Merge pull request #33303 from backstage/blam/actions-permissions

`feat(actions)`: Add support for defining permissions at the action level

.changeset/actions-permissions-api.md

@@ -0,0 +1,30 @@
+---
+'@backstage/backend-plugin-api': minor
+---
+
+Added optional `visibilityPermission` field to `ActionsRegistryActionOptions`, allowing actions to declare a `BasicPermission` that controls visibility and access.
+
+```typescript
+import { createPermission } from '@backstage/plugin-permission-common';
+
+const myPermission = createPermission({
+  name: 'myPlugin.myAction.use',
+  attributes: {},
+});
+
+actionsRegistry.register({
+  name: 'my-action',
+  title: 'My Action',
+  description: 'An action that requires permission',
+  visibilityPermission: myPermission,
+  schema: {
+    input: z => z.object({ name: z.string() }),
+    output: z => z.object({ ok: z.boolean() }),
+  },
+  action: async ({ input }) => {
+    return { output: { ok: true } };
+  },
+});
+```
+
+Actions without a `visibilityPermission` field continue to work as before.

.changeset/actions-permissions-defaults.md

@@ -0,0 +1,5 @@
+---
+'@backstage/backend-defaults': patch
+---
+
+Added permissions integration to the actions registry. Actions registered with a `visibilityPermission` field are now checked against the permissions framework when listing and invoking. Denied actions are filtered from list results, and invoking a denied action returns a `404 Not Found` as if the action does not exist. Permissions are automatically registered with the `PermissionsRegistryService` so they appear in the permission policy system.