feat(pg): PostgreSQL datastore compatibility layer

.claude/CLAUDE.md

@@ -35,6 +35,14 @@ The following terms were recently renamed. Use the new terms in conversation and
 
 Go and API conventions (ctxerr error wrapping, error types, request/response structs, auth, slog, `new(expression)` pointers, endpoint registration) auto-load from `.claude/rules/` when you edit matching files — see `rules/fleet-go-backend.md`, `rules/fleet-api.md`, and `rules/fleet-database.md`. Reference example: `server/service/vulnerabilities.go`.
 
+## Writing migrations
+
+- Bulk UPDATE/DELETE steps in migrations must be batched (see
+  `incrementalMigrationStep` in `migrations/tables/`) — an unbatched
+  full-table statement holds locks for the whole run on large deployments.
+- Avoid MySQL-only `UPDATE/DELETE ... LIMIT n`; use a keyed-subquery batch
+  (the PG driver rejects the LIMIT form).
+
 ## Before writing a fix
 
 - Identify WHERE in the request lifecycle the problem manifests (creation vs team-addition vs sync vs query). Fix it there, not at the reproduction step.

.github/actions/gitops/action.yml

@@ -0,0 +1,92 @@
+name: fleetctl-gitops
+description: Runs fleetctl gitops to apply configuration to Fleet
+# Schema: https://json.schemastore.org/github-action.json
+
+# This action expects the following env vars to be set:
+# - FLEET_URL: The URL of the Fleet server to apply configuration to.
+# - FLEET_API_TOKEN: An API token for a Fleet GitOps user.
+#
+# Optional:
+# - FLEET_GITOPS_DIR: The directory containing the GitOps config (default.yml,
+#   fleets/*.yml). Defaults to the current directory.
+# - FLEET_CUSTOM_HEADERS: Comma-separated "Header:Value" pairs (e.g. a Cloudflare
+#   Access service token) sent on every request to the Fleet server.
+
+inputs:
+  working-directory:
+    description: 'The working directory, which should be the root of the repository.'
+    default: './'
+  dry-run-only:
+    description: 'Whether to only run the fleetctl gitops commands in dry-run mode.'
+    default: 'false'
+  delete-other-fleets:
+    description: 'Whether to delete other fleets in Fleet which are not part of the gitops config.'
+    default: 'true'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install fleetctl
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        FLEET_URL="${FLEET_URL%/}"
+
+        # Build optional custom request headers from FLEET_CUSTOM_HEADERS, a comma-separated
+        # list of "Header:Value" pairs (e.g. a Cloudflare Access service token). Empty by default.
+        CURL_HEADER_ARGS=()
+        if [[ -n "${FLEET_CUSTOM_HEADERS:-}" ]]; then
+          IFS=',' read -ra _CUSTOM_HEADERS <<< "$FLEET_CUSTOM_HEADERS"
+          for _header in "${_CUSTOM_HEADERS[@]}"; do
+            CURL_HEADER_ARGS+=(--header "$_header")
+          done
+        fi
+
+        FLEET_VERSION="$(curl "$FLEET_URL/api/v1/fleet/version" --header "Authorization: Bearer $FLEET_API_TOKEN" "${CURL_HEADER_ARGS[@]}" --fail --silent | jq --raw-output '.version')"
+        DEFAULT_FLEETCTL_VERSION="latest"
+
+        # Decide which fleetctl version to install:
+        # If the server returns a clean version (e.g. 4.74.0), use that.
+        # If the server returns a snapshot (e.g. 0.0.0-SNAPSHOT-xxxxx) or is empty, pin to DEFAULT_FLEETCTL_VERSION.
+        if [[ -z "$FLEET_VERSION" ]]; then
+          INSTALL_VERSION="$DEFAULT_FLEETCTL_VERSION"
+        elif [[ "$FLEET_VERSION" == 0.0.0-SNAPSHOT* ]]; then
+          INSTALL_VERSION="$DEFAULT_FLEETCTL_VERSION"
+        elif [[ "$FLEET_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+          INSTALL_VERSION="$FLEET_VERSION"
+        else
+          # Strip anything after + (e.g. 4.81.0+foobar -> 4.81.0)
+          FLEET_VERSION="${FLEET_VERSION%%\+*}"
+          if [[ "$FLEET_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
+            INSTALL_VERSION="$FLEET_VERSION"
+          else
+            INSTALL_VERSION="$DEFAULT_FLEETCTL_VERSION"
+          fi
+        fi
+
+        echo "Installing fleetctl v$INSTALL_VERSION..."
+        npm install -g "fleetctl@$INSTALL_VERSION" || npm install -g fleetctl@latest
+
+    - name: Configure fleetctl
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      run: |
+        # Build optional custom request headers from FLEET_CUSTOM_HEADERS, a comma-separated
+        # list of "Header:Value" pairs. fleetctl persists them and sends them on every request,
+        # so the gitops commands below use them too.
+        CUSTOM_HEADER_ARGS=()
+        if [[ -n "${FLEET_CUSTOM_HEADERS:-}" ]]; then
+          IFS=',' read -ra _CUSTOM_HEADERS <<< "$FLEET_CUSTOM_HEADERS"
+          for _header in "${_CUSTOM_HEADERS[@]}"; do
+            CUSTOM_HEADER_ARGS+=(--custom-header "$_header")
+          done
+        fi
+        fleetctl config set --address "$FLEET_URL" --token "$FLEET_API_TOKEN" "${CUSTOM_HEADER_ARGS[@]}"
+
+    - name: Run fleetctl gitops commands
+      shell: bash
+      working-directory: ${{ inputs.working-directory }}
+      env:
+        FLEET_DRY_RUN_ONLY: ${{ inputs.dry-run-only }}
+        FLEET_DELETE_OTHER_FLEETS: ${{ inputs.delete-other-fleets }}
+      run: bash "$GITHUB_ACTION_PATH/gitops.sh"

.github/actions/gitops/gitops.sh

@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+
+# -e: Immediately exit if any command has a non-zero exit status.
+# -x: Print all executed commands to the terminal.
+# -u: Exit if an undefined variable is used.
+# -o pipefail: Exit if any command in a pipeline fails.
+set -exuo pipefail
+
+FLEET_GITOPS_DIR="${FLEET_GITOPS_DIR:-.}"
+FLEET_GLOBAL_FILE="${FLEET_GLOBAL_FILE:-$FLEET_GITOPS_DIR/default.yml}"
+FLEETCTL="${FLEETCTL:-fleetctl}"
+FLEET_DRY_RUN_ONLY="${FLEET_DRY_RUN_ONLY:-false}"
+FLEET_DELETE_OTHER_FLEETS="${FLEET_DELETE_OTHER_FLEETS:-true}"
+
+# Check for existence of the global file in case the script is used
+# on repositories with fleet only yamls.
+if [ -f "$FLEET_GLOBAL_FILE" ]; then
+	# Validate that global file contains org_settings
+	grep -Exq "^org_settings:.*" "$FLEET_GLOBAL_FILE"
+else
+	FLEET_DELETE_OTHER_FLEETS=false
+fi
+
+# If you are using secrets to manage SSO metadata for Fleet SSO login or MDM SSO login, uncomment the below:
+
+# FLEET_SSO_METADATA=$( sed '2,$s/^/      /' <<<  "${FLEET_MDM_SSO_METADATA}")
+# FLEET_MDM_SSO_METADATA=$( sed '2,$s/^/        /' <<<  "${FLEET_MDM_SSO_METADATA}")
+
+# Copy/pasting raw SSO metadata into GitHub secrets will result in malformed yaml.
+# Adds spaces to all but the first line of metadata keeps the  multiline string in bounds.
+
+if compgen -G "$FLEET_GITOPS_DIR"/fleets/*.yml > /dev/null; then
+  # Validate that every fleet has a unique name.
+  # This is a limited check that assumes all fleet files contain the phrase: `name: <fleet_name>`
+  ! perl -nle 'print $1 if /^name:\s*(.+)$/' "$FLEET_GITOPS_DIR"/fleets/*.yml | sort | uniq -d | grep . -cq
+fi
+
+args=()
+if [ -f "$FLEET_GLOBAL_FILE" ]; then
+	args=(-f "$FLEET_GLOBAL_FILE")
+fi
+
+for fleet_file in "$FLEET_GITOPS_DIR"/fleets/*.yml; do
+  if [ -f "$fleet_file" ]; then
+    args+=(-f "$fleet_file")
+  fi
+done
+if [ "$FLEET_DELETE_OTHER_FLEETS" = true ]; then
+  args+=(--delete-other-fleets)
+fi
+
+# Dry run
+$FLEETCTL gitops "${args[@]}" --dry-run
+if [ "$FLEET_DRY_RUN_ONLY" = true ]; then
+  exit 0
+fi
+
+# Real run
+$FLEETCTL gitops "${args[@]}"

.github/workflows/dependency-review.yml

@@ -15,6 +15,10 @@ permissions:
 jobs:
   dependency-review:
     runs-on: ubuntu-latest
+    # actions/dependency-review-action requires GitHub Advanced Security on
+    # private repos. Skip on private mirrors (e.g. ledoent/fleet); upstream
+    # public fleetdm/fleet still runs the check.
+    if: ${{ !github.event.repository.private }}
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4

.github/workflows/dogfood-gitops.yml

@@ -43,18 +43,9 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Checkout GitOps repository
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
-        with:
-          repository: fleetdm/fleet-gitops
-          ref: main
-          path: fleet-gitops
-          persist-credentials: false
-
       - name: Apply latest configuration to Fleet
-        uses: ./fleet-gitops/.github/gitops-action-fleets
+        uses: ./.github/actions/gitops
         with:
-          working-directory: ${{ github.workspace }}/fleet-gitops
           dry-run-only: ${{ github.event_name == 'pull_request' && 'true' || 'false' }}
         env:
           FLEET_GITOPS_DIR: ${{ github.workspace }}/it-and-security