Fixes and improvements for .NET, Spring Boot and Postgrest templates by hoangphuc841 · Pull Request #71 · helios-platform-team/helios-platform

hoangphuc841 · 2026-04-21T07:07:23Z

Description

This PR fixes several bugs discovered during end-to-end testing of the PostgREST scaffolding template and the db-migrate Tekton trigger pipeline.

Root causes found:

The PostgREST template hardcoded the component name as api, causing the Helios Operator to provision secrets and statefulsets under the wrong name (e.g., api-db-secret instead of test-postgres-app-v8-db-secret). This broke the Portal's database and CI/CD tab discovery entirely.
The db-migrate CUE trigger had three bugs: the generated PipelineRun name could exceed Kubernetes' 63-character limit for long app names (causing silent webhook failures), the DB secret reference was hardcoded to api-db-secret, and the migration file path was db/migration (singular) instead of db/migrations (plural) which is what the template scaffolds.
The PostgREST catalog-info.yaml was missing required Backstage annotations (tekton.dev/ci-cd, backstage.io/kubernetes-label-selector, backstage.io/kubernetes-namespace) needed for the CI/CD and Kubernetes tabs to function in the portal.

Type of change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update

Checklist

Files changed:

File	Change
`cue/definitions/tekton/triggers/db-migrate-trigger.cue`	Truncate app name to 32 chars in PipelineRun name; use dynamic `databaseSecretRef`; fix path to `db/migrations`
`apps/operator/internal/controller/tekton/mapper.go`	Derive `DatabaseSecretRef` dynamically from `app.Name` instead of hardcoded fallback
`apps/portal/examples/postgrest-template/content/gitops/helios-app.yaml`	Use `${{ values.name }}` for component name instead of static `api`
`apps/portal/examples/postgrest-template/content/source/catalog-info.yaml`	Add missing Backstage CI/CD and Kubernetes annotations
`apps/portal/examples/postgrest-template/template.yaml`	Mask JWT secret field with `ui:widget: password`
`apps/portal/examples/{dotnet,spring-boot}-template/content/source/catalog-info.yaml`	Remove hardcoded Gitea repo URL annotation

Tested with: test-postgres-app — ArgoCD sync ✅, database provisioned ✅, portal database tab ✅, portal CI/CD tab ✅, db-migrate webhook trigger ✅

…ate code in operator causing syntax error during compile. Add missing java test image for the test run

…ent name value in postgres template

- fix(cue): truncate app name to 32 chars in migrate PipelineRun name to prevent exceeding Kubernetes 63-char resource name limit - fix(cue): replace hardcoded 'api-db-secret' with dynamic databaseSecretRef in db-migrate TriggerTemplate - fix(cue): correct migration-source path from 'db/migration' to 'db/migrations' - fix(operator): derive db secret name from app.Name if not explicitly set - fix(postgrest-template): use values.name for component name instead of 'api' - fix(postgrest-template): add missing Backstage CI/CD and Kubernetes annotations - fix(postgrest-template): mask JWT secret input with ui:widget password - fix(catalog): remove hardcoded gitea repo-url from dotnet and spring-boot templates

DatabaseSecretRef field in HeliosApp types and CRD schema

coderabbitai · 2026-04-21T07:07:31Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 6302c9de-a853-41c7-adce-90977f1487aa

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch user/nhphuc/test-and-fix-templates

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

…ecks

… in. change jwtSecret widget from password to secret

…ant.

…aints

nghiaz160904

Postgrest: Confirmed functional tests pass successfully.

Copilot

Pull request overview

This PR addresses several end-to-end failures in the PostgREST scaffolding template and Tekton db-migrate trigger flow by making resource naming and references dynamic (app-specific), fixing migration path handling, and improving Backstage discovery annotations.

Changes:

Truncates Tekton PipelineRun names to avoid exceeding Kubernetes name limits, and fixes db-migrate params (dynamic DB secret ref + db/migrations path).
Fixes PostgREST GitOps component naming and adds Backstage Tekton/Kubernetes annotations needed for Portal discovery.
Updates operator-side Tekton mapping defaults and standardizes Postgres DB type usage; adjusts related tests and local dev setup tasks.

Reviewed changes

Copilot reviewed 18 out of 19 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
cue/definitions/tekton/triggers/github-push.cue	Truncates generated `PipelineRun` names for push/migrate TriggerTemplates.
cue/definitions/tekton/triggers/db-migrate-trigger.cue	Truncates `PipelineRun` name; uses dynamic `databaseSecretRef`; fixes migration source path.
apps/portal/examples/spring-boot-template/template.yaml	Sets a Gradle test image for pipeline execution.
apps/portal/examples/spring-boot-template/content/source/catalog-info.yaml	Removes hardcoded local Gitea repo URL annotation.
apps/portal/examples/postgrest-template/template.yaml	Adds JWT secret constraints/masking and changes how JWT secret is passed to templates.
apps/portal/examples/postgrest-template/content/source/catalog-info.yaml	Adds Backstage TechDocs/Kubernetes/Tekton annotations for Portal tabs.
apps/portal/examples/postgrest-template/content/gitops/helios-app.yaml	Uses dynamic component name instead of hardcoded `api`.
apps/portal/examples/dotnet-template/content/source/catalog-info.yaml	Removes hardcoded local Gitea repo URL annotation.
apps/portal/examples/dotnet-template/content/README.md	Adds template README describing scaffolded .NET project contents.
apps/operator/internal/cue/tekton_test.go	Updates expected rendered Tekton resource counts/kinds after pipeline/trigger changes.
apps/operator/internal/controller/tekton/pipelinerun.go	Adjusts PipelineRun generation logic (per diff).
apps/operator/internal/controller/tekton/mapper.go	Defaults `DatabaseSecretRef` to `{appName}-db-secret` when unset.
apps/operator/internal/controller/database/resources_test.go	Updates expected Postgres URI format to include `sslmode=disable`.
apps/operator/internal/controller/database/resources.go	Replaces hardcoded `"postgres"` string usage with `dbTypePostgres` constant.
apps/operator/internal/controller/database/reconciler.go	Uses `dbTypePostgres` constant for DB-type checks.
apps/operator/internal/controller/database/injection.go	Introduces `dbTypePostgres` constant and uses it in DB URL template selection.
apps/operator/config/crd/bases/app.helios.io_heliosapps.yaml	Adds CRD schema field docs for `databaseSecretRef`.
apps/operator/api/v1alpha1/heliosapp_types.go	Updates `DatabaseSecretRef` docs and removes hardcoded kubebuilder default.
Taskfile.yml	Adds CoreDNS patch task and disables Valkey in local Gitea Helm install.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-04-24T04:09:52Z

          description: "PostgREST API: ${{ parameters.name }}"
          image: index.docker.io/${{ parameters.dockerOrg }}/${{ parameters.repoName }}
          apiSchema: ${{ parameters.apiSchema }}
-          jwtSecret: ${{ parameters.jwtSecret }}
+          jwtSecret: ${{ secrets.jwtSecret }}
          jwtRole: ${{ parameters.jwtRole }}


${{ secrets.jwtSecret }} is unlikely to resolve here: the portal scaffolder config only defines environment secrets like GITEA_TOKEN, so this will render an empty JWT secret (or fail templating). Use the user input (parameters.jwtSecret) and rely on ui:field: Secret/password masking to avoid leaking it in the UI/logs.

Copilot · 2026-04-24T04:09:53Z

          databaseVersion: ${{ parameters.databaseConfig.version or '16' }}
          apiSchema: ${{ parameters.apiSchema }}
-          jwtSecret: ${{ parameters.jwtSecret }}
+          jwtSecret: ${{ secrets.jwtSecret }}
          jwtRole: ${{ parameters.jwtRole }}


Same issue as earlier: ${{ secrets.jwtSecret }} is not provided by the scaffolder execution context (only configured env secrets like GITEA_TOKEN exist), so this will not propagate the JWT secret into the rendered GitOps manifests. Reference the parameter value instead.

Copilot · 2026-04-24T04:09:53Z

+    backstage.io/techdocs-ref: dir:.
    backstage.io/kubernetes-id: ${{ values.name }}
+    backstage.io/kubernetes-label-selector: app.kubernetes.io/name=${{ values.name }}
+    backstage.io/kubernetes-namespace: default


backstage.io/kubernetes-namespace is hardcoded to default, but this template lets the user choose a namespace (parameters.namespace). This will break Kubernetes/CI-CD tab discovery when deploying outside default; consider templating this annotation (e.g. via values.namespace) and passing the namespace into the source fetch:template values.

Suggested change

backstage.io/kubernetes-namespace: default

backstage.io/kubernetes-namespace: ${{ values.namespace }}

Copilot · 2026-04-24T04:09:53Z

 					params: [
 						{name: "app-repo-url", value: "$(tt.params.git-repo-url)"},
 						{name: "app-repo-revision", value: "$(tt.params.git-revision)"},
-						{name: "db-secret-name", value: "api-db-secret"},
-						{name: "migration-source", value: "db/migration"},
+						{name: "db-secret-name", value: _bp.databaseSecretRef},
+						{name: "migration-source", value: "db/migrations"},
 						{name: "namespace", value: _bp.namespace},
 					]


The trigger now sets migration-source to db/migrations, but several file comments still refer to db/migration (singular) and the listener section says it filters by db/migration. Please update the comments/docs in this file to reflect the current behavior (and/or explicitly call out that the CEL filter supports both paths).

Copilot · 2026-04-24T04:09:53Z

 			dbName:   "testdb",
 			port:     5432,
-			expected: "postgres://user:pass@::1:5432/testdb",
+			expected: "postgres://user:pass@::1:5432/testdb?sslmode=disable",


The IPv6 test case (and current formatPostgresURI behavior) produces postgres://...@::1:5432/..., which is not a valid URI because IPv6 hosts must be wrapped in brackets ([::1]). Consider updating formatPostgresURI to bracket IPv6 literals and adjust this expectation accordingly.

Suggested change

expected: "postgres://user:pass@::1:5432/testdb?sslmode=disable",

expected: "postgres://user:pass@[::1]:5432/testdb?sslmode=disable",

hoangphuc841 added 4 commits April 21, 2026 10:21

fix: Add new steps in taskfile to resolve startup problem, fix duplic…

917bf8f

…ate code in operator causing syntax error during compile. Add missing java test image for the test run

fix: update application catalog metadata and fix an issue with compon…

eeba8db

…ent name value in postgres template

- fix(crd): remove hardcoded 'api-db-secret' kubebuilder default from

6cb1c63

DatabaseSecretRef field in HeliosApp types and CRD schema

hoangphuc841 and others added 6 commits April 21, 2026 18:08

fix(test): updates tests for the recent changes

f6b8f1b

chore: regenerate the crd from the go type annotations to match CI ch…

02e186d

…ecks

fix(cue): repalce unsafe [:32] string slice with safe conditional let…

1c1fab8

… in. change jwtSecret widget from password to secret

fix(template): updated jwt references after switching to secret field

7fd9b97

fix(lint): extract repeated postgres string into dbTypePostgres const…

6bdddb2

…ant.

fix(template): update jwtSecret description and enforce length constr…

1c8e862

…aints

nghiaz160904 approved these changes Apr 21, 2026

View reviewed changes

PhuocHoan requested a review from Copilot April 24, 2026 04:03

Copilot started reviewing on behalf of PhuocHoan April 24, 2026 04:03 View session

Copilot AI reviewed Apr 24, 2026

View reviewed changes

NgocAnhDo26 merged commit b6faeb3 into features/sprint4-backend-templates-db-injection May 3, 2026
9 checks passed

NgocAnhDo26 deleted the user/nhphuc/test-and-fix-templates branch May 3, 2026 07:21

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Fixes and improvements for .NET, Spring Boot and Postgrest templates#71

Fixes and improvements for .NET, Spring Boot and Postgrest templates#71
NgocAnhDo26 merged 10 commits into
features/sprint4-backend-templates-db-injectionfrom
user/nhphuc/test-and-fix-templates

hoangphuc841 commented Apr 21, 2026

Uh oh!

coderabbitai Bot commented Apr 21, 2026 •

edited

Loading

Review skipped

Uh oh!

nghiaz160904 left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Copilot AI Apr 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	backstage.io/kubernetes-namespace: default
	backstage.io/kubernetes-namespace: ${{ values.namespace }}

	expected: "postgres://user:pass@::1:5432/testdb?sslmode=disable",
	expected: "postgres://user:pass@[::1]:5432/testdb?sslmode=disable",

Conversation

hoangphuc841 commented Apr 21, 2026

Description

Type of change

Checklist

Uh oh!

coderabbitai Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Uh oh!

nghiaz160904 left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 24, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

coderabbitai Bot commented Apr 21, 2026 •

edited

Loading