feat!: introduce new standalone RHDH Chart [RHDHPLAN-1058]

.github/CODEOWNERS

@@ -20,3 +20,4 @@
 
 # Lightspeed:
 /charts/backstage/files/lightspeed/ @redhat-developer/rhdh-ai
+/charts/rhdh/files/lightspeed/      @redhat-developer/rhdh-ai

.github/actions/test-charts/action.yml

@@ -6,19 +6,19 @@ inputs:
     description: 'Target branch for chart-testing'
     required: true
   extra_helm_args:
-    description: 'Extra Helm arguments to pass to ct install'
+    description: 'Individual --set overrides passed to ct install via --helm-extra-set-args'
     required: false
     default: ''
   all_charts:
     description: 'Install all charts instead of only changed ones'
     required: false
     default: 'false'
   chart:
-    description: 'Specific chart to test (e.g., charts/backstage). When set, only this chart is tested.'
+    description: 'Specific chart to test (e.g., charts/rhdh). When set, only this chart is tested.'
     required: false
     default: ''
   helm_extra_args:
-    description: 'Extra arguments to pass to helm via ct install --helm-extra-args (e.g., --values file.yaml)'
+    description: 'General helm flags (e.g. --values file.yaml) passed to ct install via --helm-extra-args'
     required: false
     default: ''
   helm_template_values_file:
@@ -60,18 +60,21 @@ runs:
       run: |
         if [[ -n "$INPUT_CHART" ]]; then
           echo "changed=true" >> "$GITHUB_OUTPUT"
-          if [[ "$INPUT_CHART" == "charts/backstage" ]]; then
-            echo "backstageChartChanged=true" >> "$GITHUB_OUTPUT"
+          if [[ "$INPUT_CHART" == "charts/rhdh" ]]; then
+            echo "orchestratorCrdsNeeded=true" >> "$GITHUB_OUTPUT"
+            echo "externalDbNeeded=true" >> "$GITHUB_OUTPUT"
           fi
         elif [[ "$INPUT_ALL_CHARTS" == "true" ]]; then
           echo "changed=true" >> "$GITHUB_OUTPUT"
-          echo "backstageChartChanged=true" >> "$GITHUB_OUTPUT"
+          echo "orchestratorCrdsNeeded=true" >> "$GITHUB_OUTPUT"
+          echo "externalDbNeeded=true" >> "$GITHUB_OUTPUT"
         else
           listChanged=$(ct list-changed --target-branch "$INPUT_TARGET_BRANCH")
           if [[ -n "$listChanged" ]]; then
             echo "changed=true" >> "$GITHUB_OUTPUT"
-            if grep 'charts/backstage' <<< "$listChanged"; then
-              echo "backstageChartChanged=true" >> "$GITHUB_OUTPUT"
+            if grep -q 'charts/rhdh' <<< "$listChanged"; then
+              echo "orchestratorCrdsNeeded=true" >> "$GITHUB_OUTPUT"
+              echo "externalDbNeeded=true" >> "$GITHUB_OUTPUT"
             fi
           fi
         fi
@@ -182,7 +185,7 @@ runs:
     # For the simple testing that we are doing here on a vanilla K8s cluster, we only need both the Knative and SonataFlow CRDs.
     # TODO(rm3l): Update this when/if there is an upstream counterpart installable via OLM.
     - name: Install Knative and SonataFlow CRDs
-      if: steps.list-changed.outputs.backstageChartChanged == 'true'
+      if: steps.list-changed.outputs.orchestratorCrdsNeeded == 'true'
       shell: bash
       env:
         SONATAFLOW_OPERATOR_VERSION: "10.1.0"
@@ -192,6 +195,83 @@ runs:
         done
         kubectl create -f "https://github.com/apache/incubator-kie-tools/releases/download/${SONATAFLOW_OPERATOR_VERSION}/apache-kie-${SONATAFLOW_OPERATOR_VERSION}-incubating-sonataflow-operator.yaml"
 
+    - name: Set up external services and test resources for rhdh
+      if: steps.list-changed.outputs.externalDbNeeded == 'true'
+      shell: bash
+      run: |
+        RHDH_VALUES="charts/rhdh/values.yaml"
+
+        # ── External PostgreSQL (ext-services namespace) ──
+        # Extract the image from the rhdh chart values to stay in sync
+        PG_REGISTRY=$(yq -r '.postgresql.image.registry' "$RHDH_VALUES")
+        PG_REPOSITORY=$(yq -r '.postgresql.image.repository' "$RHDH_VALUES")
+        PG_TAG=$(yq -r '.postgresql.image.tag' "$RHDH_VALUES")
+        # Pin the chart version to match the rhdh chart dependency
+        PG_CHART_VERSION=$(yq -r '.dependencies[] | select(.name == "postgresql") | .version' charts/rhdh/Chart.yaml)
+        echo "[INFO] Using PostgreSQL chart version: ${PG_CHART_VERSION}"
+        echo "[INFO] Using PostgreSQL image: ${PG_REGISTRY}/${PG_REPOSITORY}:${PG_TAG}"
+
+        kubectl create namespace ext-services
+        helm install ext-db bitnami/postgresql \
+          --namespace ext-services \
+          --version "$PG_CHART_VERSION" \
+          --set image.registry="$PG_REGISTRY" \
+          --set image.repository="$PG_REPOSITORY" \
+          --set image.tag="$PG_TAG" \
+          --set auth.postgresPassword=testpassword \
+          --set postgresqlDataDir=/var/lib/pgsql/data/userdata \
+          --set primary.persistence.enabled=false \
+          --set primary.podSecurityContext.enabled=false \
+          --set primary.containerSecurityContext.enabled=false \
+          --set primary.extraEnvVars[0].name=POSTGRESQL_ADMIN_PASSWORD \
+          --set primary.extraEnvVars[0].value=testpassword \
+          --wait --timeout 300s
+
+        # ── Fixed test namespace (ct-charts) ──
+        # Using --namespace with ct install keeps this namespace alive across all
+        # ci/ values file tests, so pre-created resources persist.
+        kubectl create namespace ct-charts
+
+        # Secret for external-db test (with-external-db-values.yaml)
+        kubectl create secret generic ext-db-password \
+          --namespace ct-charts \
+          --from-literal=password=testpassword
+
+        # Secret for orchestrator external-db (with-external-db-values.yaml)
+        kubectl create secret generic ext-db-orchestrator \
+          --namespace ct-charts \
+          --from-literal=POSTGRES_HOST=ext-db-postgresql.ext-services.svc.cluster.local \
+          --from-literal=POSTGRES_PORT=5432 \
+          --from-literal=POSTGRES_USER=postgres \
+          --from-literal=POSTGRES_PASSWORD=testpassword
+
+        # Fake .npmrc secret for dynamic-plugins init container test.
+        # The volume is optional: true in the deployment, so this is only needed
+        # if a ci/ values file actually exercises the npmrc path.
+        # ct uses the Chart.yaml name as the Helm release name, so fullname = redhat-developer-hub.
+        # kubectl create secret generic redhat-developer-hub-dynamic-plugins-npmrc \
+        #   --namespace ct-charts \
+        #   --from-literal=.npmrc=$'@myscope:registry=https://my-registry.example.com\n//my-registry.example.com:_authToken=foo'
+
+        # Lightspeed existing-resource test (with-lightspeed-existing-config-values.yaml)
+        kubectl create configmap test-lightspeed-stack \
+          --namespace ct-charts \
+          --from-file=lightspeed-stack.yaml=charts/rhdh/files/lightspeed/lightspeed-stack.yaml
+        kubectl create configmap test-lightspeed-server \
+          --namespace ct-charts \
+          --from-file=config.yaml=charts/rhdh/files/lightspeed/config.yaml
+        kubectl create configmap test-lightspeed-profile \
+          --namespace ct-charts \
+          --from-file=rhdh-profile.py=charts/rhdh/files/lightspeed/rhdh-profile.py
+        kubectl create secret generic test-lightspeed-secret \
+          --namespace ct-charts \
+          --from-literal=LLAMA_STACK_LOGGING=info
+
+        # Minimal app-config for extraAppConfig test (with-extra-app-config-values.yaml)
+        kubectl create configmap my-app-config \
+          --namespace ct-charts \
+          --from-literal=app-config-custom.yaml='{}'
+
     - name: Run chart-testing (install)
       if: steps.list-changed.outputs.changed == 'true'
       shell: bash
@@ -219,12 +299,17 @@ runs:
         fi
 
         EXTRA_ARGS=()
-        if [[ -z "$INPUT_CHART" || "$INPUT_CHART" == "charts/backstage" ]]; then
+        if [[ "$INPUT_CHART" == "charts/rhdh" ]]; then
+          # On vanilla K8s (KinD), there is no SCC to assign a common UID.
+          # Set fsGroup so shared volumes (e.g. RAG data) are group-writable
+          # across init containers and sidecars that may run as different UIDs.
           EXTRA_ARGS+=(
-            "--set route.enabled=false"
-            "--set upstream.ingress.enabled=true"
-            "--set global.host=rhdh.127.0.0.1.sslip.io"
-            "--set upstream.backstage.podSecurityContext.fsGroup=1001"
+            "--set openshift.route.enabled=false"
+            "--set ingress.enabled=true"
+            "--set host=rhdh.127.0.0.1.sslip.io"
+            "--set postgresql.primary.persistence.enabled=false"
+            "--set postgresql.primary.resources.limits.ephemeral-storage=200Mi"
+            "--set podSecurityContext.fsGroup=1001"
           )
         fi
         if [[ -n "$INPUT_EXTRA_HELM_ARGS" ]]; then
@@ -236,19 +321,32 @@ runs:
           --target-branch "$INPUT_TARGET_BRANCH"
           --helm-extra-set-args="${EXTRA_ARGS[*]}"
         )
+        # Use a fixed namespace so that pre-created test resources
+        # (Secrets, ConfigMaps) persist across all ci/ values file tests.
+        kubectl create namespace ct-charts 2>/dev/null || true
+        CT_ARGS+=(--namespace ct-charts)
+        # Test upgrades from the previous revision unless:
+        # - the chart is new (not on the target branch)
+        # - the chart version is unchanged
+        # - there is a major version bump
+        SKIP_UPGRADE=false
         if [[ -n "$INPUT_CHART" ]]; then
-          old_version=$(git show "origin/$INPUT_TARGET_BRANCH:$INPUT_CHART/Chart.yaml" 2>/dev/null | yq '.version' 2>/dev/null || echo "0.0.0")
-          new_version=$(yq '.version' "$INPUT_CHART/Chart.yaml")
-          old_major=${old_version%%.*}
-          new_major=${new_version%%.*}
-          if [[ "$old_version" == "$new_version" ]]; then
-            echo "Skipping --upgrade: chart version unchanged ($old_version)"
-          elif [[ "$old_major" != "$new_major" ]]; then
-            echo "Skipping --upgrade: major version bump detected ($old_version -> $new_version)"
+          if ! git show "origin/$INPUT_TARGET_BRANCH:${INPUT_CHART}/Chart.yaml" &>/dev/null; then
+            echo "Skipping --upgrade: chart $INPUT_CHART is new (not on $INPUT_TARGET_BRANCH)"
+            SKIP_UPGRADE=true
           else
-            CT_ARGS+=(--upgrade)
+            old_version=$(git show "origin/$INPUT_TARGET_BRANCH:$INPUT_CHART/Chart.yaml" | yq '.version' 2>/dev/null || echo "0.0.0")
+            new_version=$(yq '.version' "$INPUT_CHART/Chart.yaml")
+            if [[ "$old_version" == "$new_version" ]]; then
+              echo "Skipping --upgrade: chart version unchanged ($old_version)"
+              SKIP_UPGRADE=true
+            elif [[ "${old_version%%.*}" != "${new_version%%.*}" ]]; then
+              echo "Skipping --upgrade: major version bump ($old_version -> $new_version)"
+              SKIP_UPGRADE=true
+            fi
           fi
-        else
+        fi
+        if [[ "$SKIP_UPGRADE" == "false" ]]; then
           CT_ARGS+=(--upgrade)
         fi
         if [[ "$RUNNER_DEBUG" == "1" ]]; then

.github/workflows/nightly.yaml

@@ -15,25 +15,36 @@ jobs:
     name: Discover charts
     runs-on: ubuntu-latest
     outputs:
-      charts: ${{ steps.list.outputs.charts }}
+      matrix: ${{ steps.list.outputs.matrix }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          fetch-depth: 0
 
-      - name: List charts
+      - name: Build per-branch chart matrix
         id: list
         run: |
-          excluded=$(yq e '.excluded-charts[]' ct.yaml 2>/dev/null || true)
-          charts='[]'
-          for chart_dir in charts/*/; do
-            [[ ! -d "$chart_dir" ]] && continue
-            chart_name=$(basename "$chart_dir")
-            chart_path="${chart_dir%/}"
-            if ! echo "$excluded" | grep -qx "$chart_name"; then
-              charts=$(echo "$charts" | jq -c --arg c "$chart_name" '. + [$c]')
+          branches=(main release-1.10 release-1.9 release-1.8)
+          matrix='[]'
+          for branch in "${branches[@]}"; do
+            ref="origin/$branch"
+            if ! git rev-parse --verify "$ref" &>/dev/null; then
+              echo "::warning::Branch $branch does not exist, skipping"
+              continue
             fi
+
+            excluded=$(git show "$ref:ct.yaml" 2>/dev/null | yq e '.excluded-charts[]' 2>/dev/null || true)
+            while IFS= read -r entry; do
+              [[ -z "$entry" ]] && continue
+              chart_name=$(basename "$entry")
+              [[ -z "$chart_name" ]] && continue
+              if ! echo "$excluded" | grep -qx "$chart_name"; then
+                matrix=$(echo "$matrix" | jq -c --arg b "$branch" --arg c "$chart_name" '. + [{"branch": $b, "chart": $c}]')
+              fi
+            done < <(git ls-tree --name-only "$ref" charts/)
           done
-          echo "charts=$charts" >> "$GITHUB_OUTPUT"
+          echo "matrix=$matrix" >> "$GITHUB_OUTPUT"
 
   test-chart:
     needs: discover-charts
@@ -43,12 +54,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        branch:
-          - main
-          - release-1.10
-          - release-1.9
-          - release-1.8
-        chart: ${{ fromJson(needs.discover-charts.outputs.charts) }}
+        include: ${{ fromJson(needs.discover-charts.outputs.matrix) }}
 
     steps:
       - name: Checkout
@@ -114,6 +120,12 @@ jobs:
           yq e '{"global": {"dynamic": {"includes": .global.dynamic.includes}, "lightspeed": {"plugins": .global.lightspeed.plugins}}, "orchestrator": {"plugins": .orchestrator.plugins}}' \
             charts/backstage/values.yaml > /tmp/backstage-nightly-values.yaml
 
+      - name: Generate nightly values override for rhdh chart
+        if: steps.check.outputs.exists == 'true' && matrix.chart == 'rhdh'
+        run: |
+          yq e '{"dynamicPlugins": {"includes": .dynamicPlugins.includes}, "lightspeed": {"plugins": .lightspeed.plugins}, "orchestrator": {"plugins": .orchestrator.plugins}}' \
+            charts/rhdh/values.yaml > /tmp/rhdh-nightly-values.yaml
+
       - name: Test charts
         if: steps.check.outputs.exists == 'true'
         uses: ./.github/actions/test-charts
@@ -122,5 +134,7 @@ jobs:
           chart: charts/${{ matrix.chart }}
           all_charts: 'true'
           monitoring_heartbeat: ${{ vars.TEST_MONITORING_HEARTBEAT_ENABLED || 'false' }}
-          extra_helm_args: ${{ matrix.chart == 'backstage' && format('--set upstream.backstage.image.repository={0} --set upstream.backstage.image.tag={1} --set upstream.backstage.image.pullPolicy=Always', steps.image.outputs.repo, steps.image.outputs.tag) || '' }}
-          helm_extra_args: ${{ matrix.chart == 'backstage' && '--values /tmp/backstage-nightly-values.yaml' || '' }}
+          # extra_helm_args: individual --set overrides, passed to ct install via --helm-extra-set-args
+          extra_helm_args: ${{ matrix.chart == 'rhdh' && format('--set image.repository={0} --set image.tag={1} --set image.pullPolicy=Always', steps.image.outputs.repo, steps.image.outputs.tag) || matrix.chart == 'backstage' && format('--set upstream.backstage.image.repository={0} --set upstream.backstage.image.tag={1} --set upstream.backstage.image.pullPolicy=Always', steps.image.outputs.repo, steps.image.outputs.tag) || '' }}
+          # helm_extra_args: general helm flags (e.g. --values), passed to ct install via --helm-extra-args
+          helm_extra_args: ${{ matrix.chart == 'rhdh' && '--values /tmp/rhdh-nightly-values.yaml' || matrix.chart == 'backstage' && '--values /tmp/backstage-nightly-values.yaml' || '' }}

.github/workflows/snyk.yaml

@@ -13,12 +13,12 @@ jobs:
     strategy:
       matrix:
         chartConfig:
-          - name: "backstage"
-            path: "backstage"
+          - name: "rhdh"
+            path: "rhdh"
           - name: "orchestrator-infra"
             path: "orchestrator-infra"
-          - name: "backstage-orchestrator"
-            path: "backstage"
+          - name: "rhdh-orchestrator"
+            path: "rhdh"
             cliArgs: "--set orchestrator.enabled=true"
 
     steps: