chore(backstage): embed upstream backstage chart as subtree [RHIDP-12534]

[rm3l]

Description of the change

This PR embeds the upstream Backstage Helm chart as Git subtree in a local directory. This is done so we can have better control over the templates in RHDH 1.10, which is needed to address the requirements we have for Lightspeed GA integration (RHDHPLAN-373) as well as multi-plugin catalog index support (RHIDP-12374).
And to keep up with any changes upstream, it also adds a nightly workflow that keeps the subtree in sync,

Which issue(s) does this PR fix or relate to

• Fixes RHIDP-12534

How to test changes / Special notes to the reviewer

This remains backward-compatible in 1.10, as confirmed by the in-place upgrade tests passing in CI.

Also see the CONTRIBUTING.md file added with a special section about managing this subtree with Git.

Checklist

• For each Chart updated, version bumped in the corresponding Chart.yaml according to Semantic Versioning.
• For each Chart updated, variables are documented in the values.yaml and added to the corresponding README.md. The pre-commit utility can be used to generate the necessary content. Run pre-commit run --all-files to run the hooks and then push any resulting changes. The pre-commit Workflow will enforce this and warn you if needed.
• JSON Schema template updated and re-generated the raw schema via the pre-commit hook.
• Tests pass using the Chart Testing tool and the ct lint command.
• If you updated the orchestrator-infra chart, make sure the versions of the Knative CRDs are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the values.yaml file. See Installing Knative Eventing and Knative Serving CRDs for more details.

[rhdh-qodo-merge]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 RHIDP-12534 - Partially compliant Compliant requirements: Update the charts/backstage chart to depend on the local vendored chart rather than the upstream chart repository. Bump the Backstage chart version as part of the change. Ensure tooling that processes charts (JSON schema dereference, Helm docs generation) skips the vendored chart content as needed. Non-compliant requirements: Embed the upstream Backstage Helm chart into this repository as a vendored subtree so templates can be controlled locally. Provide contributor documentation explaining how the upstream chart dependency/subtree sync is handled. Add CI automation (e.g., nightly workflow) to sync the subtree with the upstream Backstage chart. Requires further human verification: Embed the upstream Backstage Helm chart into this repository as a vendored subtree so templates can be controlled locally. Provide contributor documentation explaining how the upstream chart dependency/subtree sync is handled. Add CI automation (e.g., nightly workflow) to sync the subtree with the upstream Backstage chart. Ensure tooling that processes charts (JSON schema dereference, Helm docs generation) skips the vendored chart content as needed.

⏱️ Estimated effort to review: 4 🔵🔵🔵🔵⚪

🔒 Security concerns Potential supply-chain / external fetch risk: the vendored schema templates include $ref URLs to raw GitHub content (e.g., https://raw.githubusercontent.com/...). If the dereference tooling resolves remote refs during CI/pre-commit, it can introduce non-hermetic builds and exposure to unexpected remote content. Consider pinning/hosting referenced schemas locally, or ensuring dereferencing is done in a controlled/offline manner (or with an allowlist of hosts).

⚡ Recommended focus areas for review Possible Issue should_skip() compares chart (likely a relative path like charts/backstage/...) against Path(prefix) entries that are also relative, but may not normalize consistently (e.g., ./charts/... vs charts/..., or different path resolutions depending on where the script is executed). This can cause vendored charts to be processed unintentionally. Consider normalizing both sides (e.g., resolve() or absolute() with consistent base) before doing parent checks. def should_skip(chart: Path, skip_paths: List[str]) -> bool: for prefix in skip_paths: if chart == Path(prefix) or Path(prefix) in chart.parents: return True return False if __name__ == '__main__': all_charts = [p.parent for p in Path(".").rglob(CHART_LOCK)] skipped = {c for c in all_charts if should_skip(c, DEFAULT_SKIP_PATHS)} if skipped: print(f"Skipping {len(skipped)} chart(s) matching skip list: {', '.join(str(c) for c in skipped)}") charts = [c for c in all_charts if not should_skip(c, DEFAULT_SKIP_PATHS)] errors: List[BaseException] = [] for chart in charts: Cleanup argparse is imported but not used. Either remove the import or actually wire DEFAULT_SKIP_PATHS to CLI flags (which would also make the skip list more flexible for future vendored content). import argparse import json from typing import List, Dict, Any from pathlib import Path import jsonref import yaml try: from yaml import CLoader as Loader except ImportError: from yaml import Loader from jinja2 import Template JSONSCHEMA_TEMPLATE_NAME = "values.schema.tmpl.json" JSONSCHEMA_NAME = "values.schema.json" VALUES_FILE = "values.yaml" CHART_LOCK = "Chart.lock" DEFAULT_SKIP_PATHS = [ "charts/backstage/vendor", ] def read_yaml(file_path: Path):

📄 References redhat-developer/rhdh-chart/charts/backstage/values.yaml [6-15] redhat-developer/rhdh-chart/charts/backstage/values.yaml [40-55] redhat-developer/rhdh-chart/charts/backstage/values.yaml [33-39] redhat-developer/rhdh-chart/charts/backstage/values.yaml [396-404] redhat-developer/rhdh-chart/charts/backstage/ci/with-orchestrator-and-dynamic-plugins-npmrc-values.yaml [1-24] redhat-developer/rhdh-chart/charts/backstage/ci/with-orchestrator-values.yaml [1-21] redhat-developer/rhdh-chart/charts/backstage/templates/sonataflows.yaml [0-2] redhat-developer/rhdh-chart/charts/orchestrator-software-templates-infra/ci/upstream-values.yaml [1-27]

[rhdh-qodo-merge]

PR Type

(Describe updated until commit 04a8d8e)

Enhancement, Documentation

---

Description

• Embeds upstream Backstage Helm chart as a Git subtree in charts/backstage/vendor/backstage/ directory for better control over templates in RHDH 1.10

• Updates charts/backstage/Chart.yaml to reference the local vendored Backstage chart instead of remote repository, with version bump from 5.4.0 to 5.5.0

• Adds comprehensive Backstage Helm chart templates including Deployment, Service, Ingress, ServiceAccount, HPA, PDB, NetworkPolicy, and ServiceMonitor resources

• Includes complete chart documentation with values schema, README, and configuration examples for Backstage deployment

• Adds nightly GitHub Actions workflow (.github/workflows/sync-upstream-backstage.yaml) to automatically sync upstream Backstage chart changes via git subtree

• Configures tooling to exclude vendored chart from analysis and updates: Renovate, SonarCloud, Helm docs generation, and pre-commit hooks

• Adds CONTRIBUTING.md with Git Subtree workflow documentation for managing upstream Backstage dependency

• Updates pre-commit configuration to skip vendor charts in JSON schema dereferencing and adds Helm dependency update hook

• Includes upstream Backstage chart CI/CD workflows, configuration files, and test values for various deployment scenarios

• Maintains backward compatibility with existing 1.10 deployments as confirmed by in-place upgrade tests

---

File Walkthrough

	Relevant files
Enhancement	17 files jsonschema_dereference.py Add JSON Schema dereferencing utility for Backstage            charts/backstage/vendor/backstage/.pre-commit/jsonschema_dereference.py New Python module for dereferencing JSON Schema templates Searches for values.schema.tmpl.json files and dereferences $refs Outputs dereferenced schemas to values.schema.json files Uses jsonref library to process schema references +54/-0    jsonschema-dereference.py Skip vendor charts in JSON schema dereferencing                    .pre-commit/jsonschema-dereference.py Added DEFAULT_SKIP_PATHS list to exclude vendor charts from processing Implemented should_skip() function to check if chart paths match skip list Modified main logic to filter out charts in charts/backstage/vendor directory Added informational output when skipping charts +15/-1    values.schema.tmpl.json Add Backstage Helm chart JSON Schema template                        charts/backstage/vendor/backstage/charts/backstage/values.schema.tmpl.json New comprehensive JSON Schema template for Backstage Helm chart values Defines schema for global, ingress, backstage, service, and PostgreSQL configurations Includes references to Kubernetes API definitions for complex types Documents all configurable parameters with titles, descriptions, and defaults +988/-0  values.yaml Add Backstage Helm chart default values                                    charts/backstage/vendor/backstage/charts/backstage/values.yaml New default values file for Backstage Helm chart Defines configuration for global settings, ingress, backstage deployment, service, and PostgreSQL Includes comprehensive documentation comments for each parameter Sets sensible defaults for replicas, image registry, ports, and probes +504/-0  backstage-deployment.yaml Add Backstage Kubernetes Deployment template                          charts/backstage/vendor/backstage/charts/backstage/templates/backstage-deployment.yaml New Kubernetes Deployment template for Backstage application Configures container image, environment variables, probes, and resource limits Supports PostgreSQL integration with automatic credential injection Includes volume mounts for app configuration and extra containers support +188/-0  README.md Update chart version and dependency source to vendored Backstage charts/backstage/README.md Updated chart version from 5.4.0 to 5.5.0 Removed reference to upstream Backstage Helm chart repository Changed dependency source from remote chart repository to local vendored path file://./vendor/backstage/charts/backstage/ +3/-6      _helpers.tpl Add Backstage Helm template helpers                                            charts/backstage/vendor/backstage/charts/backstage/templates/_helpers.tpl Added Helm template helpers for Backstage chart Includes functions for image rendering, service account, PostgreSQL configuration +74/-0    serviceaccount.yaml Add Backstage ServiceAccount template                                        charts/backstage/vendor/backstage/charts/backstage/templates/serviceaccount.yaml Added ServiceAccount template for Backstage deployment Supports custom labels, annotations, and automount configuration +19/-0    service.yaml Add Backstage Service template                                                      charts/backstage/vendor/backstage/charts/backstage/templates/service.yaml Added Service template for Backstage application Supports multiple service types, load balancer configuration, and IP families +58/-0    ingress.yaml Add Backstage Ingress template                                                      charts/backstage/vendor/backstage/charts/backstage/templates/ingress.yaml Added Ingress template for Backstage application Supports TLS, multiple hosts, and custom ingress class configuration +57/-0    app-config-configmap.yaml Add Backstage app configuration ConfigMap template              charts/backstage/vendor/backstage/charts/backstage/templates/app-config-configmap.yaml Added ConfigMap template for Backstage application configuration Renders app-config.yaml from values +10/-0    hpa.yaml Add Backstage HorizontalPodAutoscaler template                      charts/backstage/vendor/backstage/charts/backstage/templates/hpa.yaml Added HorizontalPodAutoscaler template for Backstage Supports CPU and memory utilization-based scaling +43/-0    pdb.yaml Add Backstage PodDisruptionBudget template                              charts/backstage/vendor/backstage/charts/backstage/templates/pdb.yaml Added PodDisruptionBudget template for Backstage Supports minAvailable and maxUnavailable configuration +29/-0    networkpolicy.yaml Add Backstage NetworkPolicy ingress template                          charts/backstage/vendor/backstage/charts/backstage/templates/networkpolicy.yaml Added NetworkPolicy template for Backstage ingress rules Supports namespace and pod selector-based access control +40/-0    networkpolicy-egress.yaml Add Backstage NetworkPolicy egress template                            charts/backstage/vendor/backstage/charts/backstage/templates/networkpolicy-egress.yaml Added NetworkPolicy template for Backstage egress rules Supports DNS and external connection restrictions +38/-0    servicemonitor.yaml Add Backstage ServiceMonitor template                                        charts/backstage/vendor/backstage/charts/backstage/templates/servicemonitor.yaml Added ServiceMonitor template for Prometheus monitoring Configures metrics scraping for Backstage application +37/-0    extra-list.yaml Add extra resources deployment template                                    charts/backstage/vendor/backstage/charts/backstage/templates/extra-list.yaml Added template for rendering extra Kubernetes resources Allows deployment of additional resources via values +4/-0
Documentation	9 files README.md Add Backstage Helm chart documentation                                      charts/backstage/vendor/backstage/charts/backstage/README.md Generated README documentation for Backstage Helm chart Includes installation instructions, prerequisites, and configuration examples Documents all chart values with descriptions and defaults Provides guidance on environment variables, secrets, and PostgreSQL setup +353/-0  LICENSE Add Apache License for Backstage                                                  charts/backstage/vendor/backstage/LICENSE Added Apache License 2.0 for Backstage project Standard open-source license text with copyright notice +201/-0  README.md.gotmpl Add Backstage Helm chart README template                                  charts/backstage/vendor/backstage/charts/backstage/README.md.gotmpl Template file for generating Backstage Helm chart README Uses Helm chart documentation templates for dynamic content generation Includes sections for installation, configuration, and PostgreSQL setup Provides examples for environment variables and configuration management +226/-0  NOTICE Add Backstage copyright notice                                                      charts/backstage/vendor/backstage/NOTICE Copyright notice for Backstage project Identifies Backstage Authors as copyright holders +2/-0      CONTRIBUTING.md Add contribution guidelines with Git Subtree workflow documentation CONTRIBUTING.md Added comprehensive contribution guidelines for the chart repository Documented Git Subtree strategy for managing upstream Backstage Helm chart dependency Provided developer workflow instructions for syncing with upstream Backstage repository Included steps for rebuilding lock files and local subchart dependencies +56/-0    pull_request_template.md Add pull request template for Backstage charts                      charts/backstage/vendor/backstage/.github/pull_request_template.md Added PR template with contribution guidelines and checklist Includes requirements for chart version bumping, documentation, and testing +28/-0    CONTRIBUTING.md Add Backstage charts contribution guidelines                          charts/backstage/vendor/backstage/CONTRIBUTING.md Added contribution guidelines for Backstage Helm Charts repository Documents requirements for commits, testing, and documentation +8/-0      README.md Add Backstage Helm Chart repository README                              charts/backstage/vendor/backstage/README.md Added README for upstream Backstage Helm Chart repository Describes chart purpose, usage, and installation methods References both Chart Repository and OCI Registry installation options +55/-0    _templates.gotmpl Add Helm documentation template                                                    charts/backstage/vendor/backstage/charts/_templates.gotmpl Added Helm documentation template for generating values table Defines table structure with Key, Description, Type, and Default columns +7/-0
Configuration changes	24 files Chart.yaml Update backstage dependency to use local vendor                    charts/backstage/Chart.yaml Changed backstage dependency repository from remote URL to local file path Updated repository to file://./vendor/backstage/charts/backstage/ Bumped chart version from 5.4.0 to 5.5.0 +2/-2      sync-upstream-backstage.yaml Add nightly upstream Backstage chart sync workflow              .github/workflows/sync-upstream-backstage.yaml New GitHub Actions workflow for nightly synchronization of upstream Backstage chart Uses git subtree to pull changes from upstream repository Automatically updates dependency versions and Helm lock files Creates pull requests when upstream changes are detected +96/-0    release.yml Add upstream Backstage chart release workflow                        charts/backstage/vendor/backstage/.github/workflows/release.yml Upstream Backstage release workflow for publishing Helm charts Handles chart release, OCI registry publishing, and Cosign signing Publishes charts to GitHub Container Registry with artifact metadata +62/-0    .pre-commit-config.yaml Add Helm dependency update pre-commit hook                              .pre-commit-config.yaml Added helm-dependency-update hook to update Backstage chart dependencies Modified jsonschema-dereference hook to not pass filenames and set pass_filenames: false +7/-0      renovate.json Configure Renovate to ignore vendored Backstage chart        .github/renovate.json Changed extends configuration from config:base to config:recommended Added ignorePaths to exclude vendored Backstage chart from Renovate updates +4/-1      .sonarcloud.properties Exclude vendored Backstage from SonarCloud analysis            .sonarcloud.properties Added new file to exclude vendored Backstage chart from SonarCloud analysis +1/-0      .helmdocsignore Exclude vendored Backstage from Helm docs generation          .helmdocsignore Added new file to exclude vendored Backstage chart directory from Helm documentation generation +2/-0      pre-commit-comment.yaml Add pre-commit failure notification workflow                          charts/backstage/vendor/backstage/.github/workflows/pre-commit-comment.yaml Added GitHub Actions workflow to comment on PRs when pre-commit hooks fail Implements logic to find PR number from workflow run and delete previous failure comments Posts instructional comment with steps to fix pre-commit issues +101/-0  pre-commit.yaml Add pre-commit validation workflow                                              charts/backstage/vendor/backstage/.github/workflows/pre-commit.yaml Added workflow to run pre-commit hooks on pull requests Installs required dependencies including helm-docs Runs pre-commit validation with verbose output +36/-0    lint.yaml Add Helm chart linting workflow                                                    charts/backstage/vendor/backstage/.github/workflows/lint.yaml Added workflow to lint Helm charts using chart-testing tool Detects changed charts and runs linting validation Sets up NGINX Ingress and Bitnami repository for testing +44/-0    test.yml Add Helm chart testing workflow                                                    charts/backstage/vendor/backstage/.github/workflows/test.yml Added workflow to test Helm charts on pull requests Creates KIND cluster and installs NGINX Ingress controller Runs chart-testing install validation on changed charts +55/-0    automate_stale.yml Add stale issue and PR automation workflow                              charts/backstage/vendor/backstage/.github/workflows/automate_stale.yml Added workflow to automatically mark stale issues and PRs Configures stale detection with customizable thresholds and exemptions Runs on schedule and manual dispatch +37/-0    spellcheck.yaml Add codespell spell-checking workflow                                        charts/backstage/vendor/backstage/.github/workflows/spellcheck.yaml Added workflow to run codespell for spell checking on pull requests Checks filenames and hidden files for spelling errors +18/-0    dependabot.yml Add Dependabot configuration for GitHub Actions                    charts/backstage/vendor/backstage/.github/dependabot.yml Added Dependabot configuration for automatic GitHub Actions updates Configured to check for updates on a weekly schedule +6/-0      CODEOWNERS Add CODEOWNERS file for Backstage charts                                  charts/backstage/vendor/backstage/.github/CODEOWNERS Added CODEOWNERS file designating Backstage Helm Charts team as code owners +1/-0      .pre-commit-config.yaml Add pre-commit configuration for Backstage charts                charts/backstage/vendor/backstage/.pre-commit-config.yaml Added pre-commit configuration for Backstage chart repository Includes helm-docs, jsonschema-dereference, and codespell hooks +25/-0    .helmignore Add helmignore file for chart packaging                                    charts/backstage/vendor/backstage/.helmignore Added helmignore file to exclude common files from Helm chart packaging Excludes VCS, IDE, backup files and schema template +25/-0    .codespellrc Add codespell configuration                                                            charts/backstage/vendor/backstage/.codespellrc Added codespell configuration file with custom ignore words list +2/-0      cr.yaml Add release configuration for Backstage charts                      charts/backstage/vendor/backstage/cr.yaml Added release configuration file for Backstage charts Enables automatic release notes generation +2/-0      ct.yaml Add chart-testing lint configuration                                          charts/backstage/vendor/backstage/ct.yaml Added chart-testing configuration for linting Backstage charts Specifies chart directories and validation settings +5/-0      ct-install.yaml Add chart-testing install configuration                                    charts/backstage/vendor/backstage/ct-install.yaml Added chart-testing configuration for installing Backstage charts Specifies chart directories and validation settings +5/-0      Chart.yaml Add Backstage chart metadata and dependencies                        charts/backstage/vendor/backstage/charts/backstage/Chart.yaml Added Chart.yaml for upstream Backstage Helm chart version 2.6.3 Specifies dependencies on Bitnami common and PostgreSQL charts Includes metadata and maintainer information +41/-0    chart_schema.yaml Add chart schema validation file                                                  charts/backstage/vendor/backstage/charts/backstage/chart_schema.yaml Added YAML schema validation file for Backstage chart Defines structure and types for Chart.yaml metadata +37/-0    artifacthub-repo.yml Add Artifact Hub repository metadata                                          charts/backstage/vendor/backstage/charts/backstage/artifacthub-repo.yml Added Artifact Hub repository metadata file Contains repository ID for Artifact Hub integration +12/-0
Formatting	1 files action.yml Fix formatting in test-charts action                                          .github/actions/test-charts/action.yml Fixed trailing whitespace formatting issue in the file +1/-1
Tests	7 files appConfig-values.yaml Add appConfig test values                                                                charts/backstage/vendor/backstage/charts/backstage/ci/appConfig-values.yaml Added test values file for Backstage application configuration Includes sample app and backend configuration +16/-0    probes-values.yaml Add health probes test values                                                        charts/backstage/vendor/backstage/charts/backstage/ci/probes-values.yaml Added test values file for Backstage health probes Configures readiness, liveness, and startup probes +44/-0    autoscaling-values.yaml Add autoscaling test values                                                            charts/backstage/vendor/backstage/charts/backstage/ci/autoscaling-values.yaml Added test values file for Backstage autoscaling configuration Specifies CPU and memory utilization targets +7/-0      ingress-values.yaml Add ingress test values                                                                    charts/backstage/vendor/backstage/charts/backstage/ci/ingress-values.yaml Added test values file for Backstage ingress configuration Includes TLS and hostname settings +6/-0      ingress-extraHosts-values.yaml Add ingress extra hosts test values                                            charts/backstage/vendor/backstage/charts/backstage/ci/ingress-extraHosts-values.yaml Added test values file for Backstage ingress with extra hosts Configures multiple hosts and TLS certificates +12/-0    postgres-provided-creds-values.yaml Add PostgreSQL provided credentials test values                    charts/backstage/vendor/backstage/charts/backstage/ci/postgres-provided-creds-values.yaml Added test values file for PostgreSQL with provided credentials Configures database authentication +8/-0      postgres-generated-creds-values.yaml Add PostgreSQL auto-generated credentials test values        charts/backstage/vendor/backstage/charts/backstage/ci/postgres-generated-creds-values.yaml Added test values file for PostgreSQL with auto-generated credentials Allows subchart to generate database credentials +8/-0
Additional files	11 files lint.yaml +0/-1      release.yaml +0/-1      snyk.yaml +0/-1      README.md.gotmpl +0/-3      default-values.yaml [link]    extraDeploy-values.yaml +7/-0      image-digest-values.yaml +5/-0      service-dualstack-ip-family-values.yaml +4/-0      service-monitor.yaml +9/-0      topologySpreadConstraints-values.yaml +10/-0    values.schema.json +7310/-0

---

[rhdh-qodo-merge]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Possible issue	Fix git branch creation logic Refactor the git branch logic to prevent the workflow from failing when updating an existing pull request. .github/workflows/sync-upstream-backstage.yaml [52-96] - name: Align dependency version and open PR if: steps.sync.outputs.has_changes == 'true' env: GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} run: | CHART_VERSION=$(yq '.version' charts/backstage/vendor/backstage/charts/backstage/Chart.yaml) TITLE="chore(deps): update upstream Backstage chart to ${CHART_VERSION}" BRANCH="chore/sync-upstream-backstage-${CHART_VERSION}" + + git checkout -b "${BRANCH}" || git checkout "${BRANCH}" EXISTING_PR=$(gh pr list --head "${BRANCH}" --state open --json number --jq '.[0].number // empty') # Align the backstage dependency version declared in Chart.yaml export CHART_VERSION yq -i '(.dependencies[] | select(.name == "backstage")).version = env(CHART_VERSION)' charts/backstage/Chart.yaml # Rebuild the Helm dependency lock file helm repo add bitnami https://charts.bitnami.com/bitnami helm dependency update charts/backstage # Commit version and lock file changes, if any git add charts/backstage/Chart.yaml charts/backstage/Chart.lock if ! git diff --cached --quiet; then git commit -m "${TITLE}" fi - - git checkout -b "${BRANCH}" if [ -n "${EXISTING_PR}" ]; then echo "Updating existing PR #${EXISTING_PR} for version ${CHART_VERSION}." git push --force origin "${BRANCH}" else git push origin "${BRANCH}" BODY=$(cat <<EOF Automated nightly sync of the vendored Backstage chart from the [upstream repository](https://github.com/backstage/charts). Updated the vendored Backstage chart to version **${CHART_VERSION}** and aligned the dependency reference in \`charts/backstage/Chart.yaml\`. EOF ) gh pr create \ --title "${TITLE}" \ --body "${BODY}" \ --base "${{ github.ref_name }}" fi Apply / Chat Suggestion importance[1-10]: 8 __ Why: The suggestion correctly identifies a logical flaw in the script that would cause the workflow to fail when an existing PR needs to be updated, and provides a correct fix.	Medium
	Trim helper whitespace Remove leading spaces before the default calls in the backstage.serviceAccountName helper to prevent unintended whitespace in the generated ServiceAccount name. charts/backstage/vendor/backstage/charts/backstage/templates/_helpers.tpl [18-24] {{- define "backstage.serviceAccountName" -}} {{- if .Values.serviceAccount.create -}} - {{ default (include "common.names.fullname" .) .Values.serviceAccount.name }} +{{- default (include "common.names.fullname" .) .Values.serviceAccount.name }} {{- else -}} - {{ default "default" .Values.serviceAccount.name }} +{{- default "default" .Values.serviceAccount.name }} {{- end -}} {{- end -}} Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies and fixes a whitespace issue in the Go template that could lead to invalid Kubernetes resource names, improving the chart's robustness.	Medium
	Enforce script failure handling Add set -euo pipefail to the script for strict error handling and replace backticks with $(...) for safer command substitution to ensure the pipeline fails on any error. charts/backstage/vendor/backstage/.github/workflows/release.yml [50-55] - name: Publish and Sign OCI Charts run: | - for chart in `find .cr-release-packages -name '*.tgz' -print`; do - helm push ${chart} oci://ghcr.io/${GITHUB_REPOSITORY} |& tee helm-push-output.log + set -euo pipefail + for chart in $(find .cr-release-packages -name '*.tgz' -print); do + helm push "${chart}" "oci://ghcr.io/${GITHUB_REPOSITORY}" |& tee helm-push-output.log ... done [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 7 __ Why: The suggestion improves script robustness by adding strict error handling (set -euo pipefail) and using modern command substitution, which makes the workflow more reliable.	Medium
	Avoid catching BaseException for robustness In the try...except block, catch the more specific Exception instead of the overly broad BaseException to avoid trapping system-level exceptions like SystemExit or KeyboardInterrupt. charts/backstage/vendor/backstage/.pre-commit/jsonschema_dereference.py [40-51] try: # Load the schema into a variable as JSON st = load_template_schema(schema_template) # Dereference all of the $refs s = jsonref.replace_refs(st) # Save the dereferenced JSON save(schema_template, s) -except BaseException as e: +except Exception as e: # Print any errors to the screen print(f"Could not process schema for '{schema_template}': {e}") # Append any exceptions to the errors List errors.append(e) Apply / Chat Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies that catching BaseException is bad practice and proposes changing it to Exception, which improves the script's robustness without affecting its logic.	Low
General	Add base_uri for ref resolution Add the base_uri parameter to the jsonref.replace_refs call to ensure correct resolution of relative $ref paths within the JSON schema. charts/backstage/vendor/backstage/.pre-commit/jsonschema_dereference.py [44] -s = jsonref.replace_refs(st) +s = jsonref.replace_refs(st, base_uri=schema_dir.as_uri() + '/') Apply / Chat Suggestion importance[1-10]: 7 __ Why: This is a good suggestion for robustness, as providing a base_uri ensures that relative $refs in JSON schemas are resolved correctly, preventing potential path resolution issues.	Medium
	Limit exception catching to Exception In the try...except block, catch Exception instead of BaseException to avoid handling system-exiting exceptions. .pre-commit/jsonschema-dereference.py [90] -except BaseException as e: +except Exception as e: [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies that catching BaseException is bad practice. Changing it to Exception improves the script's robustness by not trapping system-level exceptions.	Low
	Optimize chart filtering to one pass Optimize the code by using a single loop to partition all_charts into charts and skipped lists, instead of iterating through all_charts twice. .pre-commit/jsonschema-dereference.py [77-82] all_charts = [p.parent for p in Path(".").rglob(CHART_LOCK)] -skipped = {c for c in all_charts if should_skip(c, DEFAULT_SKIP_PATHS)} +charts = [] +skipped = set() +for chart in all_charts: + if should_skip(chart, DEFAULT_SKIP_PATHS): + skipped.add(chart) + else: + charts.append(chart) + if skipped: print(f"Skipping {len(skipped)} chart(s) matching skip list: {', '.join(str(c) for c in skipped)}") -charts = [c for c in all_charts if not should_skip(c, DEFAULT_SKIP_PATHS)] - Apply / Chat Suggestion importance[1-10]: 5 __ Why: The suggestion offers a valid performance optimization by reducing two loops over all_charts to a single loop, which improves efficiency and is good practice for a pre-commit hook.	Low
Update

[rhdh-qodo-merge]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
High-level	Consider forking instead of vendoring Instead of vendoring the upstream chart using git subtree, consider forking it into a separate repository. This would allow for modifications while consuming it as a standard Helm dependency, leading to a cleaner main repository and more explicit change management. Examples: charts/backstage/Chart.yaml [27] repository: "file://./vendor/backstage/charts/backstage/" .github/workflows/sync-upstream-backstage.yaml [1-96] name: Sync Upstream Backstage Chart on: schedule: - cron: '0 3 * * *' workflow_dispatch: concurrency: group: ${{ github.workflow }} cancel-in-progress: true ... (clipped 86 lines) Solution Walkthrough: Before: # file: charts/backstage/Chart.yaml dependencies: - name: backstage repository: "file://./vendor/backstage/charts/backstage/" version: "2.6.3" alias: upstream # file: .github/workflows/sync-upstream-backstage.yaml ... - name: Sync upstream Backstage subtree run: | git subtree pull --prefix charts/backstage/vendor/backstage ... ... # Directory structure includes the entire vendored chart # charts/backstage/vendor/backstage/... After: # file: charts/backstage/Chart.yaml dependencies: - name: backstage # Repository points to a fork or a Helm repo built from the fork repository: "https://github.com/my-org/backstage-chart-fork.git" version: "2.6.3-custom.1" alias: upstream # The sync workflow and the vendor directory are removed from this repository. # Upstream syncing is managed within the forked repository. Suggestion importance[1-10]: 8 __ Why: The suggestion addresses a core architectural decision with significant long-term maintainability implications, proposing a valid and often cleaner alternative to the git subtree approach.	Medium
Possible issue	Limit exception catching to Exception In the try...except block, catch the more specific Exception rather than the broad BaseException to avoid intercepting system-exiting signals. charts/backstage/vendor/backstage/.pre-commit/jsonschema_dereference.py [40-51] try: # Load the schema into a variable as JSON st = load_template_schema(schema_template) # Dereference all of the $refs s = jsonref.replace_refs(st) # Save the dereferenced JSON save(schema_template, s) -except BaseException as e: +except Exception as e: # Print any errors to the screen print(f"Could not process schema for '{schema_template}': {e}") # Append any exceptions to the errors List errors.append(e) Apply / Chat Suggestion importance[1-10]: 7 __ Why: The suggestion correctly points out that catching BaseException is too broad and can prevent the script from being interrupted. Changing it to Exception is a significant improvement for script robustness and standard practice.	Medium
	Add default memory utilization threshold Add a default value of 80 to the targetMemoryUtilizationPercentage property in the JSON schema to make it optional and consistent with the CPU utilization property. charts/backstage/vendor/backstage/charts/backstage/values.schema.tmpl.json [306-309] "targetMemoryUtilizationPercentage": { "title": "Percentage of memory that each Backstage pod should be using on average before the autoscaler decides to scale", - "type": "integer" + "type": "integer", + "default": 80 } [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 6 __ Why: The suggestion correctly points out a missing default value for targetMemoryUtilizationPercentage, which improves schema consistency and usability. Adding a default value makes the property optional, aligning it with targetCPUUtilizationPercentage.	Low
General	Remove redundant template helper logic Simplify the backstage.postgresql.databaseSecretName helper by removing the redundant default and tpl calls in the else block, as they evaluate to an empty string. charts/backstage/vendor/backstage/charts/backstage/templates/_helpers.tpl [48-56] {{- define "backstage.postgresql.databaseSecretName" -}} {{- if ((((.Values).global).postgresql).auth).existingSecret }} {{- tpl .Values.global.postgresql.auth.existingSecret $ -}} {{- else if .Values.postgresql.auth.existingSecret }} {{- tpl .Values.postgresql.auth.existingSecret $ -}} {{- else -}} - {{- default (include "backstage.postgresql.fullname" .) (tpl .Values.postgresql.auth.existingSecret $) -}} + {{- include "backstage.postgresql.fullname" . -}} {{- end -}} {{- end -}} [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 6 __ Why: The suggestion correctly identifies and simplifies redundant logic in the Helm template, improving code clarity and maintainability.	Low
	Use json.load for file parsing Refactor load_template_schema to use json.load(f) instead of json.loads(f.read()) for more direct and efficient JSON file parsing. charts/backstage/vendor/backstage/.pre-commit/jsonschema_dereference.py [22-25] def load_template_schema(schema_dir: Path) -> Dict[str, Any]: """Load the schema template values.schema.tmpl.json""" with open(schema_dir / JSONSCHEMA_TEMPLATE_NAME, "r", encoding="utf-8") as f: - return json.loads(f.read()) + return json.load(f) Apply / Chat Suggestion importance[1-10]: 5 __ Why: The suggestion improves the code by using the more direct and idiomatic json.load(f) for reading from a file, which is cleaner and slightly more efficient.	Low
	Convert skip paths to Path objects Initialize DEFAULT_SKIP_PATHS with Path objects instead of strings for type consistency and to avoid repeated conversions within the should_skip function. .pre-commit/jsonschema-dereference.py [18-20] +from pathlib import Path + DEFAULT_SKIP_PATHS = [ - "charts/backstage/vendor", + Path("charts/backstage/vendor"), ] Apply / Chat Suggestion importance[1-10]: 4 __ Why: This is a good suggestion for consistency and robustness, as it makes path operations type-safe and avoids repeated string-to-path conversions inside a loop.	Low
	Optimize list filtering to avoid re-computation Optimize list filtering by using a single loop to partition all_charts into skipped and charts lists, avoiding a second iteration. .pre-commit/jsonschema-dereference.py [75-84] if __name__ == '__main__': -- charts = [p.parent for p in Path(".").rglob(CHART_LOCK)] -+ all_charts = [p.parent for p in Path(".").rglob(CHART_LOCK)] -+ skipped = {c for c in all_charts if should_skip(c, DEFAULT_SKIP_PATHS)} -+ if skipped: -+ print(f"Skipping {len(skipped)} chart(s) matching skip list: {', '.join(str(c) for c in skipped)}") -+ -+ charts = [c for c in all_charts if not should_skip(c, DEFAULT_SKIP_PATHS)] - errors: List[BaseException] = [] - for chart in charts: - try: + all_charts = [p.parent for p in Path(".").rglob(CHART_LOCK)] + + charts = [] + skipped_charts = [] + for chart in all_charts: + if should_skip(chart, DEFAULT_SKIP_PATHS): + skipped_charts.append(chart) + else: + charts.append(chart) + if skipped_charts: + print(f"Skipping {len(skipped_charts)} chart(s) matching skip list: {', '.join(str(c) for c in skipped_charts)}") + + errors: List[BaseException] = [] + for chart in charts: + try: + Apply / Chat Suggestion importance[1-10]: 3 __ Why: The suggestion offers a valid micro-optimization by iterating through all_charts once instead of twice, but the current implementation using comprehensions is more idiomatic and readable, and the performance gain is likely marginal.	Low
More

[rm3l]

/agentic_review

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

1. Sync job missing helm/yq ☑ 🐞 Bug ⛯ Reliability

Description

The sync-upstream-backstage workflow invokes yq and helm dependency update but never installs
yq or Helm, so the scheduled job can fail before aligning Chart.yaml/Chart.lock and creating the
PR. This breaks the nightly subtree sync automation.

Code

.github/workflows/sync-upstream-backstage.yaml[R52-70]

+      - name: Align dependency version and open PR
+        if: steps.sync.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          CHART_VERSION=$(yq '.version' charts/backstage/vendor/backstage/charts/backstage/Chart.yaml)
+          TITLE="chore(deps): update upstream Backstage chart to ${CHART_VERSION}"
+          BRANCH="chore/sync-upstream-backstage-${CHART_VERSION}"
+
+          EXISTING_PR=$(gh pr list --head "${BRANCH}" --state open --json number --jq '.[0].number // empty')
+
+          # Align the backstage dependency version declared in Chart.yaml
+          export CHART_VERSION
+          yq -i '(.dependencies[] | select(.name == "backstage")).version = env(CHART_VERSION)' charts/backstage/Chart.yaml
+
+          # Rebuild the Helm dependency lock file
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm dependency update charts/backstage
+

Evidence

The new workflow directly executes yq and helm commands, but there are no preceding setup steps
for either tool. In contrast, existing workflows in this repo explicitly install Helm and use a
dedicated action for yq, indicating the repo does not rely on these binaries being present by
default.

.github/workflows/sync-upstream-backstage.yaml[52-70]
.github/workflows/lint.yaml[29-33]
.github/workflows/bump-version.yaml[96-114]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The workflow `.github/workflows/sync-upstream-backstage.yaml` runs `yq` and `helm` commands but does not install those tools in the job. This can cause the scheduled sync to fail before updating `charts/backstage/Chart.yaml` / `Chart.lock` and opening/updating the PR.
### Issue Context
Other workflows in this repo explicitly install Helm (`azure/setup-helm`) and use the `mikefarah/yq` action for yq, so this workflow should follow the same pattern.
### Fix Focus Areas
- .github/workflows/sync-upstream-backstage.yaml[21-70]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Pre-commit helm hook breaks ☑ 🐞 Bug ⛯ Reliability

Description

The new helm-dependency-update pre-commit hook is configured with language: unsupported and runs
helm dependency update, but the Pre-commit GitHub workflow does not install Helm, so
pre-commit/action can fail. This can block PRs by failing the required pre-commit checks.

Code

.pre-commit-config.yaml[R16-21]

+      - id: helm-dependency-update
+        name: helm-dependency-update
+        entry: helm dependency update charts/backstage/vendor/backstage/charts/backstage
+        language: unsupported
+        pass_filenames: false
+        files: charts/backstage/vendor/backstage/charts/backstage/Chart\.(ya?ml|lock)$

Evidence

The repo-level pre-commit config adds a hook that runs helm dependency update ... with `language:
unsupported. The CI pre-commit workflow runs pre-commit/action` across all files but does not
include any Helm installation step, so the new hook introduces a new runtime dependency that the
workflow does not satisfy.

.pre-commit-config.yaml[16-21]
.github/workflows/pre-commit.yaml[30-44]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The repo-level pre-commit hook `helm-dependency-update` runs `helm dependency update ...` but is configured with `language: unsupported` and the CI workflow that runs pre-commit does not install Helm. This can cause the Pre-commit workflow to fail.
### Issue Context
`.github/workflows/pre-commit.yaml` runs `pre-commit/action` over all files and currently only installs `helm-docs`, not Helm.
### Fix Focus Areas
- .pre-commit-config.yaml[14-28]
- .github/workflows/pre-commit.yaml[20-44]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

ⓘ The new review experience is currently in Beta. Learn more

[gabemontero]

bump @rm3l @gazarenkov - curious on the progress of this PR when you all have a moment? I ask because IIUC from @rm3l getting this work done was a prereq for doing the lightspeed flavor work for helm chart install

are you all requiring review from all the reviewers before tagging this for merge?

are you still iterating on the changes @rm3l ?

thanks for any info, again when you have cycles to respond

@Jdubrick @michael-valdron FYI

[rm3l]

bump @rm3l @gazarenkov - curious on the progress of this PR when you all have a moment? I ask because IIUC from @rm3l getting this work done was a prereq for doing the lightspeed flavor work for helm chart install

are you all requiring review from all the reviewers before tagging this for merge?

are you still iterating on the changes @rm3l ?

thanks for any info, again when you have cycles to respond

@Jdubrick @michael-valdron FYI

no longer iterating on this. I've reminded the Install team to review this PR earlier today. So should hopefully be merged soon.
cc @Fortune-Ndlovu @gazarenkov @OpinionatedHeron @subhashkhileri @zdrapela

[gabemontero]

bump @rm3l @gazarenkov - curious on the progress of this PR when you all have a moment? I ask because IIUC from @rm3l getting this work done was a prereq for doing the lightspeed flavor work for helm chart install
are you all requiring review from all the reviewers before tagging this for merge?
are you still iterating on the changes @rm3l ?
thanks for any info, again when you have cycles to respond
@Jdubrick @michael-valdron FYI

no longer iterating on this. I've reminded the Install team to review this PR earlier today. So should hopefully be merged soon. cc @Fortune-Ndlovu @gazarenkov @OpinionatedHeron @subhashkhileri @zdrapela

awesome thanks for the quick response @rm3l

sounds good to me

[Fortune-Ndlovu]

Thanks for creating the @rm3l, tested locally and lgtm, just added a small comment.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud