[release-1.8] fix: bumping orchestrator plugins to 1.8.9

[Fortune-Ndlovu]

Description of the change

[release-1.8] feat: bumping orchestrtor plugins to 1.8.9

Which issue(s) does this PR fix or relate to

• JIRA_issue_link https://redhat.atlassian.net/browse/RHDHBUGS-2825

How to test changes / Special notes to the reviewer

Checklist

• For each Chart updated, version bumped in the corresponding Chart.yaml according to Semantic Versioning.
• For each Chart updated, variables are documented in the values.yaml and added to the corresponding README.md. The pre-commit utility can be used to generate the necessary content. Run pre-commit run --all-files to run the hooks and then push any resulting changes. The pre-commit Workflow will enforce this and warn you if needed.
• JSON Schema template updated and re-generated the raw schema via the pre-commit hook.
• Tests pass using the Chart Testing tool and the ct lint command.
• If you updated the orchestrator-infra chart, make sure the versions of the Knative CRDs are aligned with the versions of the CRDs installed by the OpenShift Serverless operators declared in the values.yaml file. See Installing Knative Eventing and Knative Serving CRDs for more details.

[Fortune-Ndlovu]

/hold

[rhdh-qodo-merge]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis 🔶 RHDHBUGS-2825 - Partially compliant Compliant requirements: Update the Helm chart to use orchestrator plugin version 1.8.9. Source orchestrator plugins from the Red Hat npm registry URLs. Non-compliant requirements: (none) Requires further human verification: Validate the chart/operator deployment pulls and loads the 1.8.9 orchestrator plugins successfully in a real cluster environment (runtime verification). Confirm the referenced Red Hat npm registry tarballs are accessible in the intended environments and that the provided integrity values match the published artifacts.

⏱️ Estimated effort to review: 2 🔵🔵⚪⚪⚪

🔒 No security concerns identified

⚡ Recommended focus areas for review YAML Robustness The new integrity values are unquoted scalars; while likely valid, quoting them can reduce the risk of YAML parsing/templating edge cases and improve consistency with other string fields like package. - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-backend-dynamic/-/backstage-plugin-orchestrator-backend-dynamic-1.8.9.tgz" integrity: sha512-V6Css2y21le4SrMj1tpupppjSkvaZcfvfF9sLoknUnFLCCYkKCH21Fpk2BxA1MMRpVXTUjUJ8lTwYAdrrxBEjg== pluginConfig: orchestrator: dataIndexService: url: http://sonataflow-platform-data-index-service.{{ .Release.Namespace }} - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator/-/backstage-plugin-orchestrator-1.8.9.tgz" integrity: sha512-k9r4xEfy3a5En1DTBZkzjhbUVFfbP8Pb+/uCkTXwqqwDJaM2ZzPMzaMj4x65XBnpKTdEZJA0rf/mFMFnfM8I6w== pluginConfig: dynamicPlugins: frontend: red-hat-developer-hub.backstage-plugin-orchestrator: appIcons: - name: orchestratorIcon importName: OrchestratorIcon dynamicRoutes: - path: /orchestrator importName: OrchestratorPage menuItem: icon: orchestratorIcon text: Orchestrator entityTabs: - path: /workflows title: Workflows mountPoint: entity.page.workflows mountPoints: - mountPoint: entity.page.workflows/cards importName: OrchestratorCatalogTab config: layout: gridColumn: "1 / -1" if: anyOf: - IsOrchestratorCatalogTabAvailable - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic/-/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.8.9.tgz" integrity: sha512-VRM/RvqQUemJLBdwm3nYwn2pSTUumZ1YEaHhgh4ELTiuVy2KQcyZCN9cSOCUswjHldmuPyT8dyfGQvSriGNS8Q== pluginConfig: orchestrator: dataIndexService: url: http://sonataflow-platform-data-index-service.{{ .Release.Namespace }} - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-form-widgets/-/backstage-plugin-orchestrator-form-widgets-1.8.9.tgz" integrity: sha512-fWlawBQUenXQXBUPe04mrIFPhNE05f1aVRJXXFS0FT0doo8X4vijmEeZf4Qm3b1Owgup8E6HHKQr3a94lBrNew== pluginConfig: Docs Generation The orchestrator.plugins default shown in the values table is a very long inline JSON-like blob; ensure it is still generated/maintained by the project’s docs tooling (e.g., helm-docs/pre-commit) and remains readable and synchronized with values.yaml. | global.host | Custom hostname shorthand, overrides `global.clusterRouterBase`, `upstream.ingress.host`, `route.host`, and url values in `upstream.backstage.appConfig`. | string | `""` | | nameOverride | | string | `"developer-hub"` | | orchestrator.enabled | | bool | `false` | | orchestrator.plugins | Orchestrator plugins and their configuration | list | `[{"disabled":false,"integrity":"sha512-V6Css2y21le4SrMj1tpupppjSkvaZcfvfF9sLoknUnFLCCYkKCH21Fpk2BxA1MMRpVXTUjUJ8lTwYAdrrxBEjg==","package":"https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-backend-dynamic/-/backstage-plugin-orchestrator-backend-dynamic-1.8.9.tgz","pluginConfig":{"orchestrator":{"dataIndexService":{"url":"http://sonataflow-platform-data-index-service.{{ .Release.Namespace }}"}}}},{"disabled":false,"integrity":"sha512-k9r4xEfy3a5En1DTBZkzjhbUVFfbP8Pb+/uCkTXwqqwDJaM2ZzPMzaMj4x65XBnpKTdEZJA0rf/mFMFnfM8I6w==","package":"https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator/-/backstage-plugin-orchestrator-1.8.9.tgz","pluginConfig":{"dynamicPlugins":{"frontend":{"red-hat-developer-hub.backstage-plugin-orchestrator":{"appIcons":[{"importName":"OrchestratorIcon","name":"orchestratorIcon"}],"dynamicRoutes":[{"importName":"OrchestratorPage","menuItem":{"icon":"orchestratorIcon","text":"Orchestrator"},"path":"/orchestrator"}],"entityTabs":[{"mountPoint":"entity.page.workflows","path":"/workflows","title":"Workflows"}],"mountPoints":[{"config":{"if":{"anyOf":["IsOrchestratorCatalogTabAvailable"]},"layout":{"gridColumn":"1 / -1"}},"importName":"OrchestratorCatalogTab","mountPoint":"entity.page.workflows/cards"}]}}}}},{"disabled":false,"integrity":"sha512-VRM/RvqQUemJLBdwm3nYwn2pSTUumZ1YEaHhgh4ELTiuVy2KQcyZCN9cSOCUswjHldmuPyT8dyfGQvSriGNS8Q==","package":"https://npm.registry.redhat.com/@redhat/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic/-/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.8.9.tgz","pluginConfig":{"orchestrator":{"dataIndexService":{"url":"http://sonataflow-platform-data-index-service.{{ .Release.Namespace }}"}}}},{"disabled":false,"integrity":"sha512-fWlawBQUenXQXBUPe04mrIFPhNE05f1aVRJXXFS0FT0doo8X4vijmEeZf4Qm3b1Owgup8E6HHKQr3a94lBrNew==","package":"https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-form-widgets/-/backstage-plugin-orchestrator-form-widgets-1.8.9.tgz","pluginConfig":{"dynamicPlugins":{"frontend":{"red-hat-developer-hub.backstage-plugin-orchestrator-form-widgets":{}}}}}]` | | orchestrator.serverlessLogicOperator.enabled | | bool | `true` |

📚 Focus areas based on broader codebase context Consistency The PR bumps Orchestrator plugins in orchestrator.plugins using direct NPM tarball URLs + integrity. Validate there isn’t another Orchestrator plugin list elsewhere in charts/backstage/values.yaml (e.g., a plugins list using OCI references and {{ "{{inherit}}" }}) that also needs a version bump to keep the chart’s plugin sources consistent. (Ref 1) # -- Orchestrator plugins and their configuration plugins: # RHDHBUGS-1464: Note that the plugins here fetch the packages from their direct HTTP download URLs from the (official) Red Hat NPM Registry. # Previously, we were using the "@redhat/plugin@version" form along with injecting a .npmrc Secret to resolve the "@redhat" scope, # but this caused conflicting issues with user-provided .npmrc secrets. - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-backend-dynamic/-/backstage-plugin-orchestrator-backend-dynamic-1.8.9.tgz" integrity: sha512-V6Css2y21le4SrMj1tpupppjSkvaZcfvfF9sLoknUnFLCCYkKCH21Fpk2BxA1MMRpVXTUjUJ8lTwYAdrrxBEjg== pluginConfig: orchestrator: dataIndexService: url: http://sonataflow-platform-data-index-service.{{ .Release.Namespace }} - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator/-/backstage-plugin-orchestrator-1.8.9.tgz" integrity: sha512-k9r4xEfy3a5En1DTBZkzjhbUVFfbP8Pb+/uCkTXwqqwDJaM2ZzPMzaMj4x65XBnpKTdEZJA0rf/mFMFnfM8I6w== pluginConfig: dynamicPlugins: frontend: red-hat-developer-hub.backstage-plugin-orchestrator: appIcons: - name: orchestratorIcon importName: OrchestratorIcon dynamicRoutes: - path: /orchestrator importName: OrchestratorPage menuItem: icon: orchestratorIcon text: Orchestrator entityTabs: - path: /workflows title: Workflows mountPoint: entity.page.workflows mountPoints: - mountPoint: entity.page.workflows/cards importName: OrchestratorCatalogTab config: layout: gridColumn: "1 / -1" if: anyOf: - IsOrchestratorCatalogTabAvailable - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic/-/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.8.9.tgz" integrity: sha512-VRM/RvqQUemJLBdwm3nYwn2pSTUumZ1YEaHhgh4ELTiuVy2KQcyZCN9cSOCUswjHldmuPyT8dyfGQvSriGNS8Q== pluginConfig: orchestrator: dataIndexService: url: http://sonataflow-platform-data-index-service.{{ .Release.Namespace }} - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-form-widgets/-/backstage-plugin-orchestrator-form-widgets-1.8.9.tgz" integrity: sha512-fWlawBQUenXQXBUPe04mrIFPhNE05f1aVRJXXFS0FT0doo8X4vijmEeZf4Qm3b1Owgup8E6HHKQr3a94lBrNew== pluginConfig: Reference reasoning: The repo already contains a plugins list in the same YAML file that references Orchestrator plugins as OCI packages with an inherited tag. That indicates Orchestrator plugins may be configured in more than one place or via different mechanisms, so version bumps should be applied consistently across those definitions to avoid mixed plugin versions/sources.

📄 References redhat-developer/rhdh-chart/charts/backstage/values.yaml [396-404] redhat-developer/rhdh-chart/charts/backstage/values.yaml [391-395] redhat-developer/rhdh-chart/charts/backstage/ci/with-orchestrator-and-dynamic-plugins-npmrc-values.yaml [1-24] redhat-developer/rhdh-chart/charts/backstage/ci/with-orchestrator-values.yaml [1-21] redhat-developer/rhdh-chart/charts/orchestrator-software-templates/values.yaml [1-12] redhat-developer/rhdh-chart/charts/orchestrator-software-templates/ci/upstream-values.yaml [1-16] redhat-developer/rhdh-chart/charts/orchestrator-software-templates-infra/ci/upstream-values.yaml [1-27] redhat-developer/rhdh/default.packages.yaml [51-61]

[rhdh-qodo-merge]

PR Type

Enhancement

---

Description

• Bumped orchestrator plugins from version 1.8.2 to 1.8.9

• Updated chart version from 4.5.13 to 4.5.14

• Updated package URLs and integrity hashes for all four orchestrator plugins

• Updated README.md to reflect new chart version

---

File Walkthrough

	Relevant files
Configuration changes	Chart.yaml Increment chart version to 4.5.14                                                charts/backstage/Chart.yaml Incremented chart version from 4.5.13 to 4.5.14 following semantic versioning +1/-1
Documentation	README.md Update README version references to 4.5.14                              charts/backstage/README.md Updated version badge from 4.5.13 to 4.5.14 Updated helm install command example to use new chart version 4.5.14 +3/-3
Dependencies	values.yaml Upgrade all orchestrator plugins to 1.8.9                                charts/backstage/values.yaml Updated orchestrator-backend-dynamic plugin from 1.8.2 to 1.8.9 with new integrity hash Updated orchestrator frontend plugin from 1.8.2 to 1.8.9 with new integrity hash Updated scaffolder-backend-module-orchestrator-dynamic plugin from 1.8.2 to 1.8.9 with new integrity hash Updated orchestrator-form-widgets plugin from 1.8.2 to 1.8.9 with new integrity hash +8/-8

---

---

🔍 To retrieve JIRA tickets as context to your PR description, please register your organization.

[rhdh-qodo-merge]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Impact
Security	Use HTTPS for internal service communication To enhance security, change the protocol for the dataIndexService.url from http to https to encrypt internal service communication. charts/backstage/values.yaml [410-452] - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-backend-dynamic/-/backstage-plugin-orchestrator-backend-dynamic-1.8.9.tgz" integrity: sha512-V6Css2y21le4SrMj1tpupppjSkvaZcfvfF9sLoknUnFLCCYkKCH21Fpk2BxA1MMRpVXTUjUJ8lTwYAdrrxBEjg== pluginConfig: orchestrator: dataIndexService: - url: http://sonataflow-platform-data-index-service.{{ .Release.Namespace }} + url: https://sonataflow-platform-data-index-service.{{ .Release.Namespace }} ... - disabled: false package: "https://npm.registry.redhat.com/@redhat/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic/-/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.8.9.tgz" integrity: sha512-VRM/RvqQUemJLBdwm3nYwn2pSTUumZ1YEaHhgh4ELTiuVy2KQcyZCN9cSOCUswjHldmuPyT8dyfGQvSriGNS8Q== pluginConfig: orchestrator: dataIndexService: - url: http://sonataflow-platform-data-index-service.{{ .Release.Namespace }} + url: https://sonataflow-platform-data-index-service.{{ .Release.Namespace }} [To ensure code accuracy, apply this suggestion manually] Suggestion importance[1-10]: 7 __ Why: The suggestion correctly identifies a potential security improvement by recommending HTTPS for internal service communication, which is a valid best practice for hardening.	Medium
Update

[rm3l]

Only the backstage chart should have its version updated. The other charts shouldn't be changed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rm3l]

/lgtm
/hold cancel

No longer blocked. Tested this PR against the image (quay.io/rhdh-community/rhdh:pr-4425-ec9200ee) from the other RHDH PR and everything works correctly. Also successfully tested an upgrade from the previous 1.8.4 to this version.

install-dynamic-plugins Logs

[...]
======= Skipping disabled dynamic plugin @redhat/backstage-plugin-orchestrator@1.8.9

======= Skipping disabled dynamic plugin @redhat/backstage-plugin-orchestrator-backend-dynamic@1.8.9

======= Skipping disabled dynamic plugin @redhat/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic@1.8.9

======= Skipping disabled dynamic plugin @redhat/backstage-plugin-orchestrator-form-widgets@1.8.9

======= Installing dynamic plugin ./dynamic-plugins/dist/red-hat-developer-hub-backstage-plugin-adoption-insights
        ==> Grabbing package archive through `npm pack`
        ==> Extracting package archive /dynamic-plugins-root/red-hat-developer-hub-backstage-plugin-adoption-insights-0.3.2.tgz
        ==> Removing package archive /dynamic-plugins-root/red-hat-developer-hub-backstage-plugin-adoption-insights-0.3.2.tgz
        ==> Successfully installed dynamic plugin ./dynamic-plugins/dist/red-hat-developer-hub-backstage-plugin-adoption-insights
        ==> Merging plugin-specific configuration

======= Installing dynamic plugin ./dynamic-plugins/dist/red-hat-developer-hub-backstage-plugin-adoption-insights-backend-dynamic
        ==> Grabbing package archive through `npm pack`
        ==> Extracting package archive /dynamic-plugins-root/red-hat-developer-hub-backstage-plugin-adoption-insights-backend-dynamic-0.3.0.tgz
        ==> Removing package archive /dynamic-plugins-root/red-hat-developer-hub-backstage-plugin-adoption-insights-backend-dynamic-0.3.0.tgz
        ==> Successfully installed dynamic plugin ./dynamic-plugins/dist/red-hat-developer-hub-backstage-plugin-adoption-insights-backend-dynamic
        ==> Merging plugin-specific configuration

======= Installing dynamic plugin ./dynamic-plugins/dist/red-hat-developer-hub-backstage-plugin-analytics-
module-adoption-insights-dynamic
        ==> Grabbing package archive through `npm pack`
        ==> Extracting package archive /dynamic-plugins-root/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights-dynamic-0.3.0.tgz
        ==> Removing package archive /dynamic-plugins-root/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights-dynamic-0.3.0.tgz
        ==> Successfully installed dynamic plugin ./dynamic-plugins/dist/red-hat-developer-hub-backstage-plugin-analytics-module-adoption-insights-dynamic
        ==> Merging plugin-specific configuration

======= Installing dynamic plugin https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-backend-dynamic/-/backstage-plugin-orchestrator-backend-dynamic-1.8.9.tgz
        ==> Grabbing package archive through `npm pack`
        ==> Verifying package integrity
        ==> Extracting package archive /dynamic-plugins-root/redhat-backstage-plugin-orchestrator-backend-dynamic-1.8.9.tgz
        ==> Removing package archive /dynamic-plugins-root/redhat-backstage-plugin-orchestrator-backend-dynamic-1.8.9.tgz
        ==> Successfully installed dynamic plugin https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-backend-dynamic/-/backstage-plugin-orchestrator-backend-dynamic-1.8.9.tgz
        ==> Merging plugin-specific configuration

======= Installing dynamic plugin https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator/-/backstage-plugin-orchestrator-1.8.9.tgz
        ==> Grabbing package archive through `npm pack`
        ==> Verifying package integrity
        ==> Extracting package archive /dynamic-plugins-root/redhat-backstage-plugin-orchestrator-1.8.9.tgz
        ==> Removing package archive /dynamic-plugins-root/redhat-backstage-plugin-orchestrator-1.8.9.tgz
        ==> Successfully installed dynamic plugin https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator/-/backstage-plugin-orchestrator-1.8.9.tgz
        ==> Merging plugin-specific configuration

======= Installing dynamic plugin https://npm.registry.redhat.com/@redhat/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic/-/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.8.9.tgz
        ==> Grabbing package archive through `npm pack`
        ==> Verifying package integrity
        ==> Extracting package archive /dynamic-plugins-root/redhat-backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.8.9.tgz
        ==> Removing package archive /dynamic-plugins-root/redhat-backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.8.9.tgz
        ==> Successfully installed dynamic plugin https://npm.registry.redhat.com/@redhat/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic/-/backstage-plugin-scaffolder-backend-module-orchestrator-dynamic-1.8.9.tgz
        ==> Merging plugin-specific configuration

======= Installing dynamic plugin https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-form-widgets/-/backstage-plugin-orchestrator-form-widgets-1.8.9.tgz
        ==> Grabbing package archive through `npm pack`
        ==> Verifying package integrity
        ==> Extracting package archive /dynamic-plugins-root/redhat-backstage-plugin-orchestrator-form-widgets-1.8.9.tgz
        ==> Removing package archive /dynamic-plugins-root/redhat-backstage-plugin-orchestrator-form-widgets-1.8.9.tgz
        ==> Successfully installed dynamic plugin https://npm.registry.redhat.com/@redhat/backstage-plugin-orchestrator-form-widgets/-/backstage-plugin-orchestrator-form-widgets-1.8.9.tgz
        ==> Merging plugin-specific configuration
======= Removed lock file: /dynamic-plugins-root/install-dynamic-plugins.lock