Skip to content

scorecard - version:bump to v1.54.6 - #4529

Open
rhdh-bot wants to merge 5 commits into
mainfrom
scorecard/v1.54.6
Open

scorecard - version:bump to v1.54.6#4529
rhdh-bot wants to merge 5 commits into
mainfrom
scorecard/v1.54.6

Conversation

@rhdh-bot

@rhdh-bot rhdh-bot commented Sep 2, 2026

Copy link
Copy Markdown
Collaborator

Backstage release v1.54.6 has been published, this Pull Request contains the changes to upgrade scorecard to this new release

Please review the changelog before approving, there may be manual changes needed:

Created by Version Bump 33595930462

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 2, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:48 AM UTC · Completed 5:53 AM UTC

Commit: efc99d8 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $0.81

@codecov

codecov Bot commented Sep 2, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.05%. Comparing base (1e93f4e) to head (075a5c7).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4529      +/-   ##
==========================================
- Coverage   62.06%   62.05%   -0.02%     
==========================================
  Files        2603     2603              
  Lines      104477   104454      -23     
  Branches    29349    29339      -10     
==========================================
- Hits        64848    64823      -25     
+ Misses      39044    37774    -1270     
- Partials      585     1857    +1272     
Flag Coverage Δ *Carryforward flag
adoption-insights 84.30% <ø> (ø) Carriedforward from 2ccd24d
ai-integrations 76.15% <ø> (ø) Carriedforward from 2ccd24d
app-defaults 56.22% <ø> (ø) Carriedforward from 2ccd24d
augment 46.67% <ø> (ø) Carriedforward from 2ccd24d
boost 80.51% <ø> (ø) Carriedforward from 2ccd24d
bulk-import 72.94% <ø> (-0.19%) ⬇️ Carriedforward from 2ccd24d
cost-management 13.55% <ø> (ø) Carriedforward from 2ccd24d
dcm 72.09% <ø> (ø) Carriedforward from 2ccd24d
e2e-adoption-insights 60.00% <ø> (ø) Carriedforward from 2ccd24d
e2e-extensions 62.32% <ø> (ø) Carriedforward from 2ccd24d
e2e-global-header 50.35% <ø> (ø) Carriedforward from 2ccd24d
e2e-homepage 61.11% <ø> (ø) Carriedforward from 2ccd24d
e2e-intelligent-assistant 47.04% <ø> (ø) Carriedforward from 2ccd24d
e2e-orchestrator 49.52% <ø> (ø) Carriedforward from 2ccd24d
e2e-orchestrator-plugin 49.51% <ø> (ø) Carriedforward from 2ccd24d
e2e-quickstart 55.21% <ø> (ø) Carriedforward from 2ccd24d
e2e-scorecard 50.10% <ø> (-0.11%) ⬇️ Carriedforward from 2ccd24d
e2e-theme 16.36% <ø> (ø) Carriedforward from 2ccd24d
extensions 56.66% <ø> (ø) Carriedforward from 2ccd24d
global-floating-action-button 71.18% <ø> (ø) Carriedforward from 2ccd24d
global-header 68.09% <ø> (ø) Carriedforward from 2ccd24d
homepage 48.48% <ø> (+0.08%) ⬆️ Carriedforward from 2ccd24d
install-dynamic-plugins 58.57% <ø> (ø) Carriedforward from 2ccd24d
intelligent-assistant 76.40% <ø> (ø) Carriedforward from 2ccd24d
konflux 91.98% <ø> (ø) Carriedforward from 2ccd24d
lightspeed 69.02% <ø> (ø) Carriedforward from 2ccd24d
mcp-integrations 84.14% <ø> (ø) Carriedforward from 2ccd24d
orchestrator 71.13% <ø> (ø) Carriedforward from 2ccd24d
quickstart 63.74% <ø> (ø) Carriedforward from 2ccd24d
sandbox 79.56% <ø> (ø) Carriedforward from 2ccd24d
scorecard 87.66% <100.00%> (ø)
theme 87.91% <ø> (ø) Carriedforward from 2ccd24d
translations 5.12% <ø> (ø) Carriedforward from 2ccd24d
x2a 77.10% <ø> (ø) Carriedforward from 2ccd24d

*This pull request uses carry forward flags. Click here to find out more.


Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 1e93f4e...075a5c7. Read the comment docs.

🚀 New features to boost your workflow:
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 2, 2026

Copy link
Copy Markdown

Review — scorecard: version bump to v1.54.6

Verdict: ✅ Approve

Automated Backstage version bump from v1.52.0 to v1.54.6 for the scorecard workspace. The PR updates dependency versions across 20 package.json files, regenerates yarn.lock, and makes two required code adaptations:

  1. Config schema API migration (ScorecardLayoutBlueprint.ts, entityTab.tsx): Migrates from Backstage's deprecated config: { schema: {...} } builder to configSchema: {...} with zod — verified correct against other packages already using this pattern in the repo.
  2. New zod: "^4.0.0" dependency: Required by @backstage/frontend-plugin-api@^0.18.0; no cross-boundary type conflicts with backend packages using zod v3.
  3. E2E test assertion changes: Two assertions updated from getByRole('article').toContainText() to getByText().toBeVisible(), likely adapting to DOM structure changes in the newer Backstage version.

Findings

Severity Category File Description
low test-weakening packages/app-legacy/e2e-tests/pages/ScorecardPage.ts:62 Assertion change drops structural check that description text appears inside an article role element. The new getByText().toBeVisible() will pass even if text moves outside the article container. Same applies to scorecard.test.ts:133. Likely necessitated by Backstage DOM changes rather than intentional weakening. Consider page.getByRole('article').getByText(text).toBeVisible() to preserve both structural and visibility checks.

Dimensions reviewed

  • CorrectnessconfigSchema migration verified against existing patterns; z.record(z.string(), ...) is semantically equivalent to old single-arg form; zod v4 dependency is correct
  • Security — No secrets, injection patterns, permission scope changes, or auth flow modifications
  • Intent & coherence — Automated version bump by rhdh-bot; scope matches mechanical nature
  • Style & conventions — Mechanical change follows established patterns
  • Documentation currency — No docs reference the changed API patterns
  • Cross-repo contractsconfigSchema is framework-internal; no public TypeScript API surface change
Previous run

Review — scorecard version bump to v1.54.6

Verdict: ✅ Approve

This PR is an automated Backstage version bump from 1.52.0 to 1.54.6 in the workspaces/scorecard workspace, created by rhdh-bot via the Version Bump GitHub Action.

Changes reviewed

Category Files Assessment
Dependency version bumps 16 package.json files, backstage.json ✅ Mechanical, consistent
Config schema migration ScorecardLayoutBlueprint.ts, entityTab.tsx ✅ Correctly migrated from deprecated config.schema builder to configSchema with Zod v4
E2E test adaptation ScorecardPage.ts, scorecard.test.ts ✅ Assertions adapted to upstream UI changes
New dependency zod ^4.0.0 in scorecard plugin ✅ Required by @backstage/frontend-plugin-api@^0.18.0
Changeset version-bump-1-54-6.md ✅ All packages marked minor
Lockfile yarn.lock ✅ Regenerated

Key observations

  1. Schema migration is correct. The @backstage/frontend-plugin-api@0.18.0 replaces the internal schema builder with Standard Schema support (@standard-schema/spec@^1.1.0). Zod v4 implements Standard Schema, making configSchema with z.record(z.string(), z.object({...})) the correct migration. Schema shapes are semantically identical to the old builder-based definitions.

  2. E2E tests adapt to upstream changes, not weaken. The assertion pattern changed from getByRole('article').toContainText() to getByText().toBeVisible(). This loses the structural check (text inside an article-role element) but gains a visibility check. The change is consistent with Backstage 1.54's updated empty-state component structure.

  3. Zod version split is safe. The frontend plugin uses zod ^4.0.0 while backend packages use zod ^3.22.4. These are separate packages without cross-boundary type sharing, and Backstage framework packages accept both (^3.25.76 || ^4.0.0).

  4. No public API contracts broken. ScorecardEntityContentLayoutBlueprint and scorecardLayoutTitleDataRef are not exported from the package's public entry points. Only the ScorecardLayoutProps type is publicly exported, and it is unaffected.

  5. Homepage plugin bump is critical. The @red-hat-developer-hub/backstage-plugin-homepage bump from 1.17.x to ^1.18.0 is necessary — the 1.17.x version uses the removed config.schema API. Version 1.18.0 resolves successfully in the lockfile.

Low-severity notes

  • E2E test structural change: The migration from getByRole('article') to getByText() may warrant verifying that Backstage 1.54 empty-state components indeed changed their HTML structure.
  • Zod version divergence: Consider aligning backend packages to zod ^4.0.0 in a future PR to reduce workspace dependency duplication.
Previous run (2)

Review — scorecard version bump to v1.54.6

Verdict: ✅ Approve

This is a clean automated Backstage version bump from v1.52.0 to v1.54.6 for the scorecard workspace, created by the rhdh-bot via the Version Bump workflow.

Changes reviewed

Area Files Assessment
Dependency versions 14 package.json files All bumps are consistent with Backstage v1.54.6 release
Config schema migration ScorecardLayoutBlueprint.ts, entityTab.tsx Correctly migrated from deprecated config.schema builder to native configSchema with zod
New dependency zod: ^4.0.0 in frontend plugin Required for the config schema migration; compatible with ecosystem (^3.25.76 || ^4.0.0)
Changeset version-bump-1-54-6.md All scorecard packages marked as minor, appropriate for a feature-bearing version bump
Lockfile yarn.lock Consistent with dependency changes
Backstage version marker backstage.json Updated to 1.54.6

Config schema migration details

The @backstage/frontend-plugin-api bump from ^0.17.2 to ^0.18.0 requires migrating from the builder-pattern config schema to native zod schemas:

  • ScorecardLayoutBlueprint.ts: config.schema.groups migrated to configSchema.groups using z.record(z.string(), z.object({...})) — correctly uses zod v4's two-argument z.record() API.
  • entityTab.tsx: config.schema.allowedFilters migrated to configSchema.allowedFilters using z.array(z.object({...})).optional() — straightforward and correct.

Both files add import { z } from 'zod', and the functional behavior (validation rules, defaults) is preserved.

No correctness, security, or architectural concerns identified.


Labels: Automated dependency version bump for Backstage framework

Previous run (3)

Review — ✅ Approve

Backstage version bump v1.52.0 → v1.54.6 for the scorecard workspace.

This is an automated version bump created by rhdh-bot via the Version Bump GitHub Actions workflow. The change is well-scoped, correct, and safe to merge.

Changes reviewed

Area Files Assessment
Dependency bumps 20 package.json files ✅ Standard minor/patch @backstage/* version range updates
Config schema migration ScorecardLayoutBlueprint.ts, entityTab.tsx ✅ Correct migration from deprecated config.schema callback API to configSchema with zod (required by @backstage/frontend-plugin-api v0.18.0)
New dependency zod: "^4.0.0" in scorecard frontend plugin ✅ Aligns with Backstage's zod v4 adoption
Changeset version-bump-1-54-6.md ✅ All packages marked minor — appropriate for framework bump with API migration
Lockfile yarn.lock ✅ Standard lockfile updates

Config schema migration detail

Both source file changes migrate from Backstage's callback-based config.schema to inline configSchema with zod:

  • ScorecardLayoutBlueprint.tsgroups record schema (title, description, metrics) — semantically equivalent, uses z.record(z.string(), z.object({...})) correctly
  • entityTab.tsxallowedFilters array schema (kind, type) — semantically equivalent, uses z.array(z.object({...})).optional() correctly

Existing tests in ScorecardLayoutBlueprint.test.tsx cover config passthrough, default empty groups, and layout rendering — these validate the migration works at runtime.

No findings

Previous run (4)

Review — scorecard version bump to Backstage v1.54.6

Verdict: Approve

Summary

This is an automated Backstage version bump PR created by rhdh-bot (via Version Bump workflow run 33595930462). It upgrades the scorecard workspace from Backstage v1.52.0 to v1.54.6.

Scope

All 20 changed files are confined to the workspaces/scorecard/ directory:

  • 1 new file: changeset (version-bump-1-54-6.md) marking all 14 scorecard packages as minor
  • 1 config update: backstage.json version marker (1.52.01.54.6)
  • 17 package.json updates: dependency version range bumps for @backstage/* packages
  • 1 lockfile update: yarn.lock with resolved dependency versions

No source code, test files, or configuration logic was changed — this is a pure dependency version bump.

Analysis

Correctness: All @backstage/* dependency version ranges use caret notation (^x.y.z) and are internally consistent across all workspace packages. The yarn.lock reflects the resolved versions matching the declared ranges. No conflicting version constraints detected.

Changeset bump level: The changeset uses minor for all packages. Since the upgrade spans two Backstage minor releases (1.52 → 1.54), new Backstage features become available to plugin consumers, making minor an appropriate bump level.

Scope containment: All changes are within workspaces/scorecard/. No files outside the workspace are modified.

Security: No new non-Backstage dependencies introduced. All version bumps are within the existing @backstage/* ecosystem. No credentials, secrets, or environment variables added.

Notes

  • Several pre-1.0 @backstage/* packages received minor bumps (e.g., @backstage/frontend-plugin-api 0.17→0.18, @backstage/ui 0.16→0.17). Per semver conventions, pre-1.0 minor bumps may include breaking changes. The PR body links to the Backstage v1.54.6 changelog for reviewers to verify compatibility.
  • The upgrade jumps from v1.52.0 to v1.54.6 (two minor releases). Reviewers should consult the Upgrade Helper linked in the PR description for any manual migration steps.

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Sep 2, 2026
The deprecated config.schema option was removed in @backstage/frontend-plugin-api 1.54.
Migrate to the new configSchema top-level option using Zod v4.

Co-authored-by: Cursor <cursoragent@cursor.com>
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 2, 2026

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 6:14 AM UTC · Ended 6:19 AM UTC

Commit: 70d7c52 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge and removed ready-for-merge All reviewers approved — ready to merge labels Sep 2, 2026
@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 6:14 AM UTC · Completed 6:19 AM UTC

Commit: 70d7c52 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $0.87

The homepage plugin at 1.17.x uses the removed config.schema API which
causes a blank page on Backstage 1.54. Version 1.18.0 has the
configSchema/Zod v4 migration.

Co-authored-by: Cursor <cursoragent@cursor.com>
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 2, 2026

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 7:59 AM UTC · Ended 8:04 AM UTC

Commit: 897cbc5 · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge dependencies Pull requests that update a dependency file and removed ready-for-merge All reviewers approved — ready to merge labels Sep 2, 2026
@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 7:59 AM UTC · Completed 8:04 AM UTC

Commit: 897cbc5 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $0.97

Signed-off-by: Sanket Saikia <sanketsaikia13@gmail.com>
@fullsend-ai-review

fullsend-ai-review Bot commented Sep 2, 2026

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 8:58 AM UTC · Ended 9:09 AM UTC

Commit: 2ccd24d · View workflow run →

fullsend-ai-review[bot]

This comment was marked as outdated.

@fullsend-ai-review fullsend-ai-review Bot removed the ready-for-merge All reviewers approved — ready to merge label Sep 2, 2026
@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Sep 2, 2026
@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 8:58 AM UTC · Completed 9:09 AM UTC

Commit: 2ccd24d · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $4.00

@fullsend-ai-review

fullsend-ai-review Bot commented Sep 2, 2026

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 12:23 PM UTC · Ended 12:33 PM UTC

Commit: 075a5c7 · View workflow run →

@sonarqubecloud

sonarqubecloud Bot commented Sep 2, 2026

Copy link
Copy Markdown

await expect(this.page.getByRole('article')).toContainText(
this.translations.emptyState.description,
);
await expect(

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[low] test-weakening

Assertion change from getByRole("article").toContainText(text) to getByText(text).toBeVisible() drops the structural check that the description text appears inside an element with role="article". The new assertion will pass even if the text moves outside the article container. Same weakening applies to scorecard.test.ts line 133. Likely necessitated by DOM changes in the Backstage version bump.

Suggested fix: Consider page.getByRole("article").getByText(text).toBeVisible() to preserve both structural and visibility checks.

@fullsend-ai-review fullsend-ai-review Bot added ready-for-merge All reviewers approved — ready to merge and removed ready-for-merge All reviewers approved — ready to merge labels Sep 2, 2026
@fullsend-ai-review

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 12:23 PM UTC · Completed 12:33 PM UTC

Commit: 075a5c7 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $3.39

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file ready-for-merge All reviewers approved — ready to merge workspace/scorecard

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants