fleet:// URL handling to trigger in-app actions (refetch, update
all).
* Dock badge shows failing policies count in real time.
* Built-in token refresh, retries, and navigation error handling for
reliability.
* MDM configuration support for enterprise deployment.
* Automated macOS packaging with code signing, notarization, and
artifact upload.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
## Summary
- Adds a new `release-qa-fleetd.md` GitHub issue template to split
`fleetd` agent QA out of the main release QA checklist into its own
dedicated issue
- Covers smoke tests for **fleetd** (enrollment, Fleet Desktop/My device
all sections, scripts, software, self-healing, auto-updates disabled),
**osquery** (version, live queries, tables, scheduled queries, packs),
and **Android** (app deployment, setup experience, Google Play software,
certificates, debug mode, unenrollment)
- Includes the existing `fleetd` testing gate (local TUF, auto-update
n+1, edge promotion) steps
- Uses a hybrid format: clickable `**Progress**` task lists (native
markdown, outside tables) for check-off + GitHub's "X of Y tasks"
progress bar, with full step/expected-result detail tables below each
list
---------
Co-authored-by: Reed Haynes <reed@fleetdm.com>
Co-authored-by: Andrey Kizimenko <87822796+AndreyKizimenko@users.noreply.github.com>
Only run this check on PRs that have Go and frontend changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated CI/CD workflow configuration to optimize PR validation
triggers based on affected file paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add exemptions to the PR template verification job. Expose GH_TOKEN and
pull request metadata (author, number, repo), skip the check when the
author is "fleet-release", and skip when all changed files are under the
exempt paths (ee/maintained-apps/ or it-and-security/) using the gh API
to list files. The existing marker-based template check remains in
place.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Resolves#46352.
## Testing
- [X] QA'd all new/changed functionality manually.
Tested on this PR:
Before having the QA item:
<img width="1056" height="274" alt="Screenshot 2026-06-08 at 6 36 23 PM"
src="https://github.com/user-attachments/assets/cbcaeefd-ff12-41b0-81d5-b40de6cd0bff"
/>
After adding the QA item:
<img width="686" height="81" alt="Screenshot 2026-06-08 at 6 36 53 PM"
src="https://github.com/user-attachments/assets/5af6b42c-34fe-4515-ac4c-253a0e788d31"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added an automated check that validates pull request descriptions
include the required QA confirmation. The check runs on PR events, fails
the check and annotates the PR when the confirmation is missing, and
emits a confirmation message when present to help maintain consistent
review readiness.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I saw CodeQL being run on this PR
https://github.com/fleetdm/fleet/pull/47154
But it only modified a .MD file inside the docs/Contributing path, we
also only have MD files in there, so I think it's wasteful to run on
those changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated CI/CD workflow configuration to optimize pipeline efficiency
by excluding documentation changes from code analysis triggers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds two winget-sourced Windows FMAs:
- R (RProject.R) -> 'R for Windows', Inno Setup exe, machine scope
- Git (Git.Git) -> 'Git', Inno Setup exe, machine scope
Both use custom Inno install/uninstall scripts (no MSI ProductCode) with
registry-UninstallString-based uninstall and fuzzy name matching, since
their ARP DisplayName embeds the version ('R for Windows <ver>', 'Git
version <ver>').
test-fma-windows-pr-only.yml: add has_r/has_git detection and removal of
the runner's pre-installed R and Git. Git for Windows provides the Git
Bash 'bash' the workflow uses, so the apps.json filtering is split into
its own step that runs before Git removal, and validation runs 'go run
-buildvcs=false' (so Go does not invoke the now-removed git for VCS
stamping).
SSMS was investigated but intentionally skipped: SSMS 21/22 is a Visual
Studio online bootstrapper (no MSI ProductCode, multi-GB network
install), which is a fragile FMA candidate, and the runner has no
standalone SSMS to uninstall.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Git (Windows) with automated install/uninstall and
UI icon.
* Added support for R for Windows with automated install/uninstall and
UI icon.
* Windows testing workflow now detects and conditionally prepares
environments when Git or R are present.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Also fixed the currently failing check on main.
Final zizmor PR
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security & Infrastructure**
* Enhanced credential handling in automated workflows by disabling
unnecessary credential persistence
* Strengthened security scanning configuration to enforce additional
checks on GitHub Actions workflows while maintaining a curated allowlist
for compatibility
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for PowerShell as a managed Windows app,
including its metadata, versioning, install/uninstall scripts, and
validation logic in the CI workflow. It also ensures that any
pre-installed PowerShell 7 is removed from the test environment before
validation. The most important changes are:
**PowerShell app definition and metadata:**
* Added a new entry for PowerShell in
`ee/maintained-apps/inputs/winget/powershell.json` and included its
metadata in `ee/maintained-apps/outputs/apps.json`, enabling PowerShell
to be managed as a Windows app.
[[1]](diffhunk://#diff-7e4899a379d327948f55b7e6ba4c9893501713edd16020b128b68343569fcbfbR1-R10)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1985-R1991)
* Created `ee/maintained-apps/outputs/powershell/windows.json`
containing version information, SQL queries for existence and patch
status, installer/uninstaller scripts, and download URL for PowerShell
7.6.2.0.
**CI workflow enhancements for PowerShell:**
* Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes involving PowerShell, set the appropriate output flags, and
conditionally execute PowerShell-specific steps.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR116)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR155-R162)
* Added a workflow step to remove any pre-installed PowerShell 7 from
the GitHub Actions runner, ensuring a clean environment for validation.
* Ensured that validation and related steps use Windows PowerShell 5.1
(not pwsh) after uninstalling PowerShell 7, to avoid shell availability
issues.
These changes collectively enable PowerShell to be validated, installed,
and uninstalled as part of the managed apps ecosystem and ensure
reliable, repeatable CI validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added PowerShell as a supported application with full Windows
integration, including installation and uninstall management
capabilities.
* Enhanced deployment scripts to support flexible input handling for app
configurations.
* Added PowerShell icon to the frontend UI for visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated GitHub Actions dependencies to latest stable versions across
CI/CD workflows for improved reliability, security, and performance.
* Enhanced build provenance attestation configuration for macOS, Linux,
and Windows builds.
* **Security**
* Strengthened workflow validation by removing override exception for
build artifact version mismatch rules, ensuring stricter security
compliance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46790
Example live run off this branch:
https://github.com/fleetdm/fleet/actions/runs/27005120262
Example stale issue with comment:
https://github.com/fleetdm/fleet/issues/18421
- Added `@author` mention when marking issue as stale
- Refactored so that both Fleetie and eng-initiated stale issue bots use
the same core JS code
- Run Fleetie-initiated workflow on a schedule
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Automated stale-issue workflows for engineering-initiated and Fleetie
issues with configurable dry-run, max-operations, manual triggers, and
scheduled runs.
* **Tests**
* Added shared test helpers and expanded, tightened test suites covering
staleness, closing, unstale, and error/boundary behaviors.
* **Refactor**
* Introduced a shared stale-issue engine used by thin,
author/label-based wrappers for consistent behavior and messaging.
* **Chores**
* Updated workflow triggers, permissions, and CI test matrix to include
the new core and wrappers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request introduces support for managing Node.js as a
maintained Windows app in the system. It adds Node.js metadata,
versioning, install/uninstall scripts, and a custom SVG icon for the
frontend. The Windows workflow is updated to detect Node.js changes and
ensure any pre-installed Node.js is removed before installing the
managed version.
**Node.js app support:**
* Added `nodejs/windows` to the maintained apps with metadata
(`ee/maintained-apps/inputs/winget/nodejs.json`,
[[1]](diffhunk://#diff-07f6dd0fa793aa5ad8e559c540e6f85df3f3ef15f3c7582462441b85f84fb244R1-R10)
and output definitions
(`ee/maintained-apps/outputs/nodejs/windows.json`,
[[2]](diffhunk://#diff-da3a5f86c5330f52227f66bf34701870ff49b5a00651f89366b092c10c5d717fR1-R22)
including version, installer URL, and install/uninstall scripts.
* Updated `apps.json` to include Node.js as a Windows app with
description and identifiers (`ee/maintained-apps/outputs/apps.json`,
[ee/maintained-apps/outputs/apps.jsonR1698-R1704](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1698-R1704)).
**CI/CD workflow enhancements:**
* Modified `.github/workflows/test-fma-windows-pr-only.yml` to detect
Node.js changes in PRs, output `has_nodejs` flags, and remove
pre-installed Node.js before managed installation
(`.github/workflows/test-fma-windows-pr-only.yml`,
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR101)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR114)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR145-R152)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR340-R407).
**Frontend improvements:**
* Added a custom Node.js SVG icon component
(`frontend/pages/SoftwarePage/components/icons/Nodejs.tsx`,
[frontend/pages/SoftwarePage/components/icons/Nodejs.tsxR1-R14](diffhunk://#diff-5c0b7f670e49e55467eb93b875eae2c00f83eee90e5b7b61eafab363df95165eR1-R14)).
* Registered the Node.js icon in the software icon map for display in
the UI (`frontend/pages/SoftwarePage/components/icons/index.ts`,
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR49)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR486).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
* Added Node.js support for Windows platform with automated detection
and management capabilities
* Node.js is now displayed with a dedicated icon in the application
interface
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- misfeature — rule enabled, waived only for the 6 Windows shell: cmd
workflows (catches any future misuse elsewhere).
- excessive-permissions and artipacked — fixed and fully enforced
(removed from gate).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD security by disabling credential persistence across
many workflows.
* Tightened workflow permissions to least-privilege for selected build
and analysis jobs.
* Made runner hardening and credential handling explicit in several
deployment and test workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Luke Heath