chore: cherry pick release 1.3 fixes

.github/workflows/ci.yml

@@ -7,13 +7,16 @@ on:
     branches: [ main, 'release/**' ]
 
 env:
-  GO_VERSION: '1.26.3'
+  GO_VERSION: '1.26.4'
   GOFLAGS: '-trimpath'
 
+permissions:
+  contents: read
+
 jobs:
   secret-detection:
     name: Secret Detection
-    runs-on: [self-hosted, rocky8]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -53,7 +56,7 @@ jobs:
 
   lint:
     name: Lint
-    runs-on: [self-hosted, rocky8]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -91,7 +94,7 @@ jobs:
 
   unit_test:
     name: Unit Tests
-    runs-on: [self-hosted, rocky8]
+    runs-on: ubuntu-latest
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -121,7 +124,7 @@ jobs:
 
   build_check:
     name: Build Check
-    runs-on: [self-hosted, rocky8]
+    runs-on: ubuntu-latest
     needs: [lint]
     strategy:
       matrix:
@@ -139,6 +142,12 @@ jobs:
       - name: Download dependencies
         run: go mod download
 
+      - name: Install ARM64 cross compiler
+        if: matrix.goarch == 'arm64'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu
+
       - name: Clean previous build artifacts
         run: |
           rm -f fleetint-${{ matrix.goos }}-${{ matrix.goarch }} || true
@@ -168,45 +177,13 @@ jobs:
           path: fleetint-${{ matrix.goos }}-${{ matrix.goarch }}
           retention-days: 7
 
-  sonarqube:
-    name: SonarQube Analysis
-    runs-on: [self-hosted, rocky8]
-    needs: [unit_test]
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0  # Shallow clones should be disabled for better relevancy of analysis
-
-      - name: Set up Go
-        uses: actions/setup-go@v4
-        with:
-          go-version: ${{ env.GO_VERSION }}
-
-      - name: Download dependencies
-        run: go mod download
-
-      - name: Run unit tests with coverage
-        run: make test
-
-      - name: SonarQube Scan
-        uses: SonarSource/sonarqube-scan-action@v7
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-          SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
-
-      # Optional: Fail the job if the Quality Gate fails
-      # Uncomment if you want to enforce quality gate in CI
-      # - name: SonarQube Quality Gate check
-      #   uses: SonarSource/sonarqube-quality-gate-action@v1
-      #   timeout-minutes: 5
-      #   env:
-      #     SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-
-  package_snapshot:
-    name: Package Snapshot
-    runs-on: [self-hosted, rocky8]
-    needs: [unit_test, build_check]
+  codeql:
+    name: CodeQL Analysis
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -221,26 +198,18 @@ jobs:
       - name: Download dependencies
         run: go mod download
 
-      - name: Clean previous dist directory
-        run: |
-          rm -rf ./dist || true
-
-      - name: Run GoReleaser snapshot
-        uses: goreleaser/goreleaser-action@v5
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
         with:
-          distribution: goreleaser
-          version: v2.4.1
-          args: release --snapshot --clean --config .goreleaser.yaml
+          languages: go
+          build-mode: manual
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          CODEQL_EXTRACTOR_GO_BUILD_TRACING: on
 
-      - name: Upload snapshot packages
-        uses: actions/upload-artifact@v4
+      - name: Build with CodeQL
+        run: go build ./...
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
         with:
-          name: snapshot-packages
-          path: |
-            dist/*.deb
-            dist/*.rpm
-            dist/*.tar.gz
-            dist/checksums.txt
-          retention-days: 7
+          category: "/language:go"

.github/workflows/release.yml

@@ -6,7 +6,7 @@ on:
       - 'v*'  # Triggers on version tags like v1.0.0, v2.1.3, etc.
 
 env:
-  GO_VERSION: '1.26.3'
+  GO_VERSION: '1.26.4'
 
 permissions:
   contents: write  # Needed for creating GitHub releases
@@ -61,6 +61,7 @@ jobs:
         run: |
           VERSION=${GITHUB_REF#refs/tags/v}
           COMMIT_SHORT=$(git rev-parse --short=7 HEAD)
+          BUILD_TIMESTAMP=$(git show -s --format=%cI HEAD)
           BRANCH="release"
           SOURCE="https://github.com/${{ github.repository }}/archive/refs/tags/${{ github.ref_name }}.tar.gz"
 
@@ -75,24 +76,11 @@ jobs:
 
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "commit=$COMMIT_SHORT" >> $GITHUB_OUTPUT
+          echo "build_timestamp=$BUILD_TIMESTAMP" >> $GITHUB_OUTPUT
           echo "branch=$BRANCH" >> $GITHUB_OUTPUT
           echo "source=$SOURCE" >> $GITHUB_OUTPUT
           echo "is_prerelease=$IS_PRERELEASE" >> $GITHUB_OUTPUT
 
-      - name: Prepare fleet-intelligence-agent image tags
-        id: agent_image
-        run: |
-          set -euo pipefail
-          VERSION="${{ steps.version.outputs.version }}"
-          IMAGE="nvcr.io/0753215517602916/agent-artifact/fleet-intelligence-agent"
-          echo "image=${IMAGE}" >> "$GITHUB_OUTPUT"
-          echo "tags<<EOF" >> "$GITHUB_OUTPUT"
-          echo "${IMAGE}:${VERSION}" >> "$GITHUB_OUTPUT"
-          if [ "${{ steps.version.outputs.is_prerelease }}" = "false" ]; then
-            echo "${IMAGE}:latest" >> "$GITHUB_OUTPUT"
-          fi
-          echo "EOF" >> "$GITHUB_OUTPUT"
-
       - name: Prepare fleet-intelligence-agent GHCR image tags
         id: agent_image_ghcr
         run: |
@@ -115,13 +103,6 @@ jobs:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
 
-      - name: Login to NVCR (nvcr.io)
-        uses: docker/login-action@v3
-        with:
-          registry: nvcr.io
-          username: $oauthtoken
-          password: ${{ secrets.NVCR_API_KEY }}
-
       - name: Login to GHCR (ghcr.io)
         uses: docker/login-action@v3
         with:
@@ -137,12 +118,11 @@ jobs:
           platforms: linux/amd64,linux/arm64
           push: true
           tags: |
-            ${{ steps.agent_image.outputs.tags }}
             ${{ steps.agent_image_ghcr.outputs.tags }}
           build-args: |
             VERSION=${{ steps.version.outputs.version }}
             REVISION=${{ steps.version.outputs.commit }}
-            BUILD_TIMESTAMP=${{ github.event.head_commit.timestamp }}
+            BUILD_TIMESTAMP=${{ steps.version.outputs.build_timestamp }}
 
       - name: Package Helm chart
         run: |
@@ -151,31 +131,6 @@ jobs:
             --version "${{ steps.version.outputs.version }}" \
             --app-version "${{ steps.version.outputs.version }}"
 
-      - name: Ensure Helm push plugin is installed
-        run: |
-          set -euo pipefail
-          if helm plugin list | awk '{print $1}' | grep -qx 'cm-push'; then
-            echo "helm-push plugin already installed"
-          else
-            helm plugin install https://github.com/chartmuseum/helm-push
-          fi
-
-      - name: Add NGC Helm repo
-        env:
-          NGC_API_KEY: ${{ secrets.NVCR_API_KEY }}
-        run: |
-          set -euo pipefail
-          helm repo remove ngc || true
-          helm repo add ngc https://helm.ngc.nvidia.com/0753215517602916/agent-artifact \
-            --username '$oauthtoken' \
-            --password "${NGC_API_KEY}"
-
-      - name: Push Helm chart to NGC Helm repo
-        run: |
-          set -euo pipefail
-          CHART_VERSION="${{ steps.version.outputs.version }}"
-          helm cm-push "dist/fleet-intelligence-agent-${CHART_VERSION}.tgz" ngc
-
       - name: Login to GHCR Helm registry
         run: |
           set -euo pipefail
@@ -234,13 +189,8 @@ jobs:
           echo "**Pre-release:** ${{ steps.version.outputs.is_prerelease }}" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "**fleet-intelligence-agent image tags:**" >> $GITHUB_STEP_SUMMARY
-          echo "${{ steps.agent_image.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
           echo "${{ steps.agent_image_ghcr.outputs.tags }}" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Helm chart (NGC Helm repo):**" >> $GITHUB_STEP_SUMMARY
-          echo "repo: https://helm.ngc.nvidia.com/0753215517602916/agent-artifact" >> $GITHUB_STEP_SUMMARY
-          echo "chart: fleet-intelligence-agent-${{ steps.version.outputs.version }}.tgz" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
           echo "**Helm chart (GHCR OCI):**" >> $GITHUB_STEP_SUMMARY
           echo "repo: oci://ghcr.io/${{ steps.agent_image_ghcr.outputs.owner_lc }}/charts" >> $GITHUB_STEP_SUMMARY
           echo "chart: fleet-intelligence-agent:${{ steps.version.outputs.version }}" >> $GITHUB_STEP_SUMMARY

.golangci.yml

@@ -1,6 +1,6 @@
 version: "2"
 run:
-  go: 1.26.3
+  go: 1.26.4
 linters:
   default: none
   enable:

.goreleaser.yaml

@@ -74,12 +74,13 @@ nfpms:
     bindir: /usr/bin
     contents:
       # License and notices
+      - src: LICENSE
+        dst: /usr/share/doc/fleetint/copyright
       - src: NOTICE
         dst: /usr/share/doc/fleetint/NOTICE
       # SystemD service file
       - src: deployments/packages/systemd/fleetintd.service
         dst: /usr/lib/systemd/system/fleetintd.service
-        type: config|noreplace
       # Environment configuration
       - src: deployments/packages/systemd/fleetint.env
         dst: /etc/default/fleetint
@@ -88,12 +89,12 @@ nfpms:
       - dst: /var/lib/fleetint
         type: dir
         file_info:
-          mode: 0755
+          mode: 0700
     scripts:
-      preinstall: deployments/packages/scripts/preinst
-      postinstall: deployments/packages/scripts/postinst
-      preremove: deployments/packages/scripts/prerm
-      postremove: deployments/packages/scripts/postrm
+      preinstall: deployments/packages/scripts/deb/preinst
+      postinstall: deployments/packages/scripts/deb/postinst
+      preremove: deployments/packages/scripts/deb/prerm
+      postremove: deployments/packages/scripts/deb/postrm
 
   - id: fleetint-rpm
     package_name: fleetint
@@ -113,12 +114,13 @@ nfpms:
     bindir: /usr/bin
     contents:
       # License and notices
+      - src: LICENSE
+        dst: /usr/share/licenses/fleetint/LICENSE
       - src: NOTICE
         dst: /usr/share/doc/fleetint/NOTICE
       # SystemD service file
       - src: deployments/packages/systemd/fleetintd.service
         dst: /usr/lib/systemd/system/fleetintd.service
-        type: config|noreplace
       # Environment configuration (RPM uses /etc/default like Debian)
       - src: deployments/packages/systemd/fleetint.env
         dst: /etc/default/fleetint
@@ -127,12 +129,12 @@ nfpms:
       - dst: /var/lib/fleetint
         type: dir
         file_info:
-          mode: 0755
+          mode: 0700
     scripts:
-      preinstall: deployments/packages/scripts/preinst
-      postinstall: deployments/packages/scripts/postinst
-      preremove: deployments/packages/scripts/prerm
-      postremove: deployments/packages/scripts/postrm
+      preinstall: deployments/packages/scripts/rpm/preinstall
+      postinstall: deployments/packages/scripts/rpm/postinstall
+      preremove: deployments/packages/scripts/rpm/preremove
+      postremove: deployments/packages/scripts/rpm/postremove
 
 # Checksum configuration
 checksum:

CONTRIBUTING.md

@@ -7,7 +7,7 @@ Please start all enhancement, bugfix, or change requests by opening a GitHub iss
 ## Development
 
 ### Prerequisites
-- Go 1.24+ (see `go.mod`)
+- Go 1.26.4+ (see `go.mod`)
 - Make
 - golangci-lint (optional locally, required in CI)
 

Dockerfile

@@ -1,6 +1,6 @@
 ARG DCGM_VERSION="4.4.2-1-ubuntu22.04"
 
-FROM golang:1.26.3 AS build
+FROM golang:1.26.4 AS build
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     ca-certificates \

Dockerfile.citests

@@ -16,7 +16,7 @@
 # Run specific package tests:
 #   docker run --rm fleet-intelligence-agent:test go test -v ./internal/...
 #
-FROM golang:1.26.3
+FROM golang:1.26.4
 
 ARG TARGETARCH
 

deployments/helm/fleet-intelligence-agent/templates/daemonset.yaml

@@ -101,6 +101,9 @@ spec:
           volumeMounts:
             - name: dev
               mountPath: /dev
+            - name: sys
+              mountPath: /sys
+              readOnly: true
             - name: state
               mountPath: /var/lib/fleetint
       {{- else if .Values.enroll.unenroll }}