Prepare to archive fleet-gitops repo

[lukeheath]

Related issue: #40300

What & why

Removes references to the fleetdm/fleet-gitops repo ahead of archiving it (#40300), and points users at the fleetctl new scaffolding, which is now the recommended way to start a Fleet GitOps repository.

• articles/managing-linux-desktops-with-gitops.md: replace the git clone fleet-gitops walkthrough with fleetctl new, and port the worked example from the old lib/ layout to the structure fleetctl new generates (labels/, platforms/linux/…).
• articles/setup-experience.md: retarget two "GitOps workflow" links from the repo to the GitOps YAML docs.
• tools/release/README.md: drop the release step that opens a PR to bump DEFAULT_FLEETCTL_VERSION in fleet-gitops. The fleetctl new scaffold auto-detects the version from the server, so nothing replaces it.
• .github/workflows/dogfood-gitops.yml + .github/actions/gitops-fleets/ (new): vendor the gitops-fleets composite action + script into the monorepo so dogfood no longer checks out fleetdm/fleet-gitops at runtime. This brings Fleet's own pipeline onto the same self-contained pattern fleetctl new ships to everyone else.

This PR is one of two: the companion PR in fleetdm/fleet-gitops adds a deprecation banner to that repo's README. The repo can be archived once both merge.

Deferred follow-ups (not required for archiving, since an archived repo stays cloneable; these are the gate before eventual deletion): decouple the two cmd/fleetctl/integrationtest/gitops tests from the live clone, retire the Render fleet-gitops-ci-* services + render-deploy.yml references, and sweep for public uses: fleetdm/fleet-gitops consumers.

Checklist for submitter

• Changes file: N/A. Docs and internal CI only, no user-visible product change.
• Untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. The vendored gitops-fleets.sh is a verbatim copy of the existing production script.

Testing

• QA'd all new/changed functionality manually (dogfood GitOps run against the vendored action).

Summary by CodeRabbit

• New Features
  • Added a GitHub Action to install and configure fleetctl, then apply Fleet GitOps configuration.
  • Added support for dry runs, custom headers, configurable working directories, and optional fleet cleanup.
  • Added validation for missing global settings and duplicate fleet names.
• Bug Fixes
  • Updated the dogfood workflow to apply configuration directly through the local GitOps action.

[lukeheath]

Moving moving fleet-gitops repo.

[lukeheath]

Moving moving fleet-gitops repo.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

This PR prepares for archiving fleetdm/fleet-gitops by removing remaining references to that repo and making Fleet’s dogfood GitOps workflow self-contained within the monorepo, aligned with the fleetctl new scaffolding approach.

Changes:

• Remove release-process instructions that required updating fleetdm/fleet-gitops.
• Update the dogfood GitOps workflow to use a new in-repo composite action instead of checking out fleetdm/fleet-gitops.
• Add a vendored composite action (.github/actions/gitops-fleets) and supporting script for running fleetctl gitops.

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
tools/release/README.md	Removes the release step that referenced updating fleetdm/fleet-gitops.
.github/workflows/dogfood-gitops.yml	Stops checking out fleetdm/fleet-gitops and switches to the new local composite action.
.github/actions/gitops-fleets/action.yml	New composite action to install/configure fleetctl and run GitOps.
.github/actions/gitops-fleets/gitops-fleets.sh	New vendored GitOps runner script invoked by the composite action.
articles/setup-experience.md	Content excluded by policy (not reviewable here).
articles/managing-linux-desktops-with-gitops.md	Content excluded by policy (not reviewable here).

Files excluded by content exclusion policy (2)

• articles/managing-linux-desktops-with-gitops.md
• articles/setup-experience.md

Comments suppressed due to low confidence (1)

.github/actions/gitops-fleets/action.yml:82

• Same issue as above for fleetctl config: a trailing comma/double comma in FLEET_CUSTOM_HEADERS produces an empty entry and will add --custom-header "", which can cause fleetctl config set to error. Skip empty header strings.

          for _header in "${_CUSTOM_HEADERS[@]}"; do
            CUSTOM_HEADER_ARGS+=(--custom-header "$_header")
          done

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated no new comments.

Files excluded by content exclusion policy (2)

• articles/managing-linux-desktops-with-gitops.md
• articles/setup-experience.md

Comments suppressed due to low confidence (1)

.github/actions/gitops/action.yml:45

• The curl that fetches the Fleet server version uses --silent without --show-error, so if the request fails the logs can be opaque (often just an exit code with no HTTP/body context). Adding --show-error keeps output quiet on success but surfaces useful errors on failure.

        FLEET_VERSION="$(curl "$FLEET_URL/api/v1/fleet/version" --header "Authorization: Bearer $FLEET_API_TOKEN" "${CURL_HEADER_ARGS[@]}" --fail --silent | jq --raw-output '.version')"

[lukeheath]

Moving from fleet-gitops.

[Copilot]

Warning

• Copilot's review of this pull request may be incomplete because some of the changed files are excluded by your Copilot content exclusion settings. See Excluding content from Copilot for details.

Pull request overview

Copilot reviewed 4 out of 6 changed files in this pull request and generated no new comments.

Files excluded by content exclusion policy (2)

• articles/managing-linux-desktops-with-gitops.md
• articles/setup-experience.md

Comments suppressed due to low confidence (4)

.github/actions/gitops/action.yml:46

• This step doesn’t validate that required env vars (FLEET_URL, FLEET_API_TOKEN) are set, and curl runs with --silent --fail, which can make failures hard to diagnose. Also jq can return "null", which currently gets treated like a real version string. Add explicit required-var checks, use --show-error, and normalize "null" to empty before version selection.

        FLEET_URL="${FLEET_URL%/}"

        # Build optional custom request headers from FLEET_CUSTOM_HEADERS, a comma-separated
        # list of "Header:Value" pairs (e.g. a Cloudflare Access service token). Empty by default.
        CURL_HEADER_ARGS=()
        if [[ -n "${FLEET_CUSTOM_HEADERS:-}" ]]; then
          IFS=',' read -ra _CUSTOM_HEADERS <<< "$FLEET_CUSTOM_HEADERS"
          for _header in "${_CUSTOM_HEADERS[@]}"; do
            CURL_HEADER_ARGS+=(--header "$_header")
          done
        fi

        FLEET_VERSION="$(curl "$FLEET_URL/api/v1/fleet/version" --header "Authorization: Bearer $FLEET_API_TOKEN" "${CURL_HEADER_ARGS[@]}" --fail --silent | jq --raw-output '.version')"
        DEFAULT_FLEETCTL_VERSION="latest"

.github/actions/gitops/gitops.sh:59

• $FLEETCTL is executed unquoted, which can break if FLEETCTL is set to a path containing spaces or includes extra flags. Quote it to avoid word-splitting and globbing issues.

# Dry run
$FLEETCTL gitops "${args[@]}" --dry-run
if [ "$FLEET_DRY_RUN_ONLY" = true ]; then
  exit 0
fi

# Real run
$FLEETCTL gitops "${args[@]}"

.github/actions/gitops/gitops.sh:22

• If default.yml exists but doesn’t contain org_settings, the script will exit due to set -e with a generic grep failure and no clear explanation. Wrap the grep in an explicit check and print a helpful error before exiting.

# Check for existence of the global file in case the script is used
# on repositories with fleet only yamls.
if [ -f "$FLEET_GLOBAL_FILE" ]; then
	# Validate that global file contains org_settings
	grep -Exq "^org_settings:.*" "$FLEET_GLOBAL_FILE"
else

.github/actions/gitops/action.yml:85

• FLEET_URL is trimmed in the install step, but that change won’t persist to this later step (each composite step runs in a separate shell). This makes URL normalization inconsistent between version detection and fleetctl configuration. Normalize (and validate) FLEET_URL again here (or export it via GITHUB_ENV in the prior step) so both steps use the same value.

    - name: Configure fleetctl
      shell: bash
      working-directory: ${{ inputs.working-directory }}
      run: |
        # Build optional custom request headers from FLEET_CUSTOM_HEADERS, a comma-separated
        # list of "Header:Value" pairs. fleetctl persists them and sends them on every request,
        # so the gitops commands below use them too.
        CUSTOM_HEADER_ARGS=()
        if [[ -n "${FLEET_CUSTOM_HEADERS:-}" ]]; then
          IFS=',' read -ra _CUSTOM_HEADERS <<< "$FLEET_CUSTOM_HEADERS"
          for _header in "${_CUSTOM_HEADERS[@]}"; do
            CUSTOM_HEADER_ARGS+=(--custom-header "$_header")
          done
        fi
        fleetctl config set --address "$FLEET_URL" --token "$FLEET_API_TOKEN" "${CUSTOM_HEADER_ARGS[@]}"

[lukeheath]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

Walkthrough

Adds a local fleetctl-gitops composite action that selects and installs a Fleet-compatible fleetctl, configures connection settings and custom headers, and invokes a GitOps script. The script validates configuration, detects duplicate fleet names, builds YAML arguments, performs a dry run, and optionally applies changes. The dogfood workflow now uses this local action instead of checking out a separate GitOps repository.

Possibly related issues

• Archive fleet-gitops and gitops-workshop repo #40300: The PR moves GitOps automation into the Fleet monorepo and removes the workflow’s dependency on the separately checked-out repository.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: preparing the fleet-gitops repo for archiving.
Description check	✅ Passed	The description includes the related issue, motivation, scope, checklist, and testing notes, with only optional sections omitted.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch archive-fleet-gitops-prep

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/actions/gitops/action.yml:
- Line 45: Update the Fleet version request in the FLEET_VERSION assignment to
add explicit curl connection and total time limits, such as --connect-timeout
and --max-time. Preserve the existing authorization headers, silent/fail
behavior, jq parsing, and command substitution.
- Around line 67-68: Update the fleetctl installation command in the GitOps
action to install only the requested $INSTALL_VERSION and propagate any
installation failure. Remove the fallback to fleetctl@latest so the action fails
when the selected version cannot be installed.

In @.github/actions/gitops/gitops.sh:
- Around line 32-36: Update the duplicate-name validation in the fleet-file
conditional to use an explicit conditional around the Perl/sort/uniq pipeline,
rather than relying on the negated pipeline expression. Ensure the
duplicate-name case is detected and handled before the script continues building
args or invoking fleetctl, while preserving the existing behavior when names are
unique.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 378f6aec-d3a5-426b-a19b-cb4706abd1c6

📥 Commits

Reviewing files that changed from the base of the PR and between f5ca4b5 and f98c261.

⛔ Files ignored due to path filters (3)

• articles/managing-linux-desktops-with-gitops.md is excluded by !**/*.md
• articles/setup-experience.md is excluded by !**/*.md
• tools/release/README.md is excluded by !**/*.md

📒 Files selected for processing (3)

• .github/actions/gitops/action.yml
• .github/actions/gitops/gitops.sh
• .github/workflows/dogfood-gitops.yml