[release-1.10] ci(backstage): skip plugin downloads in PR checks and use chart defaults

[rm3l]

Manual cherry-pick of #480

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rm3l]

manual cherry-pick - merging to unblock CI.

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (2) 📘 Rule violations (0) 🔗 Cross-repo conflicts (2) 📜 Skill insights (0)

Context used

✅ Cross-repo context

  Explored: repo: redhat-developer/rhdh (branch: release-1.10, sha: da65cdf8)

  Not relevant to this PR: redhat-developer/rhdh-plugins

  Not relevant to this PR: redhat-developer/rhdh-must-gather

1. Unpinned yq dependency 🐞 Bug ☼ Reliability

Description

The test.yaml and nightly.yaml workflows invoke yq to generate values overrides, but the
workflows/action never installs or pins a yq version. This makes CI dependent on whatever happens
to be preinstalled on the runner image and can break when runner images change or in self-hosted
runners without yq.

Code

.github/workflows/test.yaml[R27-31]

+      - name: Generate full-plugins values for template sanity check
+        run: |
+          yq e '{"global": {"dynamic": {"includes": .global.dynamic.includes}, "lightspeed": {"plugins": .global.lightspeed.plugins}}, "orchestrator": {"plugins": .orchestrator.plugins}}' \
+            charts/backstage/values.yaml > /tmp/backstage-full-plugins-values.yaml
+

Relevance

⭐⭐ Medium

No past accepted/rejected feedback found about installing/pinning yq; PR #480 added yq usage
unpinned.

PR-#480

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

Both workflows execute yq e ..., but the composite action and workflows only set up
Helm/Python/chart-testing; nothing installs yq, so the job implicitly relies on the runner image.

.github/workflows/test.yaml[27-31]
.github/workflows/nightly.yaml[44-48]
.github/actions/test-charts/action.yml[28-44]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
Workflows call `yq` directly, but there is no step to install/pin `yq`. This makes CI brittle across runner image updates and self-hosted runners.

### Issue Context
`yq` is invoked in both PR and nightly workflows to generate temporary values files.

### Fix Focus Areas
- .github/workflows/test.yaml[27-31]
- .github/workflows/nightly.yaml[44-48]

### Suggested fix
Add an explicit installation step for a pinned `yq` version before the `yq e ...` invocation in both workflows (or move the generation into the composite action and install/pin `yq` there). Ensure the install is version-pinned to avoid runner drift.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Curl redirects not constrained 🐞 Bug ⛨ Security

Description

The OLM install step downloads a script with curl -L and executes it, but only constrains the
initial protocol via --proto =https and does not constrain redirect protocols or fail on HTTP
errors. This leaves a gap where redirects could downgrade protocols or error pages could be
downloaded and then executed.

Code

.github/actions/test-charts/action.yml[R161-163]

+        curl --proto =https -L "https://github.com/operator-framework/operator-lifecycle-manager/releases/download/${OLM_VERSION}/install.sh" -o install-olm.sh
        chmod +x install-olm.sh
        ./install-olm.sh "${OLM_VERSION}"

Relevance

⭐ Low

Same curl redirect hardening was definitely rejected in PR #480.

PR-#480

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The action uses curl -L to fetch install.sh, then immediately marks it executable and runs it;
the curl command does not include redirect-protocol restrictions (--proto-redir) nor HTTP-failure
handling (--fail).

.github/actions/test-charts/action.yml[154-163]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

### Issue description
The workflow downloads and executes a remote installer script using `curl -L` without constraining redirect protocols and without failing on HTTP errors.

### Issue Context
Even though the URL is HTTPS, curl treats redirect protocol restrictions separately (`--proto-redir`). Executing downloaded scripts is a high-trust operation and should be hardened.

### Fix Focus Areas
- .github/actions/test-charts/action.yml[161-163]

### Suggested fix
Update the curl invocation to:
- fail fast on HTTP errors (`--fail` or `--fail-with-body --show-error`)
- restrict redirects to HTTPS as well (`--proto '=https' --proto-redir '=https'`)
Optionally add `--tlsv1.2` and/or integrity verification (checksum/signature) if available for the installer content.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

3. PR CI skips plugin install 🔗 Cross-repo conflict ☼ Reliability

Description

Chart PR checks now install with CI value files that clear global.dynamic.includes and plugin
lists, so PR-time installs no longer exercise RHDH’s dynamic-plugin installation contract
(CATALOG_INDEX_IMAGE + dynamic-plugins.default.yaml). This can let chart↔rhdh image
incompatibilities in the plugin installer path slip until nightly/downstream validation.

Code

charts/backstage/ci/default-values.yaml[R5-11]

+# CI: skip dynamic plugin downloads to speed up tests.
+# The chart features under test (deployment, config, probes, etc.) don't depend on actual plugins.
+global:
+  dynamic:
+    includes: []
+  lightspeed:
+    plugins: []

Relevance

⭐ Low

PR #480 intentionally disables dynamic plugins in PR CI to speed tests.

PR-#480

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR CI values explicitly disable dynamic plugins, while the RHDH repo documents and implements a
catalog-index-driven default plugin install flow that the chart normally relies on; skipping this in
PR installs reduces cross-repo integration validation.

charts/backstage/ci/default-values.yaml[5-11]
charts/backstage/values.yaml[346-380]
External repo: redhat-developer/rhdh, docs/dynamic-plugins/installing-plugins.md [38-49]
External repo: redhat-developer/rhdh, scripts/install-dynamic-plugins/install-dynamic-plugins.py [1391-1462]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
PR CI installs no longer exercise the cross-repo dynamic-plugin installation flow implemented in `redhat-developer/rhdh` (catalog-index extraction + `dynamic-plugins.default.yaml` replacement + plugin merging). This reduces early detection of chart↔image compatibility regressions.

## Issue Context
- The chart always sets `CATALOG_INDEX_IMAGE` for the `install-dynamic-plugins` initContainer.
- The RHDH image’s `install-dynamic-plugins.py` performs catalog-index extraction whenever `CATALOG_INDEX_IMAGE` is set, and uses the `includes` list to decide whether `dynamic-plugins.default.yaml` is replaced/consumed.
- PR CI value files set `global.dynamic.includes: []` and clear plugin lists, so the install path no longer validates that `dynamic-plugins.default.yaml`-driven installs still work end-to-end.

## Fix Focus Areas
- charts/backstage/ci/default-values.yaml[5-11]
- .github/workflows/test.yaml[27-36]
- .github/actions/test-charts/action.yml[181-214]

## Suggested fix approach
- Keep the fast CI scenarios, but add **one** PR-time smoke install that overlays the chart defaults for dynamic plugins (e.g., pass `helm_extra_args: --values /tmp/backstage-full-plugins-values.yaml` to `test-charts` so at least one ct install uses real `global.dynamic.includes`/plugin lists).
- Alternatively, introduce a dedicated CI scenario values file (e.g., `charts/backstage/ci/full-plugins-values.yaml`) used by a single `ct install` invocation, to validate the full plugin installer path without slowing every scenario.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

4. Downstream image not tested 🔗 Cross-repo conflict ☼ Reliability

Description

The PR workflow no longer overrides the chart install to validate against the downstream supported
RHDH image (quay.io/rhdh/rhdh-hub-rhel9), and PR-time installs will instead rely on the chart
default image (quay.io/rhdh-community/rhdh:next-1.10). This reduces cross-repo compatibility
coverage for the supported downstream image pipeline in redhat-developer/rhdh.

Code

.github/workflows/test.yaml[R27-36]

+      - name: Generate full-plugins values for template sanity check
+        run: |
+          yq e '{"global": {"dynamic": {"includes": .global.dynamic.includes}, "lightspeed": {"plugins": .global.lightspeed.plugins}}, "orchestrator": {"plugins": .orchestrator.plugins}}' \
+            charts/backstage/values.yaml > /tmp/backstage-full-plugins-values.yaml
+
      - name: Test charts
        uses: ./.github/actions/test-charts
        with:
          target_branch: ${{ github.event.pull_request.base.ref }}
-          # The RHDH image tag is already pinned to a specific version for the 'release-1.y' branches.
-          # TODO([RHDHBUGS-3095](https://redhat.atlassian.net/browse/RHDHBUGS-3095)): Remove the catalogIndex.image.tag pin once the lightspeed plugins OCI refs are fixed in the latest catalog index image.
-          extra_helm_args: ${{ github.event.pull_request.base.ref == 'main' && format('--set upstream.backstage.image.repository={0} --set upstream.backstage.image.tag={1} --set global.catalogIndex.image.tag=1.10-51', env.RHDH_IMAGE_REPOSITORY, env.RHDH_IMAGE_TAG) || '--set global.catalogIndex.image.tag=1.10-51' }}
+          helm_template_values_file: /tmp/backstage-full-plugins-values.yaml

Relevance

⭐ Low

PR #480 explicitly removed downstream image override to use chart defaults.

PR-#480

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

PR workflow no longer supplies image override inputs, so installs fall back to chart defaults; the
RHDH repo explicitly treats rhdh/rhdh-hub-rhel9 as the downstream supported image repo, distinct
from PR/community images.

.github/workflows/test.yaml[27-36]
charts/backstage/values.yaml[190-197]
External repo: redhat-developer/rhdh, e2e-tests/README.md [87-90]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
PR CI no longer validates chart installs against the downstream supported RHDH image (`quay.io/rhdh/rhdh-hub-rhel9`), increasing the chance that chart changes pass PR checks but fail for the supported downstream image used by `redhat-developer/rhdh` consumers.

## Issue Context
The RHDH repo distinguishes the **downstream supported** image repo (`rhdh/rhdh-hub-rhel9`) from the **PR/community** image repo (`rhdh-community/rhdh`). Chart PR checks now rely on chart defaults, which point at the PR/community image.

## Fix Focus Areas
- .github/workflows/test.yaml[27-36]
- charts/backstage/values.yaml[190-197]

## Suggested fix approach
- Add a small PR-time matrix or separate job that runs `ct install` (or a single `helm install`) with `--set upstream.backstage.image.repository=rhdh/rhdh-hub-rhel9` and an appropriate tag for the branch (e.g., `latest` or `1.10.x`).
- Keep the default-image PR job if desired, but ensure at least one job validates the downstream-supported image path so chart↔rhdh contracts (entrypoints, filesystem layout, initContainer tooling) are covered before merge.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

[rhdh-qodo-merge]

PR Summary by Qodo

CI(backstage): skip dynamic plugin downloads and add Helm template sanity check

🐞 Bug fix ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Skip Backstage dynamic plugin downloads during CI chart tests to reduce flakiness and runtime.
• Add a Helm-template “sanity check” pass using a layered values override and explicit kube version.
• Align workflows with chart defaults (catalog index default, nightly overrides via values file).

Diagram

graph TD
  A["PR workflow: test.yaml"] --> B["Composite action: test-charts"] --> D["Helm template sanity"] --> E["Backstage chart"] --> G["CI scenario values"]
  C["Nightly workflow: nightly.yaml"] --> B
  B --> F["ct install (helm args)"] --> E

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Single shared CI overlay values file for all scenarios

• ➕ Avoids duplicating the same global.dynamic/includes and lightspeed.plugins overrides across many scenario files
• ➕ Makes future CI behavior changes (e.g., plugin skip) one-file updates
• ➖ Requires consistently layering the overlay everywhere (ct install + template checks) to avoid drift
• ➖ Scenario-specific files become less self-contained/readable without the full effective config

2. Introduce a chart-level "disable plugin downloads" CI flag

• ➕ More explicit intent and less brittle than relying on empty includes/plugins lists
• ➕ Reduces CI-specific configuration surface area in values files
• ➖ Adds chart feature/maintenance burden for a CI-only concern
• ➖ Requires chart template changes and backwards-compat considerations

Recommendation: Current approach is reasonable for a release branch: it is low-risk (values-only behavior changes) and immediately reduces CI cost by preventing plugin download work. If this pattern continues to expand, consider consolidating the repeated CI plugin-skip settings into a shared overlay values file to reduce duplication and drift.

Files changed (14) +101 / -18

Documentation (1) +2 / -2

README.mdUpdate README version badge and install example +2/-2

Update README version badge and install example

• Updates displayed chart version references from 5.12.8 to 5.12.9.

charts/backstage/README.md

Other (13) +99 / -16

action.ymlAdd Helm-template sanity check and support extra Helm args +32/-3

Add Helm-template sanity check and support extra Helm args

• Adds new inputs for passing through raw Helm args and an optional values file used for a Helm template-only sanity check across Backstage CI scenarios. Makes ct debugging conditional on RUNNER_DEBUG, adds a safer curl invocation, and removes/avoids ct upgrade behavior while allowing additional helm args to flow into ct install.

.github/actions/test-charts/action.yml

nightly.yamlGenerate nightly Backstage override values and pass via helm_extra_args +8/-2

Generate nightly Backstage override values and pass via helm_extra_args

• Generates a reduced values overlay for nightly runs and passes it into the shared test-charts action via a values file. Removes the catalog index tag pinning from nightly extra_helm_args while keeping image pinning behavior.

.github/workflows/nightly.yaml

test.yamlAdd PR Helm-template values generation and use template sanity check +7/-9

Add PR Helm-template values generation and use template sanity check

• Adds a workflow timeout and generates a "full-plugins" values overlay from the chart defaults. Switches the PR job to use the composite action’s helm_template_values_file input rather than pinning image/catalog index args in the workflow.

.github/workflows/test.yaml

Chart.yamlBump Backstage chart version to 5.12.9 +1/-1

Bump Backstage chart version to 5.12.9

• Increments the chart version as part of the release-1.10 cherry-pick update.

charts/backstage/Chart.yaml

default-values.yamlDisable dynamic plugin and lightspeed plugin downloads in CI defaults +8/-0

Disable dynamic plugin and lightspeed plugin downloads in CI defaults

• Adds CI-only overrides to clear dynamic plugin includes and lightspeed plugins to avoid downloading plugins during CI installs.

charts/backstage/ci/default-values.yaml

with-custom-dynamic-pvc-claim-spec-values.yamlSkip plugin downloads for custom PVC CI scenario +7/-0

Skip plugin downloads for custom PVC CI scenario

• Adds global.dynamic.includes and global.lightspeed.plugins empty lists so CI doesn’t download plugins in this scenario.

charts/backstage/ci/with-custom-dynamic-pvc-claim-spec-values.yaml

with-custom-image-for-test-pod-values.yamlSkip plugin downloads for test-pod image scenario +8/-0

Skip plugin downloads for test-pod image scenario

• Adds global dynamic/lightspeed plugin-empty overrides to reduce CI work and flakiness.

charts/backstage/ci/with-custom-image-for-test-pod-values.yaml

with-lightspeed-disabled-values.yamlSkip dynamic plugin downloads even when lightspeed is disabled +4/-0

Skip dynamic plugin downloads even when lightspeed is disabled

• Ensures dynamic plugin includes are empty and lightspeed plugin list is empty for this scenario.

charts/backstage/ci/with-lightspeed-disabled-values.yaml

with-lightspeed-service-host-values.yamlSkip plugin downloads for lightspeed service-host scenario +5/-0

Skip plugin downloads for lightspeed service-host scenario

• Clears dynamic includes and lightspeed plugins in CI values (with an existing FIXME retained).

charts/backstage/ci/with-lightspeed-service-host-values.yaml

with-orchestrator-and-dynamic-plugins-npmrc-values.yamlSkip plugin downloads and neutralize orchestrator plugin list +5/-0

Skip plugin downloads and neutralize orchestrator plugin list

• Overrides dynamic includes and lightspeed plugins to empty, and sets orchestrator.plugins to an empty list to avoid unintended plugin resolution during CI.

charts/backstage/ci/with-orchestrator-and-dynamic-plugins-npmrc-values.yaml

with-orchestrator-values.yamlSkip plugin downloads and neutralize orchestrator plugin list +5/-0

Skip plugin downloads and neutralize orchestrator plugin list

• Overrides dynamic includes and lightspeed plugins to empty, and sets orchestrator.plugins to an empty list for CI stability.

charts/backstage/ci/with-orchestrator-values.yaml

with-test-pod-disabled-values.yamlSkip plugin downloads for test-pod-disabled scenario +8/-0

Skip plugin downloads for test-pod-disabled scenario

• Adds global dynamic/lightspeed plugin-empty overrides to avoid plugin downloads in this CI scenario.

charts/backstage/ci/with-test-pod-disabled-values.yaml

values.schema.tmpl.jsonUpdate catalog index image tag default to 1.10 +1/-1

Update catalog index image tag default to 1.10

• Changes the schema default for the catalog index image tag from 1.9 to 1.10 to match the release branch expectations.

charts/backstage/values.schema.tmpl.json