Merge branch 'backstage:master' into feature/asyncapi3

.changeset/beige-apples-press.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-azure-devops': patch
+---
+
+Added alpha support for the New Frontend System (Declarative Integration)

.changeset/calm-onions-exercise.md

@@ -0,0 +1,5 @@
+---
+'@backstage/repo-tools': patch
+---
+
+Resolved an issue with generate-catalog-info where it was replacing upper case characters with -.

.changeset/cold-cheetahs-pull.md

@@ -0,0 +1,12 @@
+---
+'@backstage/plugin-scaffolder-backend-module-bitbucket-server': minor
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+New scaffolder module `@backstage/plugin-scaffolder-backend-module-bitbucket-server`.
+
+Extracted from `@backstage/plugin-scaffolder-backend-module-bitbucket`
+and replaces its actions related to Bitbucket Server.
+
+- `publish:bitbucketServer`
+- `publish:bitbucketServer:pull-request`

.changeset/cool-islands-impress.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-azure-sites': patch
+---
+
+Updated README

.changeset/create-app-1706621803.md

@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+Bumped create-app version.

.changeset/dirty-cheetahs-shave.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Support additional algorithms in the `/.well-known/openid-configuration` endpoint.

.changeset/dirty-plums-fix.md

@@ -0,0 +1,17 @@
+---
+'@backstage/plugin-tech-insights-backend-module-jsonfc': patch
+---
+
+Add support for the new backend system.
+
+A new backend module for the tech-insights backend
+was added and exported as `default`.
+
+The module will register the `JsonRulesEngineFactCheckerFactory`
+as `FactCheckerFactory`, loading checks from the config.
+
+You can use it with the new backend system like
+
+```ts title="packages/backend/src/index.ts"
+backend.add(import('@backstage/plugin-tech-insights-backend-module-jsonfc'));
+```

.changeset/fast-onions-own.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+`FetchUrlReader#readUrl()` now supports passing an optional `token` to authenticate requests.

.changeset/flat-roses-happen.md

@@ -0,0 +1,17 @@
+---
+'@backstage/plugin-scaffolder-backend-module-bitbucket': minor
+---
+
+Split `@backstage/plugin-scaffolder-backend-module-bitbucket` into
+`@backstage/plugin-scaffolder-backend-module-bitbucket-cloud` and
+`@backstage/plugin-scaffolder-backend-module-bitbucket-server`.
+
+`@backstage/plugin-scaffolder-backend-module-bitbucket` was **deprecated** in favor of these two replacements.
+
+Please use any of the two replacements depending on your needs.
+
+```diff
+- backend.add(import('@backstage/plugin-scaffolder-backend-module-bitbucket'));
++ backend.add(import('@backstage/plugin-scaffolder-backend-module-bitbucket-cloud'));
++ backend.add(import('@backstage/plugin-scaffolder-backend-module-bitbucket-server'));
+```

.changeset/fluffy-jeans-eat.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Added check for the `repository` field in the `repo fix` command.

.changeset/forty-beers-sniff.md

@@ -0,0 +1,22 @@
+---
+'@backstage/core-components': patch
+'@backstage/plugin-catalog-graph': patch
+---
+
+Added possibility to show arrow heads for graph edges for better understandability.
+
+In order to show arrow heads in the catalog graph page, add `showArrowHeads` attribute to `CatalogGraphPage` component
+(typically in `packages/app/src/App.tsx`):
+
+```diff
+- <CatalogGraphPage />
++ <CatalogGraphPage showArrowHeads />
+```
+
+In order to show arrow heads in entity graphs, add `showArrowHeads` attribute to `EntityCatalogGraphCard` components
+(typically multiple occurrences in `packages/app/src/components/catalog/EntityPage.tsx`):
+
+```diff
+- <EntityCatalogGraphCard variant="gridItem" height={400} />
++ <EntityCatalogGraphCard variant="gridItem" height={400} showArrowHeads />
+```

.changeset/four-walls-perform.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder': minor
+---
+
+Updating the `EntityPicker` to only select `kind` `metadata.name` and `metadata.namespace` by default to improve performance on larger datasets.

.changeset/fresh-gifts-smile.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-techdocs-module-addons-contrib': patch
+---
+
+Fixed the value label text color in dark mode for the TextSize addon.

.changeset/friendly-terms-love.md

@@ -0,0 +1,5 @@
+---
+'@backstage/repo-tools': patch
+---
+
+Introduced `knip` to the `knip-reports` command, which generates a `knip-report.md` file for your packages with dependency warnings, if any.

.changeset/fuzzy-comics-collect.md

@@ -0,0 +1,27 @@
+---
+'@backstage/plugin-tech-insights-backend-module-jsonfc': patch
+---
+
+Support loading `TechInsightsJsonRuleCheck` instances from config.
+
+Uses the check `id` as key.
+
+Example:
+
+```yaml title="app-config.yaml"
+techInsights:
+  factChecker:
+    checks:
+      groupOwnerCheck:
+        type: json-rules-engine
+        name: Group Owner Check
+        description: Verifies that a group has been set as the spec.owner for this entity
+        factIds:
+          - entityOwnershipFactRetriever
+        rule:
+          conditions:
+            all:
+              - fact: hasGroupOwner
+                operator: equal
+                value: true
+```

.changeset/fuzzy-turtles-camp.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli-node': patch
+---
+
+Added `repository` field to `BackstagePackageJson` type.

.changeset/gorgeous-ways-applaud.md

@@ -0,0 +1,8 @@
+---
+'@backstage/plugin-signals-backend': patch
+'@backstage/plugin-signals-react': patch
+'@backstage/plugin-signals-node': patch
+'@backstage/plugin-signals': patch
+---
+
+Fix disconnect loop on server start

.changeset/great-rats-collect.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-kubernetes-backend': minor
+---
+
+**BREAKING** The backend will fail to start if two clusters in the app-config
+have the same name. The requirement for unique names has been declared in the
+docs for some time, but is now enforced.

.changeset/green-dogs-fold.md

@@ -0,0 +1,15 @@
+---
+'@backstage/plugin-tech-insights-backend': patch
+'@backstage/plugin-tech-insights-node': patch
+---
+
+Add support for the new backend system.
+
+A new backend plugin for the tech-insights backend
+was added and exported as `default`.
+
+You can use it with the new backend system like
+
+```ts title="packages/backend/src/index.ts"
+backend.add(import('@backstage/plugin-tech-insights-backend'));
+```

.changeset/hip-ears-add.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+The auth backend will now refuse to issue user tokens are excessively large.

.changeset/hot-horses-matter.md

@@ -0,0 +1,108 @@
+---
+'@backstage/plugin-scaffolder-backend-module-confluence-to-markdown': patch
+'@backstage/plugin-search-backend-module-stack-overflow-collator': patch
+'@backstage/plugin-catalog-backend-module-incremental-ingestion': patch
+'@backstage/plugin-scaffolder-backend-module-cookiecutter': patch
+'@backstage/plugin-events-backend-module-bitbucket-cloud': patch
+'@backstage/plugin-tech-insights-backend-module-jsonfc': patch
+'@backstage/plugin-catalog-backend-module-unprocessed': patch
+'@backstage/plugin-analytics-module-newrelic-browser': patch
+'@backstage/plugin-scaffolder-backend-module-gitlab': patch
+'@backstage/plugin-scaffolder-backend-module-sentry': patch
+'@backstage/plugin-scaffolder-backend-module-yeoman': patch
+'@backstage/plugin-catalog-backend-module-puppetdb': patch
+'@backstage/plugin-scaffolder-backend-module-rails': patch
+'@backstage/plugin-api-docs-module-protoc-gen-doc': patch
+'@backstage/plugin-catalog-backend-module-msgraph': patch
+'@backstage/plugin-catalog-backend-module-openapi': patch
+'@backstage/plugin-search-backend-module-techdocs': patch
+'@backstage/plugin-events-backend-module-aws-sqs': patch
+'@backstage/plugin-search-backend-module-catalog': patch
+'@backstage/plugin-search-backend-module-explore': patch
+'@backstage/plugin-catalog-unprocessed-entities': patch
+'@backstage/plugin-events-backend-module-gerrit': patch
+'@backstage/plugin-events-backend-module-github': patch
+'@backstage/plugin-events-backend-module-gitlab': patch
+'@backstage/plugin-events-backend-module-azure': patch
+'@backstage/plugin-entity-feedback-backend': patch
+'@backstage/plugin-code-coverage-backend': patch
+'@backstage/plugin-tech-insights-backend': patch
+'@backstage/plugin-analytics-module-ga4': patch
+'@backstage/plugin-azure-devops-backend': patch
+'@backstage/backend-plugin-api': patch
+'@backstage/plugin-analytics-module-ga': patch
+'@backstage/plugin-azure-sites-backend': patch
+'@backstage/backend-dev-utils': patch
+'@backstage/plugin-github-deployments': patch
+'@backstage/plugin-lighthouse-backend': patch
+'@backstage/plugin-microsoft-calendar': patch
+'@backstage/plugin-scaffolder-backend': patch
+'@backstage/backend-defaults': patch
+'@backstage/plugin-entity-validation': patch
+'@backstage/plugin-sonarqube-backend': patch
+'@backstage/backend-app-api': patch
+'@backstage/plugin-devtools-backend': patch
+'@backstage/plugin-linguist-backend': patch
+'@backstage/plugin-playlist-backend': patch
+'@backstage/backend-common': patch
+'@backstage/plugin-catalog-backend': patch
+'@backstage/plugin-explore-backend': patch
+'@backstage/plugin-graphql-voyager': patch
+'@backstage/plugin-jenkins-backend': patch
+'@backstage/plugin-rollbar-backend': patch
+'@backstage/backend-tasks': patch
+'@backstage/plugin-badges-backend': patch
+'@backstage/plugin-bazaar-backend': patch
+'@backstage/plugin-catalog-import': patch
+'@backstage/plugin-events-backend': patch
+'@backstage/plugin-github-actions': patch
+'@backstage/plugin-octopus-deploy': patch
+'@backstage/plugin-splunk-on-call': patch
+'@backstage/plugin-techdocs-react': patch
+'@backstage/app-defaults': patch
+'@backstage/core-app-api': patch
+'@backstage/plugin-catalog-graph': patch
+'@backstage/plugin-code-coverage': patch
+'@backstage/plugin-cost-insights': patch
+'@backstage/plugin-nomad-backend': patch
+'@backstage/plugin-tech-insights': patch
+'@backstage/plugin-vault-backend': patch
+'@backstage/plugin-azure-devops': patch
+'@backstage/plugin-code-climate': patch
+'@backstage/plugin-adr-backend': patch
+'@backstage/plugin-app-backend': patch
+'@backstage/plugin-azure-sites': patch
+'@backstage/plugin-firehydrant': patch
+'@backstage/plugin-lighthouse': patch
+'@backstage/plugin-scaffolder': patch
+'@backstage/plugin-tech-radar': patch
+'@backstage/plugin-codescene': patch
+'@backstage/plugin-dynatrace': patch
+'@backstage/plugin-shortcuts': patch
+'@backstage/plugin-sonarqube': patch
+'@backstage/plugin-xcmetrics': patch
+'@backstage/plugin-airbrake': patch
+'@backstage/plugin-api-docs': patch
+'@backstage/plugin-circleci': patch
+'@backstage/plugin-devtools': patch
+'@backstage/plugin-graphiql': patch
+'@backstage/plugin-linguist': patch
+'@backstage/plugin-newrelic': patch
+'@backstage/plugin-opencost': patch
+'@backstage/plugin-periskop': patch
+'@backstage/plugin-bitrise': patch
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-jenkins': patch
+'@backstage/plugin-rollbar': patch
+'@backstage/plugin-allure': patch
+'@backstage/plugin-badges': patch
+'@backstage/plugin-bazaar': patch
+'@backstage/plugin-sentry': patch
+'@backstage/plugin-fossa': patch
+'@backstage/plugin-ilert': patch
+'@backstage/plugin-nomad': patch
+'@backstage/plugin-vault': patch
+'@backstage/plugin-home': patch
+---
+
+Use `--cwd` as the first `yarn` argument

.changeset/kind-wombats-draw.md

@@ -0,0 +1,11 @@
+---
+'@backstage/core-plugin-api': minor
+'@backstage/app-defaults': minor
+'@backstage/core-app-api': minor
+'@backstage/frontend-plugin-api': patch
+---
+
+Added a utility API for VMware Cloud auth; the API ref is available in the
+`@backstage/core-plugin-api` and `@backstage/frontend-plugin-api` packages, the
+implementation is in `@backstage/core-app-api` and a factory has been added to
+`@backstage/app-defaults`.

.changeset/large-tables-wonder.md

@@ -2,4 +2,4 @@
 '@backstage/cli': patch
 ---
 
-Add experimental support for optional `auth` app entry point.
+Add experimental support for an optional `public` app entry point that lets users sign-in before being able to access the full app.

.changeset/lovely-bugs-prove.md

@@ -0,0 +1,19 @@
+---
+'@backstage/repo-tools': minor
+---
+
+**BREAKING**: The `schema openapi *` commands are now renamed into `package schema openapi *` and `repo schema openapi *`. The aim is to make it more clear what the command is operating on, the entire repo or just a single package.
+
+The following commands now live under the `package` namespace,
+
+- `schema openapi generate` is now `package schema openapi generate --server`
+- `schema openapi generate-client` is now `package schema openapi generate --client-package`
+- `schema openapi init` is now `package schema openapi init`
+
+And these commands live under the new `repo` namespace,
+
+- `schema openapi lint` is now `repo schema openapi lint`
+- `schema openapi test` is now `repo schema openapi test`
+- `schema openapi verify` is now `repo schema openapi verify`
+
+The `package schema openapi generate` now supports defining both `--server` and `--client-package` to generate both at once.This update also reworks the `--client-package` flag to accept only an output directory as the input directory can now be inferred.

.changeset/lucky-bugs-bow.md

@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+Add a seed file for `yarn.lock` in newly created apps. This file is downloaded directly from `https://github.com/backstage/backstage` at the time of creating a new project, ensuring that users always receive the latest version. The purpose of the seed file is to initialize the lock file with known good versions of individual dependencies that have had bad new releases published. The seed file will have no effect if the dependency is not present, it can not be used to install additional packages.

.changeset/mighty-steaks-shave.md

@@ -0,0 +1,5 @@
+---
+'@backstage/create-app': patch
+---
+
+Bumped TypeScript to version `5.3`.

.changeset/mighty-tomatoes-visit.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+adds a x-goog-api-client header to existing API requests in this plugin to clearly identify API requests from this GKE plugin. headers are formatted as follows where `libVersion` represents the current dotted version number of the Backstage GKE plugin and `libName` represent the current Google API used at backstage.

.changeset/mighty-toys-laugh.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-react': minor
+---
+
+Add support to `configSchema` option on the `createEntityCardExtension` factory function.

.changeset/nasty-days-jog.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend-module-aws-alb-provider': patch
+---
+
+Refactored to use the `jose` library for JWT handling.

.changeset/nasty-shirts-look.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-home': patch
+---
+
+Use EntityDisplayName JSX element entity information directly for FeaturedDocsCard.

.changeset/neat-eels-greet.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-graph': minor
+---
+
+Migrate plugin to the new frontend system, it is experimental and available via alpha subpath.

.changeset/ninety-hats-kiss.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-playlist': patch
+---
+
+Conditionally render playlist description only when it's non-empty

.changeset/olive-boats-agree.md

@@ -0,0 +1,93 @@
+---
+'@backstage/core-app-api': patch
+'@backstage/core-components': patch
+'@backstage/core-plugin-api': patch
+'@backstage/dev-utils': patch
+'@backstage/frontend-app-api': patch
+'@backstage/frontend-plugin-api': patch
+'@backstage/plugin-adr': patch
+'@backstage/plugin-airbrake': patch
+'@backstage/plugin-allure': patch
+'@backstage/plugin-apache-airflow': patch
+'@backstage/plugin-api-docs-module-protoc-gen-doc': patch
+'@backstage/plugin-api-docs': patch
+'@backstage/plugin-apollo-explorer': patch
+'@backstage/plugin-azure-devops': patch
+'@backstage/plugin-azure-sites': patch
+'@backstage/plugin-badges': patch
+'@backstage/plugin-bazaar': patch
+'@backstage/plugin-bitrise': patch
+'@backstage/plugin-catalog-graph': patch
+'@backstage/plugin-catalog-import': patch
+'@backstage/plugin-catalog-react': patch
+'@backstage/plugin-catalog-unprocessed-entities': patch
+'@backstage/plugin-catalog': patch
+'@backstage/plugin-circleci': patch
+'@backstage/plugin-cloudbuild': patch
+'@backstage/plugin-code-climate': patch
+'@backstage/plugin-code-coverage': patch
+'@backstage/plugin-codescene': patch
+'@backstage/plugin-config-schema': patch
+'@backstage/plugin-cost-insights': patch
+'@backstage/plugin-devtools': patch
+'@backstage/plugin-dynatrace': patch
+'@backstage/plugin-entity-feedback': patch
+'@backstage/plugin-entity-validation': patch
+'@backstage/plugin-explore': patch
+'@backstage/plugin-firehydrant': patch
+'@backstage/plugin-fossa': patch
+'@backstage/plugin-gcalendar': patch
+'@backstage/plugin-git-release-manager': patch
+'@backstage/plugin-github-actions': patch
+'@backstage/plugin-github-deployments': patch
+'@backstage/plugin-github-issues': patch
+'@backstage/plugin-github-pull-requests-board': patch
+'@backstage/plugin-gitops-profiles': patch
+'@backstage/plugin-graphiql': patch
+'@backstage/plugin-graphql-voyager': patch
+'@backstage/plugin-home': patch
+'@backstage/plugin-ilert': patch
+'@backstage/plugin-jenkins': patch
+'@backstage/plugin-kafka': patch
+'@backstage/plugin-kubernetes-cluster': patch
+'@backstage/plugin-kubernetes-react': patch
+'@backstage/plugin-kubernetes': patch
+'@backstage/plugin-lighthouse': patch
+'@backstage/plugin-linguist': patch
+'@backstage/plugin-microsoft-calendar': patch
+'@backstage/plugin-newrelic-dashboard': patch
+'@backstage/plugin-newrelic': patch
+'@backstage/plugin-nomad': patch
+'@backstage/plugin-octopus-deploy': patch
+'@backstage/plugin-opencost': patch
+'@backstage/plugin-org-react': patch
+'@backstage/plugin-org': patch
+'@backstage/plugin-pagerduty': patch
+'@backstage/plugin-periskop': patch
+'@backstage/plugin-permission-react': patch
+'@backstage/plugin-playlist': patch
+'@backstage/plugin-puppetdb': patch
+'@backstage/plugin-rollbar': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-scaffolder': patch
+'@backstage/plugin-search-react': patch
+'@backstage/plugin-search': patch
+'@backstage/plugin-sentry': patch
+'@backstage/plugin-shortcuts': patch
+'@backstage/plugin-sonarqube': patch
+'@backstage/plugin-splunk-on-call': patch
+'@backstage/plugin-stack-overflow': patch
+'@backstage/plugin-stackstorm': patch
+'@backstage/plugin-tech-insights': patch
+'@backstage/plugin-tech-radar': patch
+'@backstage/plugin-techdocs-addons-test-utils': patch
+'@backstage/plugin-techdocs-react': patch
+'@backstage/plugin-techdocs': patch
+'@backstage/plugin-user-settings': patch
+'@backstage/plugin-vault': patch
+'@backstage/plugin-xcmetrics': patch
+'@backstage/test-utils': patch
+'@backstage/theme': patch
+---
+
+Widen `@types/react` dependency range to include version 18.

.changeset/orange-gorillas-clean.md

@@ -0,0 +1,26 @@
+---
+'@backstage/plugin-tech-insights-backend': patch
+'@backstage/plugin-tech-insights-node': patch
+---
+
+Move `FactRetrieverRegistry` and `PersistenceContext` to `@backstage/plugin-tech-insights-node`.
+
+Original exports are marked as deprecated and re-export the moved types.
+
+Please replace uses like
+
+```ts
+import {
+  FactRetrieverRegistry,
+  PersistenceContext,
+} from '@backstage/plugin-tech-insights-backend';
+```
+
+with
+
+```ts
+import {
+  FactRetrieverRegistry,
+  PersistenceContext,
+} from '@backstage/plugin-tech-insights-node';
+```

.changeset/perfect-colts-hammer.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+Organized imports in plugin.ts

.changeset/poor-points-do.md

@@ -0,0 +1,46 @@
+---
+'@backstage/plugin-catalog-backend-module-scaffolder-entity-model': patch
+'@backstage/plugin-search-backend-module-stack-overflow-collator': patch
+'@backstage/plugin-permission-backend-module-allow-all-policy': patch
+'@backstage/plugin-scaffolder-backend-module-bitbucket-server': patch
+'@backstage/plugin-auth-backend-module-oauth2-proxy-provider': patch
+'@backstage/plugin-auth-backend-module-vmware-cloud-provider': patch
+'@backstage/plugin-scaffolder-backend-module-bitbucket-cloud': patch
+'@backstage/plugin-catalog-backend-module-backstage-openapi': patch
+'@backstage/plugin-auth-backend-module-atlassian-provider': patch
+'@backstage/plugin-auth-backend-module-microsoft-provider': patch
+'@backstage/plugin-auth-backend-module-pinniped-provider': patch
+'@backstage/plugin-auth-backend-module-github-provider': patch
+'@backstage/plugin-auth-backend-module-gitlab-provider': patch
+'@backstage/plugin-auth-backend-module-oauth2-provider': patch
+'@backstage/plugin-scaffolder-backend-module-bitbucket': patch
+'@backstage/plugin-analytics-module-newrelic-browser': patch
+'@backstage/plugin-auth-backend-module-oidc-provider': patch
+'@backstage/plugin-auth-backend-module-okta-provider': patch
+'@backstage/plugin-catalog-backend-module-github-org': patch
+'@backstage/backend-dynamic-feature-service': patch
+'@backstage/plugin-scaffolder-backend-module-gerrit': patch
+'@backstage/plugin-scaffolder-backend-module-github': patch
+'@backstage/plugin-scaffolder-backend-module-azure': patch
+'@backstage/plugin-notifications-backend': patch
+'@backstage/frontend-test-utils': patch
+'@backstage/plugin-analytics-module-ga4': patch
+'@backstage/plugin-notifications-common': patch
+'@backstage/plugin-notifications-node': patch
+'@backstage/frontend-app-api': patch
+'@backstage/plugin-kubernetes-react': patch
+'@backstage/e2e-test-utils': patch
+'@backstage/plugin-kubernetes-node': patch
+'@backstage/plugin-signals-backend': patch
+'@backstage/plugin-app-visualizer': patch
+'@backstage/plugin-notifications': patch
+'@backstage/plugin-signals-react': patch
+'@backstage/plugin-vault-backend': patch
+'@backstage/plugin-signals-node': patch
+'@backstage/plugin-vault-node': patch
+'@backstage/plugin-app-node': patch
+'@backstage/plugin-opencost': patch
+'@backstage/plugin-signals': patch
+---
+
+Added or fixed the `repository` field in `package.json`.

.changeset/pre.json

@@ -267,85 +267,189 @@
     "@backstage/plugin-signals": "0.0.0",
     "@backstage/plugin-signals-backend": "0.0.0",
     "@backstage/plugin-signals-node": "0.0.0",
-    "@backstage/plugin-signals-react": "0.0.0"
+    "@backstage/plugin-signals-react": "0.0.0",
+    "@backstage/plugin-auth-backend-module-aws-alb-provider": "0.0.0",
+    "@backstage/plugin-notifications": "0.0.0",
+    "@backstage/plugin-notifications-backend": "0.0.0",
+    "@backstage/plugin-notifications-common": "0.0.0",
+    "@backstage/plugin-notifications-node": "0.0.0",
+    "@backstage/plugin-scaffolder-backend-module-bitbucket-cloud": "0.0.0",
+    "@backstage/plugin-scaffolder-backend-module-bitbucket-server": "0.0.0"
   },
   "changesets": [
     "afraid-numbers-invite",
     "angry-phones-arrive",
+    "beige-apples-press",
+    "blue-keys-do",
+    "breezy-cobras-sin",
     "brown-items-hammer",
+    "calm-cups-rule",
+    "calm-items-double",
+    "calm-onions-exercise",
     "chilled-chefs-notice",
+    "chilled-ways-wave",
     "chilly-seahorses-bake",
+    "cold-cheetahs-pull",
     "cold-cooks-care",
+    "cool-islands-impress",
+    "create-app-1706621803",
     "curvy-ladybugs-impress",
     "cyan-bats-lick",
     "cyan-icons-rest",
+    "dirty-cheetahs-shave",
+    "dirty-mirrors-retire",
+    "dirty-plums-fix",
     "dry-lizards-taste",
     "dry-lobsters-flash",
+    "dry-vans-kiss",
     "dull-dolphins-explain",
     "dull-fireants-repeat",
+    "eight-hounds-dream",
     "empty-ligers-hang",
+    "fair-mirrors-hammer",
+    "famous-houses-thank",
     "fast-jeans-walk",
+    "fast-onions-own",
     "fifty-adults-watch",
     "fifty-files-argue",
+    "flat-roses-happen",
     "flat-wasps-fold",
+    "forty-beers-sniff",
     "forty-cars-scream",
+    "four-mugs-try",
+    "four-walls-perform",
+    "fresh-gifts-smile",
     "friendly-cheetahs-rescue",
+    "funny-buttons-sip",
     "funny-timers-visit",
+    "fuzzy-comics-collect",
+    "giant-suits-switch",
     "good-lemons-lick",
     "gorgeous-bobcats-press",
+    "gorgeous-pumas-draw",
+    "gorgeous-ways-applaud",
+    "great-rats-collect",
+    "green-dogs-fold",
+    "green-flies-draw",
     "grumpy-poets-study",
+    "hip-ears-add",
+    "hot-horses-matter",
+    "hot-paws-tap",
     "hot-pillows-poke",
     "hot-tips-doubt",
     "kind-clouds-fly",
+    "kind-wombats-draw",
     "large-frogs-grab",
+    "large-moons-speak",
     "large-tables-wonder",
     "lemon-cameras-remember",
     "long-suns-bow",
     "loud-walls-compare",
+    "lovely-bugs-prove",
     "lovely-starfishes-remain",
+    "lucky-bugs-bow",
     "many-pugs-change",
     "metal-elephants-sit",
     "metal-students-drive",
+    "mighty-steaks-shave",
+    "mighty-toys-laugh",
+    "nasty-days-jog",
+    "nasty-shirts-look",
+    "neat-eels-greet",
     "neat-hotels-wink",
+    "nice-carrots-dream",
     "nine-bulldogs-camp",
     "nine-olives-swim",
+    "ninety-rules-sneeze",
+    "old-papayas-shave",
     "old-students-smoke",
+    "olive-boats-agree",
+    "olive-experts-fold",
     "olive-singers-accept",
+    "orange-gorillas-clean",
+    "orange-walls-complain",
     "polite-meals-hug",
+    "quick-penguins-refuse",
+    "quick-ties-stare",
+    "quiet-donkeys-punch",
+    "rare-seals-thank",
     "real-eggs-sip",
+    "real-grapes-sing",
+    "red-bottles-swim",
+    "red-eggs-serve",
     "renovate-47c1714",
     "renovate-4b698fb",
     "renovate-5f8d1ca",
     "renovate-95b717a",
+    "renovate-97e6aa5",
+    "renovate-f4b1d70",
     "renovate-f58dd5c",
     "renovate-fb2e0b9",
     "rotten-lemons-cry",
+    "selfish-mails-scream",
     "serious-carpets-learn",
     "seven-dots-serve",
     "seven-plums-return",
+    "shaggy-trainers-rule",
+    "shaggy-windows-cross",
     "sharp-pandas-hunt",
+    "shiny-apes-glow",
+    "shiny-clocks-greet",
+    "shiny-poets-tease",
+    "short-cherries-mix",
     "shy-carrots-decide",
     "silent-hotels-knock",
     "silent-poets-grab",
+    "silent-waves-pretend",
+    "six-jobs-sin",
     "six-melons-end",
     "sixty-shoes-prove",
+    "slimy-rats-fly",
+    "smart-numbers-call",
+    "soft-balloons-relax",
     "soft-beans-tease",
     "sour-rivers-fry",
+    "spotty-jokes-unite",
+    "spotty-kids-pay",
     "strange-parents-hammer",
+    "strong-lobsters-hide",
+    "strong-news-develop",
+    "sweet-ravens-glow",
+    "tall-frogs-clap",
+    "tall-tools-compare",
     "tame-numbers-smile",
     "tame-rockets-sin",
+    "tasty-feet-cheat",
+    "tasty-oranges-rescue",
     "ten-numbers-happen",
     "ten-planets-guess",
+    "ten-trainers-cough",
+    "tender-flowers-collect",
+    "thirty-dolls-admire",
+    "tidy-cooks-mix",
+    "tidy-cooks-mixed",
+    "tiny-donuts-drive",
     "tiny-kiwis-know",
     "tough-drinks-scream",
+    "twelve-hounds-know",
+    "twelve-pens-rescue",
+    "twelve-weeks-march",
     "twenty-taxis-mate",
     "two-coats-smile",
+    "two-geese-explain",
     "two-singers-learn",
+    "unlucky-pens-search",
     "unlucky-wasps-tan",
     "warm-maps-scream",
+    "weak-news-jam",
     "wet-emus-work",
+    "wet-lions-crash",
+    "wicked-ants-reflect",
     "wicked-elephants-scream",
     "wild-owls-doubt",
+    "wise-flies-laugh",
+    "wise-papayas-cough",
+    "young-ladybugs-decide",
     "young-rules-repeat"
   ]
 }

.changeset/real-grapes-sing.md

@@ -0,0 +1,8 @@
+---
+'@backstage/core-components': patch
+'@backstage/app-defaults': minor
+'@backstage/plugin-playlist': patch
+'@backstage/plugin-scaffolder': minor
+---
+
+Added stack trace display to `ErrorPage` and updated existing refs

.changeset/red-bottles-swim.md

@@ -0,0 +1,7 @@
+---
+'@backstage/plugin-auth-backend': patch
+'@backstage/plugin-auth-node': patch
+---
+
+The helper function `makeProfileInfo` and `PassportHelpers.transformProfile`
+were refactored to use the `jose` library.

.changeset/red-eggs-serve.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-app-backend': patch
+---
+
+Support injecting config multiple times in a single bundle

.changeset/renovate-235713b.md

@@ -0,0 +1,11 @@
+---
+'@backstage/core-components': patch
+'@backstage/plugin-catalog-react': patch
+'@backstage/plugin-entity-validation': patch
+'@backstage/plugin-gcp-projects': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-scaffolder': patch
+'@backstage/plugin-techdocs-module-addons-contrib': patch
+---
+
+Updated dependency `@react-hookz/web` to `^24.0.0`.

.changeset/renovate-2d87790.md

@@ -0,0 +1,11 @@
+---
+'@backstage/plugin-home-react': patch
+'@backstage/plugin-home': patch
+'@backstage/plugin-scaffolder-react': patch
+'@backstage/plugin-scaffolder': patch
+---
+
+Updated dependency `@rjsf/utils` to `5.17.0`.
+Updated dependency `@rjsf/core` to `5.17.0`.
+Updated dependency `@rjsf/material-ui` to `5.17.0`.
+Updated dependency `@rjsf/validator-ajv8` to `5.17.0`.

.changeset/renovate-97e6aa5.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-opencost': patch
+---
+
+Updated dependency `date-fns` to `^3.0.0`.

.changeset/renovate-c392808.md

@@ -0,0 +1,8 @@
+---
+'@backstage/plugin-gcalendar': patch
+'@backstage/plugin-microsoft-calendar': patch
+'@backstage/plugin-techdocs': patch
+---
+
+Updated dependency `dompurify` to `^3.0.0`.
+Updated dependency `@types/dompurify` to `^3.0.0`.

.changeset/renovate-f4b1d70.md

@@ -0,0 +1,6 @@
+---
+'@backstage/cli': patch
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Updated dependency `esbuild` to `^0.20.0`.

.changeset/shiny-apes-glow.md

@@ -0,0 +1,12 @@
+---
+'@backstage/plugin-scaffolder-backend-module-bitbucket-cloud': minor
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+New scaffolder module `@backstage/plugin-scaffolder-backend-module-bitbucket-cloud`.
+
+Extracted from `@backstage/plugin-scaffolder-backend-module-bitbucket`
+and replaces its actions related to Bitbucket Cloud.
+
+- `publish:bitbucketCloud`
+- `bitbucket:pipelines:run`

.changeset/shiny-clocks-greet.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-user-settings': patch
+---
+
+conditionally rendering the user name and email in user settings page

.changeset/short-cherries-mix.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend-module-gerrit': patch
+---
+
+Provide default branch when creating repositories.

.changeset/slimy-rats-fly.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-org': patch
+---
+
+Added basic support for the new frontend system, exported from the `/alpha` subpath.

.changeset/soft-balloons-relax.md

@@ -0,0 +1,6 @@
+---
+'@backstage/core-components': patch
+'@backstage/app-defaults': patch
+---
+
+Fix invalid HTTP status code 501 in Error Page

.changeset/spotty-jokes-unite.md

@@ -0,0 +1,5 @@
+---
+'@backstage/cli': patch
+---
+
+Harmonize the package naming and allow custom prefix

.changeset/spotty-kids-pay.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-auth-backend': patch
+---
+
+Ability for user to configure backstage token expiration

.changeset/strong-news-develop.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-explore': patch
+---
+
+Use the EntityDisplayName component for rendering Group nodes

.changeset/tall-frogs-clap.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-azure-sites-backend': patch
+---
+
+Added `permissionIntegrationRouter` for azure-sites-backend routes

.changeset/tasty-oranges-rescue.md

@@ -0,0 +1,11 @@
+---
+'@backstage/plugin-auth-backend': minor
+---
+
+**BREAKING**: The `saml` provider has been migrated from `passport-saml` to `@node-saml/passport-saml`.
+
+This comes with breaking changes to config options:
+
+- `audience` is now mandatory
+- `wantAuthnResponseSigned` is now exposed and defaults to `true`
+- `wantAssertionsSigned` is now exposed and defaults to `true`

.changeset/tiny-donuts-drive.md

@@ -0,0 +1,6 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+Backstage will log a warning whenever duplicate cluster names are detected --
+even if clusters sharing the same name come from separate locators.

.changeset/twelve-shirts-buy.md

@@ -0,0 +1,15 @@
+---
+'@backstage/plugin-catalog-backend': patch
+'@backstage/plugin-catalog-node': patch
+---
+
+Add support for `onProcessingError` handler at the catalog plugin (new backend system).
+
+You can use `setOnProcessingErrorHandler` at the `catalogProcessingExtensionPoint`
+as replacement for
+
+```ts
+catalogBuilder.subscribe({
+  onProcessingError: hander,
+});
+```

.changeset/weak-news-jam.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-react': patch
+---
+
+Fix bug that erroneously caused a separator or a 0 to render in the TemplateCard for Templates with empty links

.changeset/wet-lions-crash.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-catalog-backend-module-puppetdb': patch
+---
+
+Added `latest_report_status` parameter from the PuppetDB node api and added it as a tag to the nodes. The status is valuable information as it displays which nodes are compliant to your configuration and which ones are failing are making changes.

.changeset/wicked-ants-reflect.md

@@ -0,0 +1,8 @@
+---
+'@backstage/plugin-notifications-backend': patch
+'@backstage/plugin-notifications-common': patch
+'@backstage/plugin-notifications-node': patch
+'@backstage/plugin-notifications': patch
+---
+
+Initial notifications system for backstage

.changeset/wicked-dolphins-wash.md

@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-kubernetes-backend': patch
+---
+
+On LocalKubectlProxyClusterLocator, when resolving localhost, IPv4 address is placed before IPv6 address, ignoring the order from the DNS resolver. This change is necessary since by default kubectl proxy listen on IPv4

.changeset/wise-papayas-cough.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-common': patch
+---
+
+Add a config declaration for `workingDirectory`

.github/labeler.yml

@@ -1,38 +1,62 @@
 area:catalog:
-  - plugins/catalog/**/*
-  - plugins/catalog-*/**/*
-  - packages/catalog-*/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/catalog/**/*
+          - plugins/catalog-*/**/*
+          - packages/catalog-*/**/*
 area:discoverability: # search + home
-  - plugins/search/**/*
-  - plugins/search-*/**/*
-  - packages/search-*/**/*
-  - plugins/home/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/search/**/*
+          - plugins/search-*/**/*
+          - packages/search-*/**/*
+          - plugins/home/**/*
 area:kubernetes:
-  - plugins/kubernetes/**/*
-  - plugins/kubernetes-*/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/kubernetes/**/*
+          - plugins/kubernetes-*/**/*
 area:permission:
-  - plugins/permission-*/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/permission-*/**/*
 area:scaffolder:
-  - plugins/scaffolder/**/*
-  - plugins/scaffolder-*/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/scaffolder/**/*
+          - plugins/scaffolder-*/**/*
 area:techdocs:
-  - plugins/techdocs/**/*
-  - plugins/techdocs-*/**/*
-  - packages/techdocs-*/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/techdocs/**/*
+          - plugins/techdocs-*/**/*
+          - packages/techdocs-*/**/*
 auth:
-  - plugins/auth-*/**/*
-  - packages/core-app-api/src/apis/implementations/auth/**/*
-  - packages/core-app-api/src/lib/Auth*/**/*
-  - packages/core-plugin-api/src/apis/definitions/auth.ts
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/auth-*/**/*
+          - packages/core-app-api/src/apis/implementations/auth/**/*
+          - packages/core-app-api/src/lib/Auth*/**/*
+          - packages/core-plugin-api/src/apis/definitions/auth.ts
 documentation:
-  - docs/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - docs/**/*
 homepage:
-  - plugins/home/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/home/**/*
 microsite:
-  - microsite/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - microsite/**/*
 search:
-  - plugins/search/**/*
-  - plugins/search-*/**/*
-  - packages/search-*/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - plugins/search/**/*
+          - plugins/search-*/**/*
+          - packages/search-*/**/*
 storybook:
-  - storybook/**/*
+  - changed-files:
+      - any-glob-to-any-file:
+          - storybook/**/*

.github/renovate.json5

@@ -1,6 +1,15 @@
 {
+  $schema: 'https://docs.renovatebot.com/renovate-schema.json',
+
   labels: ['dependencies'],
-  extends: ['config:base', ':disableDependencyDashboard', ':gitSignOff'],
+
+  extends: ['config:best-practices', ':gitSignOff'],
+  // do not pin dev dependencies, which are part of the best-practices preset
+  ignorePresets: [':pinDevDependencies'],
+
+  // the default limit are 10 PRs
+  prConcurrentLimit: 20,
+
   postUpdateOptions: ['yarnDedupeHighest'],
   rangeStrategy: 'update-lockfile',
   // @elastic/elasticsearch is ignored due to licensing issues. See #10992

.github/vale/config/vocabularies/Backstage/accept.txt

@@ -185,6 +185,7 @@ Kaswell
 keepalive
 Keyv
 Knex
+knip
 Koyeb
 KPIs
 Kuang

.github/workflows/automate_area-labels.yml

@@ -13,11 +13,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/labeler@v4.3.0
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         with:
           repo-token: '${{ secrets.GITHUB_TOKEN }}'
           sync-labels: true

.github/workflows/automate_changeset_feedback.yml

@@ -23,18 +23,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           # Fetch the commit that's merged into the base rather than the target ref
           # This will let us diff only the contents of the PR, without fetching more history
           ref: 'refs/pull/${{ github.event.pull_request.number }}/merge'
       - name: fetch base
         run: git fetch --depth 1 origin ${{ github.base_ref }}
-      - uses: backstage/actions/changeset-feedback@v0.6.5
+      - uses: backstage/actions/changeset-feedback@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         name: Generate feedback
         with:
           diff-ref: 'origin/master'

.github/workflows/automate_merge_message.yml

@@ -24,11 +24,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           ref: '${{ github.event.pull_request.merge_commit_sha }}'
 
@@ -44,7 +44,7 @@ jobs:
           node generate.js ${{ github.event.pull_request.base.sha }} ${{ github.event.pull_request.head.sha }} > message.txt
 
       - name: Post Message
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         env:
           ISSUE_NUMBER: ${{ github.event.pull_request.number }}
         with:

.github/workflows/automate_stale.yml

@@ -15,11 +15,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/stale@v9.0.0
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
         id: stale
         with:
           stale-issue-message: >

.github/workflows/ci-noop.yml

@@ -40,7 +40,7 @@ jobs:
     name: Test ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 

.github/workflows/ci.yml

@@ -28,20 +28,20 @@ jobs:
     name: Install ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 
@@ -64,20 +64,20 @@ jobs:
     name: Verify ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 
@@ -113,10 +113,10 @@ jobs:
         run: yarn backstage-repo-tools generate-catalog-info --ci
 
       - name: lint openapi yaml files
-        run: yarn backstage-repo-tools schema openapi lint
+        run: yarn backstage-repo-tools repo schema openapi lint
 
       - name: verify openapi yaml file matches generated ts file
-        run: yarn backstage-repo-tools schema openapi verify
+        run: yarn backstage-repo-tools repo schema openapi verify
 
       - name: verify doc links
         run: node scripts/verify-links.js
@@ -155,7 +155,7 @@ jobs:
     name: Test ${{ matrix.node-version }}
     services:
       postgres16:
-        image: postgres:16
+        image: postgres:16@sha256:09f23e02d76670d3b346a3c00aa33a27cf57aab8341eedfcdaed41459d14f5c4
         env:
           POSTGRES_PASSWORD: postgres
         options: >-
@@ -166,7 +166,7 @@ jobs:
         ports:
           - 5432/tcp
       postgres12:
-        image: postgres:12
+        image: postgres:12@sha256:8ffdca6e9208aceb30653fa0cc1c38956303ace453944b54b4f71019cfe854c1
         env:
           POSTGRES_PASSWORD: postgres
         options: >-
@@ -177,7 +177,7 @@ jobs:
         ports:
           - 5432/tcp
       mysql8:
-        image: mysql:8
+        image: mysql:8@sha256:2a9ef1075ff30c65bbcf4f96b25a03ea3b3f492c284e6c4a612c269ce4c5bb19
         env:
           MYSQL_ROOT_PASSWORD: root
         options: >-
@@ -197,18 +197,18 @@ jobs:
       INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: fetch branch master
         run: git fetch origin master
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 
@@ -225,7 +225,7 @@ jobs:
 
       # We run the test cases before verifying the specs to prevent any failing tests from causing errors.
       - name: verify openapi specs against test cases
-        run: yarn backstage-repo-tools schema openapi test
+        run: yarn backstage-repo-tools repo schema openapi test
 
       - name: ensure clean working directory
         run: |

.github/workflows/cron.yml

@@ -9,11 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: backstage/actions/cron@v0.6.5
+      - uses: backstage/actions/cron@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }}
           private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }}

.github/workflows/deploy_docker-image.yml

@@ -16,24 +16,24 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           path: backstage
           ref: v${{ github.event.client_payload.version }}
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 
@@ -47,17 +47,17 @@ jobs:
         working-directory: ./example-app
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v3.0.0
+        uses: docker/login-action@343f7c4344506bcbf9b4de18042ae17996df046d # v3.0.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3.0.0
+        uses: docker/setup-buildx-action@f95db51fddba0c2d1ec667646a06c2ce06100226 # v3.0.0
 
       - name: Build and push
-        uses: docker/build-push-action@v5.1.0
+        uses: docker/build-push-action@4a13e500e55cf31b7a5d59a38ab2040ab0f42f56 # v5.1.0
         with:
           context: './example-app'
           file: ./example-app/packages/backend/Dockerfile

.github/workflows/deploy_microsite.yml

@@ -24,14 +24,14 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: use node.js 18.x
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: 18.x
           registry-url: https://registry.npmjs.org/ # Needed for auth

.github/workflows/deploy_nightly.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
@@ -27,7 +27,7 @@ jobs:
           node-version: 18.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v18.x
 

.github/workflows/deploy_packages.yml

@@ -1,6 +1,11 @@
 name: Deploy Packages
 on:
   workflow_dispatch:
+    inputs:
+      force_release:
+        description: Unconditionally trigger the release job
+        required: false
+        type: boolean
   push:
     branches: [master, patch/*]
 
@@ -18,7 +23,7 @@ jobs:
 
     services:
       postgres16:
-        image: postgres:16
+        image: postgres:16@sha256:09f23e02d76670d3b346a3c00aa33a27cf57aab8341eedfcdaed41459d14f5c4
         env:
           POSTGRES_PASSWORD: postgres
         options: >-
@@ -29,7 +34,7 @@ jobs:
         ports:
           - 5432/tcp
       postgres12:
-        image: postgres:12
+        image: postgres:12@sha256:8ffdca6e9208aceb30653fa0cc1c38956303ace453944b54b4f71019cfe854c1
         env:
           POSTGRES_PASSWORD: postgres
         options: >-
@@ -40,7 +45,7 @@ jobs:
         ports:
           - 5432/tcp
       mysql8:
-        image: mysql:8
+        image: mysql:8@sha256:2a9ef1075ff30c65bbcf4f96b25a03ea3b3f492c284e6c4a612c269ce4c5bb19
         env:
           MYSQL_ROOT_PASSWORD: root
         options: >-
@@ -53,22 +58,22 @@ jobs:
 
     env:
       CI: true
-      NODE_OPTIONS: --max-old-space-size=4096
+      NODE_OPTIONS: ${{ matrix.node-version == '20.x' && '--max-old-space-size=4096 --no-node-snapshot' || '--max-old-space-size=4096' }}
       INTEGRATION_TEST_GITHUB_TOKEN: ${{ secrets.INTEGRATION_TEST_GITHUB_TOKEN }}
       INTEGRATION_TEST_GITLAB_TOKEN: ${{ secrets.INTEGRATION_TEST_GITLAB_TOKEN }}
       INTEGRATION_TEST_BITBUCKET_TOKEN: ${{ secrets.INTEGRATION_TEST_BITBUCKET_TOKEN }}
       INTEGRATION_TEST_AZURE_TOKEN: ${{ secrets.INTEGRATION_TEST_AZURE_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 
@@ -76,6 +81,7 @@ jobs:
         run: git fetch origin '${{ github.event.before }}'
 
       - name: Check if release
+        if: inputs.force_release != true
         id: release_check
         run: node scripts/check-if-release.js
         env:
@@ -124,7 +130,7 @@ jobs:
   release:
     needs: build
 
-    if: needs.build.outputs.needs_release == 'true'
+    if: needs.build.outputs.needs_release == 'true' || inputs.force_release == true
 
     runs-on: ubuntu-latest
 
@@ -138,19 +144,19 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 
@@ -190,7 +196,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
 
       - name: Dispatch repository event
-        uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570 # v2.1.2
+        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
         with:
           token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
           event-type: release-published

.github/workflows/issue.yaml

@@ -10,9 +10,9 @@ jobs:
     if: github.repository == 'backstage/backstage'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: Issue sync
-        uses: backstage/actions/issue-sync@v0.6.5
+        uses: backstage/actions/issue-sync@a674369920067381b450d398b27df7039b7ef635 # v0.6.5

.github/workflows/pr-review-comment-trigger.yaml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
@@ -30,7 +30,7 @@ jobs:
         run: |
           mkdir -p ./pr
           echo $PR_NUMBER > ./pr/pr_number
-      - uses: actions/upload-artifact@v3.1.3
+      - uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: pr_number-${{ github.event.pull_request.number }}
           path: pr/

.github/workflows/pr-review-comment.yaml

@@ -17,13 +17,13 @@ jobs:
     steps:
       # Inspired by https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: Read PR Number
         id: pr-number
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
@@ -40,7 +40,7 @@ jobs:
             const prNumber = artifact.name.slice('pr_number-'.length)
             core.setOutput('pr-number', prNumber);
 
-      - uses: backstage/actions/re-review@v0.6.5
+      - uses: backstage/actions/re-review@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }}
           private-key: ${{ secrets.BACKSTAGE_GOALIE_PRIVATE_KEY }}

.github/workflows/pr.yaml

@@ -18,12 +18,12 @@ jobs:
     if: github.repository == 'backstage/backstage' && ( github.event.pull_request || github.event.issue.pull_request )
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: PR sync
-        uses: backstage/actions/pr-sync@v0.6.5
+        uses: backstage/actions/pr-sync@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN  }}
           app-id: ${{ secrets.BACKSTAGE_GOALIE_APPLICATION_ID }}

.github/workflows/scorecard.yml

@@ -29,12 +29,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: 'Checkout code'
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           persist-credentials: false
 
@@ -58,7 +58,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: 'Upload artifact'
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: SARIF file
           path: results.sarif
@@ -66,6 +66,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@b7bf0a3ed3ecfa44160715d7c442788f65f0f923 # v3.23.2
+        uses: github/codeql-action/upload-sarif@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
         with:
           sarif_file: results.sarif

.github/workflows/sync_code-formatting.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
@@ -20,12 +20,12 @@ jobs:
           fetch-depth: 0
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 

.github/workflows/sync_dependabot-changesets.yml

@@ -11,12 +11,12 @@ jobs:
     if: github.actor == 'dependabot[bot]' && github.repository == 'backstage/backstage'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 2
           ref: ${{ github.head_ref }}
@@ -26,7 +26,7 @@ jobs:
           git config --global user.email noreply@backstage.io
           git config --global user.name 'Github changeset workflow'
       - name: Generate changeset
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const { promises: fs } = require('fs');

.github/workflows/sync_release-manifest.yml

@@ -8,12 +8,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       # Setup node & install deps before checkout, keeping install quick
-      - uses: actions/setup-node@v4.0.1
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: 18.x
       - name: Install dependencies
@@ -21,7 +21,7 @@ jobs:
         run: npm install semver@7.3.5 fs-extra@10.0.0 @manypkg/get-packages@1.1.1
 
       - name: Checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           path: backstage
           # 'v' prefix is added here for the tag, we keep it out of the manifest logic
@@ -29,7 +29,7 @@ jobs:
 
       # Checkout backstage/versions into /backstage/versions, which is where store the output
       - name: Checkout versions
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           repository: backstage/versions
           path: backstage/versions
@@ -53,7 +53,7 @@ jobs:
           git push
 
       - name: Dispatch update-helper update
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           github-token: ${{ secrets.GH_SERVICE_ACCOUNT_TOKEN }}
           # TODO(Rugvip): Remove the create-app dispatch once we've been on the release version for a while

.github/workflows/sync_renovate-changesets.yml

@@ -11,12 +11,12 @@ jobs:
     if: github.actor == 'renovate[bot]' && github.repository == 'backstage/backstage'
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 2
           ref: ${{ github.head_ref }}
@@ -26,7 +26,7 @@ jobs:
           git config --global user.email noreply@backstage.io
           git config --global user.name 'Github changeset workflow'
       - name: Generate changeset
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const { promises: fs } = require("fs");

.github/workflows/sync_snyk-github-issues.yml

@@ -12,19 +12,19 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: use node.js 18.x
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: 18.x
           registry-url: https://registry.npmjs.org/ # Needed for auth
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v18.x
 

.github/workflows/sync_snyk-monitor.yml

@@ -25,11 +25,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Monitor and Synchronize Snyk Policies
         uses: snyk/actions/node@1d672a455ab3339ef0a0021e1ec809165ee12fad # master
         with:
@@ -58,6 +58,6 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
           NODE_OPTIONS: --max-old-space-size=7168
       - name: Upload Snyk report
-        uses: github/codeql-action/upload-sarif@v3.23.2
+        uses: github/codeql-action/upload-sarif@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
         with:
           sarif_file: snyk.sarif

.github/workflows/sync_version-packages.yml

@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 20000
           fetch-tags: true
@@ -26,7 +26,7 @@ jobs:
       - name: Install Dependencies
         run: yarn --immutable
       - name: Create Release Pull Request
-        uses: backstage/changesets-action@v2.1.0
+        uses: backstage/changesets-action@99063c276a7f12e024cb310e7a05a3a5b89449f8 # v2.1.0
         with:
           # Calls out to `changeset version`, but also runs prettier
           version: yarn release

.github/workflows/uffizzi-build.yml

@@ -26,21 +26,21 @@ jobs:
       tags: ${{ steps.meta.outputs.tags }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: checkout
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: setup-node
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: 18.x
           registry-url: https://registry.npmjs.org/
 
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: linux-v18
 
@@ -61,7 +61,7 @@ jobs:
 
       - name: Docker metadata
         id: meta
-        uses: docker/metadata-action@dbef88086f6cef02e264edb7dbf63250c17cef6c # v5.5.0
+        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
         with:
           images: registry.uffizzi.com/${{ env.UUID_TAG_APP }}
           tags: type=raw,value=60d
@@ -84,12 +84,12 @@ jobs:
       - build-backstage
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: Checkout git repo
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Render Compose File
         run: |
           # update image after the build above
@@ -98,13 +98,13 @@ jobs:
           kustomize build . > manifests.rendered.yml
           cat manifests.rendered.yml
       - name: Upload Rendered Manifests File as Artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3
         with:
           name: preview-spec
           path: ./.github/uffizzi/k8s/manifests/manifests.rendered.yml
           retention-days: 2
       - name: Upload PR Event as Artifact
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: preview-spec
           path: ${{ github.event_path }}
@@ -116,13 +116,13 @@ jobs:
     if: ${{ github.event.action == 'closed' }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       # If this PR is closing, we will not render a compose file nor pass it to the next workflow.
       - name: Upload PR Event as Artifact
-        uses: actions/upload-artifact@v3.1.3
+        uses: actions/upload-artifact@a8a3f3ad30e3422c9c7b888a15615d19a852ae32 # v3.1.3
         with:
           name: preview-spec
           path: ${{ github.event_path }}

.github/workflows/uffizzi-preview.yaml

@@ -23,7 +23,7 @@ jobs:
       action: ${{ steps.event.outputs.ACTION }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           disable-sudo: true
           egress-policy: block
@@ -32,7 +32,7 @@ jobs:
 
       - name: 'Download artifacts'
         # Fetch output (zip archive) from the workflow run that triggered this workflow.
-        uses: actions/github-script@v7.0.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             let allArtifacts = await github.rest.actions.listWorkflowRunArtifacts({
@@ -76,7 +76,7 @@ jobs:
 
       - name: Cache Manifests File
         if: ${{ steps.event.outputs.ACTION != 'closed' }}
-        uses: actions/cache@v4.0.0
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4.0.0
         with:
           path: manifests.rendered.yml
           key: ${{ steps.hash.outputs.MANIFESTS_FILE_HASH }}
@@ -102,11 +102,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       # Identify comment to be updated
       - name: Find comment for Ephemeral Environment
-        uses: peter-evans/find-comment@v2
+        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2
         id: find-comment
         with:
           issue-number: ${{ needs.cache-manifests-file.outputs.pr-number }}
@@ -117,7 +117,7 @@ jobs:
       # Create/Update comment with action deployment status
       - name: Create or Update Comment with Deployment Notification
         id: notification
-        uses: peter-evans/create-or-update-comment@v3
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ needs.cache-manifests-file.outputs.pr-number }}
@@ -140,7 +140,7 @@ jobs:
 
       - name: Fetch cached Manifests File
         id: cache
-        uses: actions/cache@v4
+        uses: actions/cache@13aacd865c20de90d75de3b17ebe84f7a17d57d2 # v4
         with:
           path: manifests.rendered.yml
           key: ${{ needs.cache-manifests-file.outputs.manifests-cache-key }}
@@ -165,7 +165,7 @@ jobs:
           echo "Access the \`backstage\` endpoint at [\`${BACKSTAGE_HOST}\`](http://${BACKSTAGE_HOST})" >> $GITHUB_STEP_SUMMARY
 
       - name: Create or Update Comment with Deployment URL
-        uses: peter-evans/create-or-update-comment@v3
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         with:
           comment-id: ${{ steps.notification.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}
@@ -209,7 +209,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Delete Virtual Cluster
         uses: UffizziCloud/cluster-action@main
@@ -220,7 +220,7 @@ jobs:
 
       # Identify comment to be updated
       - name: Find comment for Ephemeral Environment
-        uses: peter-evans/find-comment@v2
+        uses: peter-evans/find-comment@a54c31d7fa095754bfef525c0c8e5e5674c4b4b1 # v2
         id: find-comment
         with:
           issue-number: ${{ needs.cache-manifests-file.outputs.pr-number }}
@@ -229,7 +229,7 @@ jobs:
           direction: last
 
       - name: Update Comment with Deletion
-        uses: peter-evans/create-or-update-comment@v3
+        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ needs.cache-manifests-file.outputs.pr-number }}

.github/workflows/verify_accessibility-noop.yml

@@ -7,7 +7,7 @@ on:
     branches: [master]
     paths-ignore:
       - 'lighthouserc.js'
-      - '.github/workflows/verify_accessibility_core.yml'
+      - '.github/workflows/verify_accessibility.yml'
       - 'plugins/catalog/src/**'
       - 'plugins/catalog-react/src/**'
       - 'plugins/techdocs/src/**'
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 

.github/workflows/verify_accessibility.yml

@@ -1,11 +1,11 @@
 name: Accessibility
 on:
-  # NOTE: If you change these you must update verify_accessibility_core-noop.yml as well
+  # NOTE: If you change these you must update verify_accessibility-noop.yml as well
   pull_request:
     branches: [master]
     paths:
       - 'lighthouserc.js'
-      - '.github/workflows/verify_accessibility_core.yml'
+      - '.github/workflows/verify_accessibility.yml'
       - 'plugins/catalog/src/**'
       - 'plugins/catalog-react/src/**'
       - 'plugins/techdocs/src/**'
@@ -20,17 +20,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: Use Node.js 18.x
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: 18.x
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v18.x
       - name: run Lighthouse CI

.github/workflows/verify_codeql.yml

@@ -42,12 +42,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
       - name: Checkout repository
-        uses: actions/checkout@v4.1.1
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           # We must fetch at least the immediate parents so that if this is
           # a pull request then we can checkout the head.
@@ -55,7 +55,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.23.2
+        uses: github/codeql-action/init@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -66,7 +66,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3.23.2
+        uses: github/codeql-action/autobuild@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -80,4 +80,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.23.2
+        uses: github/codeql-action/analyze@e8893c57a1f3a2b659b6b55564fdfdbbd2982911 # v3.24.0

.github/workflows/verify_docs-quality.yml

@@ -12,11 +12,11 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       # Vale does not support file excludes, so we use the script to generate a list of files instead
       # The action also does not allow args or a local config file to be passed in, so the files array

.github/workflows/verify_e2e-kubernetes-noop.yml

@@ -23,7 +23,7 @@ jobs:
     name: Kubernetes ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 

.github/workflows/verify_e2e-kubernetes.yml

@@ -22,20 +22,20 @@ jobs:
     name: Kubernetes ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
 
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 

.github/workflows/verify_e2e-linux-noop.yml

@@ -29,7 +29,7 @@ jobs:
     name: E2E Linux ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 

.github/workflows/verify_e2e-linux.yml

@@ -19,7 +19,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:12
+        image: postgres:12@sha256:8ffdca6e9208aceb30653fa0cc1c38956303ace453944b54b4f71019cfe854c1
         env:
           POSTGRES_USER: postgres
           POSTGRES_PASSWORD: postgres
@@ -41,11 +41,11 @@ jobs:
     name: E2E Linux ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Configure Git
         run: |
@@ -53,12 +53,12 @@ jobs:
           git config --global user.name 'GitHub e2e user'
 
       - name: use node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v4.0.1
+        uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8 # v4.0.1
         with:
           node-version: ${{ matrix.node-version }}
           registry-url: https://registry.npmjs.org/ # Needed for auth
       - name: yarn install
-        uses: backstage/actions/yarn-install@v0.6.5
+        uses: backstage/actions/yarn-install@a674369920067381b450d398b27df7039b7ef635 # v0.6.5
         with:
           cache-prefix: ${{ runner.os }}-v${{ matrix.node-version }}
 

.github/workflows/verify_e2e-techdocs.yml

@@ -30,12 +30,12 @@ jobs:
     name: Techdocs
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v4.1.1
-      - uses: actions/setup-python@v5.0.0
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
         with:
           python-version: '3.9'
 

.github/workflows/verify_e2e-windows-noop.yml

@@ -25,7 +25,7 @@ jobs:
     name: E2E Windows ${{ matrix.node-version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
+        uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
           egress-policy: audit