* fix(auth-backend): harden default allowed patterns for CIMD and DCR
Signed-off-by: benjdlambert <ben@blam.sh>
* address PR review feedback for OIDC defaults
- narrow CLI client ID pattern to exact cli.json path
- add BREAKING prefix to changeset
- add IPv6 [::1] to docs examples
- add loopback redirect URI tests for IPv6 and 127.0.0.1
Signed-off-by: benjdlambert <ben@blam.sh>
* remove dead ['*'] fallback when features are disabled
The restrictive defaults are now always used regardless of the enabled
flag, since the patterns are only consulted on code paths that require
the feature to be enabled.
Signed-off-by: benjdlambert <ben@blam.sh>
* add default pattern tests and fix docs cli example
Signed-off-by: benjdlambert <ben@blam.sh>
* use URL constructor for CLI client ID
Signed-off-by: benjdlambert <ben@blam.sh>
* use string templating for cliClientId to match OidcRouter
Signed-off-by: benjdlambert <ben@blam.sh>
* fix docs: remove misleading CLI client_id URL example
Signed-off-by: benjdlambert <ben@blam.sh>
---------
Signed-off-by: benjdlambert <ben@blam.sh>
Add least-privilege permissions blocks to three workflows that use
pull_request_target without explicit permission scoping:
- sync_renovate-changesets: contents:write + pull-requests:write
- sync_dependabot-changesets: contents:write + pull-requests:write
- sync_pull-requests-trigger: all none (only uploads artifacts)
These workflows run in the base repo context and have access to secrets.
Explicit permissions ensure the GITHUB_TOKEN is scoped to only what each
workflow needs, reducing blast radius if a guard is ever bypassed.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Fredrik Adelöw <freben@gmail.com>
Introduces a Combobox component to Backstage UI for times when you want to allow users to choose from a list of values but also specify their own in some cases.
---------
Signed-off-by: James Brooks <jamesbrooks@spotify.com>
Introduces a new Backstage backend module that incrementally ingests
users and groups from Microsoft Graph one page at a time, using the
incremental ingestion framework.
Unlike MicrosoftGraphOrgEntityProvider, this module never holds the
full dataset in memory. Each burst processes a single page (up to 999
items), making it suitable for large Azure AD tenants where the
full-scan provider causes memory pressure or OOM failures.
The @odata.nextLink cursor is persisted in the incremental ingestion
marks table, so a pod restart during ingestion resumes from the last
completed page rather than starting over.
Signed-off-by: pillaris <pillaris@adobe.com>
* docs: frontend plugin golden path guide
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* add changeset
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* Apply suggestion from @aramissennyeydd
Signed-off-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix template
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix template test
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* print stderr on failure
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* try writing directly
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* maybe this?
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* address feedback
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix: avoid destructuring FetchApi and fix template issues
- Use fetchApi.fetch() instead of destructuring to preserve this binding
- Add discoveryApi and fetchApi to useAsync dependency array
- Use react-use/esm/useAsync to match repo conventions
- Replace waitFor + getAllByText with findByText in error test
- Update HTTP client doc to match template changes
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix: address docs review feedback
- Use stronger guidance tone in scaffolding guide intro
- Slim down file tree to show folder structure only
- Mention that plugin path depends on chosen plugin ID
- Link to installation docs for non-discovery case
- Quote page:todo YAML key to avoid parse errors
- Remove "new" from "new frontend system" in template README
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix: improve error handling in e2e plugin creation
- Narrow error to non-null object before using in operator
- Also write error.stdout since tools like Jest report to stdout
- Avoid variable shadowing with outer scope stdout/stderr
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* revert: keep destructured fetch from FetchApi
Destructuring fetch from FetchApi is fine — revert to original
pattern while keeping the dependency array and other fixes.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* feat: use @backstage/ui components in frontend plugin template
Replace core-components layout and table with @backstage/ui equivalents:
- Use HeaderPage and Container instead of Page, Header, Content, ContentHeader
- Use BUI Table with useTable and CellText instead of core-components Table
- Add @backstage/ui to template package.json dependencies
- Update poking-around docs to reflect BUI component usage
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix: add example data when backend request fails
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* better logging setup
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* address feedback
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* better config driven example
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* debug logs
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* fix build failure related to unknown version
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* revert e2e run changes
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
* skip the discovery api for now
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* remove another ref
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
* Apply suggestions from code review
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
---------
Signed-off-by: aramissennyeydd <aramis.sennyey@doordash.com>
Signed-off-by: Aramis Sennyey <159921952+aramissennyeydd@users.noreply.github.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
* workflows: add Discord notification for ready PRs
Adds a new workflow that posts to Discord whenever a pull request is
opened as non-draft or marked as ready for review. Uses jq to safely
construct the JSON payload and sends it via curl to a webhook URL
stored in repository secrets.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
* workflows: harden Discord webhook notification
Add early guard for missing webhook secret, disable Discord mention
parsing to prevent abuse via PR titles/bodies, and check the HTTP
response to surface webhook failures.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
* workflows: upgrade github-script to v8 and truncate embed title
Align actions/github-script pin with the rest of the repo (v8.0.0)
and truncate the Discord embed title to the 256-character limit to
prevent webhook failures on long PR titles.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
---------
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Replace the third-party Discord notification action with inline
`actions/github-script@v8` steps that post to the Discord webhook
directly using fetch. This removes a third-party action dependency
and adds explicit error handling for missing secrets and failed
webhook requests.
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Add three new skill documents for migrating to the new Backstage frontend system:
- App migration (old app-defaults to new frontend-defaults)
- Plugin dual-support (adding new system support while keeping old system working)
- Plugin full migration (completely moving to the new frontend system)
Signed-off-by: Patrik Oldsberg <poldsberg@gmail.com>
Made-with: Cursor
Ben Lambert