<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Action items for #40725 postmortem
Added in both places because we should consider these things both when
working on bugs and drafting new features. #40725 happened because what
was thought to be a temporary state had no limits on retries
---------
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
- Configures internal alb to log to the same bucket as the public alb
- Adds support for osquery-perf task size (cpu/memory) configuration
- Updates defaults for osquery-perf extra_flags
- Updates default enroll.sh loop sleep_time from 60s -> 300s
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42573
Fixes failing test by replacing no-longer-supported `--no-quarantine`
option with manually turning off quarantine for Wine.
Successful run here:
https://github.com/fleetdm/fleet/actions/runs/23661332211
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
Add nightly testing across the following:
OS: mac/Linux/Windows
Updates: enabled/disabled
Channels (for each of orbit/osquery\desktop): edge/stable
Arch: arm/x86
Failures are alerted to Slack.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42226
When doing dev in a remote environment, like a public cloud VM, don't
expose ports to the public.
This is a contributor security improvement.
The localstack fail is present on main, and was not caused by this
change:
https://github.com/fleetdm/fleet/actions/runs/23439965808/job/68187858627
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Docker Compose configuration updated across multiple services (Redis,
MySQL, mail, monitoring, and storage services) to restrict port bindings
to localhost only instead of all network interfaces.
* Documentation Docker Compose examples updated to reflect
localhost-only port binding for core services.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#42252
Pins the Localstack image to the last-known-good version (4.5) before
they 🔪 'd the community edition and started requiring an auth token. I
also added a "wait for localstack" as an initial debugging step, and
left it in to catch similar future issues. It's probably redundant since
there likely _is_ no future for Fleet and Localstack beyond this, but it
take milliseconds and would catch any other weird Localstack failures
so, why not.
Updating actions/setup-go to v6.3.0 from a mix of different versions.
This gets us faster CI runs, with improvements such as:
- built in Go module cache AND Go build cache (separate cache no longer
needed)
- using go.mod resulting in fewer cache invalidations
- faster Node 24 runtime
- using go.dev download URL, which is more reliable
Add mobile management hint secrets in the dogfood GitOps workflow by
adding DOGFOOD_OKTA_ANDROID_MANAGEMENT_HINT and
DOGFOOD_OKTA_IOS_MANAGEMENT_HINT to the job environment. These values
are sourced from repository secrets and are intended for Okta
Android/iOS management hint configuration during the workflow run. No
other behavior was changed.
This pull request updates the environment variable configuration for
Okta metadata URLs in the `dogfood-gitops` GitHub Actions workflow.
Instead of using a single metadata URL, the workflow now distinguishes
between admin and end user metadata URLs.
Workflow configuration changes:
* Split the `DOGFOOD_OKTA_METADATA_URL` environment variable into two
separate variables: `DOGFOOD_OKTA_METADATA_URL_ADMINS` and
`DOGFOOD_OKTA_METADATA_URL_END_USERS` in the
`.github/workflows/dogfood-gitops.yml` workflow file.
Add DOGFOOD_OKTA_METADATA_URL to the dogfood GitOps workflow environment
and update SSO configuration to use Okta. it-and-security/default.yml:
change end_user_authentication.entity_id to fleet-end-users and org SSO
entity_id to fleet-admins, set idp_name to Okta for both, remove inline
metadata values, and point metadata_url to $DOGFOOD_OKTA_METADATA_URL.
This centralizes IdP metadata retrieval via a secret URL.
Updates the auto-tag-unreleased-bugs workflow to improve version
detection and handling.
## Changes Made
- **Orbit/Fleetd Version Detection**: Added support for detecting Orbit
and Fleetd versions in addition to Fleet server versions. The workflow
now checks `**Orbit version**:` and `**Fleetd version**:` fields (case
insensitive) and validates them against orbit-v* tags.
- **Optimized API Calls**: The workflow now only fetches the data it
needs:
- Fetches releases only when checking Fleet server versions
- Fetches tags only when checking Orbit/Fleetd versions
- This reduces unnecessary GitHub API calls and improves performance
- **Singular/Plural Field Support**: Updated regex patterns to match
both "version" and "versions" in issue templates (e.g., `**Fleet
version**:` and `**Fleet versions**:`). This handles variations in issue
template formatting where either singular or plural forms may be used.
- **Pagination Support**: Both `listReleases` and `listTags` API calls
now use `github.paginate()` to fetch all results instead of just the
first 100. This ensures older Orbit/Fleetd versions or Fleet versions
won't be misclassified as unreleased when they exist beyond the first
page of results.
- **Fixed 4.x Handling**: Corrected the logic for handling "4.x" version
strings (which represent all 4.x versions). The check now occurs before
the empty versions check, preventing issues reporting only "4.x" from
being incorrectly tagged as unreleased.
## Testing
- ✅ Verified regex patterns match both singular and plural forms for
Fleet, Orbit, and Fleetd version fields
- ✅ Confirmed the workflow correctly parses versions from various issue
formats
- ✅ Tested that API optimization only fetches releases or tags based on
which version types are present
- ✅ Verified pagination logic fetches all releases and tags, not just
first 100
- ✅ Tested 4.x handling logic correctly treats it as released
The changes maintain backward compatibility with existing issue formats
while adding support for Orbit/Fleetd version detection, handling
template variations, and ensuring comprehensive version checking through
pagination.
---------
Co-authored-by: anthropic-code-agent[bot] <242468646+Claude@users.noreply.github.com>
Co-authored-by: iansltx <472804+iansltx@users.noreply.github.com>
Co-authored-by: lukeheath <2495927+lukeheath@users.noreply.github.com>
## Summary
Updates the test plan template to include a set of optional, reusable
testing sections that help ensure broader and more consistent test
coverage across features.
New sections:
- Core flow
- UI
- API
- GitOps
- Permissions
- Edge cases
- Supplemental testing
The goal is to make it easier for teams to reliably consider these areas
without requiring every issue to manually outline them.
## Core flow ownership
The **Core flow** section represents the original test plan content that
Product typically outlined for a user story. It captures the primary
feature behavior and expected functionality that must work for the story
to be considered complete.
This section is owned by **Product** and should describe the main user
flow and expected outcomes, similar to how the test plan was previously
documented.
## Edge case ownership
The **Edge cases** section is owned by **QA**, or shared between QA and
Product when Product wants QA to validate specific scenarios.
This helps ensure that less obvious scenarios (invalid inputs, boundary
conditions, missing configuration, etc.) are explicitly considered
rather than overlooked.
## Optional sections
Sections such as UI, API, GitOps, and Permissions are intentionally
designed to be **optional**.
They can be removed when they are not applicable to the feature being
implemented.
These sections act as reminders for areas that frequently require
validation in Fleet.
## Confirmation improvements
The **Confirmation** section has also been expanded to encourage
engineers to include any special setup or test data used during
development.
Providing this context helps QA reproduce the setup faster and reduces
time spent recreating test environments.
---------
Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
PR created based on this:
https://fleetdm.slack.com/archives/C071NNMSP2R/p1773261307958859
Which will allows us to keep enrolling Windows devices via Autopilot,
currently it will be wiped next Gitops run.
I've added the GH secret with the value Jordan posted.
## Summary
- Adds `windows_entra_tenant_ids` configuration to the Dogfood
`controls` section in `it-and-security/default.yml`, referencing a new
`$DOGFOOD_ENTRA_TENANT_ID` environment variable.
- Adds the corresponding `DOGFOOD_ENTRA_TENANT_ID` secret mapping in
`.github/workflows/dogfood-gitops.yml` so the value is passed through
during deployment.
## Action required
The actual tenant ID value needs to be added as a GitHub Actions secret
named `DOGFOOD_ENTRA_TENANT_ID` in the repository settings before this
will take effect. The tenant ID can be found in [Microsoft Entra admin
center](https://entra.microsoft.com/#home) under **Microsoft Entra ID >
Home**.
Built for [Magnus
Jensen](https://fleetdm.slack.com/archives/D0AG2PPQWV7/p1773271863050969)
by [Kilo for Slack](https://kilo.ai/features/slack-integration)
Co-authored-by: kiloconnect[bot] <240665456+kiloconnect[bot]@users.noreply.github.com>
Changes:
1. Adding Fleet free checks for each product group
2. Adding UI/UX checks for each product group
3. Expanding the IdP coverage and moving it to orchestration (postmortem
action item: https://github.com/fleetdm/fleet/issues/39684)
4. Moving Certificates to S&C
5. Adjusting assignee list
Replaces the single **Fleet version** field in the bug template with two
fields:
- **Discovered** – the Fleet version where the issue was first observed
- **Reproduced** – the Fleet version, where we confirmed the issue can
also be reproduced
Co-authored-by: Brayan Jimenez <137363326+Brajim20@users.noreply.github.com>
This pull request makes a small change to the GitHub Actions workflow
configuration by adding a new secret environment variable for use in the
dogfood environment.
- Added the `DOGFOOD_OKTA_VERIFY_WINDOWS_URL` secret to the environment
variables in the `.github/workflows/dogfood-gitops.yml` workflow file.
Fixes#40975.
8.0.32 (was running in Aurora managed cloud at the time) -> 8.0.39 (what
we're running now) 8.0.36 -> 8.0.44 (latest 8.0.x version supported by
Aurora; holding off on 8.0.45 until Aurora supports it) 8.4.7 -> 8.4.8
9.5.0 -> 9.6.0
Also bumped the supported Aurora version from 3.07.0 to 3.08.2 to match
what we're running in managed cloud right now
Fleet might work on older patch versions but we'll no longer dev/test on
them. MySQL 9.x not testing previous minor versions matches with our
previous approach for that version.
Since these are all patch/minor bumps (and the overnight build cases are
patch bumps/are covered by AWS envs) automated testing should be
sufficient here.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38538
This PR is just refactoring GitHub workflows. No significant functional
differences.
In this PR, we create a reusable workflow for running a single Go test
suite. This eliminates/reduces the complex and hard to maintain strategy
matrix from the original job.
This is pre-work before splitting off activity bounded context tests
into their own job.
- Instead, changes to activity will be specified as a PR to
`audit-logs.md` in the reference doc release branch just like API and
YAML (GitOps) changes
Ran `yarn upgrade` to catch things up. Seeing if tests pass, then will
add other items on top.
---------
Co-authored-by: Gabriel Hernandez <ghernandez345@gmail.com>
