diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 67d3c77a8c..bfdb88bf98 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -1,5 +1,90 @@ +# Basic set up for Actions and Docker. Security updates enabled via GitHub settings for other ecosystems. + version: 2 -# updates intentionally left empty, as we were seeing too much volume of PRs, and breakages -# introduced by dependency version updates. Dependabot will continue to open security-related PRs, -# but non-security dependency updates must be done manually. -updates: [] +updates: + +# Maintain dependencies for GitHub Actions + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + pull-request-branch-name: + # Default is "/" which makes "docker tag" fail with + # "not a valid repository/tag: invalid reference format". + separator: "-" + # Add assignees + assignees: + - "lukeheath" + +# Maintain dependencies for Dockerfiles + - package-ecosystem: "docker" + directory: "/" + schedule: + interval: "daily" + reviewers: + - "fleetdm/go" + - "fleetdm/infra" + pull-request-branch-name: + # Default is "/" which makes "docker tag" fail with + # "not a valid repository/tag: invalid reference format". + separator: "-" + # Add assignees + assignees: + - "fleetdm/go" + - "fleetdm/infra" + +# Maintain dependencies for website NPM + - package-ecosystem: "npm" + directory: "/website" + labels: + - "website" + schedule: + interval: "daily" + # Disable version updates + open-pull-requests-limit: 0 + allow: + - dependency-type: "production" + reviewers: + - "eashaw" + pull-request-branch-name: + # Default is "/" which makes "docker tag" fail with + # "not a valid repository/tag: invalid reference format". + separator: "-" + assignees: + - "eashaw" + +# Maintain dependencies for Go + - package-ecosystem: "gomod" + directory: "/" + schedule: + interval: "daily" + # Disable version updates + open-pull-requests-limit: 0 + reviewers: + - lucasmrod + pull-request-branch-name: + # Default is "/" which makes "docker tag" fail with + # "not a valid repository/tag: invalid reference format". + separator: "-" + # Add assignees + assignees: + - lucasmrod + +# Maintain dependencies for npm + - package-ecosystem: "npm" + directory: "/" + schedule: + interval: "daily" + # Disable version updates + open-pull-requests-limit: 0 + reviewers: + - lukeheath + allow: + - dependency-type: "production" + pull-request-branch-name: + # Default is "/" which makes "docker tag" fail with + # "not a valid repository/tag: invalid reference format". + separator: "-" + # Add assignees + assignees: + - lukeheath \ No newline at end of file diff --git a/.github/workflows/example-workflow.yaml b/.github/workflows/example-workflow.yaml index 75ca7e2964..5a19e87b9f 100644 --- a/.github/workflows/example-workflow.yaml +++ b/.github/workflows/example-workflow.yaml @@ -32,7 +32,7 @@ jobs: runs-on: ubuntu-latest steps: - name: Apply configuration profiles and updates - uses: fleetdm/fleet-mdm-gitops@026ee84a69cb89c869fedbe27c969bf89def418b + uses: fleetdm/fleet-mdm-gitops@15072f2739ef92c6357414ddd86e89b6bf302a2b with: FLEET_API_TOKEN: $FLEET_API_TOKEN FLEET_URL: $FLEET_URL diff --git a/changes/10102-host-script-details-api b/changes/10102-host-script-details-api new file mode 100644 index 0000000000..817ffbd35d --- /dev/null +++ b/changes/10102-host-script-details-api @@ -0,0 +1 @@ +- Added `GET /hosts/{id}/scripts` endpoint to retrieve status details of saved scripts applicable to a host. diff --git a/changes/13654-script-activity-logging b/changes/13654-script-activity-logging new file mode 100644 index 0000000000..5bbc9edcbc --- /dev/null +++ b/changes/13654-script-activity-logging @@ -0,0 +1 @@ +- Added activity logging for add, delete, and edit scripts. diff --git a/changes/bug-11314-disable-multicursor-editor b/changes/bug-11314-disable-multicursor-editor new file mode 100644 index 0000000000..b5fbb8c121 --- /dev/null +++ b/changes/bug-11314-disable-multicursor-editor @@ -0,0 +1 @@ +- Fleet UI: Disable multicursor editing for SQL editors diff --git a/changes/issue-14406-implement-script-host-details b/changes/issue-14406-implement-script-host-details new file mode 100644 index 0000000000..b900b68752 --- /dev/null +++ b/changes/issue-14406-implement-script-host-details @@ -0,0 +1 @@ +- implement scripts tab and table for host details page diff --git a/changes/issue-9829-scripts-api b/changes/issue-9829-scripts-api new file mode 100644 index 0000000000..402ad3287f --- /dev/null +++ b/changes/issue-9829-scripts-api @@ -0,0 +1,2 @@ +* Added API endpoints for script management. +* Updated the `POST /scripts/run` and `POST /scripts/run/sync` endpoints to accept an optional saved script ID instead of the script contents. diff --git a/changes/issue-9831-implement-scripts-page b/changes/issue-9831-implement-scripts-page new file mode 100644 index 0000000000..c21d40b483 --- /dev/null +++ b/changes/issue-9831-implement-scripts-page @@ -0,0 +1 @@ +- implement UI for scripts on the controls page diff --git a/cmd/fleetctl/get_test.go b/cmd/fleetctl/get_test.go index 88e612a637..1bd33060cd 100644 --- a/cmd/fleetctl/get_test.go +++ b/cmd/fleetctl/get_test.go @@ -2021,6 +2021,9 @@ func TestGetTeamsYAMLAndApply(t *testing.T) { ds.BulkSetPendingMDMAppleHostProfilesFunc = func(ctx context.Context, hostIDs, teamIDs, profileIDs []uint, uuids []string) error { return nil } + ds.BatchSetScriptsFunc = func(ctx context.Context, tmID *uint, scripts []*fleet.Script) error { + return nil + } actualYaml := runAppForTest(t, []string{"get", "teams", "--yaml"}) yamlFilePath := writeTmpYml(t, actualYaml) diff --git a/cmd/fleetctl/scripts_test.go b/cmd/fleetctl/scripts_test.go index 31ec5a3f5f..ae3267d80c 100644 --- a/cmd/fleetctl/scripts_test.go +++ b/cmd/fleetctl/scripts_test.go @@ -88,7 +88,7 @@ func TestRunScriptCommand(t *testing.T) { scriptPath: func() string { return writeTmpScriptContents(t, maxChars, ".sh") }, - expectErrMsg: `Script is too large. It’s limited to 10,000 characters (approximately 125 lines).`, + expectErrMsg: `Script is too large. It's limited to 10,000 characters (approximately 125 lines).`, }, { name: "script empty", diff --git a/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json b/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json index 35a2091761..146f64e82a 100644 --- a/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json +++ b/cmd/fleetctl/testdata/expectedGetConfigAppConfigJson.json @@ -111,6 +111,7 @@ "metadata_url": "", "idp_name": "" } - } + }, + "scripts": null } } \ No newline at end of file diff --git a/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml b/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml index dc026f027c..c6d273df1c 100644 --- a/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml +++ b/cmd/fleetctl/testdata/expectedGetConfigAppConfigYaml.yml @@ -39,6 +39,7 @@ spec: metadata: "" metadata_url: "" entity_id: "" + scripts: null org_info: org_logo_url: "" org_logo_url_light_background: "" diff --git a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json index 42a6018435..e6b915b875 100644 --- a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json +++ b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigJson.json @@ -70,6 +70,7 @@ "idp_name": "" } }, + "scripts": null, "sso_settings": { "enable_jit_provisioning": false, "enable_jit_role_sync": false, diff --git a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml index 0e5b42befe..1ddb36b944 100644 --- a/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml +++ b/cmd/fleetctl/testdata/expectedGetConfigIncludeServerConfigYaml.yml @@ -39,6 +39,7 @@ spec: metadata: "" metadata_url: "" entity_id: "" + scripts: null license: expiration: "0001-01-01T00:00:00Z" tier: free diff --git a/cmd/fleetctl/testdata/expectedGetTeamsJson.json b/cmd/fleetctl/testdata/expectedGetTeamsJson.json index 6a99943e94..c8b587d149 100644 --- a/cmd/fleetctl/testdata/expectedGetTeamsJson.json +++ b/cmd/fleetctl/testdata/expectedGetTeamsJson.json @@ -38,6 +38,7 @@ "macos_setup_assistant": null } }, + "scripts": null, "user_count": 99, "host_count": 42 } @@ -98,6 +99,7 @@ "macos_setup_assistant": null } }, + "scripts": null, "user_count": 87, "host_count": 43 } diff --git a/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml b/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml index a6905cf569..61643d07db 100644 --- a/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml +++ b/cmd/fleetctl/testdata/expectedGetTeamsYaml.yml @@ -17,6 +17,7 @@ spec: bootstrap_package: enable_end_user_authentication: false macos_setup_assistant: + scripts: null name: team1 --- apiVersion: v1 @@ -46,4 +47,5 @@ spec: bootstrap_package: enable_end_user_authentication: false macos_setup_assistant: + scripts: null name: team2 diff --git a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml index 5f25121e3b..c48bef7a3e 100644 --- a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml +++ b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigEmpty.yml @@ -39,6 +39,7 @@ spec: metadata: "" metadata_url: "" entity_id: "" + scripts: null org_info: org_logo_url: "" org_logo_url_light_background: "" diff --git a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml index 4b2fd0c151..05207bb30e 100644 --- a/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml +++ b/cmd/fleetctl/testdata/macosSetupExpectedAppConfigSet.yml @@ -39,6 +39,7 @@ spec: metadata: "" metadata_url: "" entity_id: "" + scripts: null org_info: org_logo_url: "" org_logo_url_light_background: "" diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml index a3668e64b3..4c50064fa2 100644 --- a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml +++ b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Empty.yml @@ -17,6 +17,7 @@ spec: macos_updates: deadline: null minimum_version: null + scripts: null name: tm1 --- apiVersion: v1 @@ -36,4 +37,5 @@ spec: macos_updates: deadline: null minimum_version: null + scripts: null name: tm2 diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml index 95e49d0321..0af52083b2 100644 --- a/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml +++ b/cmd/fleetctl/testdata/macosSetupExpectedTeam1And2Set.yml @@ -17,6 +17,7 @@ spec: macos_updates: deadline: null minimum_version: null + scripts: null name: tm1 --- apiVersion: v1 @@ -36,4 +37,5 @@ spec: macos_updates: deadline: null minimum_version: null + scripts: null name: tm2 diff --git a/cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml b/cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml index 8ad10fc6c5..a32bec16f3 100644 --- a/cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml +++ b/cmd/fleetctl/testdata/macosSetupExpectedTeam1Empty.yml @@ -17,5 +17,6 @@ spec: macos_updates: deadline: null minimum_version: null + scripts: null name: tm1 diff --git a/docs/Configuration/configuration-files/README.md b/docs/Configuration/configuration-files/README.md index 8b8f34b8cf..f5a7ed2765 100644 --- a/docs/Configuration/configuration-files/README.md +++ b/docs/Configuration/configuration-files/README.md @@ -246,6 +246,9 @@ spec: - path/to/profile1.mobileconfig - path/to/profile2.mobileconfig enable_disk_encryption: true + scripts: + - path/to/script1.sh + - path/to/script2.sh ``` ### Team agent options @@ -329,6 +332,23 @@ spec: # the team-specific mdm options go here ``` +### Team scripts + +List of saved scripts that can be run on hosts that are part of the team. + +- Default value: none +- Config file format: + ```yaml +apiVersion: v1 +kind: team +spec: + team: + name: Client Platform Engineering + scripts: + - path/to/script1.sh + - path/to/script2.sh + ``` + ## Organization settings The `config` YAML file controls Fleet's organization settings and MDM features for hosts assigned to "No team." @@ -1147,6 +1167,20 @@ If you're using Fleet Premium, this enforces disk encryption on all hosts assign enable_disk_encryption: true ``` +#### Scripts + +List of saved scripts that can be run on all hosts. + +> If you want to add scripts to hosts on a specific team in Fleet, use the `team` YAML document. Learn how to create one [here](#teams). + +- Default value: none +- Config file format: + ```yaml + scripts: + - path/to/script1.sh + - path/to/script2.sh + ``` + #### Advanced configuration > **Note:** More settings are included in the [contributor documentation](https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Configuration-for-contributors.md). It's possible, although not recommended, to configure these settings in the YAML configuration file. diff --git a/docs/Configuration/fleet-server-configuration.md b/docs/Configuration/fleet-server-configuration.md index 250d5c6b17..588b000217 100644 --- a/docs/Configuration/fleet-server-configuration.md +++ b/docs/Configuration/fleet-server-configuration.md @@ -2945,11 +2945,11 @@ This content was moved to [Proxies](http://fleetdm.com/docs/deploy/proxies) on S
- Upload scripts to change configuration and remediate issues on macOS
- hosts. Each script runs once per host. All scripts can be rerun on end
- users’ My device page.
+ Upload scripts to change configuration and remediate issues on macOS
+ hosts. You can run scripts on individual hosts.{" "}
+
@@ -34,7 +49,7 @@ const DeleteScriptModal = ({