Multiple packages API changes - #48607
Merged
cdcme merged 6 commits intoJul 3, 2026
Merged
Conversation
CI Feedback 🧐A test triggered by this PR failed. Here is an AI-generated analysis of the failure:
|
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## feat/28108-multiple-custom-packages #48607 +/- ##
======================================================================
Coverage ? 68.03%
======================================================================
Files ? 3680
Lines ? 234136
Branches ? 12454
======================================================================
Hits ? 159299
Misses ? 60494
Partials ? 14343
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
cdcme
force-pushed
the
feat/48397-packages-api
branch
from
July 3, 2026 15:05
103c368 to
bc1e1b5
Compare
cdcme
marked this pull request as ready for review
July 3, 2026 15:06
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
Member
Author
|
@claude review once. |
Member
Author
|
@claude review once |
Member
Author
|
@claude review once |
jkatz01
reviewed
Jul 3, 2026
jkatz01
approved these changes
Jul 3, 2026
cdcme
merged commit Jul 3, 2026
2dd989c
into
feat/28108-multiple-custom-packages
37 of 39 checks passed
4 tasks
RachelElysia
added a commit
that referenced
this pull request
Jul 8, 2026
- `installer_id` is now required on `ISoftwarePackage` — backend #48607 (resolves #48397) landed on the feature branch and confirms the field name. Dropped the "TODO: make required once #48397 ships" and the "Optional during transition" comment. - Reframed `packages: ISoftwarePackage[] | null` comments on both `ISoftwareTitle` and `ISoftwareTitleDetails` — no longer "until the server is on the multi-package contract," now describes the actual meaning (null = no custom packages, source of truth when present). - Dropped the "TODO(48400): drop the software_package fallback once #48397 ships" in the details page. Fallback stays as defense against no-custom-packages titles (FMA / app-store branch), reframed the comment accordingly. - Added `useBlockNavigation` to the custom-hooks list in `frontend/docs/patterns.md`.
7 tasks
georgekarrv
added a commit
that referenced
this pull request
Jul 15, 2026
**Related issue:** Resolves #28108 Adds support for uploading multiple custom packages (up to 10) for the same software title on a team — so IT admins can deploy different versions or architectures (for example, Arm vs. Intel builds or staged rollouts) to label-scoped hosts instead of splitting them across teams. The software title keeps a single first-added `software_package` for backwards compatibility, and first-added-wins resolves overlaps consistently across self-service, manual install, policy automation, and setup experience. Feature branch combining the sub-PRs: migration (#48596), packages[] API and add/edit/delete-package endpoints (#48607), install-time precedence and setup experience (#48708), GitOps (#48710), Library and Add/Edit/Delete modals (#48520), secondary UI — policy automation, setup experience, and install-details hash (#49079), and the host install-result `hash_sha256` field (#49085). # Checklist for submitter - [x] Changes file added for user-visible changes in `changes/`, `orbit/changes/` or `ee/fleetd-chrome/changes`. - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually ## Database migrations - [x] Checked schema for all modified table for columns that will auto-update timestamps during migration. - [x] Confirmed that updating the timestamps is acceptable, and will not cause unwanted side effects. - [x] Ensured the correct collation is explicitly set for character columns (`COLLATE utf8mb4_unicode_ci`). <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Support up to 10 custom packages per software title, with package-scoped deploy/install settings and package-specific edit/delete. * Policy automation can pin “Install software” to a specific package. * GitOps generation now outputs repeatable multi-package YAML per title. * Software install details now display the package SHA-256 hash (when available) with a copy-to-clipboard action. * **Bug Fixes** * Improved deterministic “first-added” precedence for installs, listings, setup experience, and policy dispatch when multiple packages match. * Fixed installer targeting and per-package metadata persistence (including installer-specific activity details). * **Accessibility/UX** * Added optional `aria-label` support for dropdowns. * Info banners can now render a leading icon with configurable color. <!-- end of auto-generated comment: release notes by coderabbit.ai -->
Merged
4 tasks
georgekarrv
added a commit
that referenced
this pull request
Jul 22, 2026
…TeamTitleAndInstallerID (#49760) **Related issue:** N/A — RC branch build/CI fix ## What & why The Docker publish for **4.89.2** on `rc-patch-fleet-v4.89.2` was failing to compile, and the `mysql` test suite + Go linters were red — all from the same root cause: a **broken cherry-pick**. **1. Missing datastore method (broke Docker publish + all binary builds):** ``` server/datastore/mysql/software_installers.go:748:30: ds.GetSoftwareInstallerMetadataByTeamTitleAndInstallerID undefined ``` The FMA patch-policy fix (#49519, commit `9603e84cc4`) was cherry-picked in, bringing a *caller* of `GetSoftwareInstallerMetadataByTeamTitleAndInstallerID`, but the method itself was introduced on `main` by the large "Multiple packages API changes" feature PR (#48607), which is not part of this release. **2. Stale test assertion (broke `mysql` test suite + `lint`/`lint-incremental` typecheck):** ``` server/datastore/mysql/software_installers_test.go:6362:11: assignment mismatch: 2 variables but ds.RecordPolicyQueryExecutions returns 1 value ``` The same cherry-pick brought a test that calls `RecordPolicyQueryExecutions` expecting `([]uint, error)` (its signature on `main`), but on this RC branch it returns just `error`. A non-compiling test package fails both the mysql suite and the linter's typecheck pass. ## Fix - Added `GetSoftwareInstallerMetadataByTeamTitleAndInstallerID` as a self-contained, minimal addition (interface + datastore impl + regenerated mock), refactoring `GetSoftwareInstallerMetadataByTeamAndTitleID` to share a private helper that takes an optional installer ID. The `nil` path preserves existing behavior exactly; a non-nil ID selects that specific package by `si.id`. - Fixed the stale test call to match the RC branch's single-return signature (the discarded first return value is simply dropped). No production behavior change for existing callers. # Checklist for submitter - [x] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. ## Testing - [x] Added/updated automated tests - [x] QA'd all new/changed functionality manually For unreleased bug fixes in a release candidate, one of: - [x] Confirmed that the fix is not expected to adversely impact load test results --------- Co-authored-by: test <test@test.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related issue: Resolves #48397
Summary
Adds the REST API layer for multiple custom packages per software title (backend only):
GET /software/titlesandGET /software/titles/:idreturn a newpackages[]array;software_packageis retained as the first-added package for backwards compatibility.POST /software/packageadds a package to an existing title and returns the added package.PATCH /software/titles/:id/packagetargets a specificinstaller_idand rejects a replacement whose hash matches a sibling package (409).DELETE /software/titles/:id/available_for_install?installer_id=deletes one package; omittinginstaller_iddeletes them all.Builds on the data-model foundation (#48396). Install-time precedence and the host-software endpoint are out of scope (#48398).
Checklist for submitter
changes/.See Changes files for more information.
SELECT *is avoided, SQL injection is prevented (using placeholders for values in statements).Testing