Mix things by rou-cru · Pull Request #81 · rou-cru/idp-blueprint

rou-cru · 2026-01-11T03:02:24Z

No description provided.

Phase 1 integrations (cherry-picked from update-docs branch): - GitHub Actions: Production-grade CI/CD pipeline with change detection, matrix builds, auto-merge, and quality gates - config.toml: Centralized configuration for cluster, versions, and fuses - docker-bake.hcl: Multi-target builds (ops, dev-portal variants) - UI/packages: Complete Backstage implementation (frontend + backend) - load-test-gateway.js: K6 load testing script All changes are additive with zero conflicts with main. Related: PR #77

Phase 2 integration: Task organization improvements Add `internal: true` flags to implementation-level tasks to declutter `task --list` output. User-facing tasks remain public (deploy, destroy, quality:check, etc.), while implementation details are hidden. Changes: - Taskfile.yaml: Mark `deploy-core` as internal - Task/bootstrap.yaml: Mark 10 tasks as internal (cilium:deploy, it:bootstrap, cert-manager:deploy, external-secrets:deploy, it:eso:apply-resources, vault:generate-secrets, vault:deploy, it:deploy-secret-and-certs, argocd:deploy, gateway:deploy) - Task/stacks.yaml: Mark `deploy` as internal Result: `task --list` now shows ~15 user-facing commands instead of 40+ Related: PR #77

coderabbitai · 2026-01-11T03:02:34Z

📝 Walkthrough

Summary by CodeRabbit

New Features
- Integrated Grafana dashboards for Kubernetes metrics and container logs visualization.
- Added auto-merge capability for pull requests via GitHub Actions workflow.
Chores
- Updated documentation URLs across issue templates.
- Upgraded Backstage dependencies to latest minor/patch versions.
- Reorganized GitHub labeler paths for IT and Kubernetes-centric structure.
- Added pull request template with standardized sections.
Documentation
- Added comprehensive merge conflict resolution strategy guide.
Style
- Enhanced dark theme with comprehensive Material-UI component styling and CSS overrides.
Tests
- Added k6 load-testing script for catalog API performance validation.
- Enhanced CI workflow with path-based change detection and conditional matrix builds.

_{✏️ Tip: You can customize this high-level summary in your review settings.}

Walkthrough

Repository-wide configuration, CI/CD workflows, task visibility, Backstage UI/theme and dependencies, observability integrations, a load test script, and documentation were updated — including new auto-merge and refactored CI workflows, Grafana UI integration, multiple dependency bumps, and added internal flags to several tasks.

Changes

Cohort / File(s)	Summary
Issue Templates `.github/ISSUE_TEMPLATE/*` `.github/ISSUE_TEMPLATE/bug_report.yml`, `.github/ISSUE_TEMPLATE/config.yml`, `.github/ISSUE_TEMPLATE/documentation.yml`, `.github/ISSUE_TEMPLATE/feature_request.yml`	Updated documentation URL and example placeholders from `https://rou-cru.github.io/idp-blueprint/` to `https://idp-blueprint.roura.xyz/`. Presentational text changes only.
Pull Request Template `.github/pull_request_template.md`	Added new PR template with Summary, Testing, and Checklist sections.
Labeler `.github/labeler.yml`	Reworked labeler path globs to IT/K8s-centric layout; updated template references and removed some legacy paths.
Workflows — Auto-merge `.github/workflows/auto-merge.yaml`	New GitHub Actions workflow to enable squash auto-merge after PR context resolution and guard checks (draft/state/behind).
Workflows — CI `.github/workflows/ci.yaml`	Major CI refactor: path-based change detection, conditional docs/core/docker matrix jobs, parallel builds, and a ci-green aggregator; removed prior path-ignore config.
Workflows — Docs `.github/workflows/docs.yaml`	Changed Node.js setup version from 24 → 22.
Task Visibility `Task/bootstrap.yaml`, `Task/stacks.yaml`, `Taskfile.yaml`	Added `internal: true` to multiple bootstrap/core deploy tasks (cilium, cert-manager, vault, argocd, gateway, deploy-core, deploy, etc.).
UI — Dependencies `UI/packages/app/package.json`	Added `@backstage-community/plugin-grafana` and bumped many Backstage frontend packages (minor/patch updates).
UI — Entity Pages `UI/packages/app/src/components/catalog/EntityPage.tsx`	Added Grafana-backed `/logs` and `/metrics` routes, conditional rendering helpers (`hasSubcomponents`, `hasApis`), and conditional integration gating on `grafana.domain`.
UI — Theme `UI/packages/app/src/theme/primer.ts`	Extended Primer dark theme: added `palette.text`, global CSS baseline, and many MUI component overrides.
Backend — Dockerfile `UI/packages/backend/Dockerfile`	Simplified yarn cache cleanup command in build stage.
Backend — Dependencies `UI/packages/backend/package.json`	Bumped numerous Backstage backend dependencies and CLI.
Load Testing `load-test-gateway.js`	Added k6 load test script targeting `/api/catalog/entities` (300 VUs, 2m, p95 < 200ms).
Documentation `merge-conflict.md`	Added comprehensive merge conflict resolution strategy and execution plan for reconciling branches.

Sequence Diagram(s)

sequenceDiagram
    actor PR as Pull Request
    participant GH as GitHub API
    participant GHA as GitHub Actions (auto-merge)
    participant AM as Auto-Merge Service

    PR->>GHA: Trigger auto-merge workflow (PR target or workflow_run)
    GHA->>GH: Resolve PR context (payload or workflow_run -> fetch PR)
    GH-->>GHA: Return PR data (draft, state, mergeable)
    alt PR found and valid
        GHA->>GHA: Run guards (not draft, open, mergeable_state)
        alt Guards pass
            GHA->>AM: Enable auto-merge (squash) using repo token
            AM-->>GHA: Confirmation enabled
        else Guards fail
            GHA-->>PR: Skip enabling (draft/closed/behind)
        end
    else No PR context
        GHA-->>PR: Fail step (no PR found)
    end

sequenceDiagram
    participant PR as Pull Request
    participant GHA as GitHub Actions (ci)
    participant PD as Path Detector
    participant Jobs as CI Jobs (docs-pr, core-ci, docker-build)
    participant CI as ci-green aggregator

    PR->>GHA: Trigger CI workflow
    GHA->>PD: Detect changed paths (docs, values, base, targets)
    PD-->>GHA: Classification (docs-only / full / targets)
    alt Docs-only
        GHA->>Jobs: Run docs-pr
        Jobs-->>GHA: Docs job result
    else Full run (base/targets/values changed)
        GHA->>Jobs: Run core-ci (lint/security/validate)
        GHA->>Jobs: Run docker-build (matrix parallel)
        Jobs-->>GHA: Core and build results
    end
    GHA->>CI: Aggregate job statuses
    alt Any failed/cancelled
        CI-->>PR: CI failed
    else All passed
        CI-->>PR: CI green
    end

Possibly related PRs

rou_cru/idp-blueprint#64 — Modifies Taskfile/task deploy structure; relates to added internal: true task flags.
rou_cru/idp-blueprint#73 — Adjusts repository metadata and GitHub automation (issue templates, workflows); overlaps with template and workflow changes here.
rou_cru/idp-blueprint#66 — Changes to primer.ts theme and UI styling; overlaps with theme extensions in this PR.

Suggested labels

dependencies, observability, cicd, configuration, argocd, vault

Poem

🐰
I tidy configs, nudge CI to race,
Hop in themes and dashboards — a cozy place.
Tasks tucked inside, merge lights gleam,
Logs and metrics in a Grafana dream.
Hop, merge, and test — hooray for the pace!

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (2 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'Mix things' is vague and does not clearly describe the primary changes in the pull request, which include documentation URL updates, GitHub workflow automation, task visibility changes, dependency updates, and UI enhancements.	Replace with a specific title that reflects the main changes, such as 'Update documentation URLs, GitHub workflows, and dependencies' or 'Add automation and update infrastructure configuration'.
Description check	❓ Inconclusive	No pull request description was provided by the author, making it impossible to assess whether the description relates to the changeset.	Add a pull request description that explains the purpose, scope, and key changes of this pull request to help reviewers understand the intent.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch mix-things

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai · 2026-01-11T03:02:46Z

Caution

Docstrings generation - FAILED

No docstrings were generated.

coderabbitai

Actionable comments posted: 6

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

UI/packages/backend/package.json (1)
18-59: Fix Prettier line length violation on line 32.

The backend correctly uses the createBackend() API and TypeScript ~5.8.0 meets requirements. However, line 32 exceeds the 88-character Prettier limit:
"@backstage/plugin-catalog-backend-module-scaffolder-entity-model": "^0.2.15",
This line is 89 characters. Split it across multiple lines or adjust formatting to comply with the project's Prettier configuration.

🤖 Fix all issues with AI agents

In @.github/labeler.yml:
- Around line 44-46: The glob "K8s/**/argocd*" won't match files under an
"argocd/" directory because "*" doesn't cross slashes; update the labeler rule
that currently uses the pattern "K8s/**/argocd*" to also include a recursive
directory pattern such as "K8s/**/argocd/**" (or replace with a pattern that
covers both file-prefix and directory cases) so files under an argocd/ directory
are matched; look for the "K8s/**/argocd*" entry in .github/labeler.yml and add
or swap in the recursive form.

In @.github/workflows/auto-merge.yaml:
- Around line 55-66: The workflow currently treats mergeable_state 'unknown' as
acceptable and may enable auto-merge prematurely; update the logic so auto-merge
is only enabled for explicit safe states (e.g., require
steps.ctx.outputs.mergeable_state == 'clean' rather than != 'behind'), and
ensure the earlier output assignment from pr.mergeable_state does not default to
'unknown' in a way that bypasses the check (use the actual pr.mergeable_state
and/or an explicit equality check for 'clean' when evaluating the Enable
auto-merge step while keeping the existing status == 'ready' check).

In @merge-conflict.md:
- Line 242: Add a blank line immediately before each markdown table that
currently starts at the spots referenced (tables at lines 242, 248, and 260) so
they render correctly, and update the fenced code block beginning at line 340 by
adding a language identifier (e.g., "plaintext") after the opening triple
backticks to ensure proper syntax highlighting for the block that shows the
asset path move.

In @Task/bootstrap.yaml:
- Line 67: The change marked the task vault:generate-secrets as internal: true
which will break consumers that invoke that task directly; revert/remove the
internal: true flag from the vault:generate-secrets task (or alternatively
update all external docs that reference vault:generate-secrets to reflect the
change), and also wrap or split long YAML lines in Task/bootstrap.yaml that
exceed the 88-char limit (e.g., long command strings, descriptions or
annotations) by using YAML folded style (>) or breaking long strings into
shorter sequenced lines so all lines comply with the Prettier 88-character rule.

In @Task/stacks.yaml:
- Line 82: The deploy task in Task/stacks.yaml was marked internal (internal:
true), which hides the documented public command `task stacks:deploy`; remove
the `internal: true` entry from the `deploy` task (or if the intent is to make
it private, instead update the README to remove or change the `task
stacks:deploy` documentation), ensuring references to the `deploy` task name
remain unchanged so users can invoke `task stacks:deploy` as documented.

In @UI/packages/app/src/theme/primer.ts:
- Around line 83-101: The theme currently uses Material-UI v5 syntax
components.MuiCssBaseline.styleOverrides['@global'], which is incompatible with
our MUI v4 dependency; change the theme shape to use
overrides.MuiCssBaseline['@global'] instead and move the existing '@global'
object (the ':root', '[data-theme-mode="dark"]', html and '#root' entries) under
overrides → MuiCssBaseline → '@global' so MUI v4 will apply the global CSS
properly.

🧹 Nitpick comments (8)

UI/packages/app/src/theme/primer.ts (1)
56-56: Line exceeds 88 character limit.

This line is approximately 130 characters. Per coding guidelines, line length must be 88 characters.
♻️ Suggested fix
-  fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji"',
+  fontFamily: [
+    '-apple-system',
+    'BlinkMacSystemFont',
+    '"Segoe UI"',
+    'Helvetica',
+    'Arial',
+    'sans-serif',
+    '"Apple Color Emoji"',
+    '"Segoe UI Emoji"',
+  ].join(', '),
UI/packages/app/src/components/catalog/EntityPage.tsx (3)
94-125: Consider iframe security and maintainability improvements.

A few concerns with the Grafana iframe integration:

Hardcoded dashboard UID (fRIvzUZMz) - if the dashboard is recreated or imported elsewhere, this breaks silently.

No sandbox attribute - consider adding sandbox="allow-scripts allow-same-origin" to restrict iframe capabilities.

Warning message exposes internal paths (line 105-106) - the file path K8s/backstage/backstage/templates/cm-tpl.yaml may reveal internal infrastructure details.
♻️ Suggested improvements
+  // Consider moving to app-config for maintainability
+  const LOKI_DASHBOARD_UID = 'fRIvzUZMz';
+
   return (
     <iframe
       title="Container Logs"
       src={src}
       className={classes.iframe}
+      sandbox="allow-scripts allow-same-origin"
     />
   );
For the warning message, consider a more generic message:
-        message='The "grafana.domain" configuration is missing in app-config. Please check your K8s/backstage/backstage/templates/cm-tpl.yaml and ensure DNS_SUFFIX is set.'
+        message='The "grafana.domain" configuration is missing in app-config. Please configure Grafana integration in your deployment settings.'
127-158: Same concerns apply to EntityKubernetesMetrics.

This component has the same issues as EntityLokiLogs: hardcoded dashboard UID (GlXkUBGiz), no iframe sandbox, and exposed internal paths in warning message.

Consider extracting common iframe logic into a reusable component to reduce duplication.
♻️ Extract common Grafana iframe component
interface GrafanaIframeProps {
  title: string;
  dashboardUid: string;
  dashboardPath: string;
  queryParams: string;
}

const GrafanaIframe = ({ title, dashboardUid, dashboardPath, queryParams }: GrafanaIframeProps) => {
  const classes = useStyles();
  const { entity } = useEntity();
  const config = useApi(configApiRef);
  const grafanaUrl = config.getOptionalString('grafana.domain');

  if (!grafanaUrl) {
    return (
      <WarningPanel
        title="Integration Disabled"
        message='The "grafana.domain" configuration is missing.'
      />
    );
  }

  const src = `${grafanaUrl}${dashboardPath}${queryParams}`;
  return (
    <iframe
      title={title}
      src={src}
      className={classes.iframe}
      sandbox="allow-scripts allow-same-origin"
    />
  );
};
332-334: Extract inline styles to useStyles.

The repeated inline style={{ height: '100%', width: '100%', minHeight: '700px' }} for TopologyPage containers should be added to the useStyles hook for consistency.
♻️ Suggested refactor
 const useStyles = makeStyles({
   iframe: {
     width: '100%',
     height: '800px',
     border: 'none',
   },
+  topologyContainer: {
+    height: '100%',
+    width: '100%',
+    minHeight: '700px',
+  },
 });
Then use className={classes.topologyContainer} instead of inline styles.
Also applies to: 386-388, 419-421
load-test-gateway.js (2)
17-17: Document that insecure TLS is for testing only.

The insecureSkipTLSVerify: true setting is appropriate for load testing against local or staging environments with self-signed certificates. Consider adding a comment clarifying that this script is intended for non-production testing only.
📝 Suggested documentation addition
   thresholds: {
     http_req_duration: ['p(95)<200'], // Goal: p95 should be under 200ms
   },
+  // Skip TLS verification for testing against self-signed certificates
+  // WARNING: Only use this script against non-production environments
   insecureSkipTLSVerify: true,
 };
6-12: Verify target system capacity for aggressive stress testing.

The test configuration uses 300 constant virtual users for 2 minutes with no sleep between requests (maximum pressure). This is an extremely aggressive stress test that will generate thousands of requests per second. Ensure your target environment can handle this load without cascading failures that could affect other systems. Consider starting with fewer VUs (e.g., 50-100) and gradually increasing to find the breaking point.

Also applies to: 27-27
.github/workflows/auto-merge.yaml (1)
19-19: Consider adding explanatory comments for complex conditional logic.

The repository check and workflow_run fallback logic (lines 19, 26-39) are correct but complex. Adding inline comments would improve maintainability, especially for the dual trigger paths (pull_request_target vs workflow_run).
📝 Suggested documentation improvements
   auto-merge:
     runs-on: ubuntu-latest
+    # Only run for PRs from the same repo (not forks) or when triggered by workflow completion
     if: github.event.pull_request.head.repo.full_name == github.repository || github.event.workflow_run.event == 'pull_request'
     steps:
       - name: Get PR context
         id: ctx
         uses: actions/github-script@v8
         with:
           script: |
+            // For pull_request_target events, use the payload directly
+            // For workflow_run events, fetch the PR from the completed workflow
             const pr = context.payload.pull_request
               ? context.payload.pull_request
               : await (async () => {
Also applies to: 26-39
.github/workflows/ci.yaml (1)
129-175: Matrix build job is well-designed, but jlumbroso/free-disk-space@main pins to a moving target.

Pinning to @main (line 146) is risky—it can break builds unexpectedly if the action changes.
🔧 Pin to a specific version or commit SHA
       - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@v1.3.1
         with:
           tool-cache: false

📜 Review details

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 02c151b and c295bb6.

📒 Files selected for processing (19)

.github/ISSUE_TEMPLATE/bug_report.yml
.github/ISSUE_TEMPLATE/config.yml
.github/ISSUE_TEMPLATE/documentation.yml
.github/ISSUE_TEMPLATE/feature_request.yml
.github/labeler.yml
.github/pull_request_template.md
.github/workflows/auto-merge.yaml
.github/workflows/ci.yaml
.github/workflows/docs.yaml
Task/bootstrap.yaml
Task/stacks.yaml
Taskfile.yaml
UI/packages/app/package.json
UI/packages/app/src/components/catalog/EntityPage.tsx
UI/packages/app/src/theme/primer.ts
UI/packages/backend/Dockerfile
UI/packages/backend/package.json
load-test-gateway.js
merge-conflict.md

🧰 Additional context used

📓 Path-based instructions (6)

**/*.{js,ts,tsx,jsx,json,css,scss,yaml,yml,md}

📄 CodeRabbit inference engine (AGENTS.md)

Line length must be 88 characters (Prettier configuration)

Files:

load-test-gateway.js
Task/stacks.yaml
merge-conflict.md
UI/packages/app/src/components/catalog/EntityPage.tsx
Taskfile.yaml
Task/bootstrap.yaml
UI/packages/app/package.json
UI/packages/app/src/theme/primer.ts
UI/packages/backend/package.json

**/*.{js,ts,tsx,jsx}

📄 CodeRabbit inference engine (AGENTS.md)

Use single quotes for quote style (Prettier configuration)

Files:

load-test-gateway.js
UI/packages/app/src/components/catalog/EntityPage.tsx
UI/packages/app/src/theme/primer.ts

**/*.{yaml,yml}

📄 CodeRabbit inference engine (AGENTS.md)

**/*.{yaml,yml}: All workloads must specify CPU/memory requests and limits using appropriate units (m for CPU, Mi/Gi for memory)
YAML files must extend yamllint default configuration with document-start and comments disabled and relaxed braces, brackets, quoted-strings
All Kubernetes resources must include required labels: owner, business-unit, environment, and app.kubernetes.io/part-of
PriorityClasses are required on all workloads
No hardcoded secrets in manifests - use Vault and External Secrets Operator for secret management

Files:

Task/stacks.yaml
Taskfile.yaml
Task/bootstrap.yaml

**/*.md

📄 CodeRabbit inference engine (AGENTS.md)

**/*.md: Markdown files should have prose wrap enabled (Prettier configuration)
Markdown line length should be 92 characters (markdownlint configuration)
Unordered lists in Markdown must use dashes as list markers (markdownlint configuration)
Markdown files may only use specific HTML elements: <details>, <summary>, <img> (markdownlint configuration)

Files:

merge-conflict.md

UI/**/*.{ts,tsx}

📄 CodeRabbit inference engine (AGENTS.md)

Backstage developer portal must use React with TypeScript and Yarn workspaces

Files:

UI/packages/app/src/components/catalog/EntityPage.tsx
UI/packages/app/src/theme/primer.ts

Taskfile.yaml

📄 CodeRabbit inference engine (AGENTS.md)

Use Task (go-task) for automation and orchestration of common development tasks

Files:

Taskfile.yaml

🧠 Learnings (8)