Fix Windows Git FMA patch policy never detecting outdated installs

[l-teles]

Related issue: Resolves #50283

Git for Windows registers itself in the Windows uninstall registry as exactly Git — its Inno Setup script has set UninstallDisplayName={#APP_NAME} since build-extra#365 (2021). The generated queries matched programs.name LIKE 'Git %', which cannot match that name, so the patch policy's NOT EXISTS (...) was always true and every host reported Pass regardless of installed version — update automations never fired. The same mismatch meant an existing Git install couldn't be matched to the maintained app.

The input now uses the custom fuzzy pattern Git%, which also covers the pre-2021 Git <version> DisplayName form (the oldest installs, which are exactly what a patch policy needs to flag), and relies on the existing publisher = 'The Git Development Community' guard to exclude GitHub Desktop, Git LFS, GitKraken and Git Extensions. This is the same match the app's own uninstall script and the FMA Windows CI workflow already use.

Instances that already created this policy pick up the corrected query when the next Git version becomes active, since the patch policy query is regenerated from the active installer.

Checklist for submitter

• Changes file added for user-visible changes in changes/.

Testing

Verified the LIKE semantics in SQLite against real-world programs rows (old pattern misses Git, new pattern matches both DisplayName forms, publisher guard still excludes GitHub Desktop / Git LFS / GitKraken / Git Extensions), and confirmed winget's PackageVersion matches the registry DisplayVersion for Git so up-to-date hosts still pass. outputs/git/windows.json was regenerated with the ingester rather than hand-edited. Not manually QA'd on a Windows host — relying on test-fma-windows validation.

Summary by CodeRabbit

• Bug Fixes
  • Improved Git for Windows detection across supported environments.
  • Outdated installations can now be correctly identified and included in update automation, including registrations named “Git.”
  • Existing publisher and version checks remain unchanged.

[coderabbitai]

Walkthrough

Updated Windows Git detection queries to match program names beginning with Git. Changed the Winget input from generic fuzzy matching to the Git% pattern. Added a changelog entry describing the patch-policy correction.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the Windows Git FMA patch policy detection bug and its impact.
Description check	✅ Passed	The description identifies issue #50283, explains the root cause and fix, documents testing, and notes the regenerated output.
Linked Issues check	✅ Passed	The changes replace the invalid Git name pattern with Git%, retain the publisher filter, and address outdated-version detection and automations for issue #50283.
Out of Scope Changes check	✅ Passed	All changes are limited to the Git Windows input, generated output, and required changelog entry for issue #50283.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

ee/maintained-apps/outputs/git/windows.json (1)

6-7: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add regression coverage for the Windows Git queries.

Test both Git and Git <version> names with The Git Development Community. Also test an unrelated publisher. Verify that an older matching version fails the patched query and the active version passes.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@ee/maintained-apps/outputs/git/windows.json` around lines 6 - 7, Add
regression coverage for the Windows Git query definitions in “exists” and
“patched”. Exercise both “Git” and “Git <version>” names for “The Git
Development Community”, plus an unrelated publisher; assert that older matching
versions fail “patched” while the active version passes, and verify the expected
existence behavior.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@ee/maintained-apps/outputs/git/windows.json`:
- Around line 6-7: Add regression coverage for the Windows Git query definitions
in “exists” and “patched”. Exercise both “Git” and “Git <version>” names for
“The Git Development Community”, plus an unrelated publisher; assert that older
matching versions fail “patched” while the active version passes, and verify the
expected existence behavior.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 6eb5710a-bce7-456c-9b6f-e2fe100af2be

📥 Commits

Reviewing files that changed from the base of the PR and between 7abc0f6 and 4926784.

📒 Files selected for processing (3)

• changes/50283-git-fma-windows-patch-policy
• ee/maintained-apps/inputs/winget/git.json
• ee/maintained-apps/outputs/git/windows.json

[l-teles]

Skipping CodeRabbit's suggestion. The version half of the suggestion isn't testable in Go — version_compare is an osquery SQL function with no Go/SQLite implementation in this repo, and programs is Windows-only, so asserting "older version fails, active version passes" needs a real osquery instance. The name/publisher half is LIKE semantics rather than Fleet logic, and the generator path is already covered by TestSetUpExistsQuery, which table-tests custom fuzzy patterns.

The coverage that would actually have caught this is at the validator level: cmd/maintained-apps/validate/windows.go checks installs with its own LOWER(name) LIKE '%<appName>%' query rather than executing the manifest's generated exists/patched queries, so a manifest whose queries match nothing still passes validation. Worth doing as a separate change since it protects every FMA, not just Git.

[allenhouchins]

Thanks!