Update apps when closed - #48662
Conversation
Enable software installation and continuous automations for Zoom.
|
@marko-lisica this change scares me! Doesn't setting Edit: NM! Just saw the recent commit. |
…l software and continuous automation for patch policies
|
Hey @allenhouchins, sorry, I just opened PR real quick so I can work on it in the code editor. Now it's complete. We want to dogfood what we planned for #39962. The idea is to add a query to the FMA manifest that checks if the app is running, and if yes install will fail. As part of this story we will improve UI to show "install skipped" instead of failure. This way, we can use the existing interface to silently update apps when they are closed. |
![claude[bot]](https://avatars.githubusercontent.com/in/1236702?s=60&v=4){kind=small}
There was a problem hiding this comment.
Claude Code Review
This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.
Tip: disable this comment in your organization's Code Review settings.
WalkthroughThis PR adds pre-install query references for fleet-maintained macOS and Windows apps in ChangesCohort: Fleet-maintained app gating and policy changes
Sequence Diagram(s)sequenceDiagram
participant workstations.yml
participant pre_install_query
participant processes
workstations.yml->>pre_install_query: Reference is-*-running.yml
pre_install_query->>processes: Check app name or app path
processes-->>pre_install_query: Matching process found or absent
pre_install_query-->>workstations.yml: Return gate result
Estimated code review effort: Medium Possibly related PRs
Suggested labels: configuration, it-and-security, macos, windows Suggested reviewers: None specified in the provided context. 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (1)
it-and-security/fleets/workstations.yml (1)
361-367: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueTrailing whitespace on Slack's
pre_install_query.pathline.Line 362 has trailing whitespace after
is-slack-running.yml. Also note the key ordering differs between the Slack entry (pre_install_queryplaced aftersetup_experience) and the Zoom entry (pre_install_queryplaced first, beforeself_service/setup_experience) — purely cosmetic but worth aligning for consistency.🧹 Proposed cleanup
- slug: slack/darwin # Slack for macOS self_service: true setup_experience: true pre_install_query: - path: ../lib/macos/misc/pre-install-queries/is-slack-running.yml + path: ../lib/macos/misc/pre-install-queries/is-slack-running.yml categories: - Communication🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@it-and-security/fleets/workstations.yml` around lines 361 - 367, Remove the trailing whitespace on the Slack entry’s pre_install_query.path line in workstations.yml, and align the Slack block’s key order with the Zoom block for consistency. Use the existing Slack and Zoom stanza structure around the slug and pre_install_query keys to update the YAML cleanly without changing behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@it-and-security/fleets/workstations.yml`:
- Around line 361-367: Remove the trailing whitespace on the Slack entry’s
pre_install_query.path line in workstations.yml, and align the Slack block’s key
order with the Zoom block for consistency. Use the existing Slack and Zoom
stanza structure around the slug and pre_install_query keys to update the YAML
cleanly without changing behavior.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 077643c0-faaf-4258-aecb-6d58e756797e
📒 Files selected for processing (4)
it-and-security/fleets/workstations.ymlit-and-security/lib/macos/misc/pre-install-queries/is-slack-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-zoom-running.ymlit-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml
|
@marko-lisica sorry I am QUICK any time a change is proposed to dogfood! :-) I saw your follow up commit as soon as I hit enter. I might want to expand on this PR. There's no reason I wouldn't want this behavior on all apps, except for a few where I want to force an update regardless if its running or not — unless you can think of a reason not to that I might not be considering. I also want to double check the preinstall queries just to make sure they target the app without picking up on a background or helper app that then prevents the app from updating. I also want to update the Resolution message to say something like "This app will automatically update when its closed for an hour. You can also...." Or something like that. Any thoughts on the updated message? |
Sounds good to me. I don't see any reason why not. I assume Okta Verify is an app where you don't care whether it's open or not.
I double checked these 2. I guess we could ask Claude to expand this PR to all apps and then review queries manually.
Hmm. I guess you'll need a resolution message if you're failing the policy. This will likely be for apps that are always open, so for those, the resolution is to open the self-service tab and hit update. I guess we could add the sentence you proposed to the description: "This app will automatically update when it's closed for an hour." We'll soon introduce notifications and a deadline, but even in that case, the resolution message can point to the self-service. Wdyt? |
marko-lisica
changed the title
Add pre-install query checks for macOS and Windows apps to verify they're not running before installation. Enable continuous automations and automatic installation for fleet-maintained apps instead of requiring manual user action. Simplify policy resolution messages by removing references to built-in update functionality.
There was a problem hiding this comment.
🧹 Nitpick comments (2)
it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml (1)
1-9: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winSame resolution-text gap as the macOS policy file.
These Windows resolutions were also reworded to Self-service wording but likewise omit the "will auto-update once closed" explanation discussed in the PR conversation. Same suggestion applies here for consistency between platforms.
Also applies to: 20-28
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml` around lines 1 - 9, The Windows Slack policy resolution text in the patch-fleet-maintained-apps YAML is missing the “will auto-update once closed” explanation, creating a mismatch with the intended cross-platform wording. Update the resolution for the Slack policy entry in this file so it matches the macOS policy phrasing and clearly tells users that Slack will auto-update after they close it, using the existing policy entry identifiers like the Slack app slug and policy name to locate the affected block.it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml (1)
3-9: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winResolution text doesn't yet mention the "auto-updates after being closed" behavior.
Per the PR discussion, the plan was to add a sentence clarifying that the app will automatically update once closed (e.g., for ~an hour), while still pointing users to Self-service for immediate updates. None of the reworded
resolution(ordescription) strings in this diff include that explanation yet — as-is, users failing these policies will just see "Download the latest version from Self-service" with no indication that leaving the app closed will resolve it automatically.Worth adding before this ships broadly, since it directly affects how confusing/actionable the failing-policy message is to end users.
Also applies to: 101-107
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml` around lines 3 - 9, The policy messaging for the Google Chrome maintained-app rule is missing the planned auto-update guidance, so update the `resolution` (and any related `description`) text in the maintained-app policy entry to mention that the app will automatically update after it has been closed for a while, while still directing users to Self-service for an immediate update. Use the `resolution` field in this policy YAML as the primary place to add the clarification, and keep the wording user-facing and actionable.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@it-and-security/lib/macos/policies/patch-fleet-maintained-apps.yml`:
- Around line 3-9: The policy messaging for the Google Chrome maintained-app
rule is missing the planned auto-update guidance, so update the `resolution`
(and any related `description`) text in the maintained-app policy entry to
mention that the app will automatically update after it has been closed for a
while, while still directing users to Self-service for an immediate update. Use
the `resolution` field in this policy YAML as the primary place to add the
clarification, and keep the wording user-facing and actionable.
In `@it-and-security/lib/windows/policies/patch-fleet-maintained-apps.yml`:
- Around line 1-9: The Windows Slack policy resolution text in the
patch-fleet-maintained-apps YAML is missing the “will auto-update once closed”
explanation, creating a mismatch with the intended cross-platform wording.
Update the resolution for the Slack policy entry in this file so it matches the
macOS policy phrasing and clearly tells users that Slack will auto-update after
they close it, using the existing policy entry identifiers like the Slack app
slug and policy name to locate the affected block.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 6ba011be-0d3e-4364-8a26-2f5d55b2393d
📒 Files selected for processing (42)
it-and-security/fleets/workstations.ymlit-and-security/lib/macos/misc/pre-install-queries/is-1password-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-android-studio-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-aws-vpn-client-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-brave-browser-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-claude-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-cursor-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-docker-desktop-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-figma-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-firefox-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-github-desktop-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-google-chrome-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-google-drive-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-grammarly-desktop-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-iterm2-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-logi-options-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-loom-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-obsidian-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-parallels-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-postman-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-rectangle-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-slack-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-spotify-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-sublime-text-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-utm-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-visual-studio-code-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-whatsapp-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-zed-running.ymlit-and-security/lib/macos/misc/pre-install-queries/is-zoom-running.ymlit-and-security/lib/macos/policies/patch-fleet-maintained-apps.ymlit-and-security/lib/macos/policies/update-claude.ymlit-and-security/lib/macos/policies/update-slack.ymlit-and-security/lib/windows/misc/pre-install-queries/is-1password-running.ymlit-and-security/lib/windows/misc/pre-install-queries/is-claude-running.ymlit-and-security/lib/windows/misc/pre-install-queries/is-firefox-running.ymlit-and-security/lib/windows/misc/pre-install-queries/is-google-chrome-running.ymlit-and-security/lib/windows/misc/pre-install-queries/is-slack-running.ymlit-and-security/lib/windows/misc/pre-install-queries/is-visual-studio-code-running.ymlit-and-security/lib/windows/misc/pre-install-queries/is-zoom-running.ymlit-and-security/lib/windows/policies/patch-fleet-maintained-apps.ymlit-and-security/lib/windows/policies/update-claude.ymlit-and-security/lib/windows/policies/update-slack.yml
✅ Files skipped from review due to trivial changes (21)
- it-and-security/lib/macos/misc/pre-install-queries/is-sublime-text-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-obsidian-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-parallels-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-github-desktop-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-logi-options-running.yml
- it-and-security/lib/windows/misc/pre-install-queries/is-google-chrome-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-claude-running.yml
- it-and-security/lib/macos/policies/update-claude.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-loom-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-android-studio-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-aws-vpn-client-running.yml
- it-and-security/lib/macos/policies/update-slack.yml
- it-and-security/lib/windows/policies/update-slack.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-spotify-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-cursor-running.yml
- it-and-security/lib/windows/misc/pre-install-queries/is-zoom-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-visual-studio-code-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-slack-running.yml
- it-and-security/lib/windows/policies/update-claude.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-google-drive-running.yml
- it-and-security/lib/macos/misc/pre-install-queries/is-zoom-running.yml
3 participants
Related to: #39962
Summary by CodeRabbit