Only run this check on PRs that have Go and frontend changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated CI/CD workflow configuration to optimize PR validation
triggers based on affected file paths.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Add exemptions to the PR template verification job. Expose GH_TOKEN and
pull request metadata (author, number, repo), skip the check when the
author is "fleet-release", and skip when all changed files are under the
exempt paths (ee/maintained-apps/ or it-and-security/) using the gh API
to list files. The existing marker-based template check remains in
place.
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
Resolves#46352.
## Testing
- [X] QA'd all new/changed functionality manually.
Tested on this PR:
Before having the QA item:
<img width="1056" height="274" alt="Screenshot 2026-06-08 at 6 36 23 PM"
src="https://github.com/user-attachments/assets/cbcaeefd-ff12-41b0-81d5-b40de6cd0bff"
/>
After adding the QA item:
<img width="686" height="81" alt="Screenshot 2026-06-08 at 6 36 53 PM"
src="https://github.com/user-attachments/assets/5af6b42c-34fe-4515-ac4c-253a0e788d31"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added an automated check that validates pull request descriptions
include the required QA confirmation. The check runs on PR events, fails
the check and annotates the PR when the confirmation is missing, and
emits a confirmation message when present to help maintain consistent
review readiness.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I saw CodeQL being run on this PR
https://github.com/fleetdm/fleet/pull/47154
But it only modified a .MD file inside the docs/Contributing path, we
also only have MD files in there, so I think it's wasteful to run on
those changes.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated CI/CD workflow configuration to optimize pipeline efficiency
by excluding documentation changes from code analysis triggers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Adds two winget-sourced Windows FMAs:
- R (RProject.R) -> 'R for Windows', Inno Setup exe, machine scope
- Git (Git.Git) -> 'Git', Inno Setup exe, machine scope
Both use custom Inno install/uninstall scripts (no MSI ProductCode) with
registry-UninstallString-based uninstall and fuzzy name matching, since
their ARP DisplayName embeds the version ('R for Windows <ver>', 'Git
version <ver>').
test-fma-windows-pr-only.yml: add has_r/has_git detection and removal of
the runner's pre-installed R and Git. Git for Windows provides the Git
Bash 'bash' the workflow uses, so the apps.json filtering is split into
its own step that runs before Git removal, and validation runs 'go run
-buildvcs=false' (so Go does not invoke the now-removed git for VCS
stamping).
SSMS was investigated but intentionally skipped: SSMS 21/22 is a Visual
Studio online bootstrapper (no MSI ProductCode, multi-GB network
install), which is a fragile FMA candidate, and the runner has no
standalone SSMS to uninstall.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added support for Git (Windows) with automated install/uninstall and
UI icon.
* Added support for R for Windows with automated install/uninstall and
UI icon.
* Windows testing workflow now detects and conditionally prepares
environments when Git or R are present.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Also fixed the currently failing check on main.
Final zizmor PR
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Security & Infrastructure**
* Enhanced credential handling in automated workflows by disabling
unnecessary credential persistence
* Strengthened security scanning configuration to enforce additional
checks on GitHub Actions workflows while maintaining a curated allowlist
for compatibility
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request adds support for PowerShell as a managed Windows app,
including its metadata, versioning, install/uninstall scripts, and
validation logic in the CI workflow. It also ensures that any
pre-installed PowerShell 7 is removed from the test environment before
validation. The most important changes are:
**PowerShell app definition and metadata:**
* Added a new entry for PowerShell in
`ee/maintained-apps/inputs/winget/powershell.json` and included its
metadata in `ee/maintained-apps/outputs/apps.json`, enabling PowerShell
to be managed as a Windows app.
[[1]](diffhunk://#diff-7e4899a379d327948f55b7e6ba4c9893501713edd16020b128b68343569fcbfbR1-R10)
[[2]](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1985-R1991)
* Created `ee/maintained-apps/outputs/powershell/windows.json`
containing version information, SQL queries for existence and patch
status, installer/uninstaller scripts, and download URL for PowerShell
7.6.2.0.
**CI workflow enhancements for PowerShell:**
* Updated `.github/workflows/test-fma-windows-pr-only.yml` to detect
changes involving PowerShell, set the appropriate output flags, and
conditionally execute PowerShell-specific steps.
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR102)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR116)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR155-R162)
* Added a workflow step to remove any pre-installed PowerShell 7 from
the GitHub Actions runner, ensuring a clean environment for validation.
* Ensured that validation and related steps use Windows PowerShell 5.1
(not pwsh) after uninstalling PowerShell 7, to avoid shell availability
issues.
These changes collectively enable PowerShell to be validated, installed,
and uninstalled as part of the managed apps ecosystem and ensure
reliable, repeatable CI validation.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added PowerShell as a supported application with full Windows
integration, including installation and uninstall management
capabilities.
* Enhanced deployment scripts to support flexible input handling for app
configurations.
* Added PowerShell icon to the frontend UI for visual identification.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated GitHub Actions dependencies to latest stable versions across
CI/CD workflows for improved reliability, security, and performance.
* Enhanced build provenance attestation configuration for macOS, Linux,
and Windows builds.
* **Security**
* Strengthened workflow validation by removing override exception for
build artifact version mismatch rules, ensuring stricter security
compliance.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#46790
Example live run off this branch:
https://github.com/fleetdm/fleet/actions/runs/27005120262
Example stale issue with comment:
https://github.com/fleetdm/fleet/issues/18421
- Added `@author` mention when marking issue as stale
- Refactored so that both Fleetie and eng-initiated stale issue bots use
the same core JS code
- Run Fleetie-initiated workflow on a schedule
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Automated stale-issue workflows for engineering-initiated and Fleetie
issues with configurable dry-run, max-operations, manual triggers, and
scheduled runs.
* **Tests**
* Added shared test helpers and expanded, tightened test suites covering
staleness, closing, unstale, and error/boundary behaviors.
* **Refactor**
* Introduced a shared stale-issue engine used by thin,
author/label-based wrappers for consistent behavior and messaging.
* **Chores**
* Updated workflow triggers, permissions, and CI test matrix to include
the new core and wrappers.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This pull request introduces support for managing Node.js as a
maintained Windows app in the system. It adds Node.js metadata,
versioning, install/uninstall scripts, and a custom SVG icon for the
frontend. The Windows workflow is updated to detect Node.js changes and
ensure any pre-installed Node.js is removed before installing the
managed version.
**Node.js app support:**
* Added `nodejs/windows` to the maintained apps with metadata
(`ee/maintained-apps/inputs/winget/nodejs.json`,
[[1]](diffhunk://#diff-07f6dd0fa793aa5ad8e559c540e6f85df3f3ef15f3c7582462441b85f84fb244R1-R10)
and output definitions
(`ee/maintained-apps/outputs/nodejs/windows.json`,
[[2]](diffhunk://#diff-da3a5f86c5330f52227f66bf34701870ff49b5a00651f89366b092c10c5d717fR1-R22)
including version, installer URL, and install/uninstall scripts.
* Updated `apps.json` to include Node.js as a Windows app with
description and identifiers (`ee/maintained-apps/outputs/apps.json`,
[ee/maintained-apps/outputs/apps.jsonR1698-R1704](diffhunk://#diff-4c1446cfc02c6bb0bda874481e333c65b84e184fcea52f656b49a6489f73c9c2R1698-R1704)).
**CI/CD workflow enhancements:**
* Modified `.github/workflows/test-fma-windows-pr-only.yml` to detect
Node.js changes in PRs, output `has_nodejs` flags, and remove
pre-installed Node.js before managed installation
(`.github/workflows/test-fma-windows-pr-only.yml`,
[[1]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR101)
[[2]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR114)
[[3]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR145-R152)
[[4]](diffhunk://#diff-51641fd1d2cc19348b81fd8310b62ad270ca5082ceddff2d49064e78f126a1eaR340-R407).
**Frontend improvements:**
* Added a custom Node.js SVG icon component
(`frontend/pages/SoftwarePage/components/icons/Nodejs.tsx`,
[frontend/pages/SoftwarePage/components/icons/Nodejs.tsxR1-R14](diffhunk://#diff-5c0b7f670e49e55467eb93b875eae2c00f83eee90e5b7b61eafab363df95165eR1-R14)).
* Registered the Node.js icon in the software icon map for display in
the UI (`frontend/pages/SoftwarePage/components/icons/index.ts`,
[[1]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR49)
[[2]](diffhunk://#diff-628095892e1d16090be1db6cc1a5c9cebc65248c32a8b1312385394818f2907bR486).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
## New Features
* Added Node.js support for Windows platform with automated detection
and management capabilities
* Node.js is now displayed with a dedicated icon in the application
interface
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- misfeature — rule enabled, waived only for the 6 Windows shell: cmd
workflows (catches any future misuse elsewhere).
- excessive-permissions and artipacked — fixed and fully enforced
(removed from gate).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Improved CI/CD security by disabling credential persistence across
many workflows.
* Tightened workflow permissions to least-privilege for selected build
and analysis jobs.
* Made runner hardening and credential handling explicit in several
deployment and test workflows.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
- Created new table specific to Windows MDM testing.
- Copied shared tests to Windows MDM table.
- Removed all Windows-specific tests from original MDM table.
- Renamed original MDM table (Apple & cross-platform)
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves #
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements), JS
inline code is prevented especially for url redirects, and untrusted
data interpolated into shell scripts/commands is validated against shell
metacharacters.
- [ ] Timeouts are implemented and retries are limited to avoid infinite
loops
- [ ] If paths of existing endpoints are modified without backwards
compatibility, checked the frontend/CLI for any necessary changes
## Testing
- [ ] Added/updated automated tests
- [ ] Where appropriate, [automated tests simulate multiple hosts and
test for host
isolation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/reference/patterns-backend.md#unit-testing)
(updates to one hosts's records do not affect another)
- [ ] QA'd all new/changed functionality manually
For unreleased bug fixes in a release candidate, one of:
- [ ] Confirmed that the fix is not expected to adversely impact load
test results
- [ ] Alerted the release DRI if additional load testing is needed
## Database migrations
- [ ] Checked schema for all modified table for columns that will
auto-update timestamps during migration.
- [ ] Confirmed that updating the timestamps is acceptable, and will not
cause unwanted side effects.
- [ ] Ensured the correct collation is explicitly set for character
columns (`COLLATE utf8mb4_unicode_ci`).
## New Fleet configuration settings
- [ ] Setting(s) is/are explicitly excluded from GitOps
If you didn't check the box above, follow this checklist for
GitOps-enabled settings:
- [ ] Verified that the setting is exported via `fleetctl
generate-gitops`
- [ ] Verified the setting is documented in a separate PR to [the GitOps
documentation](https://github.com/fleetdm/fleet/blob/main/docs/Configuration/yaml-files.md#L485)
- [ ] Verified that the setting is cleared on the server if it is not
supplied in a YAML file (or that it is documented as being optional)
- [ ] Verified that any relevant UI is disabled when GitOps mode is
enabled
## fleetd/orbit/Fleet Desktop
- [ ] Verified compatibility with the latest released version of Fleet
(see [Must
rule](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/workflows/fleetd-development-and-release-strategy.md))
- [ ] If the change applies to only one platform, confirmed that
`runtime.GOOS` is used as needed to isolate changes
- [ ] Verified that fleetd runs on macOS, Linux and Windows
- [ ] Verified auto-update works from the released version of component
to the new version (see [tools/tuf/test](../tools/tuf/test/README.md))
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added Icon Composer as a supported macOS application with
install/uninstall support and a visual icon in the UI.
* **Chores**
* CI workflows updated to detect Icon Composer changes and to validate
it on macOS runners using a clean Xcode state.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Allen Houchins <allenhouchins@mac.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated security hardening tools across multiple GitHub Actions
workflows to the latest available version for enhanced CI/CD
infrastructure protection and resilience.
* Enabled additional security validation rules in workflow configuration
to strengthen infrastructure oversight and improve vulnerability
detection capabilities across build and deployment pipelines.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Fixing/enabling these zizmor checks:
- dependabot-cooldown
- secrets-inherit
- unpinned-uses
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Refined secret handling in CI test workflows: replaced inherited
secrets with explicit secret mappings and conditional forwarding
(scheduled runs vs others).
* Declared additional callable secrets for the reusable test suite: a
GitHub token and a Slack webhook for scheduled-run notifications.
* Updated blocking gate configuration: adjusted which rules are shown as
disabled and updated finding count comments.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Disabled Go toolchain/module caching across CI build, release, and
publish workflows.
* Disabled Node package-manager caching in relevant publish workflows.
* **Security**
* Re-enabled the cache-poisoning gate rule so cache-poisoning checks can
now block failing runs.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
This workflow has been flaky for years.
I've added inline comments explaining the changes.
This is important as a regression test now that we get more code changes
(AI) to review in fleetd.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Bumped osquery used in integration tests (5.9.1 → 5.23.0).
* Release tooling now updates the integration-test workflow when
releasing osqueryd.
* **Tests**
* Improved integration tests: refined trigger paths, separated service
startup, skipped frontend bundling for faster CI, more robust
host-enrollment detection and teardown.
* Limited package build targets (removed RPM) and added sparse checkout
for macOS uninstall script.
* **Stability**
* Added macOS osquery warm-up to prevent startup timeouts.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
This was getting flagged by automation when filtering for TODOs on
issues. This is one of the final things that QA needs to do before
wrapping up their work, so we'll remove the TODO from it for parity with
other "Confirmation" steps
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#41198
Subsequent PRs will clean up existing failures to enable more checks.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated security scanning for repository
workflow/configuration changes and pull requests, with manual trigger
and concurrent-run cancellation.
* **Chores**
* Introduced a configurable audit gate to suppress backlog rules with
guidance for removal.
* Enabled runner hardening, pinned tool versions, read-only checkout,
annotation-enabled reporting, and limited-scope analysis for workflow
files.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Every story issue inherited ~14 generic test-plan checkboxes (UI, API,
GitOps, Permissions) plus TODO placeholders, regardless of whether they
applied. The result was that most issues carried large blocks of
uncurated boilerplate, making it hard to see which checks were actually
relevant and adding visible noise to every story.
This restructures the Test plan section into a hybrid format:
- Keep "Core flow" and "Edge cases" visible, with Edge cases retaining a
required QA TODO slot so every story has a curated entry point.
- Move the UI, API, GitOps, and Permissions checklists into a single
commented block headed by a visible nudge. Authors un-comment only the
sections that apply, so the rendered issue shows only relevant checks
instead of orphan headers.
It also expands suggested coverage with three new sections (commented by
default):
- Premium gating: confirm premium-only features are blocked on both the
frontend and backend, not just hidden in the UI.
- Upgrade / data migration: confirm behavior on upgraded servers (not
just fresh installs) and that data migrates/rolls back safely.
- Feature in isolation (MDM / platform independence): confirm
cross-platform or Apple-MDM-independent features work without Apple MDM
configured. This addresses a recurring bug class where features break
when Apple MDM is off — e.g. #44801 (end user auth on
Windows/Linux-only), #44194 (team BitLocker enable when Apple MDM off),
and #46283 (host OS settings API with only Android MDM).
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves # None - Regenerating a cert to fix tests
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Replaced SCEP test CA certificates and associated encrypted
private-key test fixtures used by automated tests.
* **Chores**
* CI workflow path filters updated so changes to test data now trigger
test runs.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/46475?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#38785
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added a manual "force rebuild" option to trigger base MSI/PKG rebuilds
regardless of automatic checks.
* **Chores**
* Improved update detection to more reliably decide when rebuilds are
required by comparing current and new metadata and by validating publish
timestamps.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45907?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
I see no reason to use macOS for this job (given how unreliable and slow
macOS runners are).
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* CI workflow runner switched to ubuntu-latest.
* Internal tooling updated to download and prepare the osqueryd binary
for macOS and Linux.
* macOS agent configuration expanded with additional options for
keychain access and file-monitoring behavior.
---
Note: No end-user visible features or breaking changes in this release.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45816?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
## What's the issue I'm trying to solve here?
1. So I have a PR (say branch name `pr-foobar`).
2. The PR will do a docker publish (say docker image with tag
`fleetdm/fleet:pr-foobar`).
3. Load test environment deployed with such docker image tag
(`fleetdm/fleet:pr-foobar`).
4. I go to My account > and see Fleet has version
`0.0.0-SNAPSHOT-<SOME-SHA>` (0.0.0-SNAPSHOT is expected because it's a
branch). Example in screenshot below.
5. I do `git fetch origin && git show <SOME-SHA>` to know exactly what's
deployed.
6. Turns out `<SOME-SHA>` is some SHA known to Github, but not in the
fleet's git repository.
Problem: I really want to tie what's running with an actual commit SHA.
And this PR solves that for these load tests that use branches.
<img width="298" height="809" alt="Screenshot 2026-05-19 at 12 57 05 PM"
src="https://github.com/user-attachments/assets/d46fa037-1de5-4cf0-b768-6ec9dbe33620"
/>
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated CI/CD workflow checkout behavior so pull-request-triggered
runs use the PR head commit, ensuring the correct code is checked out
and improving build/test reliability and snapshot accuracy.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45814?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45700
Not a product change. This PR will allow us to run the workflow
manually. After ~2 weeks, if there are no issues, we'll make it
automatic.
## Testing
- [x] Added/updated automated tests
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **New Features**
* Added automated workflow to identify and close stale issues created by
Fleet team members, with dry-run capability and operation limits.
* Added system to build and maintain a deduplicated list of Fleet team
member handles from GitHub organization and repository history.
* **Tests**
* Added comprehensive test suites for stale issue management and handle
list generation with mock GitHub API interactions and boundary condition
coverage.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45530?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Resolves#45220 (one of several PRs)
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Tests**
* Added a dedicated maintained-apps test helper and updated integration
tests to use it, consolidating sync test setup and improving reliability
of maintained-apps scenarios.
* Updated several tests to use improved test utilities and helper
variants for SQL test helpers and request fixtures.
* **Chores**
* Adjusted CI lint checks to exclude the new test helper location from
specific env-var override validations.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45494)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Resolves#45497
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [ ] Changes file added for user-visible changes in `changes/`,
`orbit/changes/` or `ee/fleetd-chrome/changes`.
See [Changes
files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files)
for more information.
not user-facing
## Testing
- [ ] Added/updated automated tests
- [ ] QA'd all new/changed functionality manually
Kinda hard to test outside of a release, but the sibling .msi upload job
works using the same action SHA.
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Updated pinned GitHub Action digests used in CI to newer commits for
improved security and build reliability.
* Reformatted a CI step parameter across multiple YAML lines (no
functional change) to improve readability and maintainability.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45498)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
<!-- Add the related story/sub-task/bug number, like Resolves#123, or
remove if NA -->
**Related issue:** Related to, but does not resolve, #45267
Adds a 12h cooldown period such that when npm is resolving dependencies
it will not resolve anything released less than 12 hours ago. This
doesn't apply globally within the fleet project because some portions
use yarn which #45267 will take care of however this does add it to our
CI jobs and the .npmrc files for projects that use npm
I was going to set this as NPM_CONFIG_MIN_RELEASE_AGE in a github EV but
that won't automatically set it on every runner so leaving it in here
for now
As far as QA local builds and CI are both green. Tested
NPM_CONFIG_MIN_RELEASE_AGE=0.5 and min-release-age=0.5(in npmrc) locally
using the npm package feed https://registry.npmjs.org/-/rss to verify
that recently updated packages either chose an older version OR the
update was blocked if I tried to choose a newer one
# Checklist for submitter
## Testing
- [x] QA'd all new/changed functionality manually
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Enhanced npm supply-chain security by implementing package
installation policies across build workflows and configuration files to
exclude packages released within the last 12 hours.
<!-- review_stack_entry_start -->
[](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45268)
<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Changes:
- Added a new Github workflow that runs on branches that change the
website's dependencies (website/package-lock.json or
website/package.json), and fails for 72 hours after a change to those
files have been made. After 72 hours, if the workflow has not run again
on a pull request, the workflow can be rerun to give a PR a passing
status.
- Updated the website handbook page to document this process.
@lukeheath After this is merged, I will need help setting up a branch
protection rule to require a passing status from this workflow to merge
pull requests that change the website's dependencies
<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit
* **Chores**
* Added an automated workflow to enforce a wait period before website
dependency updates can proceed, preventing premature merges.
* Added scheduled and manual re-triggering for recent failed workflow
runs to ensure dependency checks are retried without manual
intervention.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
Lucas Manuel Rodriguez
