Add hash_sha256 field to host installer result and install software activity

[jkatz01]

Related issue: Resolves #

• Adds hash_sha256 field to host installer result and install software activity so they can be used in combination to cover past activities with existing installers + all new activities even if their installer will get deleted

Checklist for submitter

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• New Features

  • Software installation results now include the installer’s SHA-256 hash when available.
  • Installed-software activity records now include the corresponding hash_sha256 value.

• Bug Fixes

  • Hash values are retained in activity history after an installer is deleted, while live results correctly show the value as unavailable.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.09%. Comparing base (8b1e806) to head (1d02aef).
⚠️ Report is 5 commits behind head on feat/28108-multiple-custom-packages.

Additional details and impacted files

@@                           Coverage Diff                           @@
##           feat/28108-multiple-custom-packages   #49085      +/-   ##
=======================================================================
+ Coverage                                68.01%   68.09%   +0.07%     
=======================================================================
  Files                                     3679     3680       +1     
  Lines                                   233804   234442     +638     
  Branches                                 12454    12454              
=======================================================================
+ Hits                                    159033   159645     +612     
+ Misses                                   60456    60442      -14     
- Partials                                 14315    14355      +40     

Flag	Coverage Δ
backend	69.75% <100.00%> (+0.08%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[jkatz01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4cd219a0-b1bd-4eb6-8433-88bccd2a3282

📥 Commits

Reviewing files that changed from the base of the PR and between 70a3206 and 1d02aef.

📒 Files selected for processing (7)

• server/datastore/mysql/software_installers.go
• server/datastore/mysql/software_installers_test.go
• server/fleet/activities.go
• server/fleet/software_installer.go
• server/service/integration_enterprise_test.go
• server/service/integration_mdm_setup_experience_test.go
• server/service/orbit.go

---

Walkthrough

Software install results now include the installer storage ID as nullable hash_sha256. The hash is exposed in HostSoftwareInstallerResult, propagated into installed-software activities, and serialized in activity payloads. Tests cover hashes while installers exist, nil values after deletion, and expected activity data across enterprise and setup-experience flows.

Possibly related PRs

• fleetdm/fleet#48127: Related to pending-install cancellation behavior, where removing the installer row results in a nil hash.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description is mostly on-template, but it leaves the related issue as Resolves # and omits any applicable non-testing checklist items.	Replace Resolves # with a real issue number or remove it, and add any other applicable checklist items or explicitly mark them N/A.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title is concise and clearly describes the main change to add hash_sha256 to installer results and activities.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jk-add-hash-to-host-installer-result

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ast-grep (0.44.1)

server/service/integration_enterprise_test.go

ast-grep timed out on this file

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}