Skip to content

feat(boost): add FE plugin, dev Backstage instance and initial config#3640

Closed
mareklibra wants to merge 13 commits into
redhat-developer:mainfrom
mareklibra:boost.fe
Closed

feat(boost): add FE plugin, dev Backstage instance and initial config#3640
mareklibra wants to merge 13 commits into
redhat-developer:mainfrom
mareklibra:boost.fe

Conversation

@mareklibra

@mareklibra mareklibra commented Jun 30, 2026

Copy link
Copy Markdown
Member

Summary

  • Adds @red-hat-developer-hub/backstage-plugin-boost, a New Frontend System plugin with a lazy-loaded /ai-catalog page route
  • Bootstraps the Boost local dev shell under packages/app (NFS app) and packages/backend (registers all Boost backend plugins, provider modules, and entity providers)
  • Adds workspace app-config.yaml with a boost: section for security mode, model, providers, and entity providers
  • Adds yarn dev for isolated frontend/backend plugin iteration and extends yarn chores with OpenSpec validation

Rationale

The Boost workspace already had backend plugins and specification-driven requirements, but no frontend plugin or way to run a full Backstage app locally. This PR establishes the development foundation described in specifications/boost-context.md:

  • packages/app — NFS dev app that registers the Boost frontend plugin
  • packages/backend — backend that wires in all registerable Boost plugins
  • app-config.yaml — local configuration under the boost.* namespace

This mirrors the NFS-first approach used in other RHDH workspaces . The /ai-catalog route currently renders the Backstage scaffold page; real chat and agent UI will follow in subsequent PRs against the OpenSpec changes.

Aligned with Backstage 1.52.0 (see backstage.json and #3621).

Review follow-up

Addresses fullsend-ai-review findings:

  • Package metadata (pluginPackage, provider pluginPackages sync)
  • Plugin conventions (boostPage, AiCatalogIcon prop forwarding)
  • Stale boost-frontend references in specs/openspec
  • Dev-only security comments (guest auth, allow-all policy, backend auth keys, Dockerfile)
  • build:api-reports script chaining and page extension test coverage

Deferred: protected-path [AGENTS.md] governance items — intentionally skipped pending linked issue / human approval.

Files changed

New plugin package

  • plugins/boost/ — frontend plugin (plugin.tsx, routes, scaffold components, tests, dev/ app, report.api.md)

Local dev shell

  • packages/app/ — NFS app (App.tsx registers catalog + nav + boost plugin), sidebar nav module, e2e smoke test
  • packages/backend/ — backend entrypoint registering boost-backend, provider modules, entity providers, and standard Backstage plugins

Workspace tooling & config

  • app-config.yaml — full local dev config including boost: section
  • package.jsonyarn dev, updated chores / build:api-reports, dependency resolutions

Documentation

  • README.md, AGENTS.md, specifications/boost-context.md, packages/README.md, plugins/boost/README.md

Test plan

  • cd workspaces/boost && yarn install
  • yarn chores — prettier, lint, tsc, API reports, OpenSpec validation, tests
  • yarn start — app loads at http://localhost:3000, /ai-catalog renders the scaffold page
  • yarn test:all — plugin and app unit tests pass
  • Verify backend registers all Boost plugins without startup errors (port 7007)

@mareklibra mareklibra requested review from a team, durandom and gabemontero as code owners June 30, 2026 10:44
@mareklibra mareklibra marked this pull request as draft June 30, 2026 10:45
@rhdh-gh-app

rhdh-gh-app Bot commented Jun 30, 2026

Copy link
Copy Markdown

Changed Packages

Package Name Package Path Changeset Bump Current Version
app workspaces/boost/packages/app none v0.0.0
backend workspaces/boost/packages/backend none v0.0.0
@red-hat-developer-hub/backstage-plugin-boost-backend-module-kagenti workspaces/boost/plugins/boost-backend-module-kagenti patch v0.1.1
@red-hat-developer-hub/backstage-plugin-boost-backend-module-llamastack workspaces/boost/plugins/boost-backend-module-llamastack patch v0.1.1
@red-hat-developer-hub/backstage-plugin-boost-backend workspaces/boost/plugins/boost-backend patch v0.1.2
@red-hat-developer-hub/backstage-plugin-boost-common workspaces/boost/plugins/boost-common patch v0.1.2
@red-hat-developer-hub/backstage-plugin-boost-node workspaces/boost/plugins/boost-node patch v0.1.2
@red-hat-developer-hub/backstage-plugin-boost-responses-api-toolkit workspaces/boost/plugins/boost-responses-api-toolkit patch v0.1.1
@red-hat-developer-hub/backstage-plugin-boost-toolscope workspaces/boost/plugins/boost-toolscope patch v0.1.1
@red-hat-developer-hub/backstage-plugin-boost workspaces/boost/plugins/boost patch v0.1.0

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 10:47 AM UTC · Completed 11:00 AM UTC
Commit: e1a86f0 · View workflow run →

@mareklibra mareklibra changed the title Boost.fe feat(boost): add FE plugin, dev Backstage instance and initial config Jun 30, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

Review

Findings

Medium

  • [fail-open] workspaces/boost/plugins/boost-backend/src/middleware/security.ts — When boost.security.mode is absent from configuration, validateSecurityMode() defaults to development-only-no-auth, disabling authentication. The production overlay sets full mode and a warning is logged in production, but the default is fail-open. This is pre-existing code not modified by this PR, but the new config files make it relevant.
    Remediation: Change the default to full (fail-closed) when no mode is configured, or throw an error requiring the mode to be explicitly set.

  • [consumer-completeness] workspaces/boost/plugins/boost-backend-module-kagenti/package.jsonpluginPackages array is missing boost-responses-api-toolkit and boost-toolscope, which are present in boost-backend, boost-common, boost-node, and the new boost plugin. Pre-existing inconsistency, but this PR is already touching these arrays.
    Remediation: Add the two missing entries to match sibling packages.

  • [consumer-completeness] workspaces/boost/plugins/boost-backend-module-llamastack/package.json — Same pluginPackages inconsistency as boost-backend-module-kagenti.
    Remediation: Add the two missing entries.

  • [package-field-missing] workspaces/boost/plugins/boost/package.json — Missing description field. Every other published plugin package in the boost workspace includes one.
    Remediation: Add "description": "Frontend plugin for the boost AI platform".

  • [package-field-missing] workspaces/boost/plugins/boost/package.json — Missing homepage and bugs fields. All existing boost plugin packages include "homepage": "https://red.ht/rhdh" and "bugs": "https://github.com/redhat-developer/rhdh-plugins/issues".
    Remediation: Add both fields.

  • [package-field-format] workspaces/boost/plugins/boost/package.json — Repository URL uses https://github.com/redhat-developer/rhdh-plugins but all sibling packages use git+https://github.com/redhat-developer/rhdh-plugins.git.
    Remediation: Change to git+https://github.com/redhat-developer/rhdh-plugins.git.

Low

  • [guest-auth-in-production] workspaces/boost/app-config.production.yaml:39 — Production config overlay still includes auth.providers.guest: {}. While Backstage guest provider in production environment mode is restricted, removing it from the production template would be cleaner.

  • [allow-all-policy] workspaces/boost/packages/backend/src/index.ts:63 — Backend unconditionally registers allow-all-policy. Code comments correctly mark it dev-only, and this is standard Backstage scaffolding for dev shells.

  • [test-isolation] workspaces/boost/packages/app/src/App.test.tsx:21 — Test replaces process.env without saving and restoring the original. Could affect subsequent tests in the same Jest worker.

  • [unused-dependency] workspaces/boost/packages/backend/package.json:51@backstage/plugin-auth-backend-module-github-provider declared as dependency but never registered via backend.add() in index.ts.

  • [package-field-format] workspaces/boost/packages/app/package.json — Repository URL format mismatch (same as boost plugin). Less important since these are private packages.

  • [package-field-inconsistency] workspaces/boost/plugins/boost/package.jsonbackstage.supported-versions field present in new plugin but absent from all existing sibling packages.

  • [scope-creep] workspaces/boost/.changeset/neat-boxes-fry.md — Changeset marks 8 packages as patch bumps, but 7 only gain a single pluginPackages line addition. Consider whether metadata-only changes warrant patch releases for all 7.


Labels: PR modifies only files under workspaces/boost/ adding a new frontend plugin and dev shell.

Previous run

Review

Findings

Medium

  • [insecure-default-config] workspaces/boost/packages/backend/Dockerfile:66 — The Dockerfile CMD defaults to --config app-config.yaml, and line 63 copies app-config*.yaml into the image. The workspace app-config.yaml configures guest auth with auto sign-in, allow-all permission policy, boost.security.mode: development-only-no-auth, commented-out backend.auth.keys, and an in-memory database. While the Dockerfile header includes a warning comment, the image ships with insecure defaults baked in. If run without config overrides, it starts with no authentication, no authorization, and no backend-to-backend auth. This follows the same pattern as other workspaces in the repository but remains a risk if published or deployed without overrides.
    Remediation: Consider not copying app-config.yaml into the image (require it mounted at runtime), or create a separate app-config.production.yaml with secure defaults and make the Dockerfile CMD use that instead.

Low

  • [dev-only-auth] workspaces/boost/app-config.yaml:141 — The config uses auth.providers.guest: {} and the backend registers plugin-permission-backend-module-allow-all-policy. Combined with boost.security.mode: development-only-no-auth and commented-out backend.auth.keys, there is no real authentication or authorization. This is clearly labeled as dev-only and consistent with all other workspaces in the repository.

  • [broad-csp] workspaces/boost/app-config.yaml:33 — The CSP connect-src directive is set to ['self', 'http:', 'https:'], allowing the frontend to connect to any HTTP/HTTPS endpoint. In production, this should be scoped to specific backend and AI provider URLs. Consistent with other dev configs in the repository.

  • [missing-authorization] workspaces/boost/package.json — This non-trivial feature PR (55 files, new plugin + dev shell + workspace config) has no linked issue. Non-trivial changes benefit from explicit authorization via a linked issue to establish scope. The PR is a draft with a WIP label, and the changes align with the documented architecture in AGENTS.md and specifications.

Previous run (2)

Review

Reason: stale-head

The review agent reviewed commit dbd0900a9b23e370641133bc0fa878de51ad3211 but the PR HEAD is now 727c4deb6b7d16dca1b9acb8e7d72deb22e814db. This review was discarded to avoid approving unreviewed code.

Previous run (3)

Review

Findings

High

  • [protected-path] workspaces/boost/AGENTS.md, workspaces/boost/packages/backend/Dockerfile, workspaces/boost/plugins/boost/* — This PR modifies files under protected paths (AGENTS.md, Dockerfile, plugins/) with no linked issue to authorize the changes. Human approval is required for protected-path changes regardless of context, and the absence of a linked issue makes the justification unverifiable.
    Remediation: Create and link an issue that describes the intent for modifying governance and infrastructure files.

  • [stale-doc] workspaces/boost/specifications/prd/platform-operations-deployment.md — Package table (line 68) and multiple prose references (lines 85, 91, 251, 258) still use the old name boost-frontend. The table also lacks the boost-responses-api-toolkit and boost-toolscope packages added to the workspace.
    Remediation: Replace all boost-frontend with boost and add rows for the new packages.

  • [stale-doc] workspaces/boost/openspec/changes/platform-operations-deployment/proposal.md — Package table (line 17) lists boost-frontend instead of boost. Line 75 references plugins/boost-frontend/src/admin/.
    Remediation: Rename boost-frontend to boost in the table and file path references. Add new library packages to the table.

Medium

  • [stale-reference] workspaces/boost/plugins/boost-backend-module-kagenti/package.json:15 — The pluginPackages array has pluginId: "boost" but was not updated to include @red-hat-developer-hub/backstage-plugin-boost, unlike the other 5 packages with pluginId: "boost" that all received this addition in the diff.
    Remediation: Add @red-hat-developer-hub/backstage-plugin-boost to the pluginPackages array.

  • [stale-reference] workspaces/boost/plugins/boost-backend-module-llamastack/package.json:15 — Same issue as boost-backend-module-kagenti: the pluginPackages array was not updated to include the new frontend plugin package.
    Remediation: Add @red-hat-developer-hub/backstage-plugin-boost to the pluginPackages array.

  • [pattern-inconsistency] workspaces/boost/plugins/boost/package.json:13 — The backstage metadata is missing the pluginPackage field. Every other boost sibling package (8 out of 8) declares it.
    Remediation: Add "pluginPackage": "@red-hat-developer-hub/backstage-plugin-boost" to the backstage section.

  • [stale-doc] workspaces/boost/openspec/changes/ai-chat-interaction-experience/proposal.md — Lines 47–49 reference file paths under plugins/boost-frontend/src/. The frontend plugin directory has been renamed to plugins/boost/.

  • [stale-doc] workspaces/boost/openspec/changes/pluggable-ai-platform-architecture/proposal.md — Line 54 references plugins/boost-frontend/src/ which should be plugins/boost/src/.

  • [stale-doc] workspaces/boost/openspec/changes/pluggable-ai-platform-architecture/design.md — Line 57 references boost-frontend in a dependency diagram. Package is now named boost.

  • [stale-doc] workspaces/boost/openspec/changes/security-safety-governance/proposal.md — Line 47 references plugins/boost-frontend/src/components/SecurityGate.tsx. Directory is now plugins/boost/.

Low

  • [fail-open] workspaces/boost/packages/backend/src/index.ts:72 — The backend registers allow-all-policy which grants every permission to every caller. While this is standard for Backstage dev backends in this repo, the Dockerfile ships this configuration into a container image with no guard against accidental production use.

  • [fail-open] workspaces/boost/app-config.yaml:124 — Auth config enables the guest provider with no restrictions and auto-signs in as guest. The same app-config.yaml is copied into the Docker image.

  • [secret-exposure] workspaces/boost/app-config.yaml:70backend.auth.keys is commented out, meaning backend-to-backend auth is disabled by default.

  • [naming-convention] workspaces/boost/plugins/boost/src/components/AiCatalogIcon.tsx:18AiCatalogIcon wraps StorefrontIcon without forwarding SvgIconProps. Either re-export directly or forward props.

  • [naming-convention] workspaces/boost/plugins/boost/src/plugin.tsx:25PageBlueprint.make result exported as bare page const. Convention in other plugins (e.g., lightspeed) is to prefix with the plugin name (boostPage).


Labels: PR adds a new frontend plugin and dev shell in the boost workspace

Previous run (4)

Review

Reason: stale-head

The review agent reviewed commit 88216481243c285cb6b3d8673b4444dfc97faa34 but the PR HEAD is now 42a0791e51daf64d0709af33c7384310baeef86b. This review was discarded to avoid approving unreviewed code.

Previous run (5)

Review

Findings

High

  • [logic-error] workspaces/boost/plugins/boost/src/plugin.tsx:28 — Route path mismatch: the plugin defines its page at path /ai-catalog but README.md, AGENTS.md, and the changeset all document the route as /boost. The dev/index.tsx uses /ai-catalog as defaultPage (consistent with plugin.tsx), but app-config.yaml has no page:boost path override, so the full app also serves the page at /ai-catalog. Developers following the docs ("Navigate to /boost") will get a 404.
    Remediation: Change the path in plugin.tsx to /boost (and update dev/index.tsx accordingly), or update all documentation (changeset, AGENTS.md, README.md) to reference /ai-catalog.

Medium

  • [stale-identifier] workspaces/boost/AGENTS.md:75 — The pre-existing AGENTS.md package table at line 75 still lists boost-frontend. The PR updates the same table at lines 60–67 to use boost but misses this row.
    Remediation: Update the remaining boost-frontend at line 75 to boost.

Low

  • [stale-identifier] workspaces/boost/specifications/prd/platform-operations-deployment.md:68 — Contains references to the old package name boost-frontend at lines 68, 85, 91, 251, 258. These are pre-existing stale references in specification documents.
    Remediation: Replace all boost-frontend with boost and update npm package names.

  • [stale-reference] workspaces/boost/openspec/changes/ai-chat-interaction-experience/proposal.md:47 — Multiple openspec proposal files reference plugins/boost-frontend/ (old name). Affected files: ai-chat-interaction-experience/proposal.md, security-safety-governance/proposal.md, pluggable-ai-platform-architecture/proposal.md and design.md, platform-operations-deployment/proposal.md.
    Remediation: Replace boost-frontend with boost in all affected openspec files.

  • [error-handling-gap] workspaces/boost/package.json:9 — The build:api-reports script uses ; (semicolon) instead of &&. If tsc:full fails, build:api-reports:only still executes, potentially producing incorrect API reports.
    Remediation: Change ; to &&.

  • [test-inadequate] workspaces/boost/plugins/boost/src/plugin.test.ts:19 — Plugin test only asserts boostPlugin.toBeDefined(). Does not test page extension path, lazy loading, or route ref wiring.
    Remediation: Add a test using @backstage/frontend-test-utils to verify the page extension is mounted at the expected path.

  • [scope-creep] workspaces/boost/packages/backend/src/index.ts:80 — Backend registers 5 Boost packages not created or modified in this PR. May fail to resolve if those packages don't export the expected modules.
    Remediation: Verify compilation before removing draft status.


Labels: PR adds Boost frontend plugin and dev infrastructure in the boost workspace

Previous run (6)

Review

Reason: stale-head

The review agent reviewed commit 83cc82a7d90cbf4cf5f6a500f7abe9c982289c6f but the PR HEAD is now 16f6019ac736b458f7387e872a23a605230bbcc4. This review was discarded to avoid approving unreviewed code.

Previous run (7)

Review

Reason: stale-head

The review agent reviewed commit 7968246449d3c843c5adad37a8cb37cd7ca2d534 but the PR HEAD is now 83cc82a7d90cbf4cf5f6a500f7abe9c982289c6f. This review was discarded to avoid approving unreviewed code.

@fullsend-ai-review

Copy link
Copy Markdown

/fs-review

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 11:03 AM UTC · Completed 11:17 AM UTC
Commit: e1a86f0 · View workflow run →

@fullsend-ai-review

Copy link
Copy Markdown

/fs-review

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 11:20 AM UTC · Ended 11:56 AM UTC
Commit: e1a86f0 · View workflow run →

@codecov

codecov Bot commented Jun 30, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 75.00000% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.03%. Comparing base (f2a4ef9) to head (29962b6).
⚠️ Report is 3 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #3640   +/-   ##
=======================================
  Coverage   54.03%   54.03%           
=======================================
  Files        2325     2329    +4     
  Lines       89195    89207   +12     
  Branches    24936    24933    -3     
=======================================
+ Hits        48193    48202    +9     
- Misses      40707    40757   +50     
+ Partials      295      248   -47     
Flag Coverage Δ *Carryforward flag
adoption-insights 83.70% <ø> (ø) Carriedforward from 727c4de
ai-integrations 67.95% <ø> (ø) Carriedforward from 727c4de
app-defaults 69.79% <ø> (ø) Carriedforward from 727c4de
augment 46.39% <ø> (ø) Carriedforward from 727c4de
boost 74.36% <75.00%> (+<0.01%) ⬆️
bulk-import 72.46% <ø> (ø) Carriedforward from 727c4de
cost-management 14.10% <ø> (ø) Carriedforward from 727c4de
dcm 61.81% <ø> (ø) Carriedforward from 727c4de
extensions 61.53% <ø> (ø) Carriedforward from 727c4de
global-floating-action-button 71.18% <ø> (ø) Carriedforward from 727c4de
global-header 59.71% <ø> (ø) Carriedforward from 727c4de
homepage 49.84% <ø> (ø) Carriedforward from 727c4de
install-dynamic-plugins 56.77% <ø> (ø) Carriedforward from 727c4de
konflux 91.49% <ø> (ø) Carriedforward from 727c4de
lightspeed 68.50% <ø> (ø) Carriedforward from 727c4de
mcp-integrations 85.46% <ø> (ø) Carriedforward from 727c4de
orchestrator 37.11% <ø> (ø) Carriedforward from 727c4de
quickstart 65.63% <ø> (ø) Carriedforward from 727c4de
sandbox 79.56% <ø> (ø) Carriedforward from 727c4de
scorecard 82.67% <ø> (ø) Carriedforward from 727c4de
theme 61.26% <ø> (ø) Carriedforward from 727c4de
translations 7.25% <ø> (ø) Carriedforward from 727c4de
x2a 78.68% <ø> (ø) Carriedforward from 727c4de

*This pull request uses carry forward flags. Click here to find out more.


Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update f2a4ef9...29962b6. Read the comment docs.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ❌ Failure · Started 11:20 AM UTC · Completed 11:56 AM UTC
Commit: e1a86f0 · View workflow run →

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 11:59 AM UTC · Completed 12:17 PM UTC
Commit: e1a86f0 · View workflow run →

@fullsend-ai-review

Copy link
Copy Markdown

/fs-review

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:21 PM UTC · Completed 12:38 PM UTC
Commit: e1a86f0 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added the enhancement New feature or request label Jun 30, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:08 PM UTC · Completed 1:25 PM UTC
Commit: e1a86f0 · View workflow run →

@fullsend-ai-review

Copy link
Copy Markdown

/fs-review

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 1:28 PM UTC · Completed 1:39 PM UTC
Commit: 0b92af1 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

gabemontero added a commit to gabemontero/rhdh-plugins that referenced this pull request Jun 30, 2026
Backend host package for local development. Registers all boost plugins
(boost-backend, both provider modules, both entity providers) plus core
Backstage infrastructure (catalog, auth, permissions, proxy).

Includes a no-op metricsServiceRef factory because catalog-backend depends
on a metrics service that backend-defaults does not yet provide (still
absent as of Backstage 1.52 / backend-defaults 0.17.3). The import uses
@backstage/backend-plugin-api/alpha — an unstable API surface. This shim
should be removed when backend-defaults adds a default metrics service
factory.

Note: packages/app is not included here — it will be added by the frontend
PR (redhat-developer#3640) which uses the NFS (New Frontend System) architecture.

Includes yarn install update

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

asdf
gabemontero added a commit to gabemontero/rhdh-plugins that referenced this pull request Jun 30, 2026
Backend host package for local development. Registers all boost plugins
(boost-backend, both provider modules, both entity providers) plus core
Backstage infrastructure (catalog, auth, permissions, proxy).

Includes a no-op metricsServiceRef factory because catalog-backend depends
on a metrics service that backend-defaults does not yet provide (still
absent as of Backstage 1.52 / backend-defaults 0.17.3). The import uses
@backstage/backend-plugin-api/alpha — an unstable API surface. This shim
should be removed when backend-defaults adds a default metrics service
factory.

Note: packages/app is not included here — it will be added by the frontend
PR (redhat-developer#3640) which uses the NFS (New Frontend System) architecture.

Includes yarn install update

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

asdf
@mareklibra mareklibra marked this pull request as ready for review June 30, 2026 20:25
@sonarqubecloud

Copy link
Copy Markdown

@fullsend-ai-review

fullsend-ai-review Bot commented Jun 30, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:27 PM UTC · Completed 8:44 PM UTC
Commit: 67be6ce · View workflow run →

@fullsend-ai-review fullsend-ai-review Bot dismissed their stale review June 30, 2026 20:44

Superseded by updated review

@fullsend-ai-review fullsend-ai-review Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See the review comment for full details.

@@ -13,6 +13,7 @@
"pluginId": "boost",
"pluginPackage": "@red-hat-developer-hub/backstage-plugin-boost-backend",
"pluginPackages": [

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] consumer-completeness

pluginPackages array missing boost-responses-api-toolkit and boost-toolscope, inconsistent with other boost family packages after this PR.

Suggested fix: Add the two missing entries to match sibling packages.

@@ -13,6 +13,7 @@
"pluginId": "boost",
"pluginPackage": "@red-hat-developer-hub/backstage-plugin-boost-backend",
"pluginPackages": [

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[medium] consumer-completeness

Same pluginPackages inconsistency as boost-backend-module-kagenti.

Suggested fix: Add the two missing entries.

auth:
environment: production
providers:
guest: {}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] guest-auth-in-production

Production config overlay still includes auth.providers.guest: {}. While restricted in production mode, removing it from the production template would be cleaner.


// search engine
// See https://backstage.io/docs/features/search/search-engines
backend.add(import('@backstage/plugin-search-backend-module-pg'));

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] allow-all-policy

Backend unconditionally registers allow-all-policy. Code comments correctly mark it dev-only, standard Backstage scaffolding.


describe('App', () => {
it('should render', async () => {
process.env = {

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] test-isolation

Test replaces entire process.env without saving and restoring the original.

Suggested fix: Save and restore process.env in afterEach/afterAll.

"@backstage/plugin-search-backend-module-techdocs": "^0.4.15",
"@backstage/plugin-search-backend-node": "^1.4.5",
"@backstage/plugin-signals-backend": "^0.3.16",
"@backstage/plugin-techdocs-backend": "^2.2.1",

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] unused-dependency

@backstage/plugin-auth-backend-module-github-provider declared as dependency but never registered via backend.add().

Suggested fix: Remove dependency or add backend.add() call.

@fullsend-ai-review fullsend-ai-review Bot added requires-manual-review Review requires human judgment workspace/boost Boost workspace (Backstage AI plugin) labels Jun 30, 2026
@rohitkrai03

Copy link
Copy Markdown
Contributor

Closing this as #3645 is merged now. Any incremental updates can be done in follow up PR.

@rohitkrai03 rohitkrai03 closed this Jul 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request requires-manual-review Review requires human judgment workspace/boost Boost workspace (Backstage AI plugin)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants