Merge branch 'main' into rhidp-14314/attachment-type-model-validation

Signed-off-by: Lucas <lyoon@redhat.com>

Author: JslYoon

.fullsend/customized/agents/code.md

@@ -1,4 +1,6 @@
 ---
+# forked-from: fullsend v0.17.0 scaffold (adds rhdh-workspace)
+# last-synced: 2026-06-16
 name: code
 description: >-
   Implementation specialist for GitHub issues. Reads triaged issues, implements
@@ -20,7 +22,7 @@ disallowedTools: >-
 model: opus
 skills:
   - code-implementation
-  - monorepo-workspace-routing
+  - rhdh-workspace
 ---
 
 # Code Agent
@@ -109,7 +111,7 @@ Your exit state is the handoff contract:
 ## Monorepo routing
 
 This is a monorepo. Before following the implementation procedure, execute
-the `monorepo-workspace-routing` skill to navigate to the correct workspace.
+the `rhdh-workspace` skill to navigate to the correct workspace.
 All subsequent work happens from within the workspace directory.
 
 ## Detailed implementation procedure

.fullsend/customized/env/rhdh-toolchain.env

@@ -8,3 +8,7 @@
 # corepack — pre-enabled in the image so yarn is on PATH immediately.
 # Must point to a writable directory (sandbox policy blocks /usr).
 export COREPACK_HOME=/tmp/corepack
+
+# openspec — disable telemetry to avoid DENIED requests to edge.openspec.dev
+# (the sandbox policy does not allowlist this endpoint).
+export OPENSPEC_TELEMETRY=0

.fullsend/customized/harness/code.yaml

@@ -1,3 +1,5 @@
+# forked-from: fullsend v0.17.0 scaffold
+# last-synced: 2026-06-16
 # harness/code.yaml — code agent with pre/post script pipeline.
 #
 # Flow: pre_script → sandbox (agent) → post_script
@@ -13,6 +15,7 @@
 #   - policy: custom code policy with repo.yarnpkg.com for corepack downloads
 #   - host_files: rhdh-toolchain.env sets COREPACK_HOME to writable /tmp/corepack
 #   - host_files: yarn-proxy.env maps OpenShell's HTTP_PROXY to YARN_HTTP_PROXY
+role: coder
 agent: agents/code.md
 doc: docs/agents/code.md
 model: opus
@@ -41,7 +44,7 @@ host_files:
 
 skills:
   - skills/code-implementation
-  - skills/monorepo-workspace-routing
+  - skills/rhdh-workspace
 
 plugins:
   - plugins/gopls-lsp
@@ -56,4 +59,4 @@ runner_env:
   REPO_DIR: "${GITHUB_WORKSPACE}/target-repo"
   TARGET_BRANCH: "${TARGET_BRANCH}"
 
-timeout_minutes: 35
+timeout_minutes: 45

.fullsend/customized/harness/fix.yaml

@@ -1,6 +1,8 @@
+# forked-from: fullsend v0.17.0 scaffold
+# last-synced: 2026-06-16
 # harness/fix.yaml — fix agent with yarn sandbox workaround.
 #
-# Based on upstream fix.yaml (baseline 2025-06-05). The fix agent handles
+# Based on upstream fix.yaml. The fix agent handles
 # automated fixes triggered by /fs-fix commands on issues or PRs.
 #
 # Flow: pre_script → sandbox (agent) → validation_loop → post_script
@@ -10,18 +12,20 @@
 #   post_script      : push commit, post summary comment on PR
 #
 # Customizations over upstream fix.yaml:
+#   - pre_script: wraps upstream pre-fix.sh with auto-rebase onto target branch
 #   - image: rhdh custom image with yarn/corepack pre-installed
 #   - host_files: rhdh-toolchain.env sets COREPACK_HOME to writable /tmp/corepack
 #   - host_files: yarn-proxy.env maps OpenShell's HTTP_PROXY to YARN_HTTP_PROXY
-#   - skills: adds monorepo-workspace-routing for workspace navigation
+#   - skills: adds rhdh-workspace for workspace navigation + test scoping
 #   - policy: custom fix policy with yarn registry + pnpm binary allowlist
+role: fix
 agent: agents/fix.md
 doc: docs/agents/fix.md
 model: opus
 image: ghcr.io/redhat-developer/rhdh-fullsend-code:latest
 policy: policies/fix.yaml
 
-pre_script: scripts/pre-fix.sh
+pre_script: scripts/pre-fix-rebase.sh
 
 validation_loop:
   script: scripts/validate-output-schema.sh
@@ -50,7 +54,7 @@ host_files:
 
 skills:
   - skills/fix-review
-  - skills/monorepo-workspace-routing
+  - skills/rhdh-workspace
 
 runner_env:
   PUSH_TOKEN: "${PUSH_TOKEN}"
@@ -67,4 +71,4 @@ runner_env:
   FULLSEND_OUTPUT_SCHEMA: ${FULLSEND_DIR}/schemas/fix-result.schema.json
   FULLSEND_OUTPUT_FILE: fix-result.json
 
-timeout_minutes: 25
+timeout_minutes: 90

.fullsend/customized/policies/code.yaml

@@ -3,10 +3,14 @@ version: 1
 
 # Sandbox policy for the code agent.
 #
-# Based on upstream code policy (baseline 2025-06-05) with additions:
+# forked-from: fullsend v0.17.0 scaffold
+# last-synced: 2026-06-16
+# Based on upstream code policy with additions:
 #   - repo.yarnpkg.com endpoint in package_registries (corepack downloads
 #     yarn binary from repo.yarnpkg.com, not registry.yarnpkg.com)
 #   - corepack binary in package_registries
+#   - allow_encoded_slash on registry.npmjs.org (yarn scoped packages use
+#     @scope%2Fpkg URLs; without this the L7 proxy rejects and retries)
 #
 # Grants network access the code agent needs beyond the base sandbox:
 #   - Vertex AI (global inference + GCP auth token exchange)
@@ -93,6 +97,7 @@ network_policies:
         protocol: rest
         enforcement: enforce
         access: read-only
+        allow_encoded_slash: true
       - host: "registry.yarnpkg.com"
         port: 443
         protocol: rest

.fullsend/customized/policies/fix.yaml

@@ -3,10 +3,14 @@ version: 1
 
 # Sandbox policy for the fix agent.
 #
-# Based on the upstream fix policy (baseline 2025-06-05) with additions:
+# forked-from: fullsend v0.17.0 scaffold
+# last-synced: 2026-06-16
+# Based on upstream fix policy with additions:
 #   - repo.yarnpkg.com endpoint in package_registries (corepack downloads
 #     yarn binary from repo.yarnpkg.com, not registry.yarnpkg.com)
 #   - pnpm binary in package_registries (present in sandbox image)
+#   - allow_encoded_slash on registry.npmjs.org (yarn scoped packages use
+#     @scope%2Fpkg URLs; without this the L7 proxy rejects and retries)
 #
 # The fix agent needs the same network access as the code agent (Vertex AI,
 # GitHub API for gh pr view/diff, package registries) because it runs tests
@@ -89,6 +93,7 @@ network_policies:
         protocol: rest
         enforcement: enforce
         access: read-only
+        allow_encoded_slash: true
       - host: "registry.yarnpkg.com"
         port: 443
         protocol: rest

.fullsend/customized/scripts/pre-fix-rebase.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# Pre-script wrapper: upstream validation + auto-rebase onto target branch.
+#
+# Runs the upstream pre-fix.sh (input checks, iteration cap), then rebases
+# the PR branch onto origin/${TARGET_BRANCH} so the agent always works on
+# a current base. Force-pushes the rebased branch while the token is fresh.
+#
+# Required env (from runner_env in fix.yaml):
+#   REPO_DIR, TARGET_BRANCH, PUSH_TOKEN, REPO_FULL_NAME
+set -euo pipefail
+
+# 1. Run upstream validation (input checks, iteration cap)
+bash scripts/pre-fix.sh
+
+# 2. Rebase PR branch onto target branch
+cd "${REPO_DIR}"
+git config user.name "fullsend-ai-coder[bot]"
+git config user.email "fullsend-ai-coder[bot]@users.noreply.github.com"
+git fetch origin "${TARGET_BRANCH}"
+
+CURRENT_HEAD="$(git rev-parse HEAD)"
+TARGET_HEAD="$(git rev-parse "origin/${TARGET_BRANCH}")"
+MERGE_BASE="$(git merge-base HEAD "origin/${TARGET_BRANCH}")"
+
+if [[ "${MERGE_BASE}" == "${TARGET_HEAD}" ]]; then
+  echo "Branch is already up-to-date with origin/${TARGET_BRANCH}. Skipping rebase."
+  exit 0
+fi
+
+BEHIND_COUNT="$(git rev-list --count HEAD.."origin/${TARGET_BRANCH}")"
+echo "Branch is ${BEHIND_COUNT} commit(s) behind origin/${TARGET_BRANCH}. Rebasing..."
+
+if ! git rebase "origin/${TARGET_BRANCH}" 2>&1; then
+  git rebase --abort 2>/dev/null || true
+  echo "::error::Rebase onto origin/${TARGET_BRANCH} failed (check log above for cause)." >&2
+  echo "::error::Please rebase manually and re-trigger /fs-fix." >&2
+  exit 1
+fi
+
+NEW_HEAD="$(git rev-parse HEAD)"
+echo "Rebase succeeded: ${CURRENT_HEAD:0:7} → ${NEW_HEAD:0:7}"
+
+# 3. Force-push the rebased branch (token is fresh here)
+BRANCH="$(git rev-parse --abbrev-ref HEAD)"
+git remote set-url origin \
+  "https://x-access-token:${PUSH_TOKEN}@github.com/${REPO_FULL_NAME}.git"
+echo "Force-pushing rebased branch ${BRANCH}..."
+git push --force-with-lease origin "${BRANCH}" 2>&1
+echo "Rebase push complete."

…ills/monorepo-workspace-routing/SKILL.md …ustomized/skills/rhdh-workspace/SKILL.md.fullsend/customized/skills/monorepo-workspace-routing/SKILL.md renamed to .fullsend/customized/skills/rhdh-workspace/SKILL.md .fullsend/customized/skills/monorepo-workspace-routing/SKILL.md renamed to .fullsend/customized/skills/rhdh-workspace/SKILL.md

@@ -1,12 +1,12 @@
 ---
-name: monorepo-workspace-routing
+name: rhdh-workspace
 description: >-
-  Navigate to the correct workspace in a monorepo before starting work.
-  Identifies the target workspace from issue/PR context and changes directory
-  so that CWD-bound tools (openspec, backstage-cli) work correctly.
+  Navigate to the correct workspace in the rhdh-plugins monorepo, install
+  dependencies, and scope all commands (test, build, lint) to the target
+  workspace. Prevents workspace-wide operations that exceed sandbox timeouts.
 ---
 
-# Monorepo Workspace Routing
+# RHDH Workspace
 
 This repository is a monorepo. Independent Backstage plugin workspaces live
 under `workspaces/<name>/`. Each workspace has its own `package.json`,
@@ -66,9 +66,54 @@ YARN_ENABLE_SCRIPTS=false yarn install --immutable
 
 After install, workspace-specific tools become available (e.g., `yarn openspec:validate`).
 
+## Step 5: Synchronize Backstage metadata and generated files
+
+After installing dependencies, run Backstage maintenance commands to ensure
+all generated files and metadata are in sync. These commands fix CI gates
+that check for committed artifacts.
+
+```bash
+# Sync package.json metadata (publishConfig, role fields)
+yarn fix
+
+# Generate API report files for packages with public exports
+yarn build:api-reports
+
+# Deduplicate lockfile entries
+yarn dedupe
+```
+
+If any of these commands modify files, the changes MUST be included in your
+commit. These are not optional — CI will reject the PR if these artifacts
+are out of sync.
+
+## Test scoping
+
+Run tests ONLY for the affected package, from within the package directory:
+
+```bash
+cd plugins/<plugin-name>/
+yarn test
+```
+
+Or equivalently from the workspace root:
+
+```bash
+yarn backstage-cli package test --filter <package-name>
+```
+
+**NEVER run workspace-wide or monorepo-wide test sweeps.** Commands like
+`yarn backstage-cli package test` without a filter, or `yarn test` from the
+workspace root, execute tests for every package in the workspace. This exceeds
+the sandbox timeout and will kill your run — losing all uncommitted work.
 ## Rules
 
 - ALL build, test, lint, and validation commands must run from the workspace root
+  or the specific package directory — never from the monorepo root
 - Do not run `yarn install` from the monorepo root for workspace-specific work
 - Do not mix changes across multiple workspaces in a single commit
 - Each workspace is independent — do not assume shared dependencies
+- After a test/build/lint failure, read the full error output and fix the code
+  before retrying. Never retry the same command without changing code first
+- After 2 consecutive test failures, re-read every file you edited and diff your
+  changes against the original before running tests again

.github/CODEOWNERS

@@ -17,28 +17,27 @@
 
 /workspaces/adoption-insights                       @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @rohitkrai03 @karthikjeeyar @eswaraiahsapram
 /workspaces/ai-integrations                         @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @redhat-developer/rhdh-ai @rohitkrai03 @karthikjeeyar @lucifergene   @johnmcollier @gabemontero
-/workspaces/augment                                 @redhat-developer/rhdh-plugins-maintainers @pkliczewski @rrbanda @durandom
-/workspaces/boost                                   @redhat-developer/rhdh-plugins-maintainers @durandom @gabemontero
+/workspaces/augment                                 @redhat-developer/rhdh-plugins-maintainers @pkliczewski @durandom @gabemontero @mareklibra
+/workspaces/boost                                   @redhat-developer/rhdh-plugins-maintainers @durandom @gabemontero @mareklibra
 /workspaces/app-defaults                            @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @rohitkrai03 @christoph-jerolimov
 /workspaces/bulk-import                             @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-plugins @rm3l   @redhat-developer/rhdh-ui @debsmita1 @its-mitesh-kumar
 /workspaces/extensions                              @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @christoph-jerolimov @karthikjeeyar
-/workspaces/global-floating-action-button           @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @debsmita1 @divyanshiGupta
 /workspaces/global-header                           @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @ciiay @divyanshiGupta
 /workspaces/homepage                                @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @christoph-jerolimov @eswaraiahsapram
+/workspaces/install-dynamic-plugins                 @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-plugins
 /workspaces/lightspeed                              @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @redhat-developer/rhdh-ai @karthikjeeyar @rohitkrai03 @yangcao77
 /workspaces/mcp-integrations                        @redhat-developer/rhdh-plugins-maintainers @johnmcollier @gabemontero @thepetk @redhat-developer/rhdh-ai
 /workspaces/orchestrator                            @redhat-developer/rhdh-plugins-maintainers @lholmquist @lokanandaprabhu @redhat-developer/rhdh-plugins @karthikjeeyar @christoph-jerolimov
 /workspaces/quickstart                              @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @divyanshiGupta @its-mitesh-kumar
 /workspaces/cost-management                         @redhat-developer/rhdh-plugins-maintainers @ydayagi @mareklibra @batzionb @PreetiW @asmasarw
-/workspaces/sandbox                                 @redhat-developer/rhdh-plugins-maintainers @lucifergene @rohitkrai03 @karthikjeeyar @xcoulon @alexeykazakov @mfrancisc @rsoaresd @jrosental @rajivnathan @MatousJobanek
 /workspaces/scorecard                               @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-plugins   @redhat-developer/rhdh-ui @christoph-jerolimov @its-mitesh-kumar @eswaraiahsapram
 /workspaces/theme                                   @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @ciiay   @logonoff
 /workspaces/translations                            @redhat-developer/rhdh-plugins-maintainers @redhat-developer/rhdh-ui @ciiay @debsmita1 @karthikjeeyar
 /workspaces/konflux                                 @redhat-developer/rhdh-plugins-maintainers @rrosatti @sahil143 @milantaky
-/workspaces/x2a                                     @redhat-developer/rhdh-plugins-maintainers @mareklibra @elai-shalev @eloycoto
+/workspaces/x2a                                     @redhat-developer/rhdh-plugins-maintainers @mareklibra @eloycoto @yray-pixel
 /workspaces/dcm                                     @redhat-developer/rhdh-plugins-maintainers @asmasarw @jkilzi @mareklibra
 
 # Fullsend AI agent configuration — requires maintainer approval to prevent
 # agents from modifying their own guardrails.
-/.fullsend/                                         @redhat-developer/rhdh-plugins-maintainers @durandom
-/.github/workflows/fullsend.yaml                    @redhat-developer/rhdh-plugins-maintainers @durandom
+/.fullsend/                                         @redhat-developer/rhdh-plugins-maintainers @durandom @gabemontero
+/.github/workflows/fullsend.yaml                    @redhat-developer/rhdh-plugins-maintainers @durandom @gabemontero

.github/archived-plugins.json

@@ -8,6 +8,15 @@
       "gitTag": "@red-hat-developer-hub/backstage-plugin-openshift-image-registry@1.18.0",
       "reason": "No longer maintained",
       "archivedDate": "2026-04-01"
+    },
+    {
+      "pluginName": "@red-hat-developer-hub/backstage-plugin-sandbox",
+      "version": "0.1.0",
+      "workspace": "sandbox",
+      "plugin": "sandbox",
+      "gitTag": "@red-hat-developer-hub/backstage-plugin-sandbox@0.1.0",
+      "reason": "No longer maintained",
+      "archivedDate": "2026-06-10"
     }
   ]
 }