The actions/setup-node@v6.4.0 upgrade stopped auto-shimming yarn onto
PATH via corepack. The yarn-plugin test spawns yarn via Node's
child_process.spawn() which does a raw PATH lookup, causing
ENOENT failures. Adding corepack: true ensures the yarn shim is
available.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Renovate deprecated matchPackagePatterns. The new matchPackageNames
accepts regex patterns wrapped in / delimiters. All other changes
in this PR (quote style, comment removal) were cosmetic and have
been reverted.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
* feat(skill): automatically onboard to openapi tooling
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* test skill against notifications backend
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* update URLs to point to main repo and describe multiple client types
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* address PR feedback
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* revert erroneous changes
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* add changeset
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* address review feedback: skill doc fixes and entityRef schema dedup
Disambiguate generated entityRef/orderField types and correct skill
guidance on operationId casing and OpenAPI version support.
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* note in skill that handler-side validation should be stripped
Reviewers may forget that manual InputError guards and primitive-type
checks become dead weight once the OpenAPI validator runs.
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
---------
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
The env vars used lowercase postgres18/postgres14 instead of uppercase
POSTGRES18/POSTGRES14, which didn't match the names expected by
TestDatabases. This caused all postgres-only test suites to see no
available databases and crash.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
* fix(auth-backend): harden default allowed patterns for CIMD and DCR
Signed-off-by: benjdlambert <ben@blam.sh>
* address PR review feedback for OIDC defaults
- narrow CLI client ID pattern to exact cli.json path
- add BREAKING prefix to changeset
- add IPv6 [::1] to docs examples
- add loopback redirect URI tests for IPv6 and 127.0.0.1
Signed-off-by: benjdlambert <ben@blam.sh>
* remove dead ['*'] fallback when features are disabled
The restrictive defaults are now always used regardless of the enabled
flag, since the patterns are only consulted on code paths that require
the feature to be enabled.
Signed-off-by: benjdlambert <ben@blam.sh>
* add default pattern tests and fix docs cli example
Signed-off-by: benjdlambert <ben@blam.sh>
* use URL constructor for CLI client ID
Signed-off-by: benjdlambert <ben@blam.sh>
* use string templating for cliClientId to match OidcRouter
Signed-off-by: benjdlambert <ben@blam.sh>
* fix docs: remove misleading CLI client_id URL example
Signed-off-by: benjdlambert <ben@blam.sh>
---------
Signed-off-by: benjdlambert <ben@blam.sh>
Adds a structured set of 11 query scenarios covering the main catalog
database access patterns: paginated listings, counts, facets, entity
lookups, full-text search, ancestry traversal, stitching reference
counts, and orphan detection.
Each scenario documents the SQL, what a healthy plan looks like, and
what anti-patterns to watch for. The baseline records execution times
and plan shapes from the staging database (545K entities, 13.8M search
rows).
This is intended to be run by humans or AI agents before and after
database-affecting changes to detect performance regressions. It lives
alongside the existing performance tests.
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Add least-privilege permissions blocks to three workflows that use
pull_request_target without explicit permission scoping:
- sync_renovate-changesets: contents:write + pull-requests:write
- sync_dependabot-changesets: contents:write + pull-requests:write
- sync_pull-requests-trigger: all none (only uploads artifacts)
These workflows run in the base repo context and have access to secrets.
Explicit permissions ensure the GITHUB_TOKEN is scoped to only what each
workflow needs, reducing blast radius if a guard is ever bypassed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Introduces a Combobox component to Backstage UI for times when you want to allow users to choose from a list of values but also specify their own in some cases.
---------
Signed-off-by: James Brooks <jamesbrooks@spotify.com>
Introduces a new Backstage backend module that incrementally ingests
users and groups from Microsoft Graph one page at a time, using the
incremental ingestion framework.
Unlike MicrosoftGraphOrgEntityProvider, this module never holds the
full dataset in memory. Each burst processes a single page (up to 999
items), making it suitable for large Azure AD tenants where the
full-scan provider causes memory pressure or OOM failures.
The @odata.nextLink cursor is persisted in the incremental ingestion
marks table, so a pod restart during ingestion resumes from the last
completed page rather than starting over.
Signed-off-by: pillaris <pillaris@adobe.com>
* docs: frontend plugin golden path guide
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* add changeset
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* Apply suggestion from @aramissennyeydd
Signed-off-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix template
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix template test
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* print stderr on failure
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* try writing directly
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* maybe this?
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* address feedback
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix: avoid destructuring FetchApi and fix template issues
- Use fetchApi.fetch() instead of destructuring to preserve this binding
- Add discoveryApi and fetchApi to useAsync dependency array
- Use react-use/esm/useAsync to match repo conventions
- Replace waitFor + getAllByText with findByText in error test
- Update HTTP client doc to match template changes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix: address docs review feedback
- Use stronger guidance tone in scaffolding guide intro
- Slim down file tree to show folder structure only
- Mention that plugin path depends on chosen plugin ID
- Link to installation docs for non-discovery case
- Quote page:todo YAML key to avoid parse errors
- Remove "new" from "new frontend system" in template README
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix: improve error handling in e2e plugin creation
- Narrow error to non-null object before using in operator
- Also write error.stdout since tools like Jest report to stdout
- Avoid variable shadowing with outer scope stdout/stderr
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* revert: keep destructured fetch from FetchApi
Destructuring fetch from FetchApi is fine — revert to original
pattern while keeping the dependency array and other fixes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* feat: use @backstage/ui components in frontend plugin template
Replace core-components layout and table with @backstage/ui equivalents:
- Use HeaderPage and Container instead of Page, Header, Content, ContentHeader
- Use BUI Table with useTable and CellText instead of core-components Table
- Add @backstage/ui to template package.json dependencies
- Update poking-around docs to reflect BUI component usage
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix: add example data when backend request fails
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* better logging setup
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* address feedback
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* better config driven example
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* debug logs
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix build failure related to unknown version
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* revert e2e run changes
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
* skip the discovery api for now
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* remove another ref
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
---------
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
Signed-off-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* workflows: add Discord notification for ready PRs
Adds a new workflow that posts to Discord whenever a pull request is
opened as non-draft or marked as ready for review. Uses jq to safely
construct the JSON payload and sends it via curl to a webhook URL
stored in repository secrets.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
* workflows: harden Discord webhook notification
Add early guard for missing webhook secret, disable Discord mention
parsing to prevent abuse via PR titles/bodies, and check the HTTP
response to surface webhook failures.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
* workflows: upgrade github-script to v8 and truncate embed title
Align actions/github-script pin with the rest of the repo (v8.0.0)
and truncate the Discord embed title to the 256-character limit to
prevent webhook failures on long PR titles.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
---------
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Replace the third-party Discord notification action with inline
`actions/github-script@v8` steps that post to the Discord webhook
directly using fetch. This removes a third-party action dependency
and adds explicit error handling for missing secrets and failed
webhook requests.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Fredrik Adelöw