Merge pull request #1 from datum-cloud/feat/initial-backstage-scaffold

feat: scaffold Backstage application

Author: scotwells

.dockerignore

@@ -0,0 +1,7 @@
+.git
+.yarn/cache
+.yarn/install-state.gz
+node_modules
+packages/*/node_modules
+plugins/*/node_modules
+*.local.yaml

.eslintignore

@@ -0,0 +1 @@
+playwright.config.ts

.eslintrc.js

@@ -0,0 +1,3 @@
+module.exports = {
+  root: true,
+};

.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    ignore:
+      - dependency-name: "@backstage/*"
+    groups:
+      minor-and-patch:
+        update-types:
+          - minor
+          - patch
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/e2e.yaml

@@ -0,0 +1,87 @@
+name: E2E
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  kind-e2e:
+    runs-on: ubuntu-latest
+    env:
+      CLUSTER_NAME: backstage-e2e
+      IMAGE: backstage:e2e
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+
+      - name: Build backend image
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
+        with:
+          context: .
+          file: packages/backend/Dockerfile
+          load: true
+          tags: ${{ env.IMAGE }}
+          cache-from: type=gha,scope=backstage-e2e
+          cache-to: type=gha,mode=max,scope=backstage-e2e
+
+      - name: Create kind cluster
+        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1
+        with:
+          cluster_name: ${{ env.CLUSTER_NAME }}
+
+      - name: Load image into kind
+        run: kind load docker-image "${IMAGE}" --name "${CLUSTER_NAME}"
+
+      - name: Install CloudNativePG operator
+        run: |
+          helm repo add cnpg https://cloudnative-pg.github.io/charts
+          helm upgrade --install cnpg cnpg/cloudnative-pg \
+            --namespace cnpg-system --create-namespace \
+            --version '0.28.x' --wait --timeout 5m
+
+      - name: Deploy e2e overlay
+        run: kubectl kustomize config/overlays/e2e | kubectl apply --server-side -f -
+
+      - name: Wait for PostgreSQL
+        run: kubectl -n backstage wait --for=condition=Ready cluster/backstage-postgres --timeout=5m
+
+      - name: Wait for Backstage
+        run: kubectl -n backstage rollout status deploy/backstage --timeout=10m
+
+      - name: Smoke test backend
+        run: |
+          kubectl -n backstage run curl-smoke \
+            --image=curlimages/curl:8.10.1 \
+            --restart=Never --rm -i --quiet -- \
+            sh -ceu '
+              echo "readiness:"
+              code=$(curl -sS -o /dev/null -w "%{http_code}" http://backstage:7007/.backstage/health/v1/readiness)
+              echo "$code"
+              [ "$code" = "200" ]
+
+              echo "liveness:"
+              code=$(curl -sS -o /dev/null -w "%{http_code}" http://backstage:7007/.backstage/health/v1/liveness)
+              echo "$code"
+              [ "$code" = "200" ]
+
+              echo "catalog entities:"
+              code=$(curl -sS -o /dev/null -w "%{http_code}" http://backstage:7007/api/catalog/entities)
+              echo "$code"
+              [ "$code" = "200" ]
+            '
+
+      - name: Dump diagnostics
+        if: failure()
+        run: |
+          kubectl -n backstage get pods,svc,cluster
+          kubectl -n backstage describe cluster/backstage-postgres || true
+          kubectl -n backstage describe deploy/backstage
+          kubectl -n backstage logs deploy/backstage --all-containers --tail=200 || true

.github/workflows/publish.yaml

@@ -0,0 +1,37 @@
+name: Publish Docker Image
+
+on:
+  push:
+    branches: [main]
+    tags: ['v*']
+  release:
+    types: ['published']
+
+jobs:
+  publish-container-image:
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+      attestations: write
+    uses: datum-cloud/actions/.github/workflows/publish-docker.yaml@v1.16.0
+    with:
+      image-name: backstage
+      context: .
+      dockerfile-path: packages/backend/Dockerfile
+      platforms: linux/amd64
+    secrets: inherit
+
+  publish-kustomize-bundle:
+    needs: publish-container-image
+    permissions:
+      id-token: write
+      contents: read
+      packages: write
+    uses: datum-cloud/actions/.github/workflows/publish-kustomize-bundle.yaml@v1.16.0
+    with:
+      bundle-name: ghcr.io/datum-cloud/backstage-kustomize
+      bundle-path: config
+      image-name: ghcr.io/datum-cloud/backstage
+      image-overlays: config/base
+    secrets: inherit

.github/workflows/snyk-scan.yaml

@@ -0,0 +1,25 @@
+name: Snyk Security Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '0 6 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  snyk:
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    uses: datum-cloud/actions/.github/workflows/snyk-scan.yaml@v1.16.0
+    with:
+      severity-threshold: high
+      upload-sarif: true
+    secrets: inherit

.github/workflows/version-bump.yaml

@@ -0,0 +1,49 @@
+name: Backstage Version Bump
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  bump:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22
+
+      - name: Enable Corepack
+        run: corepack enable
+
+      - name: Install dependencies
+        run: yarn install --immutable
+
+      - name: Bump Backstage packages
+        run: yarn backstage-cli versions:bump
+
+      - name: Open pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.BACKSTAGE_BUMP_TOKEN || github.token }}
+          branch: chore/backstage-version-bump
+          delete-branch: true
+          base: main
+          title: 'chore: bump Backstage to latest release'
+          commit-message: 'chore: bump Backstage packages'
+          labels: dependencies
+          body: |
+            Automated `yarn backstage-cli versions:bump` — moves every
+            `@backstage/*` package to the latest coordinated release and
+            updates `backstage.json`.
+
+            Review the diff and let the `E2E` workflow validate the kind
+            deployment before merging.

.gitignore

@@ -0,0 +1,56 @@
+# macOS
+.DS_Store
+
+# Logs
+logs
+*.log
+npm-debug.log*
+yarn-debug.log*
+yarn-error.log*
+
+# Coverage directory generated when running tests with coverage
+coverage
+
+# Dependencies
+node_modules/
+
+# Yarn files
+.pnp.*
+.yarn/*
+!.yarn/patches
+!.yarn/plugins
+!.yarn/releases
+!.yarn/sdks
+!.yarn/versions
+
+# Node version directives
+.nvmrc
+
+# dotenv environment variables file
+.env
+.env.test
+
+# Build output
+dist
+dist-types
+
+# Temporary change files created by Vim
+*.swp
+
+# MkDocs build output
+site
+
+# Local configuration files
+*.local.yaml
+
+# Sensitive credentials
+*-credentials.yaml
+
+# vscode database functionality support files
+*.session.sql
+
+# E2E test reports
+e2e-test-report/
+
+# Cache
+.cache/

.prettierignore

@@ -0,0 +1,4 @@
+dist
+dist-types
+coverage
+.vscode