Allen Houchins
cc9f8e4891
<!-- Add the related story/sub-task/bug number, like Resolves #123, or remove if NA --> **Related issue:** NA The Fleet UI now displays a policy's targeted platform, so repeating it in the policy name is redundant. This strips the leading `macOS - ` / `Windows - ` / `Linux - ` from all 84 prefixed policies in `it-and-security`. ## Collisions GitOps rejects duplicate policy names within a fleet ([`pkg/spec/gitops.go`](https://github.com/fleetdm/fleet/blob/main/pkg/spec/gitops.go#L2020)), and the Workstations fleet includes macOS, Windows, and Linux policies together. 14 stripped names would collide, so for those the platform moves to a trailing suffix instead of being dropped: | Before | After | |---|---| | `macOS - Gatekeeper enabled` | `Gatekeeper enabled` | | `Windows - Secure Boot enabled` | `Secure Boot enabled` | | `Linux - Removable storage is read-only` | `Removable storage is read-only` | | `macOS - Disk encryption enabled` | `Disk encryption enabled (macOS)` | | `Windows - Disk encryption enabled` | `Disk encryption enabled (Windows)` | | `Linux - Disk encryption enabled` | `Disk encryption enabled (Linux)` | 49 policies lose the platform entirely; 35 keep it as a suffix. The 14 suffixed names are: Disk encryption enabled, Sufficient disk space available, User .npmrc min-release-age at least 0.5 days, 1Password installed, Battery healthy, and the 9 patch policies that exist for both macOS and Windows (1Password, Google Chrome, Firefox, Slack, Zoom, Visual Studio Code, Okta Verify, Claude, Adobe Acrobat Reader). Also updates the descriptions of `macos-screen-lock-exclusions` and `windows-screen-lock-exclusions`, which quote policy names. ## Notes for the reviewer - **This is destructive on apply.** GitOps matches policies by name, so applying this deletes the 84 existing policies and creates new ones. Policy pass/fail history and host results reset. Automations defined in the policy YAML (calendar events, install/script triggers) carry over, but anything referencing these names outside the repo — saved filters, dashboards, Slack workflows — needs updating separately. - `tools/fleet-slackbot/system-prompt.js:338` still documents the `<Platform> - <Description>` convention, and the `fleetctl new` macOS template still ships a prefixed name. Both left alone intentionally — out of scope for dogfood config. - Four policy files appear unused by any fleet and were renamed only for consistency: `lib/{macos,windows}/policies/update-claude.yml` and `update-slack.yml`. Their names duplicate entries already in `patch-fleet-maintained-apps.yml` for the same platform. Worth deleting in a follow-up. # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. See [Changes files](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/guides/committing-changes.md#changes-files) for more information. N/A — dogfood GitOps config only, no product code changes. ## Testing - [x] QA'd all new/changed functionality manually Verified locally: - No `macOS - ` / `Windows - ` / `Linux - ` strings remain anywhere under `it-and-security/`. - Every fleet passes the same uniqueness rule GitOps enforces — Workstations resolves to 78 policies with 0 duplicate names; all other fleets unchanged. - All 73 touched/related YAML files parse. - The diff touches only `- name:` lines plus the two label descriptions.
Fleet
These files allow you to configure, patch, and secure computing devices for your organization.
Whether you're making changes by hand or spinning them up from Slack or Teams using a tool like Claude or Kilo Code (e.g. "Make our endpoints compliant with ISO 27001" or "Fix CVE-2026-XXXX"), your team reviews, merges, and it deploys to thousands of endpoints in seconds. This makes it straightforward to instantly rollback a change, and history is fully tracked.
You can read more about the anatomy of these files and what they do in Fleet's documentation. You can also opt to manage particular aspects of Fleet in the graphical user interface instead, such as software or labels.
Unsure? Talk to a human at fleetdm.com/support
What is Fleet?
Fleet is high-agency device management software. It is especially popular with IT and security teams who manage lots of endpoints.
All source code is public and the product is supported by a company called Fleet Device Management that enrolls millions of laptops, tablets, phones, servers, and other computing devices in 90+ countries.