feat(datastore): PostgreSQL dual-database support (dialect + rebind driver)

.custom-gcl.yml

@@ -1,7 +1,7 @@
 # This configures how golangci-lint builds a custom build, wich is necessary to use nilaway as a plugin per https://github.com/uber-go/nilaway?tab=readme-ov-file#golangci-lint--v1570
 
 # This has to be >= v1.57.0 for module plugin system support.
-version: v2.7.1
+version: v2.11.3
 plugins:
   - module: "go.uber.org/nilaway"
     import: "go.uber.org/nilaway/cmd/gclplugin"

.github/workflows/build-kencove.yml

@@ -0,0 +1,120 @@
+name: Build & Push Kencove Fleet Image
+
+on:
+  push:
+    branches: [kencove]
+    tags:
+      - 'fleet-v*'
+    paths:
+      - 'cmd/**'
+      - 'ee/**'
+      - 'server/**'
+      - 'frontend/**'
+      - 'orbit/**'
+      - 'pkg/**'
+      - 'go.mod'
+      - 'go.sum'
+      - 'package.json'
+      - 'yarn.lock'
+      - 'webpack.config.js'
+      - 'Dockerfile'
+      - '.github/workflows/build-kencove.yml'
+  pull_request:
+    branches: [kencove]
+    paths:
+      - 'cmd/**'
+      - 'ee/**'
+      - 'server/**'
+      - 'frontend/**'
+      - 'orbit/**'
+      - 'pkg/**'
+      - 'go.mod'
+      - 'go.sum'
+      - 'package.json'
+      - 'yarn.lock'
+      - 'webpack.config.js'
+      - 'Dockerfile'
+      - '.github/workflows/build-kencove.yml'
+  # Tag pushes ignore paths filter per GitHub docs, so fleet-v* tags always build.
+  # For branch and PR pushes, only source code changes trigger a rebuild.
+  workflow_dispatch:
+
+env:
+  REGION: us-central1
+  PROJECT_ID: kencove-prod
+  REPOSITORY: kencove-docker-repo
+  IMAGE_NAME: fleet
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      id-token: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Derive Fleet version and image tag
+        id: version
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/fleet-v* ]]; then
+            BASE_TAG="${GITHUB_REF#refs/tags/}"
+          else
+            BASE_TAG=$(git describe --tags --match 'fleet-v*' --abbrev=0 2>/dev/null || echo "fleet-vdev")
+          fi
+          FLEET_VERSION="${BASE_TAG#fleet-}"
+          echo "fleet_version=${FLEET_VERSION}" >> "$GITHUB_OUTPUT"
+
+          # PR builds get a pr-N tag; branch/tag builds get the release tag + latest
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            IMAGE_TAG="${FLEET_VERSION}-kencove-pr${{ github.event.number }}"
+            echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
+            echo "extra_tags=" >> "$GITHUB_OUTPUT"
+          else
+            IMAGE_TAG="${FLEET_VERSION}-kencove"
+            echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
+            EXTRA="${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.IMAGE_NAME }}:latest"
+            echo "extra_tags=${EXTRA}" >> "$GITHUB_OUTPUT"
+          fi
+          echo "Fleet version: ${FLEET_VERSION}, image tag: ${IMAGE_TAG}"
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: 'projects/103143301688/locations/global/workloadIdentityPools/github-wlif/providers/github-oidc'
+          service_account: 'github-actions-seer@kencove-prod.iam.gserviceaccount.com'
+
+      - uses: google-github-actions/setup-gcloud@v2
+
+      - name: Configure Docker for Artifact Registry
+        run: gcloud auth configure-docker ${{ env.REGION }}-docker.pkg.dev --quiet
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build image tags
+        id: tags
+        run: |
+          TAGS="${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.image_tag }}"
+          if [[ -n "${{ steps.version.outputs.extra_tags }}" ]]; then
+            TAGS="${TAGS},${{ steps.version.outputs.extra_tags }}"
+          fi
+          echo "tags=${TAGS}" >> "$GITHUB_OUTPUT"
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: ${{ steps.tags.outputs.tags }}
+          build-args: |
+            FLEET_VERSION=${{ steps.version.outputs.fleet_version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Output image info
+        run: |
+          echo "## Build Complete" >> $GITHUB_STEP_SUMMARY
+          echo "Image: \`${{ env.REGION }}-docker.pkg.dev/${{ env.PROJECT_ID }}/${{ env.REPOSITORY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.image_tag }}\`" >> $GITHUB_STEP_SUMMARY

.github/workflows/build-ledo.yml

@@ -0,0 +1,80 @@
+name: Build & Push Ledo Fleet Image
+
+on:
+  push:
+    branches: [ledoent]
+    tags:
+      - 'fleet-v*'
+    paths:
+      - 'cmd/**'
+      - 'ee/**'
+      - 'server/**'
+      - 'frontend/**'
+      - 'orbit/**'
+      - 'pkg/**'
+      - 'go.mod'
+      - 'go.sum'
+      - 'package.json'
+      - 'yarn.lock'
+      - 'webpack.config.js'
+      - 'Dockerfile'
+      - '.github/workflows/build-ledo.yml'
+  workflow_dispatch:
+
+env:
+  REGISTRY: ghcr.io
+  IMAGE_NAME: ledoent/fleet
+
+jobs:
+  build-and-push:
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      packages: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Derive Fleet version and image tag
+        id: version
+        run: |
+          if [[ "$GITHUB_REF" == refs/tags/fleet-v* ]]; then
+            BASE_TAG="${GITHUB_REF#refs/tags/}"
+          else
+            BASE_TAG=$(git describe --tags --match 'fleet-v*' --abbrev=0 2>/dev/null || echo "fleet-vdev")
+          fi
+          FLEET_VERSION="${BASE_TAG#fleet-}"
+          IMAGE_TAG="${FLEET_VERSION}-ledo"
+          echo "fleet_version=${FLEET_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "image_tag=${IMAGE_TAG}" >> "$GITHUB_OUTPUT"
+          echo "Fleet version: ${FLEET_VERSION}, image tag: ${IMAGE_TAG}"
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: docker/setup-buildx-action@v3
+
+      - name: Build and push
+        uses: docker/build-push-action@v6
+        with:
+          context: .
+          push: true
+          tags: |
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.image_tag }}
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          build-args: |
+            FLEET_VERSION=${{ steps.version.outputs.fleet_version }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Output image info
+        run: |
+          echo "## Build Complete" >> $GITHUB_STEP_SUMMARY
+          echo "Image: \`${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ steps.version.outputs.image_tag }}\`" >> $GITHUB_STEP_SUMMARY

.github/workflows/build-orbit.yaml

@@ -31,6 +31,7 @@ permissions:
 
 jobs:
   build:
+    if: github.repository == 'fleetdm/fleet'
     runs-on: macos-latest
     steps:
       - name: Harden Runner

.github/workflows/dogfood-gitops.yml

@@ -30,6 +30,7 @@ permissions:
 
 jobs:
   fleet-gitops:
+    if: github.repository == 'fleetdm/fleet'
     timeout-minutes: 10
     runs-on: ubuntu-latest
     steps:
@@ -82,6 +83,8 @@ jobs:
           DOGFOOD_END_USER_SSO_METADATA: ${{ secrets.DOGFOOD_END_USER_SSO_METADATA }}
           DOGFOOD_TESTING_AND_QA_ENROLL_SECRET: ${{ secrets.DOGFOOD_TESTING_AND_QA_ENROLL_SECRET }}
           DOGFOOD_OKTA_CA_CERTIFICATE: ${{ secrets.DOGFOOD_OKTA_CA_CERTIFICATE }}
+          DOGFOOD_OKTA_ANDROID_MANAGEMENT_HINT: ${{ secrets.DOGFOOD_OKTA_ANDROID_MANAGEMENT_HINT }}
+          DOGFOOD_OKTA_IOS_MANAGEMENT_HINT: ${{ secrets.DOGFOOD_OKTA_IOS_MANAGEMENT_HINT }}
           DOGFOOD_OKTA_VERIFY_WINDOWS_URL: ${{ secrets.DOGFOOD_OKTA_VERIFY_WINDOWS_URL }}
           DOGFOOD_ENTRA_TENANT_ID: ${{ secrets.DOGFOOD_ENTRA_TENANT_ID }}
           DOGFOOD_OKTA_METADATA_URL_ADMINS: ${{ secrets.DOGFOOD_OKTA_METADATA_URL_ADMINS }}

.github/workflows/fleet-and-orbit.yml

@@ -39,6 +39,7 @@ permissions:
 
 jobs:
   gen:
+    if: github.repository == 'fleetdm/fleet'
     runs-on: ubuntu-latest
     outputs:
       subdomain: ${{ steps.gen.outputs.subdomain }}
@@ -61,6 +62,7 @@ jobs:
           echo "enroll_secret=$ENROLL" >> $GITHUB_OUTPUT
 
   run-server:
+    if: github.repository == 'fleetdm/fleet'
     timeout-minutes: 60
     strategy:
       matrix:
@@ -178,6 +180,7 @@ jobs:
   #
   # This job also makes sure the Fleet server is up and running.
   set-enroll-secret:
+    if: github.repository == 'fleetdm/fleet'
     timeout-minutes: 60
     runs-on: ubuntu-latest
     needs: gen
@@ -219,6 +222,7 @@ jobs:
   # Here we generate the Fleet Desktop and osqueryd targets for
   # macOS which can only be generated from a macOS host.
   build-macos-targets:
+    if: github.repository == 'fleetdm/fleet'
     # Set macOS version to '14' for building the binary as Fleet's minimum supported macOS version.
     runs-on: macos-14
     steps:
@@ -261,6 +265,7 @@ jobs:
   # We run this job in ubuntu because Github macOS runner doesn't have Docker
   # installed, and installing it is time consuming and unreliable.
   run-tuf-and-gen-pkgs:
+    if: github.repository == 'fleetdm/fleet'
     timeout-minutes: 60
     runs-on: ubuntu-latest
     needs: [gen, build-macos-targets]
@@ -328,6 +333,7 @@ jobs:
             fleet-osquery.msi
 
   orbit-macos:
+    if: github.repository == 'fleetdm/fleet'
     timeout-minutes: 60
     runs-on: macos-latest
     needs: [gen, run-tuf-and-gen-pkgs]
@@ -390,6 +396,7 @@ jobs:
           sudo ./it-and-security/lib/macos/scripts/uninstall-fleetd-macos.sh
 
   orbit-ubuntu:
+    if: github.repository == 'fleetdm/fleet'
     timeout-minutes: 60
     runs-on: ubuntu-latest
     needs: [gen, run-tuf-and-gen-pkgs]
@@ -449,6 +456,7 @@ jobs:
           sudo apt remove fleet-osquery -y
 
   orbit-windows:
+    if: github.repository == 'fleetdm/fleet'
     timeout-minutes: 60
     needs: [gen, run-tuf-and-gen-pkgs]
     runs-on: windows-latest

.github/workflows/golangci-lint.yml

@@ -73,7 +73,7 @@ jobs:
         run: |
           # Don't forget to update
           # docs/Contributing/Testing-and-local-development.md when this version changes
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@a4b55ebc3471c9fbb763fd56eefede8050f99887 # v2.7.1
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@6008b81b81c690c046ffc3fd5bce896da715d5fd # v2.11.3
           SKIP_INCREMENTAL=1 make lint-go
 
       - name: Run cloner-check tool
@@ -136,7 +136,7 @@ jobs:
         run: |
           # Don't forget to update
           # docs/Contributing/Testing-and-local-development.md when this version changes
-          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@a4b55ebc3471c9fbb763fd56eefede8050f99887 # v2.7.1
+          go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@6008b81b81c690c046ffc3fd5bce896da715d5fd # v2.11.3
           # custom build of golangci-lint that incorporates nilaway - see .custom-gcl.yml
           golangci-lint custom
           ./custom-gcl run -c .golangci-incremental.yml --new-from-rev=origin/${{ github.base_ref }} --timeout 15m ./...