chore: apply local review findings — dep bumps, workflow dedup/cache, small cleanups

- bump esbuild 0.24.2 -> 0.28.1 (clears GHSA-67mh-4wv8-2f99 advisory range) and
  typescript 6.0.2 -> 6.0.3; engines.yarn ">=4" to match packageManager yarn@4
- workflow: single source of truth for the default plugin ref (env only, input
  default removed); corepack before setup-node + yarn cache keyed on
  smoke-tests-native/yarn.lock
- native-smoke: shared BackendStartResult type; writeErrorReport helper also
  covers usage errors (results.json now written on exit 2 too); drop unused env
  param from run(); single-pass KNOWN_FAILURES partition
- loader: normalize "./dist/…" package mains; type-guard filter instead of
  "as string[]"; hoist repeated role check

Verified on Node 24: tsc clean, esbuild build ok, end-to-end smoke run
status: pass (backend loaded 1/1, startTestBackend booted), usage-error path
writes results.json (status: error) and exits 2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: gustavolira

.github/workflows/native-smoke.yaml

@@ -23,11 +23,11 @@ on:
     inputs:
       plugin_ref:
         description: >-
-          OCI package ref to validate (oci://…:tag!name). Defaults to a known-good
-          pure-backend plugin. Catalog-extending modules are not supported yet.
+          OCI package ref to validate (oci://…:tag!name). Leave empty to use the
+          known-good pure-backend default (env.DEFAULT_PLUGIN_REF below).
+          Catalog-extending modules are not supported yet.
         type: string
         required: false
-        default: "oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/roadiehq-scaffolder-backend-module-http-request:bs_1.49.4__5.6.0!roadiehq-scaffolder-backend-module-http-request"
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
@@ -38,7 +38,8 @@ permissions:
   packages: read
 
 env:
-  # Default plugin validated on pull_request; overridable via the dispatch input.
+  # Single source of truth for the plugin validated on pull_request and when the
+  # dispatch input is left empty.
   DEFAULT_PLUGIN_REF: "oci://ghcr.io/redhat-developer/rhdh-plugin-export-overlays/roadiehq-scaffolder-backend-module-http-request:bs_1.49.4__5.6.0!roadiehq-scaffolder-backend-module-http-request"
 
 jobs:
@@ -54,13 +55,16 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Enable Corepack
+        # Before setup-node so its yarn-cache detection resolves Yarn 4 via corepack.
+        run: corepack enable
+
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24
-
-      - name: Enable Corepack
-        run: corepack enable
+          cache: yarn
+          cache-dependency-path: smoke-tests-native/yarn.lock
 
       - name: Install skopeo
         # The install-dynamic-plugins CLI shells out to skopeo to pull OCI plugins.

smoke-tests-native/package.json

@@ -6,7 +6,7 @@
   "description": "Docker-free, in-process smoke harness for RHDH dynamic backend plugins: install via the published install-dynamic-plugins CLI, then boot with startTestBackend — no container, no cluster.",
   "engines": {
     "node": ">=24",
-    "yarn": ">=3"
+    "yarn": ">=4"
   },
   "packageManager": "yarn@4.12.0",
   "scripts": {
@@ -23,7 +23,7 @@
   "devDependencies": {
     "@red-hat-developer-hub/cli-module-install-dynamic-plugins": "0.3.0",
     "@types/node": "24.13.2",
-    "esbuild": "0.24.2",
-    "typescript": "6.0.2"
+    "esbuild": "0.28.1",
+    "typescript": "6.0.3"
   }
 }

smoke-tests-native/src/loader.ts

@@ -67,15 +67,16 @@ export function discoverPlugins(root: string): PluginManifest {
       continue;
     }
     const role: string = pkg.backstage?.role ?? "";
+    const isFrontend = role.includes("frontend");
     const item: PluginEntry = {
       name: pkg.name ?? entry.name,
       version: pkg.version ?? "0.0.0",
       dirName: entry.name,
       path: dir,
-      role: role.includes("frontend") ? "frontend" : "backend",
+      role: isFrontend ? "frontend" : "backend",
     };
 
-    if (role.includes("frontend")) frontend.push(item);
+    if (isFrontend) frontend.push(item);
     else if (role.includes("backend")) backend.push(item);
     // dirs without a backstage role aren't plugins — skip
   }
@@ -90,12 +91,14 @@ function resolveEntryPoint(pluginPath: string): string {
     throw new Error(`package.json not found in ${pluginPath}`);
   }
   const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  // Normalize "./dist/…" → "dist/…" so an explicit main is not silently excluded.
+  const main: string | undefined = pkg.main?.replace(/^\.\//, "");
   const candidates = [
     "dist/index.cjs.js",
     "dist/index.esm.js",
     "dist/index.js",
-    pkg.main?.startsWith("dist/") ? pkg.main : undefined,
-  ].filter(Boolean) as string[];
+    main?.startsWith("dist/") ? main : undefined,
+  ].filter((c): c is string => Boolean(c));
 
   for (const candidate of candidates) {
     const full = join(pluginPath, candidate);

smoke-tests-native/src/native-smoke.ts

@@ -73,6 +73,7 @@ const CLI_BIN = join(
 const coreFeatures = [scaffolderPlugin];
 
 type Status = "pass" | "fail-load" | "fail-start" | "fail-bundle" | "error";
+type BackendStartResult = { ok: boolean; skipped?: boolean; error?: string };
 type Report = {
   cliVersion: string;
   backend: {
@@ -81,19 +82,34 @@ type Report = {
     skipped: string[];
     errors: PluginError[];
   };
-  backendStart: { ok: boolean; skipped?: boolean; error?: string };
+  backendStart: BackendStartResult;
   frontend: { total: number; valid: number; errors: PluginError[] };
   status: Status;
 };
 
 // execFileSync (args array, no shell) so workspace names / OCI refs can never be
 // interpolated into a shell command as this grows beyond a single fixed plugin.
-function run(file: string, args: string[], env?: NodeJS.ProcessEnv): string {
-  return execFileSync(file, args, {
-    encoding: "utf-8",
-    stdio: "pipe",
-    env: { ...process.env, ...env },
-  }).trim();
+function run(file: string, args: string[]): string {
+  return execFileSync(file, args, { encoding: "utf-8", stdio: "pipe" }).trim();
+}
+
+// Any failure — bad args, install CLI crash, boot error before the report is built —
+// still produces a results.json (status: error), so a consumer never reads a stale
+// "pass" or finds no report at all.
+async function writeErrorReport(
+  out: string,
+  cliVersion: string,
+  message: string,
+): Promise<void> {
+  const report: Report = {
+    cliVersion,
+    backend: { total: 0, loaded: 0, skipped: [], errors: [] },
+    backendStart: { ok: false, error: message },
+    frontend: { total: 0, valid: 0, errors: [] },
+    status: "error",
+  };
+  await writeFile(out, JSON.stringify(report, null, 2));
+  console.error(`▶ report → ${out} (status: error)\n${message}`);
 }
 
 function computeStatus(
@@ -122,9 +138,7 @@ async function extractPlugins(root: string, dynamicPlugins: string): Promise<voi
 }
 
 // Boot the loaded backend features in-process to confirm they integrate.
-async function startBackend(
-  loaded: LoadedPlugin[],
-): Promise<{ ok: boolean; skipped?: boolean; error?: string }> {
+async function startBackend(loaded: LoadedPlugin[]): Promise<BackendStartResult> {
   // No backend plugins (e.g. a frontend-only workspace) — boot wasn't attempted, not a
   // failure. Flag it so results.json doesn't read like the backend crashed.
   if (loaded.length === 0) return { ok: true, skipped: true };
@@ -172,11 +186,11 @@ async function main(): Promise<number> {
   const dynamicPlugins = values["dynamic-plugins"];
 
   if (!dynamicPlugins) {
-    console.error("Provide --dynamic-plugins <dynamic-plugins.yaml>.");
+    await writeErrorReport(out, "unknown", "Provide --dynamic-plugins <dynamic-plugins.yaml>.");
     return 2;
   }
   if (!existsSync(dynamicPlugins)) {
-    console.error(`dynamic-plugins file not found: ${dynamicPlugins}`);
+    await writeErrorReport(out, "unknown", `dynamic-plugins file not found: ${dynamicPlugins}`);
     return 2;
   }
 
@@ -204,18 +218,18 @@ async function main(): Promise<number> {
     // Let extracted plugins (under a temp dir) resolve their @backstage/* peers here.
     patchModuleResolution(HARNESS_NODE_MODULES);
 
-    const skipped = manifest.backend
-      .filter((p) => KNOWN_FAILURES.has(p.dirName))
-      .map((p) => p.dirName);
+    // Partition in one pass so `skipped` and `backendPlugins` stay complementary.
+    const skipped: string[] = [];
+    const backendPlugins: PluginEntry[] = [];
+    for (const p of manifest.backend) {
+      if (KNOWN_FAILURES.has(p.dirName)) skipped.push(p.dirName);
+      else backendPlugins.push(p);
+    }
     if (skipped.length > 0) {
       console.warn(
         `⚠ skipped ${skipped.length} known-failure backend plugin(s): ${skipped.join(", ")}`,
       );
     }
-
-    const backendPlugins = manifest.backend.filter(
-      (p) => !KNOWN_FAILURES.has(p.dirName),
-    );
     const { loaded, errors: loadErrors } = loadBackendPlugins(backendPlugins);
     const start = await startBackend(loaded);
     const frontend = validateFrontends(manifest.frontend);
@@ -258,18 +272,8 @@ async function main(): Promise<number> {
     );
     return report.status === "pass" ? 0 : 1;
   } catch (err) {
-    // Any failure before the report is built (e.g. the install CLI failing on a bad
-    // OCI ref) still writes a results.json, so a consumer never reads a stale "pass".
-    const message = err instanceof Error ? err.message : String(err);
-    const report: Report = {
-      cliVersion,
-      backend: { total: 0, loaded: 0, skipped: [], errors: [] },
-      backendStart: { ok: false, error: message },
-      frontend: { total: 0, valid: 0, errors: [] },
-      status: "error",
-    };
-    await writeFile(out, JSON.stringify(report, null, 2));
-    console.error(`▶ report → ${out} (status: error)\n${message}`);
+    // e.g. the install CLI failing on a bad OCI ref — see writeErrorReport.
+    await writeErrorReport(out, cliVersion, err instanceof Error ? err.message : String(err));
     return 1;
   } finally {
     if (tempDir) await rm(tempDir, { recursive: true, force: true });