Fix gitops not updating FMA installer

[jkatz01]

Related issue: Resolves #49811

Checklist for submitter

If some of the following don't apply, delete the relevant line.

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.

• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters.

• Timeouts are implemented and retries are limited to avoid infinite loops

• If paths of existing endpoints are modified without backwards compatibility, checked the frontend/CLI for any necessary changes

Testing

• Added/updated automated tests

• Where appropriate, automated tests simulate multiple hosts and test for host isolation (updates to one hosts's records do not affect another)

• QA'd all new/changed functionality manually

Summary by CodeRabbit

• Bug Fixes
  • Fixed Fleet-maintained app updates when a rebuilt installer keeps the same version.
  • Rebuilt installers now update their files, hashes, filenames, and install scripts correctly.
  • Prevented installers from being incorrectly skipped when their contents differ despite matching versions.
• Tests
  • Added coverage for same-version installer rebuilds and team-specific caching behavior.

[codecov]

Codecov Report

❌ Patch coverage is 84.21053% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 67.97%. Comparing base (8e0c038) to head (24256ba).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
ee/server/service/maintained_apps_auto_update.go	50.00%	2 Missing ⚠️
server/datastore/mysql/software_titles.go	88.88%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #50000      +/-   ##
==========================================
- Coverage   67.99%   67.97%   -0.03%     
==========================================
  Files        3924     3922       -2     
  Lines      250120   250043      -77     
  Branches    13330    13319      -11     
==========================================
- Hits       170072   169958     -114     
- Misses      64747    64781      +34     
- Partials    15301    15304       +3     

Flag	Coverage Δ
backend	69.37% <84.21%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: fe6b6e3f-abe0-4ec0-8aa4-9a9166ffd8eb

📥 Commits

Reviewing files that changed from the base of the PR and between bdd04ba and b944544.

📒 Files selected for processing (11)

• changes/49811-fma-installing-wrong-version
• ee/server/service/maintained_apps_auto_update.go
• ee/server/service/maintained_apps_auto_update_download_test.go
• ee/server/service/software_installers.go
• server/datastore/mysql/software_installers.go
• server/datastore/mysql/software_installers_test.go
• server/datastore/mysql/software_titles.go
• server/fleet/datastore.go
• server/mock/datastore_mock.go
• server/service/integration_enterprise_test.go
• server/service/testing_utils_test.go

---

Walkthrough

FMA installer cache checks now return and compare the cached installer storage ID with the payload hash. Batch persistence also includes storage_id when determining whether an existing same-version installer can be reused, allowing rebuilt installers to update in place. Datastore interfaces, implementations, mocks, and test callers were updated for the new return value. Tests cover cached hash retrieval, same-version rebuilds, metadata updates, and per-build installer scripts.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title matches the main fix: GitOps/FMA installers no longer keep the wrong build when the version string is reused.
Description check	✅ Passed	It includes the related issue, changefile, tests, and manual QA, and the remaining checklist items are plausibly not applicable.
Linked Issues check	✅ Passed	The code now distinguishes rebuilt FMA installers by hash/storage ID, so GitOps can replace the old build for the same version. [#49811]
Out of Scope Changes check	✅ Passed	The touched datastore, service, mock, and test changes all support the same FMA rebuild fix and appear in scope.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch 49811-fma-installing-wrong-version

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 ast-grep (0.44.1)

server/service/integration_enterprise_test.go

ast-grep timed out on this file

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[dantecatalfamo]

Happy 50000th pull request/issue 🥳