Merge branch 'main' into feat/profile-content-diff

Resolves the conflicts with the no-team diff (#56):

- internal/api/client.go: keep this branch's GetProfileContent and
  EnrichProfileContents alongside main's updated GetScripts doc comment.
- internal/api/client_test.go and internal/diff/differ_test.go: both branches
  appended tests, so git interleaved them. Rebuilt from main's file plus this
  branch's blocks; every test function from both sides is present.
- internal/diff/differ.go: the no-team profile diff added in #56 now passes
  the profile enricher through, so profiles on hosts with no team get the same
  content-level diff as any team's. Covered by TestDiffNoTeamProfileContent.

Verified against the live Fleet instance: the real no-team file diffs clean,
and a locally modified profile still reports its changed key by name.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KEpzMNJnGaBLAfrPeqknCy

Author: robbiet480

.github/workflows/ci.yml

@@ -25,6 +25,9 @@ jobs:
       - name: Test
         run: go test -v -race -coverprofile=coverage.txt -covermode=atomic -count=1 ./...
 
+      - name: Coverage floor
+        run: ./scripts/coverage-floor.sh coverage.txt 75
+
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v5
         with:

CLAUDE.md

@@ -15,7 +15,7 @@ go vet ./...
 golangci-lint run
 ```
 
-Coverage target: >= 75% per package, enforced by `codecov.yml`. Current: 83.8%
+Coverage target: >= 75% per package, enforced in CI by `scripts/coverage-floor.sh`. Current: 84.7%
 overall, every package at or above 78.9%. All packages have `_test.go`. Tests use `testdata/` as a shared fleet-gitops fixture. Table-driven throughout.
 
 ## Key packages

CONTRIBUTING.md

@@ -20,7 +20,9 @@ Go 1.26+. CI runs the same commands plus `govulncheck ./...` and CodeQL. See [do
 - `go build ./...`, `go vet ./...`, and `go test -race ./...` all pass.
 - `golangci-lint run` reports no issues (`golangci-lint fmt` applies the gofmt /
   gofumpt formatting it expects).
-- New or changed logic has table-driven tests. Coverage should not regress.
+- New or changed logic has table-driven tests. Coverage stays at or above 75%
+  per package: `go test -coverprofile=coverage.txt ./... && ./scripts/coverage-floor.sh`
+  (CI runs the same check).
 - Commit messages use conventional prefixes (`feat:`, `fix:`, `test:`, `docs:`, `chore:`).
 
 ## Invariants that reviewers will enforce

cmd/fleet-plan/cmd_test.go

@@ -13,6 +13,7 @@ import (
 	"testing"
 
 	"github.com/CampusTech/fleet-plan/internal/git"
+	"github.com/CampusTech/fleet-plan/internal/parser"
 )
 
 // ---------- version command ----------
@@ -755,3 +756,38 @@ func TestRunExitCodes(t *testing.T) {
 		})
 	}
 }
+
+func TestHasNoTeam(t *testing.T) {
+	tests := []struct {
+		name  string
+		teams []parser.ParsedTeam
+		want  bool
+	}{
+		{name: "no teams at all"},
+		{
+			name:  "ordinary teams only",
+			teams: []parser.ParsedTeam{{Name: "Workstations", SourceFile: "teams/workstations.yml"}},
+		},
+		{
+			name: "teams layout no-team file",
+			teams: []parser.ParsedTeam{
+				{Name: "Workstations", SourceFile: "teams/workstations.yml"},
+				{Name: "No team", SourceFile: "teams/no-team.yml"},
+			},
+			want: true,
+		},
+		{
+			name:  "fleets layout unassigned file",
+			teams: []parser.ParsedTeam{{Name: "Unassigned", SourceFile: "fleets/unassigned.yml"}},
+			want:  true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := hasNoTeam(tt.teams); got != tt.want {
+				t.Errorf("got %v, want %v", got, tt.want)
+			}
+		})
+	}
+}

cmd/fleet-plan/main.go

@@ -168,7 +168,10 @@ func runDiff(cmd *cobra.Command, _ []string) error {
 	}
 	fmt.Fprintf(os.Stderr, "Fetching Fleet state from %s...\n", auth.URL)
 
-	state, err := client.FetchAll(ctx, repo.Global != nil)
+	state, err := client.FetchAll(ctx, api.FetchOptions{
+		Global: repo.Global != nil,
+		NoTeam: hasNoTeam(repo.Teams),
+	})
 	if err != nil {
 		return err
 	}
@@ -233,6 +236,18 @@ func runDiff(cmd *cobra.Command, _ []string) error {
 	return nil
 }
 
+// hasNoTeam reports whether the repo configures Fleet's "hosts on no team"
+// bucket. Fetching that bucket costs extra API calls, so it is only requested
+// when a file describes it.
+func hasNoTeam(teams []parser.ParsedTeam) bool {
+	for _, t := range teams {
+		if parser.IsNoTeam(t.Name, t.SourceFile) {
+			return true
+		}
+	}
+	return false
+}
+
 // errChangesDetected signals --detailed-exitcodes exit status 2. It is not a
 // failure: main translates it to the exit code after runDiff's defers run.
 var errChangesDetected = errors.New("changes detected")

codecov.yml

@@ -1,4 +1,8 @@
-# Coverage gates. The project floor is the 75% documented in CLAUDE.md.
+# Codecov reporting. The per-package floor is enforced in CI by
+# scripts/coverage-floor.sh, not here: the codecov project status configured
+# below has never posted a check on this repo, so it cannot be relied on as a
+# gate. Keep both -- the status is useful when it works, the script is the one
+# that actually blocks a merge.
 coverage:
   status:
     project:

docs/API-Endpoints.md

@@ -9,6 +9,7 @@ All read-only. fleet-plan never writes to your Fleet server.
 | `GET` | `/api/v1/fleet/labels` | Label validation and host counts |
 | `GET` | `/api/v1/fleet/teams/{id}/policies` | Per-team policies |
 | `GET` | `/api/v1/fleet/global/policies` | Global policies (when default.yml parsed) |
+| `GET` | `/api/v1/fleet/teams/0/policies` | Policies for hosts on no team (when the repo has a no-team file) |
 | `GET` | `/api/v1/fleet/queries` | Per-team and global queries |
 | `GET` | `/api/v1/fleet/configuration_profiles` | MDM configuration profiles (list includes each profile's checksum) |
 | `GET` | `/api/v1/fleet/configuration_profiles/{uuid}?alt=media` | Profile content, for key-level diffing (only when the checksum differs) |
@@ -20,4 +21,6 @@ All read-only. fleet-plan never writes to your Fleet server.
 
 Global endpoints (`/config`, `/global/policies`, `/queries` with teamID=0) are only called when `default.yml` defines global sections.
 
+The "hosts on no team" bucket is fetched only when the repo has a no-team file (`teams/no-team.yml` or `fleets/unassigned.yml`). Its resources live behind `team_id=0` on `/configuration_profiles` and `/scripts`, and behind `/teams/0/policies` for policies — note that `/global/policies` is a *different* set. Fleet does not report configured software for this bucket, so software is not diffed there.
+
 HTTPS enforced unless `FLEET_PLAN_INSECURE=1`.

docs/Architecture.md

@@ -89,6 +89,8 @@ Walks `teams/*.yml`, resolves `path:` references, produces `ParsedRepo`. Also pa
 
 Compares `FleetState` (API) vs `ParsedRepo` (YAML). Produces `[]DiffResult` per team + a `(global)` result when `default.yml` is present.
 
+Fleet's "hosts on no team" bucket is absent from `GET /teams`, so it is fetched separately (`team_id=0`) and diffed like any other team for policies, profiles, and scripts, baseline subtraction included. Software and queries are reported as skipped there: Fleet exposes configured software only through the teams list, and scopes queries to a real team or the global scope. When the bucket was not fetched, the diff falls back to summarizing what the repo configures for it.
+
 | Resource | Match key | Diff fields |
 |----------|-----------|-------------|
 | Config sections (global) | dot-path key | old/new value (skips `$VAR` placeholders) |
@@ -157,4 +159,4 @@ This mirrors how fleet-gitops environment overlays work. The merged result is wr
 go test -race ./...
 ```
 
-All packages have `_test.go`. Tests use `testdata/` as a shared fleet-gitops fixture. Table-driven throughout. Coverage target: >= 75% per package, enforced by `codecov.yml` (current: 83.8% overall, lowest package 78.9%).
+All packages have `_test.go`. Tests use `testdata/` as a shared fleet-gitops fixture. Table-driven throughout. Coverage target: >= 75% per package, enforced in CI by `scripts/coverage-floor.sh` (current: 84.7% overall, lowest package 78.9%).

internal/api/client.go

@@ -127,6 +127,32 @@ type FleetState struct {
 	Config                 map[string]any // from GET /api/v1/fleet/config
 	GlobalPolicies         []Policy       // from GET /api/v1/fleet/global/policies (teamID=0)
 	GlobalQueries          []Query        // from GET /api/v1/fleet/queries (teamID=0)
+	NoTeam                 *NoTeam        // "hosts on no team" bucket, when requested
+}
+
+// NoTeam holds the current state of Fleet's "hosts on no team" bucket, which
+// the /teams endpoint does not return. Its resources live behind team_id=0.
+//
+// Queries are absent by design: Fleet scopes queries to a real team or to the
+// global scope, so a no-team file cannot define them. Managed software is
+// absent too — Fleet only reports configured packages through the teams list,
+// which excludes this bucket.
+type NoTeam struct {
+	Policies            []Policy
+	Profiles            []Profile
+	Scripts             []Script
+	PoliciesUnavailable bool
+	ProfilesUnavailable bool
+	ScriptsUnavailable  bool
+}
+
+// FetchOptions selects the optional scopes FetchAll retrieves. Both cost extra
+// round trips, so callers ask for them only when the repo defines them.
+type FetchOptions struct {
+	// Global fetches /config, /global/policies, and global queries.
+	Global bool
+	// NoTeam fetches the "hosts on no team" bucket (team_id=0).
+	NoTeam bool
 }
 
 // Team represents a Fleet team with its associated resources.
@@ -426,6 +452,35 @@ func (c *Client) GetPolicies(ctx context.Context, teamID uint) ([]Policy, error)
 	return all, nil
 }
 
+// GetNoTeamPolicies fetches the policies that belong to Fleet's "hosts on no
+// team" bucket. This is a different endpoint from GetPolicies(0), which
+// returns global policies. The response also carries inherited_policies (the
+// global ones, which apply to no-team hosts as well); those are deliberately
+// ignored, since a no-team YAML file does not own them.
+func (c *Client) GetNoTeamPolicies(ctx context.Context) ([]Policy, error) {
+	var all []Policy
+	page := 0
+	for {
+		q := url.Values{
+			"per_page": {"250"},
+			"page":     {strconv.Itoa(page)},
+		}
+		var resp policiesResponse
+		if err := c.get(ctx, "/api/v1/fleet/teams/0/policies", q, &resp); err != nil {
+			return nil, fmt.Errorf("fetching no-team policies: %w", err)
+		}
+		all = append(all, resp.Policies...)
+		if len(resp.Policies) < 250 {
+			break
+		}
+		page++
+		if page > 100 { // safety: max 25k policies
+			break
+		}
+	}
+	return all, nil
+}
+
 // GetQueries fetches queries, optionally filtered by team, with pagination.
 func (c *Client) GetQueries(ctx context.Context, teamID uint) ([]Query, error) {
 	var all []Query
@@ -454,7 +509,9 @@ func (c *Client) GetQueries(ctx context.Context, teamID uint) ([]Query, error) {
 	return all, nil
 }
 
-// GetSoftware fetches managed (available_for_install) software titles for a team.
+// GetSoftware fetches managed (available_for_install) software titles for a
+// team. team_id is always sent; see GetProfiles for why teamID 0 must not be
+// omitted.
 // Uses available_for_install=true to exclude detected-only titles (OS packages,
 // browser extensions, etc.) and only return software deployed via Fleet/GitOps.
 // Paginates to collect all results.
@@ -467,9 +524,7 @@ func (c *Client) GetSoftware(ctx context.Context, teamID uint) ([]SoftwareTitle,
 			"page":                  {strconv.Itoa(page)},
 			"available_for_install": {"true"},
 		}
-		if teamID > 0 {
-			q.Set("team_id", strconv.FormatUint(uint64(teamID), 10))
-		}
+		q.Set("team_id", strconv.FormatUint(uint64(teamID), 10))
 		var resp softwareResponse
 		if err := c.get(ctx, "/api/v1/fleet/software/titles", q, &resp); err != nil {
 			return nil, fmt.Errorf("fetching software (team %d): %w", teamID, err)
@@ -581,7 +636,9 @@ func (c *Client) GetLabels(ctx context.Context) ([]Label, error) {
 	return all, nil
 }
 
-// GetProfiles fetches MDM profiles for a team with pagination.
+// GetProfiles fetches MDM profiles for a team with pagination. team_id is
+// always sent: Fleet reads teamID 0 as the "hosts on no team" bucket, whereas
+// omitting the parameter returns every team's profiles.
 func (c *Client) GetProfiles(ctx context.Context, teamID uint) ([]Profile, error) {
 	var all []Profile
 	page := 0
@@ -590,9 +647,7 @@ func (c *Client) GetProfiles(ctx context.Context, teamID uint) ([]Profile, error
 			"per_page": {"250"},
 			"page":     {strconv.Itoa(page)},
 		}
-		if teamID > 0 {
-			q.Set("team_id", strconv.FormatUint(uint64(teamID), 10))
-		}
+		q.Set("team_id", strconv.FormatUint(uint64(teamID), 10))
 		var resp profilesResponse
 		if err := c.get(ctx, "/api/v1/fleet/configuration_profiles", q, &resp); err != nil {
 			return nil, fmt.Errorf("fetching profiles (team %d): %w", teamID, err)
@@ -677,7 +732,8 @@ func (c *Client) EnrichProfileContents(ctx context.Context, profiles []Profile)
 	_ = g.Wait()
 }
 
-// GetScripts fetches scripts for a team with pagination.
+// GetScripts fetches scripts for a team with pagination. team_id is always
+// sent; see GetProfiles for why teamID 0 must not be omitted.
 func (c *Client) GetScripts(ctx context.Context, teamID uint) ([]Script, error) {
 	var all []Script
 	page := 0
@@ -686,9 +742,7 @@ func (c *Client) GetScripts(ctx context.Context, teamID uint) ([]Script, error)
 			"per_page": {"250"},
 			"page":     {strconv.Itoa(page)},
 		}
-		if teamID > 0 {
-			q.Set("team_id", strconv.FormatUint(uint64(teamID), 10))
-		}
+		q.Set("team_id", strconv.FormatUint(uint64(teamID), 10))
 		var resp scriptsResponse
 		if err := c.get(ctx, "/api/v1/fleet/scripts", q, &resp); err != nil {
 			return nil, fmt.Errorf("fetching scripts (team %d): %w", teamID, err)
@@ -759,9 +813,13 @@ func (c *Client) getScriptContent(ctx context.Context, scriptID uint) (string, e
 // FetchAll concurrently fetches the complete Fleet state. Uses errgroup for
 // parallel requests. If fetchGlobal is true, also fetches global config,
 // policies, and queries (for default.yml diffing).
-func (c *Client) FetchAll(ctx context.Context, fetchGlobal ...bool) (*FleetState, error) {
+func (c *Client) FetchAll(ctx context.Context, opts ...FetchOptions) (*FleetState, error) {
 	state := &FleetState{}
-	wantGlobal := len(fetchGlobal) > 0 && fetchGlobal[0]
+	var o FetchOptions
+	if len(opts) > 0 {
+		o = opts[0]
+	}
+	wantGlobal := o.Global
 
 	teams, err := c.GetTeams(ctx)
 	if err != nil {
@@ -822,6 +880,49 @@ func (c *Client) FetchAll(ctx context.Context, fetchGlobal ...bool) (*FleetState
 		})
 	}
 
+	// noTeam is written only by the goroutines below, then attached to state
+	// after g.Wait().
+	var noTeam *NoTeam
+	if o.NoTeam {
+		noTeam = &NoTeam{}
+		g.Go(func() error {
+			policies, err := c.GetNoTeamPolicies(gctx)
+			if err != nil {
+				if !isPermissionError(err) {
+					return err
+				}
+				noTeam.PoliciesUnavailable = true
+				return nil
+			}
+			noTeam.Policies = policies
+			return nil
+		})
+		g.Go(func() error {
+			profiles, err := c.GetProfiles(gctx, 0)
+			if err != nil {
+				if !isPermissionError(err) {
+					return err
+				}
+				noTeam.ProfilesUnavailable = true
+				return nil
+			}
+			noTeam.Profiles = profiles
+			return nil
+		})
+		g.Go(func() error {
+			scripts, err := c.GetScripts(gctx, 0)
+			if err != nil {
+				if !isPermissionError(err) {
+					return err
+				}
+				noTeam.ScriptsUnavailable = true
+				return nil
+			}
+			noTeam.Scripts = scripts
+			return nil
+		})
+	}
+
 	// teamPartials holds per-goroutine results indexed by team slot.
 	// Each field is written by exactly one goroutine, so there is no data race.
 	type teamPartial struct {
@@ -924,6 +1025,13 @@ func (c *Client) FetchAll(ctx context.Context, fetchGlobal ...bool) (*FleetState
 		teamResults[i].ScriptsUnavailable = p.scriptsUnavailable
 	}
 
+	if noTeam != nil {
+		if !noTeam.ScriptsUnavailable && len(noTeam.Scripts) > 0 {
+			c.EnrichScriptContents(ctx, noTeam.Scripts)
+		}
+		state.NoTeam = noTeam
+	}
+
 	// Enrich script contents (second pass, needs script IDs from first pass)
 	for i := range teamResults {
 		if !teamResults[i].ScriptsUnavailable && len(teamResults[i].Scripts) > 0 {