Merge remote-tracking branch 'origin/main' into victor/24870-fleetd-d…

…ownload-from-CDN

.github/ISSUE_TEMPLATE/release-qa.md

@@ -2,7 +2,7 @@
 name:  Release QA
 about: Checklist of required tests prior to release
 title: 'Release QA:'
-labels: '#g-mdm,#g-endpoint-ops,:release'
+labels: '#g-mdm,#g-orchestration,#g-software:release'
 assignees: 'xpkoala,pezhub,jmwatts'
 
 ---
@@ -27,11 +27,12 @@ Smoke tests are limited to core functionality and serve as a pre-release final r
 
 ### Prerequisites
 
-1. `fleetctl preview` is set up and running the desired test version using [`--tag` parameters.](https://github.com/fleetdm/fleet/blob/main/handbook/product.md#manual-qa )
+1. `fleetctl preview` is set up and running the desired test version using [`--tag` parameters.](https://fleetdm.com/handbook/engineering#run-fleet-locally-for-qa-purposes)
 2. Unless you are explicitly testing older browser versions, browser is up to date.
 3. Certificate & flagfile are in place to create new host.
 4. In your browser, clear local storage using devtools.
 
+### Orchestration
 <table>
 <tr><th>Test name</th><th>Step instructions</th><th>Expected result</th><th>pass/fail</td></tr>
 <tr><td>$Name</td><td>{what a tester should do}</td><td>{what a tester should see when they do that}</td><td>pass/fail</td></tr>
@@ -53,20 +54,6 @@ Smoke tests are limited to core functionality and serve as a pre-release final r
 3. forget password link prompts for email
 4. valid credentials result in a successful login.
 5. valid sso credentials result in a successful login</td><td>pass/fail</td></tr>
-<tr><td>Query flow</td><td>Create, edit, run, and delete queries. </td><td>
-
-1. permissions regarding creating/editing/deleting queries are up to date with documentation
-2. syntax errors result in error messaging
-3. queries can be run manually 
-</td><td>pass/fail</td></tr>
-<tr><td>Host Flow</td><td>Verify a new host can be added and removed following modal instructions using your own device.</td><td>
-
-1. Host is added via command line
-2. Host serial number and date added are accurate
-3. Host is not visible after it is deleted
-4. Warning and informational modals show when expected and make sense
-</td><td>pass/fail</td></tr>
-
 <tr><td>Packs flow</td><td>Verify management, operation, and logging of ["2017 packs"](https://fleetdm.com/handbook/company/why-this-way#why-does-fleet-support-query-packs).</td><td>
 
 1. Packs successfully run on host machines after migrations 
@@ -82,16 +69,17 @@ Smoke tests are limited to core functionality and serve as a pre-release final r
 2. Software, query, policy, and packs logs are successfully sent to Filesystem log destinations
 
 </td><td>pass/fail</td></tr>
+<tr><td>OS settings</td><td>Verify OS settings functionality</td><td>
 
-
-<tr><td>My device page</td><td>Verify the end user's my device page loads successfully.</td><td>
-
-1. Clicking the Fleet desktop item, then "My device" successfully loads the my device page.
-2. The "My device" page is populated correctly and as expected. 
-3. Styling and padding appears correct.
-
+1. Verify able to configure Disk encryption (macOS, Windows, & Linux).
+2. Verify host enrolled with Disk encryption enforced successfully encrypts.
 </td><td>pass/fail</td></tr>
+</table>
 
+### MDM
+<table>
+<tr><th>Test name</th><th>Step instructions</th><th>Expected result</th><th>pass/fail</td></tr>
+<tr><td>$Name</td><td>{what a tester should do}</td><td>{what a tester should see when they do that}</td><td>pass/fail</td></tr>
 <tr><td>MDM enrollment flow</td><td>Verify MDM enrollments, run MDM commands</td><td>
 
 1. Erase an ADE-eligible macOS host and verify able to complete automated enrollment flow.
@@ -106,45 +94,22 @@ Smoke tests are limited to core functionality and serve as a pre-release final r
 3. Turn off MDM on a non ADE-eligible macOS host.
 4. On the My device page, follow the "Turn on MDM" instructions and verify that MDM is turned on.
 </td><td>pass/fail</td></tr>
-
-<tr><td>Scripts</td><td>Verify script library and execution</td><td>
-
-1. Verify able to run a script on all host types from CLI.
-2. Verify scripts library upload/download/delete.
-3. From Host details (macOS, Windows, & Linux) run a script that should PASS, verify.
-4. From Host details (macOS, Windows, & Linux) run a script that should FAIL, verify.
-5. Verify UI loading state and statuses for scripts.
-6. Disable scripts globally and verify unable to run.
-7. Verify scripts display correctly in Activity feed.
-</td><td>pass/fail</td></tr>
-
-<tr><td>Software</td><td>Verify software library and install / download</td><td>
-
-1. Verify software library upload/download/delete.
-2. From Host details (macOS, Windows, & Linux) run an install that should PASS, verify.
-3. From My Device (macOS, Windows, & Linux) software tab should have self-service items available, verify.
-4. Verify UI loading state and statuses for installing software.
-6. Verify software installs display correctly in Activity feed.
-</td><td>pass/fail</td></tr>
-
 <tr><td>OS settings</td><td>Verify OS settings functionality</td><td>
 
-1. Verify able to configure Disk encryption (macOS, Windows, & Linux).
-2. Verify host enrolled with Disk encryption enforced successfully encrypts.
-3. Verify Profiles upload/download/delete (macOS & Windows).
-4. Verify Profiles are delivered to host and applied. 
+1. Verify Profiles upload/download/delete (macOS & Windows).
+2. Verify Profiles are delivered to host and applied. 
 </td><td>pass/fail</td></tr>
 
 <tr><td>Setup experience</td><td>Verify macOS Setup experience</td><td>
 
 1. Configure End user authentication.
-2. Upload a Bootstrap package.
-3. Add software (FMA, VPP, & Custom pkg)
-4. Add a script
-5. Enroll an ADE-eligible macOS host and verify successful authentication.
-6. Verify Bootstrap package is delivered.
-7. Verify SwiftDialogue window displays.
-8. Verify software installs and script runs.
+3. Upload a Bootstrap package.
+4. Add software (FMA, VPP, & Custom pkg)
+5. Add a script
+6. Enroll an ADE-eligible macOS host and verify successful authentication.
+7. Verify Bootstrap package is delivered.
+8. Verify SwiftDialogue window displays.
+9. Verify software installs and script runs.
 </td><td>pass/fail</td></tr>
 
 <tr><td>OS updates</td><td>Verify OS updates flow</td><td>
@@ -161,25 +126,78 @@ Smoke tests are limited to core functionality and serve as a pre-release final r
 3. Verify Profiles are delivered to host and applied.
 4. Verify VPP apps install & display correctly in Activity feed.
 
+</td><td>pass/fail</td></tr>
 <tr><td>Certificates Upload</td><td>APNs cert and ABM token renewal workflow</td><td>
 
 1. Renew APNs Certificate.
 2. Renew ABM Token.
 3. Ensure ADE hosts can enroll.
 </td><td>pass/fail</td></tr>
 
+</table>
+
+### Software
+<table>
+<tr><th>Test name</th><th>Step instructions</th><th>Expected result</th><th>pass/fail</td></tr>
+<tr><td>$Name</td><td>{what a tester should do}</td><td>{what a tester should see when they do that}</td><td>pass/fail</td></tr>
+<tr><td>Query flow</td><td>Create, edit, run, and delete queries. </td><td>
+
+1. permissions regarding creating/editing/deleting queries are up to date with documentation
+2. syntax errors result in error messaging
+3. queries can be run manually 
+</td><td>pass/fail</td></tr>
+<tr><td>Host Flow</td><td>Verify a new host can be added and removed following modal instructions using your own device.</td><td>
+
+1. Host is added via command line
+2. Host serial number and date added are accurate
+3. Host is not visible after it is deleted
+4. Warning and informational modals show when expected and make sense
+</td><td>pass/fail</td></tr>
+<tr><td>My device page</td><td>Verify the end user's my device page loads successfully.</td><td>
+
+1. Clicking the Fleet desktop item, then "My device" successfully loads the my device page.
+2. The "My device" page is populated correctly and as expected. 
+3. Styling and padding appears correct.
+
+</td><td>pass/fail</td></tr>
+<tr><td>Scripts</td><td>Verify script library and execution</td><td>
+
+1. Verify able to run a script on all host types from CLI.
+2. Verify scripts library upload/download/delete.
+3. From Host details (macOS, Windows, & Linux) run a script that should PASS, verify.
+4. From Host details (macOS, Windows, & Linux) run a script that should FAIL, verify.
+5. Verify UI loading state and statuses for scripts.
+8. Disable scripts globally and verify unable to run.
+9. Verify scripts display correctly in Activity feed.
+</td><td>pass/fail</td></tr>
+
+<tr><td>Software</td><td>Verify software library and install / download</td><td>
+
+1. Verify software library upload/download/delete.
+2. From Host details (macOS, Windows, & Linux) run an install that should PASS, verify.
+3. From My Device (macOS, Windows, & Linux) software tab should have self-service items available, verify.
+4. Verify UI loading state and statuses for installing software.
+7. Verify software installs display correctly in Activity feed.
+</td><td>pass/fail</td></tr>
+
+
 <tr><td>Migration Test</td><td>Verify Fleet can migrate to the next version with no issues.</td><td>
 
 Using the migration scripts located in fleet/test/upgrade/
 1. Run the upgrade_test.go script using the most recent stable version of Fleet and `main`.
 2. Upgrade test returns an 'OK' response.
 </td><td>pass/fail</td></tr>
-
+</table>
+
+### All Product Groups
+<table>
+ <tr><th>Test name</th><th>Step instructions</th><th>Expected result</th><th>pass/fail</td></tr>
+<tr><td>$Name</td><td>{what a tester should do}</td><td>{what a tester should see when they do that}</td><td>pass/fail</td></tr>
 <tr><td>Release blockers</td><td>Verify there are no outstanding release blocking tickets.</td><td>
 
 1. Check [this](https://github.com/fleetdm/fleet/labels/~release%20blocker) filter to view all open `~release blocker` tickets.
 2. If any are found raise an alarm in the `#help-engineering` and `#g-mdm` (or `#g-endpoint-ops`)  channels.
-</td><td>pass/fail</td></tr>
+</td><td>pass/fail</td></tr> 
 </table>
 
 ### Notes

.github/workflows/build-binaries.yaml

@@ -88,7 +88,7 @@ jobs:
       - name: Build binaries
         run: make
 
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+      - uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: build
           path: build/

.github/workflows/build-fleetd-base-pkg.yml

@@ -107,14 +107,14 @@ jobs:
           </plist>' > fleetd-base-manifest.plist
 
       - name: Upload fleetd-base.pkg
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: fleetd-base.pkg
           path: |
             fleetd-base.pkg
 
       - name: Upload fleetd-base-manifest.plist
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: fleetd-base-manifest.plist
           path: |

.github/workflows/fleet-and-orbit.yml

@@ -155,15 +155,15 @@ jobs:
 
       - name: Upload fleet logs
         if: always()
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: fleet-logs
           path: |
             fleet_log
 
       - name: Upload cloudflared logs
         if: always()
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: cloudflared.log
           path: cloudflared.log
@@ -235,7 +235,7 @@ jobs:
           make osqueryd-app-tar-gz version=$OSQUERY_VERSION out-path=.
 
       - name: Upload desktop.app.tar.gz and osqueryd.app.tar.gz
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: macos-pre-built-apps
           path: |
@@ -274,7 +274,7 @@ jobs:
 
       - name: Download macos pre-built apps
         id: download
-        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: macos-pre-built-apps
 
@@ -301,21 +301,21 @@ jobs:
           ./tools/tuf/test/main.sh
 
       - name: Upload PKG installer
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: fleet-osquery.pkg
           path: |
             fleet-osquery.pkg
 
       - name: Upload DEB installer
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: fleet-osquery_42.0.0_amd64.deb
           path: |
             fleet-osquery_42.0.0_amd64.deb
 
       - name: Upload MSI installer
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: fleet-osquery.msi
           path: |
@@ -336,7 +336,7 @@ jobs:
 
       - name: Download pkg
         id: download
-        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: fleet-osquery.pkg
 
@@ -365,9 +365,9 @@ jobs:
 
       - name: Upload orbit logs
         if: always()
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
-          name: orbit-logs
+          name: orbit-logs-macos
           path: |
             orbit-logs
 
@@ -387,7 +387,7 @@ jobs:
 
       - name: Download deb
         id: download
-        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: fleet-osquery_42.0.0_amd64.deb
 
@@ -416,9 +416,9 @@ jobs:
 
       - name: Upload orbit logs
         if: always()
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
-          name: orbit-logs
+          name: orbit-logs-ubuntu
           path: |
             orbit-logs
 
@@ -438,7 +438,7 @@ jobs:
 
       - name: Download msi
         id: download
-        uses: actions/download-artifact@fb598a63ae348fa914e94cd0ff38f362e927b741 # v2
+        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           name: fleet-osquery.msi
 
@@ -535,7 +535,7 @@ jobs:
 
       - name: Upload Orbit logs
         if: always()
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: orbit-logs-windows
           path: C:\Windows\system32\config\systemprofile\AppData\Local\FleetDM\Orbit\Logs\orbit-osquery.log

.github/workflows/fleetctl-preview-latest.yml

@@ -94,7 +94,7 @@ jobs:
 
     - name: Upload logs
       if: always()
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
       with:
         name: ${{ matrix.os }}-log
         path: |

.github/workflows/fleetctl-preview.yml

@@ -55,7 +55,7 @@ jobs:
 
     - name: Upload logs
       if: always()
-      uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+      uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
       with:
         name: ${{ matrix.os }}-log
         path: |

.github/workflows/generate-nudge-targets.yml

@@ -45,7 +45,7 @@ jobs:
         run: make nudge-app-tar-gz version=$NUDGE_VERSION out-path=.
 
       - name: Upload nudge.app.tar.gz
-        uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v2
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: nudge.app.tar.gz
           path: nudge.app.tar.gz