To be fleshed out;

current idea is to use David's https://github.com/redhat-developer/rhdh-plugin-export-utils to generate plugins, then package them into a container image along with some generated index/metadata. See https://docs.google.com/document/d/1gO-UQGYI8zlBnFM0RRxwd6qOqo69z-5bg_e8mzBQ78A/edit#heading=h.4838ucujn3d

Now the plan is to have 1 OCI artifact per npm package tarball. See other JIRAs under epic RHIDP-2449.

If we want something lighterweight via GH action we can do RHIDP-2107 too; but if Konflux works for us then there's no need for the GH action too.

WIP here:

• https://console.redhat.com/preview/application-pipeline/workspaces/rhdh-build/applications/rhdh-plugin-registry
• https://github.com/redhat-developer/rhdh-plugin-registry/blob/main/.tekton/

Plugins are here (for backstage/backstage):

• https://github.com/redhat-developer/rhdh-plugin-export-backstage-backstage/releases ?
• https://github.com/redhat-developer/rhdh-plugin-export-backstage-backstage/tree/1.2.x ?
• https://github.com/redhat-developer/rhdh-plugin-export-backstage-backstage/blob/v1.2.0/plugins-list.yaml

Plugins (community):

• https://github.com/redhat-developer/rhdh-plugin-export-backstage-community-plugins/blob/v1.2.0/branches.json

Exporter:

• https://github.com/redhat-developer/rhdh-plugin-export-utils/tree/main/export-dynamic

Ref docs for Konflux/Cachi2:

• https://gitlab.cee.redhat.com/konflux/docs/users/-/tree/main/topics/getting-started
• https://gitlab.cee.redhat.com/konflux/docs/users/-/blob/main/topics/getting-started/components-applications.md
• https://github.com/containerbuildsystem/cachi2/blob/main/docs/usage.md
• https://konflux-ci.dev/docs/how-tos/configuring/prefetching-dependencies/

TODO:

• build stage
  • fetch prebuilt deps from npmjs.com or yarnpkg.org with cachi2 and/or hermetic build
  • repackage them (export them) as dynamic plugins for backstage
  • generate metadata [spec TBD]
• deploy/run stage (scratch image)
  • COPY --from=build the dynamic plugins and metadata (json/yaml) that into a 1-layer FROM scratch layer (previous layers will be discarded)
  • ignore warning from Konflux about ubi base images
  • sbom will list the packages you pulled from npm and report CVEs against the upstream images