Merge branch 'main' into 19372-api-design

.github/ISSUE_TEMPLATE/feature-request.md

@@ -2,7 +2,7 @@
 name: 💡  Feature request
 about: Propose a new feature or enhancement in Fleet.
 title: ''
-labels: '~feature fest,:product'
+labels: ':product'
 assignees: ''
 
 ---

.github/ISSUE_TEMPLATE/release-article.md

@@ -3,7 +3,7 @@ name: 📰 Release article
 about: Propose a new feature or enhancement in Fleet.
 title: 'Release article: vXXX.YYY.ZZZ'
 labels: '#g-demand,:improve documentation'
-assignees: 'spokanemac'
+assignees: 'rachaelshaw'
 
 ---
 

.github/ISSUE_TEMPLATE/story.md

@@ -19,8 +19,15 @@ It is [planned and ready](https://fleetdm.com/handbook/company/development-group
 | I want to _________________________________________
 | so that I can _________________________________________.
 
+## Objective
+
+<!-- What quarterly objective does this story contribute to, if any? If it doesn't contribute to an objective, explain why it's being prioritized. -->
+
+## Original requests
+
+<!-- Insert the link to the feature request(s) that this story contributes to. Put "None" if it doesn't contribute to a request. For customer requests, add the `customer-xyz` label(s). -->
+
 ## Context
-- Requestor(s): _________________________ <!-- Who are the non-customer requestor(s) for this story, if any? Put their GitHub usernames here. They should be notified if the story gets de-prioritized. For customer requestors, use the `customer-xyz` label instead. -->
 - Product designer: _________________________ <!-- Who is the product designer to contact if folks have questions about the UI, CLI, or API changes? -->
 
 <!--

.github/ISSUE_TEMPLATE/website-request.md

@@ -0,0 +1,25 @@
+---
+name: 🌐 Website request
+about: Propose a new feature or enhancement to fleetdm.com.
+title: 'Website request: _________________'
+labels: '#g-digital-experience, ~website'
+assignees: ''
+
+---
+
+## Goal 
+
+| User story  |
+|:---------------------------------------------------------------------------|
+| As a _________________________________________,
+| I want to _________________________________________
+| so that I can _________________________________________.
+
+>For help creating a user story, see ["Writing a good user story"](https://fleetdm.com/handbook/company/development-groups#writing-a-good-user-story) in the website handbook.
+
+
+## How?
+
+- [ ] TODO
+
+### Context

.github/workflows/build-and-check-fleetctl-docker-and-deps.yml

@@ -2,11 +2,6 @@ name: Build fleetctl docker dependencies and check vulnerabilities
 
 on:
   workflow_dispatch:
-    inputs:
-      image_tag:
-        description: "Docker image tag"
-        required: true
-        type: string
   schedule:
     - cron: "0 6 * * *"
 
@@ -25,7 +20,7 @@ permissions:
 
 jobs:
   build-and-check:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     environment: Docker Hub
     permissions:
       contents: write
@@ -47,7 +42,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
         with:
-          go-version-file: 'go.mod'
+          go-version-file: "go.mod"
 
       - name: Install Go Dependencies
         run: make deps-go

.github/workflows/build-binaries.yaml

@@ -37,11 +37,10 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
-      # Set the Node.js version
-      - name: Set up Node.js ${{ vars.NODE_VERSION }}
+      - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
         with:
-          node-version: ${{ vars.NODE_VERSION }}
+          node-version-file: package.json
 
       - name: JS Dependency Cache
         id: js-cache
@@ -51,7 +50,7 @@ jobs:
             **/node_modules
           # Use a separate cache for this from other JS jobs since we run the
           # webpack steps and will have more to cache.
-          key: ${{ runner.os }}-node_modules-${{ hashFiles('**/yarn.lock') }}-node_version-${{ vars.NODE_VERSION }}
+          key: ${{ runner.os }}-node_modules-${{ hashFiles('**/yarn.lock') }}
           restore-keys: |
             ${{ runner.os }}-node_modules-
 

.github/workflows/check-tuf-timestamps.yml

@@ -6,7 +6,7 @@ on:
       - '.github/workflows/check-tuf-timestamps.yml'
   workflow_dispatch: # Manual
   schedule:
-    - cron: '0 10 * * *'
+    - cron: '0 10,22 * * *'
 
 # This allows a subsequently queued workflow run to interrupt previous runs
 concurrency:
@@ -38,7 +38,7 @@ jobs:
       run: |
         expires=$(curl -s http://tuf.fleetctl.com/timestamp.json | jq -r '.signed.expires' | cut -c 1-10)
         today=$(date "+%Y-%m-%d")
-        warning_at=$(date -d "$today + 2 day" "+%Y-%m-%d")
+        warning_at=$(date -d "$today + 4 day" "+%Y-%m-%d")
         expires_sec=$(date -d "$expires" "+%s")
         warning_at_sec=$(date -d "$warning_at" "+%s")
         

.github/workflows/deploy-fleet-website.yml

@@ -27,7 +27,7 @@ jobs:
   build:
     if: ${{ github.repository == 'fleetdm/fleet' }}
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:

.github/workflows/deploy-vulnerability-dashboard.yml

@@ -15,7 +15,7 @@ jobs:
       contents: write  # for Git to git push
     if: ${{ github.repository == 'fleetdm/fleet' }}
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
 
     strategy:
       matrix:

.github/workflows/fleet-and-orbit.yml

@@ -79,11 +79,10 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
-      # Set the Node.js version
-      - name: Set up Node.js ${{ vars.NODE_VERSION }}
+      - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
         with:
-          node-version: ${{ vars.NODE_VERSION }}
+          node-version-file: package.json
 
       - name: Start tunnel
         env:

.github/workflows/generate-desktop-targets.yml

@@ -19,7 +19,7 @@ defaults:
     shell: bash
 
 env:
-  FLEET_DESKTOP_VERSION: 1.33.0
+  FLEET_DESKTOP_VERSION: 1.34.0
 
 permissions:
   contents: read

.github/workflows/generate-osqueryd-targets.yml

@@ -24,7 +24,7 @@ defaults:
     shell: bash
 
 env:
-  OSQUERY_VERSION: 5.13.1
+  OSQUERY_VERSION: 5.14.1
 
 permissions:
   contents: read

.github/workflows/golangci-lint.yml

@@ -64,7 +64,7 @@ jobs:
           # Don't forget to update
           # docs/Contributing/Testing-and-local-development.md when this
           # version changes
-          go install github.com/golangci/golangci-lint/cmd/golangci-lint@e3c2265f4939976874989e159386b3bb7dcf8e1f # v1.55.2
+          go install github.com/golangci/golangci-lint/cmd/golangci-lint@a1d6c560de1a193a0c68ffed68cd5928ef39e884 # v1.61.0
           make lint-go
 
       - name: Run cloner-check tool

.github/workflows/goreleaser-fleet.yaml

@@ -46,11 +46,10 @@ jobs:
         with:
           go-version-file: 'go.mod'
 
-      # Set the Node.js version
-      - name: Set up Node.js ${{ vars.NODE_VERSION }}
+      - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
         with:
-          node-version: ${{ vars.NODE_VERSION }}
+          node-version-file: package.json
 
       - name: Install JS Dependencies
         run: make deps-js

.github/workflows/goreleaser-snapshot-fleet.yaml

@@ -4,8 +4,8 @@ on:
   push:
     branches:
       - "main"
-      - "minor-*"
-      - "patch-*"
+      - "rc-minor-*"
+      - "rc-patch-*"
     paths-ignore:
       - "handbook/**"
       - "website/**"
@@ -60,10 +60,10 @@ jobs:
           go-version-file: 'go.mod'
 
       # Set the Node.js version
-      - name: Set up Node.js ${{ vars.NODE_VERSION }}
+      - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
         with:
-          node-version: ${{ vars.NODE_VERSION }}
+          node-version-file: package.json
 
       - name: Install Dependencies
         run: make deps

.github/workflows/render-deploy.yml

@@ -0,0 +1,48 @@
+name: Render deploy
+
+# Re-deploy Fleet servers on Render to update to the latest Fleet release.
+#
+# Render (https://render.com/) is hosting 2 Fleet servers that are used by our gitops repos:
+# - https://github.com/fleetdm/fleet-gitops
+# - https://gitlab.com/fleetdm/fleet-gitops
+#
+# The premium server (fleet-gitops-ci-premium) is used by GitHub CI and the free server (fleet-gitops-ci-free) is used by GitLab CI.
+# Both servers share a MySQL service (fleet-gitops-ci-mysql).
+# - fleet-gitops-ci-premium uses fleet database
+# - fleet-gitops-ci-free uses fleet_free database
+#
+# Both servers share a Redis service (fleet-gitops-ci-redis).
+# - fleet-gitops-ci-premium uses database 0 (the default)
+# - fleet-gitops-ci-free uses database 1
+
+on:
+  workflow_dispatch: # Manual
+  schedule:
+    - cron: '0 2 * * *' # Nightly 2AM UTC
+
+# This allows a subsequently queued workflow run to interrupt previous runs
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id}}
+  cancel-in-progress: true
+
+defaults:
+  run:
+    # fail-fast using bash -eo pipefail. See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#exit-codes-and-error-action-preference
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  render-deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
+        with:
+          egress-policy: audit
+
+      - name: Trigger deploy
+        run: |
+          curl "${{ secrets.RENDER_GITOPS_FREE_DEPLOY_HOOK }}"
+          curl "${{ secrets.RENDER_GITOPS_PREMIUM_DEPLOY_HOOK }}"

.github/workflows/test-go.yaml

@@ -44,7 +44,7 @@ jobs:
       matrix:
         suite: ["integration", "core"]
         os: [ubuntu-latest]
-        mysql: ["mysql:8.0.36", "mysql:8.4.2"] # make sure to update supported versions docs when this changes
+        mysql: ["mysql:8.0.36", "mysql:8.4.3"] # make sure to update supported versions docs when this changes
     continue-on-error: ${{ matrix.suite == 'integration' }} # Since integration tests have a higher chance of failing, often for unrelated reasons, we don't want to fail the whole job if they fail
     runs-on: ${{ matrix.os }}
 
@@ -120,6 +120,7 @@ jobs:
         fi
         GO_TEST_EXTRA_FLAGS="-v -race=$RACE_ENABLED -timeout=$GO_TEST_TIMEOUT $RUN_TESTS_ARG" \
           TEST_LOCK_FILE_PATH=$(pwd)/lock \
+          TEST_CRON_NO_RECOVER=1 \
           NETWORK_TEST=1 \
           REDIS_TEST=1 \
           MYSQL_TEST=1 \