Deleting a label from scope on a configuration profile via GitOps shouldn't require action in the UI to clean up

[allenhouchins]

Fleet version: Observed in Fleet's dogfood environment on 2025-04-10. PR to GitOps that triggered this bug is here.

💥  Actual behavior

A configuration profile had a custom target (label). In the same PR, the label was removed from the configuration profile and deleted:

https://github.com/fleetdm/fleet/pull/28083/files#diff-96f80858f5a487334ae6014cddaa65d1bb79d7e85fa0ea596d1e49063f5b99bd

When the PR was merged, the profile entered the broken state:

🕯️ More info (optional)

We think the only way to clear this is to delete the configuration profile from the UI which is not possible in gitops mode and also has undesirable consequences for devices still in scope via other labels.

• @noahtalerman: I filed this feature request to track getting profiles out of the broken state via the UI/API.

🛠️ To fix

Via GitOps, if a label is removed from a configuration profile a deleted in the same PR, the configuration profile's targets should be updated and not set to the broken state.

[noahtalerman]

Hey @allenhouchins can you please send me a link to the PR you opened that removed the 1Password8 label?

I think this is a feature request (that we should prioritize) rather than a bug but I want to confirm.

The expected behavior is for profiles to be broken when labels are deleted.

[noahtalerman]

@allenhouchins just following up to say no action needed. I found your PR and updated the bug.

I also filed a feature request to get out of the broken state: #28859