Anyone have an automation to sync custom scheduled queries from a github repo to fleet, so that fleet is always mirroring the state of the repo?

Hey @Ari Weinberg! In Fleet v4.35.0, we introduced the ability to import scheduled queries using

fleetctl

. I haven't tested this out yet, but here's a rough outline of a GH action that would be a good starting point:

name: 'Apply scheduled queries to Fleet'
description: 'Applies queries saved in .yml format to Fleet using fleetctl'

inputs:
  FLEET_API_TOKEN:
    description: 'Fleet API Token'
    required: true
  FLEET_URL:
    description: 'Fleet URL'
    required: true
  SCHEDULE_DIRECTORY:
    description: 'Directory in repo where query files are stored'
    required: true
    default: 'scheduled_queries'

runs:
  using: 'composite'
  steps:
    - name: Install fleetctl
      run: npm install -g fleetctl
      shell: bash

    - name: Configure fleetctl
      run: fleetctl config set --address ${{ inputs.FLEET_URL }} --token ${{ inputs.FLEET_API_TOKEN }}
      shell: bash

    - name: Apply queries
      run: |
        cat {{ inputs.TEAM_DIRECTORY }}/*.yml > queries.yml
        fleetctl apply -f queries.yml
      shell: bash

Thanks!