[nicolejms]

Summary

Phase 3 of the Backstage plugin migration, as defined in the plan in #406 (commit 1d3105b).

• 3A (FS-01–FS-08, BS-01–BS-04): Adds a native Radius plugin as the default export at @internal/plugin-radius/alpha. It uses createFrontendPlugin, one ApiBlueprint (radius-api) and eight PageBlueprint pages with the existing URLs. The plugin ID stays radius, and the radius-catalog flag and Kubernetes API dependencies are kept. The legacy root exports stay for the support window. Packed-artifact tests install the root and /alpha entries in real hosts. The six-plugin backend is now built by a testable factory. The health-only Radius backend scaffold stays uninstalled.
• 3B (FS-09–FS-12): The standalone app was qualified as a hybrid host on the new frontend defaults before the final change.
• 3C (FS-13–FS-16): The standalone app is now a native createApp host. It uses native catalog, catalog graph, home, user settings and Kubernetes entries. Auth, themes, sidebar, cards, alerts and dialogs are native extensions. It has no convertLegacyPlugin, and no legacy app helpers are required. Auto guest sign-in is kept. A failed guest-backend sign-in now displays an error instead of offering a legacy-token fallback.
• FS-16: yarn test:e2e:rollback runs all journeys on the candidate image. Then it restores the previous qualified image on the same address and runs that revision's journeys. Before any test runs, it checks each image's revision label and yarn.lock Git blob. The Build workflow runs this check on the CI-built image.
• Review fixes: Replaces the new UUID 10 dependency with fixed UUID 11.1.1 without changing the qualified Backstage versions. The packed-host runner closes its server after browser startup or shutdown failure and reports both journey and cleanup errors. Three new failure-path tests run as part of test:all. Documentation separates historical image records from current CI evidence.

The package remains private. Public naming and publication are separate decisions. Out of scope, as the plan requires: the graph POST stays in ApplicationTab; no @radius-project/core or graph-react adoption (Phase 4); no publication; React stays at 18.

Reason for change

Backstage's legacy frontend system is being retired. This change implements Phase 3 of the plan in #406.

Fixes #

How to test

Prerequisites: Node 24, corepack enable, Docker with linux/amd64 support, and Playwright Chromium (yarn exec playwright install --with-deps chromium). Use Bash or WSL for the environment-variable syntax below.

1. yarn install --immutable && yarn tsc && yarn lint:all: expect no errors.
2. yarn test:all: expect the release-image tests, cleanup regression tests and workspace suites to pass. To run only the new regressions, use yarn test:qualification-runners; all three must exit without a process timeout.
3. yarn test:package: expect the packed root and /alpha hosts to pass.
4. yarn build:backend && NODE_ENV=production yarn test:e2e:standalone: expect 9 journeys to pass against the real backend and the built native app.
5. yarn build-image. Then run yarn test:e2e:rollback ghcr.io/radius-project/dashboard@sha256:166dcc84f8399b6c7b2e060c22eda390763d9379001e24695a961154679daa44 4f243cc02166e1330fe5769683d2a70aca23ded1 <built image ID> <HEAD revision>. Expect the candidate to pass 9/9 and the restored image to pass 6/6. A wrong revision must fail before any tests run.
6. In CI, both the Build workflow and Dependency Review must pass.

Recorded results

Build run 40589071183 passed for head d30482c (checked-out merge revision 944d80359e77102c54998f344d48dfd3b4b59cae). Dependency Review run 40589071602 also passed. DCO passed.

Command or check	Result
yarn install --immutable	Passed in CI
yarn run tsc, yarn run lint:all, yarn run format:check	Passed in CI
yarn run test:all	Passed: 68 release-image tests, 3 cleanup tests and 517 workspace tests; 23 package tests run separately
yarn run test:package	Passed: 23 package tests, including both packed browser hosts
yarn run test:e2e:standalone with NODE_ENV=production	Passed: 9 journeys
yarn run test:e2e:components	Passed: 8 tests
PLAYWRIGHT_URL=http://localhost:7007 PLAYWRIGHT_DISABLE_WEBSERVER=true yarn run test:e2e	Passed: 8 tests; the controlled-backend auth case runs in standalone and rollback qualification
yarn run test:e2e:rollback <previous digest> <previous revision> <candidate ID> <candidate revision>	Passed in CI: candidate 9/9, restored image 6/6; both source/lockfile records verified
YARN_ENABLE_HARDENED_MODE=1 corepack yarn install --immutable --mode=skip-build	Passed against public npm in WSL
node --test scripts/release-image.test.ts scripts/qualify-plugin-host.test.ts	Passed in WSL: 71/71
shellcheck --shell=bash -, shellcheck --shell=sh -	Passed for the PR's workflow and Docker shell blocks supplied on stdin

The CI candidate image ID is sha256:afa29d094a14ebee9b18ab4a9c1e7681bfeb00dc18937fc7f99e538f6f146aee, with lockfile Git blob e16d68e3d4e49b5c3fbe6fd52404b7ac384c9c0e. The previous image uses revision 4f243cc02166e1330fe5769683d2a70aca23ded1 and lockfile blob 858e8c64a07fc43c8dc52a526eb5cb07c30865fb. The CI candidate is not claimed as a published registry image.

The two new startup/shutdown regressions failed with a timeout before the fix and now pass. A separate check confirmed that Dockerode can require UUID 11.1.1 and call v4(), and that an out-of-bounds v5() buffer write throws RangeError. The lockfile contains no internal registry URLs. Local image rebuilds remain limited by this machine's registry network access; current image evidence comes from CI.

File change summary

File	Summary of change
plugins/plugin-radius/src/alpha.tsx, src/api/ref.ts, package.json	Native /alpha plugin, shared API ref, export map
plugins/plugin-radius/src/components/**	Import the shared API ref
plugins/plugin-radius/src/*.test.ts(x), fixtures/*	Native registration, packing and import-boundary tests
packages/app/src/**	Native standalone app, sidebar, home, API and catalog modules
packages/app/e2e-tests/*	Native host and catalog journeys; automatic guest entry
packages/backend/src/*	Backend factory and BS tests
packages/backend/Dockerfile	Optional local npm registry, passed only as a BuildKit secret
scripts/qualify-*.ts	Packed-host, standalone-host and image-rollback runners; browser failure cleanup and regression tests
scripts/release-image.ts, .test.ts	Registry secret option, release guard and required CI test-chain assertions
.github/workflows/build.yaml	Runs built-host qualification and the FS-16 image restore check
docs/contributing/**	Migration versions, qualification commands, historical FS-16 records and auth failure behavior
package.json, playwright.config.ts, yarn.lock	Scripts, native frontend dependencies and the fixed UUID resolution

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 16 packages with OpenSSF Scorecard issues.

View full job summary

[nithyatsu]

Thanks for the thorough follow-up. Almost all of the earlier feedback is addressed. The docs cleanup, #421 tracking, removed source-text tests and registry override, apis cleanup and dialog handling all look good, and CI is green (candidate 10/10, restored 6/6).

A few remaining items inline. The main ones are the shared config file in the rollback script (the restored container can briefly read the candidate's config) and the duplicated port-retry helper.

[nithyatsu]

Thank you, Nicole. All of the review feedback is addressed. The rollback runner now uses a separate upstream container and resets the config for each image. The backend startup retry lives in one shared helper, the route binding is back inline, and CI passes. Approving.