[delize]

Related issue: #54013

Adds a pre-apply check to the GitOps repository template that fleetctl generate-gitops writes. Before fleetctl gitops runs, .github/fleet-gitops/check-app-store-apps.sh asks the server which App Store apps the VPP account can supply (GET /software/app_store_apps for each fleet, plus the App Store apps already added via GET /software/titles?available_for_install=true) and compares that with every numeric app_store_id declared under fleets/ (or teams/). If any declared app is missing it fails the workflow with a ::error annotation naming the app, linking its App Store page and listing the files that declare it, so a wrong or unlicensed App Store ID is caught on the pull request instead of during the real apply.

Companion to #54019, which makes fleetctl gitops --dry-run itself return the availability error. This template step was requested in addition to that, so the check is visible in the generated workflow and works against servers that predate the server-side change.

What changed:

• templates/new/.github/fleet-gitops/check-app-store-apps.sh: bash, curl and jq only, matching the existing gitops.sh. Uses the same FLEET_URL and FLEET_API_TOKEN as the other steps. Handles both the fleets/fleet_id and the older teams/team_id API vocabularies, pages through software titles, skips fleets without a VPP token, and ignores Play Store entries (bundle identifiers, not numeric IDs). The readable name comes from Apple's public lookup endpoint as a best-effort courtesy; the verdict never depends on it.
• action.template.yml: new step "Verify App Store apps are available on the VPP account" between "Configure fleetctl" and "Run fleetctl gitops commands".
• workflow.template.yml: the chmod step now covers both scripts, since the generator writes files as 0644.
• .gitlab-ci.template.yml: runs the same script before gitops.sh.
• new_test.go: the generated tree is expected to contain the new script.

Checklist for submitter

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.
• Input data is properly validated, SELECT * is avoided, SQL injection is prevented (using placeholders for values in statements), JS inline code is prevented especially for url redirects, and untrusted data interpolated into shell scripts/commands is validated against shell metacharacters. (The script only interpolates numeric IDs extracted with [0-9]+ and the server-provided fleet IDs, which are used as query parameters via curl.)
• Timeouts are implemented and retries are limited to avoid infinite loops (the titles page loop ends when meta.has_next_results is false or a request fails; the catalog lookup has --max-time 8).

Testing

• Added/updated automated tests: TestNewBasicFileStructure now expects the new script in the generated repository.
• QA'd all new/changed functionality manually: exercised the script against a small mock of the Fleet API in both the fleets and legacy teams vocabularies, with all apps available (exit 0), with one unavailable app (exit 1, ::error::Gable Visitor Management (6741767014, https://apps.apple.com/app/id6741767014) is not available on the VPP account. Declared in: ./fleets/other.yml ...), and with a bad token (curl fails, non-zero exit). The mock and the transcript are in the PR discussion on request.

AI

AI: Claude Code (claude-fable-5-1)

Notes for reviewers

• The generated workflow runs this on every event, including pushes and the nightly schedule, so a license that disappears later also stops the apply before catalogs are touched.
• Fleets whose token call fails are skipped rather than treated as errors, so a repository with a mix of VPP and non-VPP fleets is not blocked by the non-VPP ones.
• Happy to drop the Apple catalog lookup if a network call to itunes.apple.com from the template is unwanted; it only supplies the display name in the error message.