chore(backstage): embed upstream backstage chart as subtree [RHIDP-12534]

.github/actions/test-charts/action.yml

@@ -69,7 +69,6 @@ runs:
       run: |
         helm repo add ingress-nginx https://kubernetes.github.io/ingress-nginx
         helm repo add bitnami https://charts.bitnami.com/bitnami
-        helm repo add backstage https://backstage.github.io/charts
         helm repo update
 
     - name: Generate KinD Config
@@ -182,4 +181,4 @@ runs:
         if [[ "$INPUT_ALL_CHARTS" == "true" ]]; then
           CT_ARGS+=(--all)
         fi
-        ct install "${CT_ARGS[@]}"
+        ct install "${CT_ARGS[@]}"

.github/renovate.json

@@ -1,7 +1,10 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
-    "config:base",
+    "config:recommended",
     "helpers:pinGitHubActionDigests"
+  ],
+  "ignorePaths": [
+    "charts/**/vendor/**"
   ]
 }

.github/workflows/lint.yaml

@@ -54,7 +54,6 @@ jobs:
         if: steps.list-changed.outputs.changed == 'true'
         run: |
           helm repo add bitnami https://charts.bitnami.com/bitnami
-          helm repo add backstage https://backstage.github.io/charts
           helm repo update
 
       - name: Run chart-testing (lint)

.github/workflows/pre-commit.yaml

@@ -35,6 +35,11 @@ jobs:
         with:
           go-version: ^1
 
+      - name: Set up Helm
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        with:
+          version: v3.17.0
+
       - name: Setup helm-docs
         run: go install github.com/norwoodj/helm-docs/cmd/helm-docs@latest
 

.github/workflows/release.yaml

@@ -31,7 +31,6 @@ jobs:
       - name: Add dependencies
         run: |
           helm repo add bitnami https://charts.bitnami.com/bitnami
-          helm repo add backstage https://backstage.github.io/charts
 
       - name: Run chart-releaser
         uses: helm/chart-releaser-action@cae68fefc6b5f367a0275617c9f83181ba54714f # v1.7.0

.github/workflows/snyk.yaml

@@ -35,7 +35,6 @@ jobs:
       - name: Render Templates for ${{ matrix.chartConfig.name }}
         run: |
           helm repo add bitnami https://charts.bitnami.com/bitnami
-          helm repo add backstage https://backstage.github.io/charts
           helm repo update
 
           helm dependency build ./charts/${{ matrix.chartConfig.path }}

.github/workflows/sync-upstream-backstage.yaml

@@ -0,0 +1,106 @@
+name: Sync Upstream Backstage Chart
+
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+jobs:
+  sync-upstream:
+    name: Sync Upstream Backstage
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          fetch-depth: 0
+
+      - name: Set up Helm
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
+        with:
+          version: v3.17.0
+
+      - name: Set up yq
+        uses: mikefarah/yq@5a7e72a743649b1b3a47d1a1d8214f3453173c51 # v4.52.4
+        with:
+          cmd: yq --version
+
+      - name: Configure Git
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      - name: Sync upstream Backstage subtree
+        id: sync
+        run: |
+          BEFORE_SHA=$(git rev-parse HEAD)
+
+          git remote add upstream-backstage https://github.com/backstage/charts.git
+          git fetch upstream-backstage main
+          git subtree pull --prefix charts/backstage/vendor/backstage upstream-backstage main --squash \
+            -m "Squashed sync of upstream Backstage chart"
+
+          AFTER_SHA=$(git rev-parse HEAD)
+
+          if [ "$BEFORE_SHA" = "$AFTER_SHA" ]; then
+            echo "No changes from upstream."
+            echo "has_changes=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Changes detected from upstream."
+            echo "has_changes=true" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Align dependency version and open PR
+        if: steps.sync.outputs.has_changes == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          CHART_VERSION=$(yq '.version' charts/backstage/vendor/backstage/charts/backstage/Chart.yaml)
+          TITLE="chore(deps): update upstream Backstage chart to ${CHART_VERSION}"
+          BRANCH="chore/sync-upstream-backstage-${CHART_VERSION}"
+
+          EXISTING_PR=$(gh pr list --head "${BRANCH}" --state open --json number --jq '.[0].number // empty')
+
+          # Align the backstage dependency version declared in Chart.yaml
+          export CHART_VERSION
+          yq -i '(.dependencies[] | select(.name == "backstage")).version = env(CHART_VERSION)' charts/backstage/Chart.yaml
+
+          # Rebuild the Helm dependency lock file
+          helm repo add bitnami https://charts.bitnami.com/bitnami
+          helm dependency update charts/backstage
+
+          # Commit version and lock file changes, if any
+          git add charts/backstage/Chart.yaml charts/backstage/Chart.lock
+          if ! git diff --cached --quiet; then
+            git commit -m "${TITLE}"
+          fi
+
+          git checkout -b "${BRANCH}"
+
+          if [ -n "${EXISTING_PR}" ]; then
+            echo "Updating existing PR #${EXISTING_PR} for version ${CHART_VERSION}."
+            git push --force origin "${BRANCH}"
+          else
+            git push origin "${BRANCH}"
+
+            BODY=$(cat <<EOF
+          Automated nightly sync of the vendored Backstage chart from the [upstream repository](https://github.com/backstage/charts).
+
+          Updated the vendored Backstage chart to version **${CHART_VERSION}** and aligned the dependency reference in \`charts/backstage/Chart.yaml\`.
+          EOF
+            )
+
+            gh pr create \
+              --title "${TITLE}" \
+              --body "${BODY}" \
+              --base "${{ github.ref_name }}"
+          fi

.gitignore

@@ -8,3 +8,6 @@
 charts/*/charts/
 **/charts/*.tgz
 output
+
+# Vendored charts need to be updated manually with `helm dependency update`
+!charts/*/vendor/**/charts/*.tgz

.gitleaks.toml

@@ -0,0 +1,22 @@
+[allowlist]
+  description = "Global Allowlist"
+
+  # Ignore based on any subset of the file path
+  paths = [
+    # Ignore all example certs
+    # '''\/example.*\.pem$''',
+
+    # Ignore anything with the word funkymonkey anywhere in the path
+    # '''funkymonkey''',
+
+    # CI values
+    '''.*\/ci\/default-values\.yaml$''',
+    '''.*\/ci\/appConfig-values\.yaml$''',
+    '''.*\/ci\/probes-values\.yaml$''',
+  ]
+
+  # Ignore based on any subset of the line
+  #regexes = [
+  #  # Ignore lines containing pickles
+  #  '''pickles''',
+  #]

.helmdocsignore

@@ -0,0 +1,2 @@
+charts/backstage/vendor
+

.pre-commit-config.yaml

@@ -13,6 +13,12 @@ repos:
           - --template-files=README.md.gotmpl
   - repo: local
     hooks:
+      - id: helm-dependency-update
+        name: helm-dependency-update
+        entry: helm dependency update charts/backstage/vendor/backstage/charts/backstage
+        language: unsupported
+        pass_filenames: false
+        files: charts/backstage/vendor/backstage/charts/backstage/Chart\.(ya?ml|lock)$
       - id: jsonschema-dereference
         name: jsonschema-dereference
         entry: python .pre-commit/jsonschema-dereference.py

.pre-commit/jsonschema-dereference.py

@@ -15,6 +15,8 @@
 VALUES_FILE = "values.yaml"
 CHART_YAML = "Chart.yaml"
 
+CHARTS_DIR = Path("charts")
+
 def read_yaml(file_path: Path):
     """Open and load Chart.yaml file."""
     with open(file_path, "r", encoding="utf-8") as f:
@@ -71,9 +73,8 @@ def save(chart_dir: Path, my_schema: Any):
         json.dump(my_schema, f, indent=4, sort_keys=True)
 
 if __name__ == '__main__':
-    charts = [p.parent for p in Path(".").rglob(CHART_YAML)]
-
-    errors: List[BaseException] = []
+    charts = [p.parent for p in CHARTS_DIR.glob(f"*/{CHART_YAML}")]
+    errors: List[Exception] = []
     for chart in charts:
         try:
             chart_yaml = read_yaml(chart / CHART_YAML)
@@ -85,7 +86,7 @@ def save(chart_dir: Path, my_schema: Any):
             schema = tidy_schema(schema, values)
 
             save(chart, schema)
-        except BaseException as e:
+        except Exception as e:
             print(f"Could not process schema for '{chart}': {e}")
             errors.append(e)
     if errors:

.sonarcloud.properties

@@ -0,0 +1 @@
+sonar.exclusions = charts/backstage/vendor/**/*

CONTRIBUTING.md

@@ -0,0 +1,56 @@
+# Contributing
+
+## Checklist
+
+Before making a contribution to the charts in this repository, you will need to ensure the following steps have been done:
+
+- Run `helm template` on the changes you're making to ensure they are correctly rendered into Kubernetes manifests.
+- Lint tests have been run for the Chart using the [Chart Testing](https://github.com/helm/chart-testing) tool and the `ct lint` command.
+- For each Chart updated, version bumped in the corresponding `Chart.yaml` according to [Semantic Versioning](http://semver.org/).
+- For each Chart updated, ensure variables are documented in the corresponding `values.yaml` file and the [pre-commit](https://pre-commit.com/) hook has been run with `pre-commit run --all-files` to generate the corresponding `README.md` documentation. The [pre-commit Workflow](./.github/workflows/pre-commit.yaml) will enforce this and warn you if needed.
+- JSON Schema template updated and re-generated the raw schema via the `pre-commit` hook.
+- [ ] If you updated the [orchestrator-infra](./charts/orchestrator-infra) chart, make sure the versions of the [Knative CRDs](./charts/orchestrator-infra/crds) are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the [values.yaml](./charts/orchestrator-infra/values.yaml) file. See [Installing Knative Eventing and Knative Serving CRDs](./charts/orchestrator-infra/README.md#installing-knative-eventing-and-knative-serving-crds) for more details.
+
+## Note on the Backstage chart dependencies
+
+This project uses a **Git Subtree** strategy to manage our dependency on the [upstream Backstage Helm chart](https://github.com/backstage/charts.git). This allows us to maintain local customizations while keeping a link to the upstream source for future updates.
+
+Unlike standard Helm dependencies that fetch tarballs from a remote repository, our dependency on Backstage is **vendored** directly into this repository under [`charts/backstage/vendor/backstage`](./charts/backstage/vendor/backstage).
+
+### Developer workflow
+
+To sync with the upstream Backstage repository, add it as a remote on your local machine:
+
+```bash
+git remote add -f upstream-backstage https://github.com/backstage/charts.git
+```
+
+When the upstream Backstage team releases an update, we can pull their changes into our subtree:
+
+```bash
+git fetch upstream-backstage main
+git subtree pull --prefix charts/backstage/vendor/backstage upstream-backstage main --squash
+
+# You may also need to update the dependency version under charts/backstage/Chart.yaml
+```
+
+It is important to use `--squash` to avoid pulling the entire commit history of the upstream chart repository.
+
+*Note: If merge conflicts occur, resolve them in your editor, then `git add` and `git commit` the resolution as a normal merge.*
+
+**Important:** After any change to the dependency structure or version of the vendored chart, you must rebuild the lock file and local subchart dependencies:
+
+```bash
+helm dependency update charts/backstage/vendor/backstage/charts/backstage
+helm dependency update charts/backstage
+```
+
+To contribute changes back to the upstream repo, you can push them directly to your personal fork of the upstream Backstage charts and open up a PR:
+
+```bash
+# Push to your personal fork of the upstream Backstage charts repo
+git remote add my-upstream-fork ssh://git@github.com/${YOUR_USERNAME}/${MY_FORK}.git
+git subtree push --prefix charts/backstage/vendor/backstage my-upstream-fork ${MY_BRANCH}
+
+# Open up a PR on the upstream Backstage charts repository
+```

charts/backstage/Chart.lock

@@ -3,7 +3,7 @@ dependencies:
   repository: https://charts.bitnami.com/bitnami
   version: 2.37.0
 - name: backstage
-  repository: https://backstage.github.io/charts
+  repository: file://./vendor/backstage/charts/backstage/
   version: 2.6.3
-digest: sha256:5cc66e4f82c4857af892fc464007a8d01931c1432ecd100e838e6433b7284729
-generated: "2026-03-23T13:22:31.418706052Z"
+digest: sha256:039433c044d3517fced6c4cd70edec0adfd8063036a4ddd40ff4b5a2b4832329
+generated: "2026-03-23T21:41:53.712994241+01:00"

charts/backstage/Chart.yaml

@@ -24,7 +24,7 @@ dependencies:
       - bitnami-common
     version: "2.37.0"
   - name: backstage
-    repository: https://backstage.github.io/charts
+    repository: "file://./vendor/backstage/charts/backstage/"
     version: "2.6.3"
     alias: upstream
 home: https://red.ht/rhdh
@@ -47,4 +47,4 @@ sources: []
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 # Note that when this chart is published to https://github.com/openshift-helm-charts/charts
 # it will follow the RHDH versioning 1.y.z
-version: 5.5.0
+version: 5.6.0

charts/backstage/README.md

@@ -1,7 +1,7 @@
 
 # RHDH Backstage Helm Chart for OpenShift
 
-![Version: 5.5.0](https://img.shields.io/badge/Version-5.5.0-informational?style=flat-square)
+![Version: 5.6.0](https://img.shields.io/badge/Version-5.6.0-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage.
@@ -27,10 +27,9 @@ For the **Generally Available** version of this chart, see:
 
 ```console
 helm repo add bitnami https://charts.bitnami.com/bitnami
-helm repo add backstage https://backstage.github.io/charts
 helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart
 
-helm install my-backstage redhat-developer/backstage --version 5.5.0
+helm install my-backstage redhat-developer/backstage --version 5.6.0
 ```
 
 ## Introduction
@@ -61,7 +60,6 @@ The following command can be used to add the chart repository:
 
 ```console
 helm repo add bitnami https://charts.bitnami.com/bitnami
-helm repo add backstage https://backstage.github.io/charts
 helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart
 ```
 
@@ -158,7 +156,7 @@ Kubernetes: `>= 1.27.0-0`
 
 | Repository | Name | Version |
 |------------|------|---------|
-| https://backstage.github.io/charts | upstream(backstage) | 2.6.3 |
+| file://./vendor/backstage/charts/backstage/ | upstream(backstage) | 2.6.3 |
 | https://charts.bitnami.com/bitnami | common | 2.37.0 |
 
 ## Values
@@ -342,7 +340,6 @@ Orchestrator is a flavor of RHDH, and can be installed alongside RHDH in the sam
 1. Have an admin install the [orchestrator-infra Helm Chart](https://github.com/redhat-developer/rhdh-chart/tree/main/charts/orchestrator-infra#readme), which will install the prerequisites required to deploy the Orchestrator-flavored RHDH. This process will include installing cluster-wide resources, so should be done with admin privileges:
 ```
 helm repo add bitnami https://charts.bitnami.com/bitnami
-helm repo add backstage https://backstage.github.io/charts
 helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart
 
 helm install <release_name> redhat-developer/redhat-developer-hub-orchestrator-infra