Skip to content

Clear stale broken label rows on profile batch upsert - #44847

Merged
nulmete merged 1 commit into
mainfrom
42637-fleetctl-gitops-apply-doesn-t
May 7, 2026
Merged

Clear stale broken label rows on profile batch upsert#44847
nulmete merged 1 commit into
mainfrom
42637-fleetctl-gitops-apply-doesn-t

Conversation

@nulmete

@nulmete nulmete commented May 6, 2026

Copy link
Copy Markdown
Member

Related issue: Resolves #42637

Checklist for submitter

  • Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
    See Changes files for more information.

Testing

  • Added/updated automated tests

  • QA'd all new/changed functionality manually

Reproduction steps:

  • Created Label X and Label Y as manual labels in the UI.
  • Applied gitops referencing the labels. The specified profile referenced Label X:
macos_settings:
    custom_settings:
      - path: ../repro-42637-profile.mobileconfig
        labels_exclude_any:
          - "Repro Label X 42637"
  • Manually ran a SQL query to update label_id to NULL.
Screenshot 2026-05-06 at 6 19 51 PM
  • Re-ran gitops referencing Label Y in the profile config.
macos_settings:
    custom_settings:
      - path: ../repro-42637-profile.mobileconfig
        labels_include_any:
          - "Repro Label Y 42637"
  • Old row was preserved AND a new one was created (association to Label Y):
Screenshot 2026-05-06 at 6 22 07 PM

Testing steps

  • Re-built fleetctl with the fix applied and re-ran gitops, still referencing Label Y for the profile.
  • Confirmed the orphan row was deleted.
Screenshot 2026-05-06 at 6 24 43 PM

Summary by CodeRabbit

Bug Fixes

  • Fixed an issue where MDM configuration profiles would remain enforced on hosts after their associated labels were deleted during fleetctl gitops apply operations. Label associations are now properly cleared when profiles are reapplied with updated targeting.

When a label referenced by an MDM configuration profile was deleted,
mdm_configuration_profile_labels.label_id was set to NULL via the FK
ON DELETE SET NULL. The cleanup DELETE in batchSetProfileLabelAssociationsDB
used `(profile_uuid, label_id) NOT IN (...)`, which under MySQL three-valued
logic evaluates to NULL for rows with label_id IS NULL — so broken rows
survived every subsequent gitops apply.

generateEntitiesToRemoveQuery treats any profile with a NULL label_id row
as broken and refuses to schedule its removal from hosts. Result: profiles
stayed enforced on previously-targeted hosts regardless of updated YAML
targeting.

Also clear rows with label_id IS NULL for profiles in the current batch.
The safety net for the in-between window (label deleted out-of-band, no
batch-set yet) still works since the cleanup only runs when the user
explicitly sets a profile's label associations.
@nulmete
nulmete marked this pull request as ready for review May 6, 2026 16:26
@nulmete
nulmete requested a review from a team as a code owner May 6, 2026 16:26
Copilot AI review requested due to automatic review settings May 6, 2026 16:26

@claude claude Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

Tip: disable this comment in your organization's Code Review settings.

@coderabbitai

coderabbitai Bot commented May 6, 2026

Copy link
Copy Markdown
Contributor

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 82ce7c7f-b001-4c6b-9344-b0218710ec30

📥 Commits

Reviewing files that changed from the base of the PR and between c72158d and 007c596.

📒 Files selected for processing (4)
  • changes/42637-clear-stale-broken-label-associations
  • server/datastore/mysql/apple_mdm_test.go
  • server/datastore/mysql/mdm.go
  • server/datastore/mysql/mdm_test.go

Walkthrough

The changes fix an issue where stale broken label associations were not being cleared when batch-setting MDM profiles. The deletion logic in batchSetProfileLabelAssociationsDB was modified to also delete rows where label_id is NULL, representing broken associations. Regression tests were added to validate that broken label associations are properly cleared when profile-label mappings are reapplied. A changelog entry documents that fleetctl gitops apply now clears stale mdm_configuration_profile_labels rows after a referenced label is deleted.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main change: clearing stale broken label rows when profiles are batch upserted, which is the core fix for the issue.
Description check ✅ Passed The description is well-structured, includes the related issue (#42637), completes key checklist items (changes file, automated tests, manual QA), and provides detailed reproduction and testing steps with supporting screenshots.
Linked Issues check ✅ Passed The changes address the core requirement in #42637: clearing stale broken label associations (where label_id is NULL) when profiles are batch-set via GitOps, preventing them from blocking host removal.
Out of Scope Changes check ✅ Passed All changes are directly scoped to fixing issue #42637: a changes file, two test additions (one per test file), and the core deletion logic fix in mdm.go for clearing broken labels.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch 42637-fleetctl-gitops-apply-doesn-t

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@qodo-free-for-open-source-projects

Copy link
Copy Markdown

CI Feedback 🧐

A test triggered by this PR failed. Here is an AI-generated analysis of the failure:

Action: test-go (fleetctl, mysql:8.0.44) / test

Failed stage: Run Go Tests [❌]

Failed test name: TestIntegrationsVulnerabilityDataStream

Failure summary:

The action failed because a Go integration test failed:
- cmd/fleetctl/integrationtest/vuln
TestIntegrationsVulnerabilityDataStream failed in
cmd/fleetctl/integrationtest/vuln/vulnerability_data_stream_test.go:44.
- The test hit an unexpected
error while downloading OSV artifacts: getting latest release: github http status error: 403 (HTTP
403 Forbidden), indicating the CI job could not access the required GitHub release/artifact
endpoint.
- This caused make test-go to exit non-zero (make[1]: *** [Makefile:278: .run-go-tests]
Error 1, make: *** [Makefile:393: test-go] Error 2), and the workflow ended with exit code 2.

Relevant error logs:
1:  ##[group]Runner Image Provisioner
2:  Hosted Compute Agent
...

1309:  �[36;1mattempt=1�[0m
1310:  �[36;1m�[0m
1311:  �[36;1mwhile [ $attempt -le $max_attempts ]; do�[0m
1312:  �[36;1m  echo "Attempt $attempt of $max_attempts"�[0m
1313:  �[36;1m�[0m
1314:  �[36;1m  # Try to connect to MySQL�[0m
1315:  �[36;1m  if wait_for_mysql "mysql_test"; then�[0m
1316:  �[36;1m    # If MySQL is ready, try to connect to MySQL replica�[0m
1317:  �[36;1m    if wait_for_mysql "mysql_replica_test"; then�[0m
1318:  �[36;1m      # Both are ready, we're done�[0m
1319:  �[36;1m      echo "All MySQL connections successful"�[0m
1320:  �[36;1m      exit 0�[0m
1321:  �[36;1m    fi�[0m
1322:  �[36;1m  fi�[0m
1323:  �[36;1m�[0m
1324:  �[36;1m  # If we get here, at least one connection failed�[0m
1325:  �[36;1m  echo "Failed to connect to MySQL on attempt $attempt"�[0m
1326:  �[36;1m�[0m
1327:  �[36;1m  if [ $attempt -lt $max_attempts ]; then�[0m
1328:  �[36;1m    echo "Restarting containers and trying again..."�[0m
1329:  �[36;1m    restart_containers�[0m
1330:  �[36;1m  else�[0m
1331:  �[36;1m    echo "Maximum attempts reached. Failing the job."�[0m
1332:  �[36;1m    exit 1�[0m
...

1422:  go: downloading github.com/stretchr/testify v1.11.1
1423:  go: downloading github.com/urfave/cli/v2 v2.27.7
1424:  go: downloading github.com/elimity-com/scim v0.0.0-20240320110924-172bf2aee9c8
1425:  go: downloading github.com/scim2/filter-parser/v2 v2.2.0
1426:  go: downloading github.com/crewjam/saml v0.5.1
1427:  go: downloading github.com/russellhaering/goxmldsig v1.6.0
1428:  go: downloading software.sslmate.com/src/go-pkcs12 v0.4.0
1429:  go: downloading github.com/remitly-oss/httpsig-go v1.2.0
1430:  go: downloading github.com/Azure/go-ntlmssp v0.1.1
1431:  go: downloading github.com/open-policy-agent/opa v1.4.2
1432:  go: downloading github.com/patrickmn/go-cache v2.1.0+incompatible
1433:  go: downloading github.com/VividCortex/mysqlerr v0.0.0-20170204212430-6c6b55f8796f
1434:  go: downloading github.com/XSAM/otelsql v0.39.0
1435:  go: downloading github.com/doug-martin/goqu/v9 v9.18.0
1436:  go: downloading github.com/google/go-cmp v0.7.0
1437:  go: downloading github.com/hashicorp/go-multierror v1.1.1
1438:  go: downloading github.com/mna/redisc v1.3.2
...

1664:  go: downloading github.com/AbGuthrie/goquery/v2 v2.0.1
1665:  go: downloading github.com/c-bata/go-prompt v0.2.3
1666:  go: downloading github.com/pkg/term v0.0.0-20190109203006-aa71e9d9e942
1667:  github.com/fleetdm/fleet/v4/cmd/fleetctl:
1668:  github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest:
1669:  github.com/fleetdm/fleet/v4/cmd/fleetctl/fleetctl/goquerycmd:
1670:  github.com/fleetdm/fleet/v4/cmd/fleetctl/fleetctl/testing_utils:
1671:  github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest/package:
1672:  �[32m✓�[0m Package (5.40s)
1673:  �[32m✓�[0m Package - -use-sytem-configuration can't be used on installers that aren't pkg (0.00s)
1674:  �[32m✓�[0m Package deb (3.13s)
1675:  github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest/vuln:
1676:  �[31m✖�[0m Integrations vulnerability data stream (52.68s)
1677:  github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest/preview:
1678:  �[32m✓�[0m Integrations preview (120.49s)
1679:  �[32m✓�[0m Preview fails on invalid license key (0.00s)
1680:  github.com/fleetdm/fleet/v4/cmd/fleetctl/fleetctl:
...

1784:  �[32m✓�[0m Apply specs deprecated keys app config windows updates.grace period days not a number (0.45s)
1785:  �[32m✓�[0m Apply specs deprecated keys app config windows updates.grace period days out of range (0.48s)
1786:  �[32m✓�[0m Apply specs deprecated keys config with FIM values for agent options (#869 9) (0.46s)
1787:  �[32m✓�[0m Apply specs deprecated keys config with blank required org name (0.57s)
1788:  �[32m✓�[0m Apply specs deprecated keys config with blank required server url (0.37s)
1789:  �[32m✓�[0m Apply specs deprecated keys config with invalid agent options command-line flags (0.38s)
1790:  �[32m✓�[0m Apply specs deprecated keys config with invalid agent options data type in dry-run (0.38s)
1791:  �[32m✓�[0m Apply specs deprecated keys config with invalid agent options data type with force (0.41s)
1792:  �[32m✓�[0m Apply specs deprecated keys config with invalid agent options in dry-run (0.45s)
1793:  �[32m✓�[0m Apply specs deprecated keys config with invalid key type (0.61s)
1794:  �[32m✓�[0m Apply specs deprecated keys config with invalid value for agent options command-line flags (0.44s)
1795:  �[32m✓�[0m Apply specs deprecated keys config with unknown key (0.36s)
1796:  �[32m✓�[0m Apply specs deprecated keys config with valid agent options command-line flags (0.42s)
1797:  �[32m✓�[0m Apply specs deprecated keys dry-run set with unsupported spec (0.49s)
1798:  �[32m✓�[0m Apply specs deprecated keys dry-run set with various specs, appconfig warning for legacy (0.57s)
1799:  �[32m✓�[0m Apply specs deprecated keys dry-run set with various specs, no errors (0.39s)
1800:  �[32m✓�[0m Apply specs deprecated keys empty config (0.35s)
...

1803:  �[32m✓�[0m Apply specs deprecated keys invalid agent options dry-run (0.43s)
1804:  �[32m✓�[0m Apply specs deprecated keys invalid agent options field type (0.43s)
1805:  �[32m✓�[0m Apply specs deprecated keys invalid agent options field type in overrides (0.48s)
1806:  �[32m✓�[0m Apply specs deprecated keys invalid agent options for existing team (0.71s)
1807:  �[32m✓�[0m Apply specs deprecated keys invalid agent options for new team (0.54s)
1808:  �[32m✓�[0m Apply specs deprecated keys invalid agent options force (0.88s)
1809:  �[32m✓�[0m Apply specs deprecated keys invalid known key's value type for team cannot be forced (0.52s)
1810:  �[32m✓�[0m Apply specs deprecated keys invalid team agent options command-line flag (0.42s)
1811:  �[32m✓�[0m Apply specs deprecated keys invalid top-level key for team (0.44s)
1812:  �[32m✓�[0m Apply specs deprecated keys macos updates deadline set but minimum version empty (0.46s)
1813:  �[32m✓�[0m Apply specs deprecated keys macos updates minimum version set but deadline empty (0.41s)
1814:  �[32m✓�[0m Apply specs deprecated keys macos updates.deadline with incomplete date (0.48s)
1815:  �[32m✓�[0m Apply specs deprecated keys macos updates.deadline with invalid date (0.46s)
1816:  �[32m✓�[0m Apply specs deprecated keys macos updates.deadline with timestamp (0.57s)
1817:  �[32m✓�[0m Apply specs deprecated keys macos updates.minimum version with build version (0.36s)
1818:  �[32m✓�[0m Apply specs deprecated keys missing required failing policies destination url (0.41s)
1819:  �[32m✓�[0m Apply specs deprecated keys missing required host status days count (0.57s)
...

1827:  �[32m✓�[0m Apply specs deprecated keys team config macos settings.enable disk encryption true (0.53s)
1828:  �[32m✓�[0m Apply specs deprecated keys team config macos settings.enable disk encryption with invalid value type (0.45s)
1829:  �[32m✓�[0m Apply specs deprecated keys team config macos settings.enable disk encryption without a value (0.53s)
1830:  �[32m✓�[0m Apply specs deprecated keys unknown key for team can be forced (0.69s)
1831:  �[32m✓�[0m Apply specs deprecated keys valid team agent options command-line flag (0.48s)
1832:  �[32m✓�[0m Apply specs deprecated keys windows updates unset valid (0.47s)
1833:  �[32m✓�[0m Apply specs deprecated keys windows updates valid (0.49s)
1834:  �[32m✓�[0m Apply specs deprecated keys windows updates.deadline days but grace period empty (0.49s)
1835:  �[32m✓�[0m Apply specs deprecated keys windows updates.deadline days not a number (0.46s)
1836:  �[32m✓�[0m Apply specs deprecated keys windows updates.deadline days out of range (0.49s)
1837:  �[32m✓�[0m Apply specs deprecated keys windows updates.grace period days but deadline empty (0.51s)
1838:  �[32m✓�[0m Apply specs deprecated keys windows updates.grace period days not a number (0.49s)
1839:  �[32m✓�[0m Apply specs deprecated keys windows updates.grace period days out of range (0.34s)
1840:  �[32m✓�[0m Apply specs dry-run set with unsupported spec (0.41s)
1841:  �[32m✓�[0m Apply specs dry-run set with various specs, appconfig warning for legacy (0.37s)
1842:  �[32m✓�[0m Apply specs dry-run set with various specs, no errors (0.51s)
1843:  �[32m✓�[0m Apply specs empty config (0.45s)
...

1846:  �[32m✓�[0m Apply specs invalid agent options dry-run (0.37s)
1847:  �[32m✓�[0m Apply specs invalid agent options field type (0.40s)
1848:  �[32m✓�[0m Apply specs invalid agent options field type in overrides (0.58s)
1849:  �[32m✓�[0m Apply specs invalid agent options for existing team (0.49s)
1850:  �[32m✓�[0m Apply specs invalid agent options for new team (0.42s)
1851:  �[32m✓�[0m Apply specs invalid agent options force (0.56s)
1852:  �[32m✓�[0m Apply specs invalid known key's value type for team cannot be forced (0.39s)
1853:  �[32m✓�[0m Apply specs invalid team agent options command-line flag (0.71s)
1854:  �[32m✓�[0m Apply specs invalid top-level key for team (0.41s)
1855:  �[32m✓�[0m Apply specs macos updates deadline set but minimum version empty (0.65s)
1856:  �[32m✓�[0m Apply specs macos updates minimum version set but deadline empty (0.47s)
1857:  �[32m✓�[0m Apply specs macos updates.deadline with incomplete date (0.39s)
1858:  �[32m✓�[0m Apply specs macos updates.deadline with invalid date (0.56s)
1859:  �[32m✓�[0m Apply specs macos updates.deadline with timestamp (0.37s)
1860:  �[32m✓�[0m Apply specs macos updates.minimum version with build version (0.44s)
1861:  �[32m✓�[0m Apply specs missing required failing policies destination url (0.43s)
1862:  �[32m✓�[0m Apply specs missing required host status days count (0.50s)
...

1948:  �[32m✓�[0m Filename functions (0.00s)
1949:  �[32m✓�[0m Filename functions outfile name builds a file name using the name provided + current time (0.00s)
1950:  �[32m✓�[0m Filename functions outfile name with ext builds a file name using the name and extension provided + current time (0.00s)
1951:  �[32m✓�[0m FleetctlUpgradePacks empty packs (0.66s)
1952:  �[32m✓�[0m FleetctlUpgradePacks no pack (0.49s)
1953:  �[32m✓�[0m FleetctlUpgradePacks non empty (0.40s)
1954:  �[32m✓�[0m FleetctlUpgradePacks not admin (0.39s)
1955:  �[32m✓�[0m Format XML (0.00s)
1956:  �[32m✓�[0m Format XML XML with attributes (0.00s)
1957:  �[32m✓�[0m Format XML basic XML (0.00s)
1958:  �[32m✓�[0m Format XML empty XML (0.00s)
1959:  �[32m✓�[0m Format XML invalid XML (0.00s)
1960:  �[32m✓�[0m Format XML nested XML (0.00s)
1961:  �[32m✓�[0m Generate MDM apple (1.39s)
1962:  �[32m✓�[0m Generate MDM apple BM (0.73s)
1963:  �[32m✓�[0m Generate MDM apple CSR API call fails (0.63s)
1964:  �[32m✓�[0m Generate MDM apple successful run (0.75s)
1965:  �[32m✓�[0m Generate MDMVPP tokens (0.00s)
1966:  �[32m✓�[0m Generate MDMVPP tokens get VPP tokens error (0.00s)
1967:  �[32m✓�[0m Generate MDMVPP tokens multiple tokens with different teams (0.00s)
...

1983:  �[32m✓�[0m Generate org settings insecure (0.00s)
1984:  �[32m✓�[0m Generate org settings masked google calendar api key (0.01s)
1985:  �[32m✓�[0m Generate policies (0.00s)
1986:  �[32m✓�[0m Generate queries (0.00s)
1987:  �[32m✓�[0m Generate software (0.00s)
1988:  �[32m✓�[0m Generate software auto update schedule (0.00s)
1989:  �[32m✓�[0m Generate software script packages (0.00s)
1990:  �[32m✓�[0m Generate team settings (0.00s)
1991:  �[32m✓�[0m Generate team settings insecure (0.00s)
1992:  �[32m✓�[0m Generated org settings no SSO (0.01s)
1993:  �[32m✓�[0m Generated org settings okta conditional access not included (0.00s)
1994:  �[32m✓�[0m Get MDM command results (0.43s)
1995:  �[32m✓�[0m Get MDM command results command flag required (0.00s)
1996:  �[32m✓�[0m Get MDM command results command not found (0.01s)
1997:  �[32m✓�[0m Get MDM command results command results empty (0.01s)
1998:  �[32m✓�[0m Get MDM command results command results error (0.01s)
1999:  �[32m✓�[0m Get MDM command results darwin command results (0.01s)
2000:  �[32m✓�[0m Get MDM command results host specific results (0.00s)
2001:  �[32m✓�[0m Get MDM command results windows command results (0.00s)
2002:  �[32m✓�[0m Get MDM commands (0.44s)
2003:  �[32m✓�[0m Get apple BM (2.87s)
2004:  �[32m✓�[0m Get apple BM free license (0.97s)
2005:  �[32m✓�[0m Get apple BM premium license, multiple tokens (0.46s)
2006:  �[32m✓�[0m Get apple BM premium license, no token (0.61s)
2007:  �[32m✓�[0m Get apple BM premium license, single token (0.83s)
2008:  �[32m✓�[0m Get apple MDM (1.05s)
2009:  �[32m✓�[0m Get carve (0.49s)
2010:  �[32m✓�[0m Get carve with error (0.69s)
2011:  �[32m✓�[0m Get carves (0.40s)
...

2039:  �[32m✓�[0m Get queries as observer observer of multiple teams (0.02s)
2040:  �[32m✓�[0m Get queries as observer team observer (0.02s)
2041:  �[32m✓�[0m Get query (1.02s)
2042:  �[32m✓�[0m Get query labels include all (0.61s)
2043:  �[32m✓�[0m Get reports labels include all (0.61s)
2044:  �[32m✓�[0m Get software titles (0.67s)
2045:  �[32m✓�[0m Get software versions (0.64s)
2046:  �[32m✓�[0m Get teams (1.37s)
2047:  �[32m✓�[0m Get teams YAML and apply (0.99s)
2048:  �[32m✓�[0m Get teams by name (0.93s)
2049:  �[32m✓�[0m Get teams expired license (0.70s)
2050:  �[32m✓�[0m Get teams not expired license (0.67s)
2051:  �[32m✓�[0m Get user roles (0.67s)
2052:  �[32m✓�[0m Git ops ABM (5.88s)
2053:  �[32m✓�[0m Git ops ABM backwards compat (0.53s)
2054:  �[32m✓�[0m Git ops ABM both keys errors (0.65s)
2055:  �[32m✓�[0m Git ops ABM deprecated config with two tokens in the db fails (0.58s)
2056:  �[32m✓�[0m Git ops ABM new key all valid (0.53s)
2057:  �[32m✓�[0m Git ops ABM new key multiple elements (0.65s)
2058:  �[32m✓�[0m Git ops ABM no team is supported (0.50s)
2059:  �[32m✓�[0m Git ops ABM non existent org name fails (0.71s)
2060:  �[32m✓�[0m Git ops ABM not provided teams defaults to no team (0.57s)
2061:  �[32m✓�[0m Git ops ABM renamed new key all valid (0.66s)
2062:  �[32m✓�[0m Git ops ABM using an undefined team errors (0.50s)
2063:  �[32m✓�[0m Git ops EULA setting (4.75s)
...

2066:  �[32m✓�[0m Git ops EULA setting not a PDF file (0.74s)
2067:  �[32m✓�[0m Git ops EULA setting relative path to working dir to pdf file (no existing EULA uploaded) (0.43s)
2068:  �[32m✓�[0m Git ops EULA setting relative path to yaml file to pdf file (no existing EULA uploaded) (0.60s)
2069:  �[32m✓�[0m Git ops EULA setting uploading the same EULA again (0.55s)
2070:  �[32m✓�[0m Git ops EULA setting valid new pdf file (different EULA already uploaded) (0.61s)
2071:  �[32m✓�[0m Git ops EULA setting valid pdf file (no existing EULA uploaded) (0.42s)
2072:  �[32m✓�[0m Git ops MDM auth settings (0.56s)
2073:  �[32m✓�[0m Git ops SMTP settings (0.56s)
2074:  �[32m✓�[0m Git ops SSO server URL (0.56s)
2075:  �[32m✓�[0m Git ops SSO settings (0.54s)
2076:  �[32m✓�[0m Git ops android certificates add (0.53s)
2077:  �[32m✓�[0m Git ops android certificates change (0.61s)
2078:  �[32m✓�[0m Git ops android certificates delete all (0.51s)
2079:  �[32m✓�[0m Git ops android certificates delete one (0.58s)
2080:  �[32m✓�[0m Git ops app store app auto update (0.47s)
2081:  �[32m✓�[0m Git ops app store app auto update invalid auto-update window triggers error and does not call update software title auto update config (0.02s)
2082:  �[32m✓�[0m Git ops app store app auto update no auto update settings and no existing schedule does not call update software title auto update config (0.02s)
...

2085:  �[32m✓�[0m Git ops apple OS updates (0.58s)
2086:  �[32m✓�[0m Git ops apple OS updates ios updates (0.05s)
2087:  �[32m✓�[0m Git ops apple OS updates ios updates changed deadline triggers bulk set pending MDM host profiles (0.02s)
2088:  �[32m✓�[0m Git ops apple OS updates ios updates changed minimum version triggers bulk set pending MDM host profiles (0.01s)
2089:  �[32m✓�[0m Git ops apple OS updates ios updates same values do not trigger bulk set pending MDM host profiles (0.01s)
2090:  �[32m✓�[0m Git ops apple OS updates ipados updates (0.05s)
2091:  �[32m✓�[0m Git ops apple OS updates ipados updates changed deadline triggers bulk set pending MDM host profiles (0.02s)
2092:  �[32m✓�[0m Git ops apple OS updates ipados updates changed minimum version triggers bulk set pending MDM host profiles (0.02s)
2093:  �[32m✓�[0m Git ops apple OS updates ipados updates same values do not trigger bulk set pending MDM host profiles (0.01s)
2094:  �[32m✓�[0m Git ops apple OS updates macos updates (0.07s)
2095:  �[32m✓�[0m Git ops apple OS updates macos updates changed deadline triggers bulk set pending MDM host profiles (0.03s)
2096:  �[32m✓�[0m Git ops apple OS updates macos updates changed minimum version triggers bulk set pending MDM host profiles (0.01s)
2097:  �[32m✓�[0m Git ops apple OS updates macos updates same values do not trigger bulk set pending MDM host profiles (0.02s)
2098:  �[32m✓�[0m Git ops basic global and no team (0.62s)
2099:  �[32m✓�[0m Git ops basic global and no team basic global and no-team.yml (0.05s)
2100:  �[32m✓�[0m Git ops basic global and no team both global and no-team.yml define controls -- should fail (0.01s)
2101:  �[32m✓�[0m Git ops basic global and no team controls only defined in no-team.yml (0.05s)
2102:  �[32m✓�[0m Git ops basic global and no team global DOES NOT define controls -- should fail (0.01s)
2103:  �[32m✓�[0m Git ops basic global and no team global and no-team.yml DO NOT define controls -- should fail (0.01s)
2104:  �[32m✓�[0m Git ops basic global and no team global defines software -- should fail (0.01s)
2105:  �[32m✓�[0m Git ops basic global and no team no-team provided without global -- should fail (0.01s)
2106:  �[32m✓�[0m Git ops basic global and no team no-team.yml defines policy with calendar events enabled -- should fail (0.02s)
2107:  �[32m✓�[0m Git ops basic global and no team unassigned provided without global -- should fail (0.01s)
2108:  �[32m✓�[0m Git ops basic global and team (0.75s)
...

2114:  �[32m✓�[0m Git ops custom settings global macos windows custom settings valid.yml (0.43s)
2115:  �[32m✓�[0m Git ops custom settings global windows custom settings invalid label mix 2 .yml (0.52s)
2116:  �[32m✓�[0m Git ops custom settings global windows custom settings invalid label mix.yml (0.60s)
2117:  �[32m✓�[0m Git ops custom settings global windows custom settings unknown label.yml (0.47s)
2118:  �[32m✓�[0m Git ops custom settings team macos custom settings valid deprecated.yml (0.54s)
2119:  �[32m✓�[0m Git ops custom settings team macos windows custom settings invalid labels mix 2 .yml (0.60s)
2120:  �[32m✓�[0m Git ops custom settings team macos windows custom settings invalid labels mix.yml (0.46s)
2121:  �[32m✓�[0m Git ops custom settings team macos windows custom settings unknown label.yml (0.40s)
2122:  �[32m✓�[0m Git ops custom settings team macos windows custom settings valid.yml (0.40s)
2123:  �[32m✓�[0m Git ops dry run rejects invalid label platform (0.35s)
2124:  �[32m✓�[0m Git ops exception enforcement (0.46s)
2125:  �[32m✓�[0m Git ops exception enforcement free tier (0.49s)
2126:  �[32m✓�[0m Git ops exceptions preserve omitted keys (0.44s)
2127:  �[32m✓�[0m Git ops features (0.55s)
2128:  �[32m✓�[0m Git ops filename validation (0.00s)
2129:  �[32m✓�[0m Git ops fleet failing policies webhook policy IDs (0.52s)
2130:  �[32m✓�[0m Git ops fleet webhooks and tickets enabled (0.66s)
...

2293:  �[32m✓�[0m Run api command get scripts full path missing (0.00s)
2294:  �[32m✓�[0m Run api command get scripts team (0.00s)
2295:  �[32m✓�[0m Run api command get scripts team no cache (0.00s)
2296:  �[32m✓�[0m Run api command get typo (0.00s)
2297:  �[32m✓�[0m Run api command upload script (0.00s)
2298:  �[32m✓�[0m Run script command (0.52s)
2299:  �[32m✓�[0m Run script command disabled scripts globally (0.00s)
2300:  �[32m✓�[0m Run script command host not found (0.01s)
2301:  �[32m✓�[0m Run script command invalid file type (0.00s)
2302:  �[32m✓�[0m Run script command invalid hashbang (0.01s)
2303:  �[32m✓�[0m Run script command invalid utf 8 (0.00s)
2304:  �[32m✓�[0m Run script command missing one of script-path and script-nqme (0.00s)
2305:  �[32m✓�[0m Run script command output truncated (0.01s)
2306:  �[32m✓�[0m Run script command posix shell hashbang (0.02s)
2307:  �[32m✓�[0m Run script command script empty (0.00s)
2308:  �[32m✓�[0m Run script command script failed (0.01s)
2309:  �[32m✓�[0m Run script command script killed (0.01s)
...

2347:  �[32m✓�[0m User is observer (0.00s)
2348:  �[32m✓�[0m User is observer global maintainer (0.00s)
2349:  �[32m✓�[0m User is observer global observer (0.00s)
2350:  �[32m✓�[0m User is observer global observer+ (0.00s)
2351:  �[32m✓�[0m User is observer team maintainer (0.00s)
2352:  �[32m✓�[0m User is observer team observer (0.00s)
2353:  �[32m✓�[0m User is observer team observer and maintainer (0.00s)
2354:  �[32m✓�[0m User is observer team observer+ (0.00s)
2355:  �[32m✓�[0m User is observer user without roles (0.00s)
2356:  github.com/fleetdm/fleet/v4/cmd/fleetctl/integrationtest/gitops:
2357:  �[32m✓�[0m Git ops VPP (4.51s)
2358:  �[32m✓�[0m Git ops VPP all teams is supported (0.61s)
2359:  �[32m✓�[0m Git ops VPP new key all valid (0.64s)
2360:  �[32m✓�[0m Git ops VPP new key multiple elements (0.85s)
2361:  �[32m✓�[0m Git ops VPP no team is supported (0.57s)
2362:  �[32m✓�[0m Git ops VPP non existent location fails (0.44s)
2363:  �[32m✓�[0m Git ops VPP not provided teams defaults to no team (0.72s)
2364:  �[32m✓�[0m Git ops VPP using an undefined team errors (0.68s)
2365:  �[32m✓�[0m Git ops existing team VPP apps with missing team (0.47s)
...

2445:  �[32m✓�[0m Git ops team software installers team software installer with display name.yml (1.51s)
2446:  �[32m✓�[0m Integrations enterprise gitops (338.60s)
2447:  �[32m✓�[0m Integrations enterprise gitops test CA integrations (5.48s)
2448:  �[32m✓�[0m Integrations enterprise gitops test FMA labels include all (6.47s)
2449:  �[32m✓�[0m Integrations enterprise gitops test IPA software installers (11.49s)
2450:  �[32m✓�[0m Integrations enterprise gitops test JSON configuration profile escaping (1.51s)
2451:  �[32m✓�[0m Integrations enterprise gitops test add manual labels (1.99s)
2452:  �[32m✓�[0m Integrations enterprise gitops test configuration profile escaping (1.79s)
2453:  �[32m✓�[0m Integrations enterprise gitops test delete CA with certificate templates (7.25s)
2454:  �[32m✓�[0m Integrations enterprise gitops test delete mac OS setup (6.42s)
2455:  �[32m✓�[0m Integrations enterprise gitops test deleting no team YAML (3.44s)
2456:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience (125.20s)
2457:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience all VPP with setup experience (1.58s)
2458:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience no team VPP (1.48s)
2459:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience no team installers (60.47s)
2460:  �[32m✓�[0m Integrations enterprise gitops test disallow software setup experience packages fail (61.47s)
2461:  �[32m✓�[0m Integrations enterprise gitops test dry run mac OS setup script with manual agent install conflict (0.90s)
...

2488:  �[32m✓�[0m Integrations enterprise gitops test omitted top level keys global (2.96s)
2489:  �[32m✓�[0m Integrations enterprise gitops test remove custom settings from default YAML (3.16s)
2490:  �[32m✓�[0m Integrations enterprise gitops test special case teams VPP apps (4.65s)
2491:  �[32m✓�[0m Integrations enterprise gitops test special case teams VPP apps all teams (2.89s)
2492:  �[32m✓�[0m Integrations enterprise gitops test special case teams VPP apps no team (1.58s)
2493:  �[32m✓�[0m Integrations enterprise gitops test unset configuration profile labels (5.98s)
2494:  �[32m✓�[0m Integrations enterprise gitops test unset software installer labels (9.00s)
2495:  �[32m✓�[0m Integrations enterprise starter library (5.35s)
2496:  �[32m✓�[0m Integrations enterprise starter library test apply starter library premium (3.91s)
2497:  �[32m✓�[0m Integrations gitops (3.32s)
2498:  �[32m✓�[0m Integrations gitops test fleet gitops (1.04s)
2499:  �[32m✓�[0m Integrations gitops test fleet gitops DDM fleet vars requires premium (0.18s)
2500:  �[32m✓�[0m Integrations gitops test fleet gitops with fleet secrets (0.48s)
2501:  �[32m✓�[0m Integrations starter library (1.76s)
2502:  �[32m✓�[0m Integrations starter library test apply starter library free (0.32s)
2503:  === �[31mFailed�[0m
2504:  === �[31mFAIL�[0m: cmd/fleetctl/integrationtest/vuln TestIntegrationsVulnerabilityDataStream (52.68s)
2505:  nettest.go:33: network test start: TestIntegrationsVulnerabilityDataStream
2506:  vulnerability_data_stream_test.go:44: 
2507:  Error Trace:	/home/runner/work/fleet/fleet/cmd/fleetctl/integrationtest/vuln/vulnerability_data_stream_test.go:44
2508:  Error:      	Received unexpected error:
2509:  Error downloading OSV artifacts: getting latest release: github http status error: 403
2510:  Test:       	TestIntegrationsVulnerabilityDataStream
2511:  nettest.go:36: network test done: TestIntegrationsVulnerabilityDataStream
2512:  DONE 827 tests, 1 failure in 665.907s
2513:  make[1]: *** [Makefile:278: .run-go-tests] Error 1
2514:  make[1]: Leaving directory '/home/runner/work/fleet/fleet'
2515:  make: *** [Makefile:393: test-go] Error 2
2516:  ##[error]Process completed with exit code 2.
2517:  ##[group]Run actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a
2518:  with:
2519:  name: fleetctl-mysql8.0.44-coverage
2520:  path: ./coverage.txt
2521:  if-no-files-found: error
2522:  compression-level: 6
...

2534:  With the provided path, there will be 1 file uploaded
2535:  Artifact name is valid!
2536:  Root directory input is valid!
2537:  Beginning upload of artifact content to blob storage
2538:  Uploaded bytes 2867486
2539:  Finished uploading artifact content to blob storage!
2540:  SHA256 hash of uploaded artifact zip is 79639dbf1336d3db4fb6a2bf7dd4d53831c4dde224dcbcfc8e758785ea0f9d1d
2541:  Finalizing artifact upload
2542:  Artifact fleetctl-mysql8.0.44-coverage.zip successfully finalized. Artifact ID 6836063884
2543:  Artifact fleetctl-mysql8.0.44-coverage has been successfully uploaded! Final size is 2867486 bytes. Artifact ID is 6836063884
2544:  Artifact download URL: https://github.com/fleetdm/fleet/actions/runs/25447373162/artifacts/6836063884
2545:  ##[group]Run c1grep() { grep "$@" || test $? = 1; }
2546:  �[36;1mc1grep() { grep "$@" || test $? = 1; }�[0m
2547:  �[36;1mc1grep -oP 'FAIL: .*$' /tmp/gotest.log > /tmp/summary.txt�[0m
2548:  �[36;1mc1grep 'test timed out after' /tmp/gotest.log >> /tmp/summary.txt�[0m
2549:  �[36;1mc1grep 'fatal error:' /tmp/gotest.log >> /tmp/summary.txt�[0m
2550:  �[36;1mc1grep -A 10 'panic: runtime error: ' /tmp/gotest.log >> /tmp/summary.txt�[0m
2551:  �[36;1mc1grep ' FAIL\t' /tmp/gotest.log >> /tmp/summary.txt�[0m
2552:  �[36;1mGO_FAIL_SUMMARY=$(head -n 5 /tmp/summary.txt | sed ':a;N;$!ba;s/\n/\\n/g')�[0m
2553:  �[36;1mecho "GO_FAIL_SUMMARY=$GO_FAIL_SUMMARY"�[0m
2554:  �[36;1mif [[ -z "$GO_FAIL_SUMMARY" ]]; then�[0m
2555:  �[36;1m  GO_FAIL_SUMMARY="unknown, please check the build URL"�[0m
2556:  �[36;1mfi�[0m
2557:  �[36;1mGO_FAIL_SUMMARY=$GO_FAIL_SUMMARY envsubst < .github/workflows/config/slack_payload_template.json > ./payload.json�[0m
2558:  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
2559:  env:
2560:  RACE_ENABLED: false
2561:  GO_TEST_TIMEOUT: 20m
2562:  DOCKER_COMMAND: docker compose -f docker-compose.yml -f docker-compose-redis-cluster.yml up -d mysql_test mysql_replica_test redis redis-cluster-1 redis-cluster-2 redis-cluster-3 redis-cluster-4 redis-cluster-5 redis-cluster-6 redis-cluster-setup s3 saml_idp mailhog mailpit smtp4dev_test
2563:  RUN_TESTS_ARG: 
2564:  CI_TEST_PKG: fleetctl
2565:  NEED_DOCKER: 1
2566:  ARTIFACT_PREFIX: fleetctl-mysql8.0.44
2567:  GOTOOLCHAIN: local
2568:  ##[endgroup]
2569:  GO_FAIL_SUMMARY=
2570:  ##[group]Run actions/upload-artifact@834a144ee995460fba8ed112a2fc961b36a5ec5a
2571:  with:
2572:  name: fleetctl-mysql8.0.44-test-log
2573:  path: /tmp/gotest.log
2574:  if-no-files-found: error
2575:  compression-level: 6

@codecov

codecov Bot commented May 6, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 66.70%. Comparing base (55d63e9) to head (007c596).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main   #44847      +/-   ##
==========================================
+ Coverage   66.68%   66.70%   +0.01%     
==========================================
  Files        2665     2667       +2     
  Lines      214783   215275     +492     
  Branches     9759     9759              
==========================================
+ Hits       143227   143589     +362     
- Misses      58521    58613      +92     
- Partials    13035    13073      +38     
Flag Coverage Δ
backend 68.57% <100.00%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@nulmete
nulmete merged commit d8a1ffa into main May 7, 2026
55 of 57 checks passed
@nulmete
nulmete deleted the 42637-fleetctl-gitops-apply-doesn-t branch May 7, 2026 14:10
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

fleetctl gitops apply doesn't clear stale labels_exclude_any associations after label deletion

2 participants