chore(deps): update upstream Backstage chart to 2.6.3

.github/workflows/sync-upstream-backstage.yaml

@@ -2,7 +2,7 @@ name: Sync Upstream Backstage Chart
 
 on:
   schedule:
-    - cron: '0 3 * * *'
+    - cron: '0 3 * * 1'
   workflow_dispatch:
 
 concurrency:
@@ -59,6 +59,36 @@ jobs:
             echo "has_changes=true" >> "$GITHUB_OUTPUT"
           fi
 
+      - name: Apply RHDH-specific changes to vendored chart
+        if: steps.sync.outputs.has_changes == 'true'
+        run: |
+          VENDOR_GITIGNORE="charts/backstage/vendor/backstage/.gitignore"
+          RHDH_MARKER="# RHDH: track vendored chart dependencies"
+
+          # Fix directory ignore pattern: "charts/*/charts/" ignores the directory itself,
+          # which prevents un-ignoring files inside it. Change to "charts/*/charts/*" to
+          # ignore contents instead, allowing the negation pattern to work.
+          sed -i 's|^charts/\*/charts/$|charts/*/charts/*|' "${VENDOR_GITIGNORE}"
+
+          # Ensure the .gitignore has the RHDH-specific exception to track tgz files
+          if ! grep -q "${RHDH_MARKER}" "${VENDOR_GITIGNORE}"; then
+            cat >> "${VENDOR_GITIGNORE}" << 'EOF'
+
+          # RHDH: track vendored chart dependencies
+          # Since this chart is vendored, we commit its dependencies rather than fetching them at install time
+          !charts/*/charts/*.tgz
+          EOF
+          fi
+
+          # Rebuild vendored chart dependencies to restore tgz files
+          helm dependency update charts/backstage/vendor/backstage/charts/backstage
+
+          git add "${VENDOR_GITIGNORE}"
+          git add charts/backstage/vendor/backstage/charts/backstage/charts/*.tgz
+          if ! git diff --cached --quiet; then
+            git commit -m "chore: apply RHDH-specific changes to vendored Backstage chart"
+          fi
+
       - name: Align dependency version and open PR
         if: steps.sync.outputs.has_changes == 'true'
         env:
@@ -93,9 +123,12 @@ jobs:
             git push origin "${BRANCH}"
 
             BODY=$(cat <<EOF
-          Automated nightly sync of the vendored Backstage chart from the [upstream repository](https://github.com/backstage/charts).
+          Automated weekly sync of the vendored Backstage chart from the [upstream repository](https://github.com/backstage/charts).
 
           Updated the vendored Backstage chart to version **${CHART_VERSION}** and aligned the dependency reference in \`charts/backstage/Chart.yaml\`.
+
+          > [!CAUTION]
+          > The subtree pull may have silently overwritten RHDH-specific local changes to the vendored chart. Please review the changes carefully and restore any local modifications if needed. See [CONTRIBUTING.md](../CONTRIBUTING.md#note-on-the-backstage-chart-dependencies) for details.
           EOF
             )
 

CONTRIBUTING.md

@@ -36,6 +36,9 @@ git subtree pull --prefix charts/backstage/vendor/backstage upstream-backstage m
 
 It is important to use `--squash` to avoid pulling the entire commit history of the upstream chart repository.
 
+> [!CAUTION]
+> **Reviewing subtree syncs:** The subtree pull may silently overwrite RHDH-specific local changes to the vendored chart, even when there are no merge conflicts. This can happen because Git's merge algorithm may auto-resolve changes in favor of upstream. After each sync, carefully review the diff to ensure any local customizations (e.g., `.gitignore` exceptions, template modifications) are preserved. If local changes were lost, restore them manually before merging.
+
 *Note: If merge conflicts occur, resolve them in your editor, then `git add` and `git commit` the resolution as a normal merge.*
 
 **Important:** After any change to the dependency structure or version of the vendored chart, you must rebuild the lock file and local subchart dependencies:

charts/backstage/Chart.yaml

@@ -47,4 +47,4 @@ sources: []
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 # Note that when this chart is published to https://github.com/openshift-helm-charts/charts
 # it will follow the RHDH versioning 1.y.z
-version: 5.7.0
+version: 5.7.1

charts/backstage/README.md

@@ -1,7 +1,7 @@
 
 # RHDH Backstage Helm Chart for OpenShift
 
-![Version: 5.7.0](https://img.shields.io/badge/Version-5.7.0-informational?style=flat-square)
+![Version: 5.7.1](https://img.shields.io/badge/Version-5.7.1-informational?style=flat-square)
 ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square)
 
 A Helm chart for deploying Red Hat Developer Hub, which is a Red Hat supported version of Backstage.
@@ -29,7 +29,7 @@ For the **Generally Available** version of this chart, see:
 helm repo add bitnami https://charts.bitnami.com/bitnami
 helm repo add redhat-developer https://redhat-developer.github.io/rhdh-chart
 
-helm install my-backstage redhat-developer/backstage --version 5.7.0
+helm install my-backstage redhat-developer/backstage --version 5.7.1
 ```
 
 ## Introduction

charts/backstage/vendor/backstage/.github/workflows/release.yml

@@ -35,7 +35,7 @@ jobs:
           CR_TOKEN: "${{ secrets.GITHUB_TOKEN }}"
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@b45d80f862d83dbcd57f89517bcf500b2ab88fb2 #pin@v4.0.0
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 #pin@v4.1.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -45,7 +45,7 @@ jobs:
         uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 #pin@v4.1.0
 
       - name: Install Oras
-        uses: oras-project/setup-oras@22ce207df3b08e061f537244349aac6ae1d214f6 # v1.2.4
+        uses: oras-project/setup-oras@38de303aac69abb66f3e6255b7198bff35f323e3 # v2.0.0
 
       - name: Publish and Sign OCI Charts
         run: |

charts/backstage/vendor/backstage/.gitignore

@@ -5,6 +5,10 @@
 .idea
 
 # helm chart dependencies
-# For RHDH use case only since this chart is vendored, we need to track its dependencies manually with `helm dependency update`
 charts/*/charts/*
+**/charts/*.tgz
+
+# RHDH: track vendored chart dependencies
+# Since this chart is vendored, we commit its dependencies rather than fetching them at install time
 !charts/*/charts/*.tgz
+