@backstage/plugin-scaffolder-backend 4.1.0 → 4.2.0-next.1

package/CHANGELOG.md

@@ -1,36 +1,52 @@
 # @backstage/plugin-scaffolder-backend
 
-## 4.1.0
+## 4.2.0-next.1
 
 ### Minor Changes
 
-- 6fb2a41: Added the `scaffolder.requireScmUserCredentials` configuration option to require user-provided credentials for supported SCM mutation and fetch actions.
+- bbba6b5: Added the `scaffolder.requireScmUserCredentials` configuration option to require user-provided credentials for supported SCM mutation and fetch actions.
 
 ### Patch Changes
 
-- 0253c50: Respect task read permission decisions when listing scaffolder tasks.
-- e673a86: Restrict task list ordering to supported fields.
-- 66d2219: Exclude internal task data from task responses.
-- 3eb3dc5: Improve denied scaffolder action error handling.
-- 3f1e869: Ensure task failure details use the configured log redactions.
-- dc30fae: Fixed log redaction for transformed secret values used to iterate Scaffolder steps.
-- 9e86c95: Restrict task retries to terminal states.
-- a91ed72: Fixed matching of action input values in scaffolder permission policies.
+- 7fba55a: Removed user entity references from scaffolder task count metrics to avoid exposing user identities and creating high-cardinality metric labels.
+- b1256aa: Respect task read permission decisions when listing scaffolder tasks.
+- 15fa029: Restrict task list ordering to supported fields.
+- be0a75a: Exclude internal task data from task responses.
+- f389dd2: Improve denied scaffolder action error handling.
+- 2eebeb7: Ensure task failure details use the configured log redactions.
+- 84ebbb9: Fixed log redaction for transformed secret values used to iterate Scaffolder steps.
+- b4172dd: Restrict task retries to terminal states.
+- ee9c48d: Fixed matching of action input values in scaffolder permission policies.
+- 79f0b91: Fixed the scaffolder task worker silently giving up after a transient failure. A single error while picking up a task, such as a dropped database connection, would stop the backend from running any further software templates for the rest of its lifetime. New tasks stayed queued indefinitely with no error shown to the user and no failing health check, and the only way to recover was to restart the backend. Picking up tasks is now retried instead.
 - Updated dependencies
-  - @backstage/plugin-scaffolder-common@2.2.3
-  - @backstage/integration@2.1.1
+  - @backstage/plugin-scaffolder-common@2.3.0-next.1
+  - @backstage/integration@2.1.2-next.0
+  - @backstage/backend-openapi-utils@0.7.2-next.0
+  - @backstage/plugin-permission-node@0.11.4-next.0
+  - @backstage/plugin-scaffolder-node@0.13.7-next.1
+  - @backstage/backend-plugin-api@1.10.1-next.0
+  - @backstage/plugin-catalog-node@2.2.5-next.0
+  - @backstage/plugin-events-node@0.4.26-next.0
 
-## 4.0.5
+## 4.1.0-next.0
 
-### Patch Changes
+### Minor Changes
 
-- 640372d: Software template inline conditionals without an `else` branch now render an empty string when their condition is false, matching Nunjucks behavior.
+- 1a705ca: Applied `templateDryRunPermission` to inline Software Template dry runs and the corresponding backend action. Permission policies that deny unknown permissions must explicitly allow `scaffolder.template.dry-run` to retain existing dry-run access.
+- e95b649: Added task recovery feature with new `scaffolder.taskRecovery` config section. When enabled, tasks that crash or timeout are automatically recovered and resume from the last completed step, task secrets are retained until the task reaches a terminal state so recovery can continue, and completed step outputs are persisted. Enabling recovery applies to all scaffolder tasks, so actions used by those tasks should be idempotent or use checkpoints. When recovery is disabled (the default), the previous behavior is unchanged: secrets are cleared as soon as a task is claimed and retries re-run every step. The new config consolidates previous experimental flags (`EXPERIMENTAL_recoverTasks`, `EXPERIMENTAL_workspaceSerialization`, `EXPERIMENTAL_recoverTasksTimeout`) which remain supported as fallbacks. The legacy workspace provider setting continues to select a provider only when `EXPERIMENTAL_workspaceSerialization` is `true`.
 
-## 4.0.4
+  Workspace serialization for task recovery now requires installing a separate workspace provider module, including when you use the legacy configuration. For development, use `@backstage/plugin-scaffolder-backend-module-workspace-database` (50 MB limit, not recommended for production). On first startup, that module migrates existing database workspace snapshots from the legacy task storage. For production, use `@backstage/plugin-scaffolder-backend-module-gcp` or a similar external storage provider. The scaffolder rejects a configured provider that has not been installed and registered.
+
+  Enabling crash recovery does not keep completed task event streams open; normal task completion remains terminal for event-stream clients.
 
 ### Patch Changes
 
-- 913634d: Restored support for intrinsic string, number, array, `Map`, and `Set` methods in software templates.
+- 2bf1392: Software template inline conditionals without an `else` branch now render an empty string when their condition is false, matching Nunjucks behavior.
+- beaa3db: Reject Scaffolder steps where `each` resolves to a primitive value instead of an array or object.
+- c1a30ef: Restored support for intrinsic string, number, array, `Map`, and `Set` methods in software templates.
+- Updated dependencies
+  - @backstage/plugin-scaffolder-common@2.3.0-next.0
+  - @backstage/plugin-scaffolder-node@0.13.7-next.0
 
 ## 4.0.3
 

package/README.md

@@ -124,3 +124,26 @@ Default secrets are resolved from environment variables and accessible via `${{
 ```
 
 **Security Note:** Secrets are automatically masked in logs and are only available to backend actions, never exposed to the frontend.
+
+### Task Recovery
+
+The scaffolder supports automatic task recovery when workers restart or crash. When enabled, tasks that were in a `processing` state will be recovered and can be resumed from where they left off.
+
+```yaml
+scaffolder:
+  taskRecovery:
+    enabled: true
+    staleTimeout: { seconds: 30 } # Optional: how long before a task is considered stale
+    workspaceProvider: database # Optional: enables workspace serialization with specified provider
+```
+
+When task recovery is enabled:
+
+- Tasks in `processing` state with stale heartbeats are automatically recovered to `open` state
+- Secrets are preserved until the task reaches a terminal state (completed/failed)
+- Completed steps are skipped on retry, resuming from the last incomplete step
+- Step outputs are restored so subsequent steps can access previous results
+
+**Note:** `workspaceProvider` is a separate option from `enabled`. Setting `enabled: true` activates task recovery (secrets preservation, step skipping), but workspace serialization only happens if you also set `workspaceProvider`. The `workspaceProvider` value specifies which storage backend to use (for example, `database` from `@backstage/plugin-scaffolder-backend-module-workspace-database`, or `gcpBucket` from `@backstage/plugin-scaffolder-backend-module-gcp`). Install and register the corresponding module before selecting a provider.
+
+This replaces the previous experimental flags (`EXPERIMENTAL_recoverTasks`, `EXPERIMENTAL_workspaceSerialization`, `EXPERIMENTAL_recoverTasksTimeout`) which are still supported as fallbacks. Legacy workspace serialization also requires a separately installed provider module.

package/config.schema.json

@@ -30,6 +30,62 @@
           "type": "number",
           "description": "Sets the number of concurrent tasks that can be run at any given time on the TaskWorker.\n\nDefaults to 10.\n\nSet to 0 to disable task workers altogether."
         },
+        "taskRecovery": {
+          "type": "object",
+          "properties": {
+            "enabled": {
+              "type": "boolean",
+              "description": "Enable automatic task recovery. When enabled:\n- Secrets are preserved until task completion\n- Step state is saved after each step\n- Crashed tasks resume from last completed step",
+              "visibility": "backend"
+            },
+            "staleTimeout": {
+              "anyOf": [
+                {
+                  "type": "object",
+                  "properties": {
+                    "years": {
+                      "type": "number"
+                    },
+                    "months": {
+                      "type": "number"
+                    },
+                    "weeks": {
+                      "type": "number"
+                    },
+                    "days": {
+                      "type": "number"
+                    },
+                    "hours": {
+                      "type": "number"
+                    },
+                    "minutes": {
+                      "type": "number"
+                    },
+                    "seconds": {
+                      "type": "number"
+                    },
+                    "milliseconds": {
+                      "type": "number"
+                    }
+                  },
+                  "description": "Human friendly durations object."
+                },
+                {
+                  "type": "string"
+                }
+              ],
+              "description": "How long before a task is considered stale and eligible for recovery. Default: 30 seconds",
+              "visibility": "backend"
+            },
+            "workspaceProvider": {
+              "type": "string",
+              "description": "The workspace provider to use for serializing and restoring workspaces. Setting this value enables workspace serialization. If not set, workspace serialization is disabled. Common values: 'database'",
+              "visibility": "backend"
+            }
+          },
+          "description": "Task recovery configuration",
+          "visibility": "backend"
+        },
         "requireScmUserCredentials": {
           "type": "boolean",
           "description": "Requires supported SCM actions to only operate with credentials explicitly provided by the signed-in user.\n\nDefaults to false."
@@ -40,15 +96,18 @@
         },
         "EXPERIMENTAL_recoverTasks": {
           "type": "boolean",
-          "description": "Sets the tasks recoverability on system start up.\n\nIf not specified, the default value is false."
+          "description": "Sets the tasks recoverability on system start up.\n\nIf not specified, the default value is false.",
+          "deprecated": "Use scaffolder.taskRecovery.enabled instead."
         },
         "EXPERIMENTAL_workspaceSerialization": {
           "type": "boolean",
-          "description": "Sets the serialization of the workspace to have an ability to rerun the failed task."
+          "description": "Sets the serialization of the workspace to have an ability to rerun the failed task.",
+          "deprecated": "Use scaffolder.taskRecovery.workspaceProvider instead."
         },
         "EXPERIMENTAL_workspaceSerializationProvider": {
           "type": "string",
-          "description": "Sets the provider for workspace serialization.\n\nBy default, it is your database."
+          "description": "Sets the provider for workspace serialization.\n\nDefaults to the database provider when workspace serialization is enabled.",
+          "deprecated": "Use scaffolder.taskRecovery.workspaceProvider instead."
         },
         "EXPERIMENTAL_recoverTasksTimeout": {
           "anyOf": [
@@ -86,7 +145,8 @@
               "type": "string"
             }
           ],
-          "description": "Every task which is in progress state and having a last heartbeat longer than a specified timeout is going to be attempted to recover.\n\nIf not specified, the default value is 5 seconds."
+          "description": "Every task which is in progress state and having a last heartbeat longer than a specified timeout is going to be attempted to recover.\n\nIf not specified, the default value is 30 seconds.",
+          "deprecated": "Use scaffolder.taskRecovery.staleTimeout instead."
         },
         "taskTimeoutJanitorFrequency": {
           "anyOf": [

package/dist/actions/createDryRunTemplateAction.cjs.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var alpha = require('@backstage/plugin-scaffolder-common/alpha');
 var yaml = require('yaml');
 
 function _interopDefaultCompat (e) { return e && typeof e === 'object' && 'default' in e ? e : { default: e }; }
@@ -26,6 +27,7 @@ const createDryRunTemplateAction = ({
       idempotent: true
     },
     description: "Dry-runs a scaffolder template to validate it without making changes. Returns success with execution logs, or errors for validation failures.",
+    visibilityPermission: alpha.templateDryRunPermission,
     schema: {
       input: (z) => z.object({
         templateYaml: z.string().describe(

package/dist/actions/createDryRunTemplateAction.cjs.js.map

@@ -1 +1 @@
-{"version":3,"file":"createDryRunTemplateAction.cjs.js","sources":["../../src/actions/createDryRunTemplateAction.ts"],"sourcesContent":["/*\n * Copyright 2026 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { ActionsRegistryService } from '@backstage/backend-plugin-api/alpha';\nimport { ScaffolderService } from '@backstage/plugin-scaffolder-node';\nimport { JsonObject } from '@backstage/types';\nimport yaml from 'yaml';\n\nconst MAX_CONTENT_SIZE = 64 * 1024;\n\nfunction base64EncodeContent(content: string): string {\n  if (content.length > MAX_CONTENT_SIZE) {\n    return Buffer.from('<file too large>', 'utf8').toString('base64');\n  }\n  return Buffer.from(content, 'utf8').toString('base64');\n}\n\nexport const createDryRunTemplateAction = ({\n  actionsRegistry,\n  scaffolderService,\n}: {\n  actionsRegistry: ActionsRegistryService;\n  scaffolderService: ScaffolderService;\n}) => {\n  actionsRegistry.register({\n    name: 'dry-run-template',\n    title: 'Dry Run Scaffolder Template',\n    attributes: {\n      destructive: false,\n      readOnly: true,\n      idempotent: true,\n    },\n    description:\n      'Dry-runs a scaffolder template to validate it without making changes. Returns success with execution logs, or errors for validation failures.',\n    schema: {\n      input: z =>\n        z.object({\n          templateYaml: z\n            .string()\n            .describe(\n              'The YAML content of the scaffolder template to validate',\n            ),\n          values: z\n            .record(z.unknown())\n            .optional()\n            .describe('Input values for template parameters'),\n          files: z\n            .array(\n              z.object({\n                path: z\n                  .string()\n                  .describe('File path relative to template root'),\n                content: z.string().describe('File content'),\n              }),\n            )\n            .optional()\n            .describe('Files required for running the template'),\n        }),\n      output: z =>\n        z.object({\n          valid: z.boolean().describe('Whether the template is valid'),\n          message: z\n            .string()\n            .describe('Success message or validation error details'),\n          errors: z\n            .array(z.string())\n            .optional()\n            .describe('List of validation errors'),\n          log: z\n            .array(\n              z.object({\n                message: z.string(),\n                stepId: z.string().optional(),\n                status: z.string().optional(),\n              }),\n            )\n            .optional()\n            .describe('Execution log from dry-run'),\n          output: z\n            .record(z.unknown())\n            .optional()\n            .describe('Template output values'),\n          steps: z\n            .array(\n              z.object({\n                id: z.string(),\n                name: z.string(),\n                action: z.string(),\n              }),\n            )\n            .optional()\n            .describe('Parsed template steps'),\n        }),\n    },\n    action: async ({ input, credentials }) => {\n      const { templateYaml, values = {}, files = [] } = input;\n\n      let template;\n      try {\n        template = yaml.parse(templateYaml);\n      } catch (parseError) {\n        const yamlError = parseError as yaml.YAMLParseError;\n        return {\n          output: {\n            valid: false,\n            message: 'Failed to parse YAML template',\n            errors: [\n              `YAML parsing error: ${yamlError.message}`,\n              yamlError.linePos\n                ? `At line ${yamlError.linePos[0].line}, column ${yamlError.linePos[0].col}`\n                : '',\n            ].filter(Boolean),\n          },\n        };\n      }\n\n      const result = await scaffolderService.dryRun(\n        {\n          template,\n          values: values as JsonObject,\n          directoryContents: files.map(file => ({\n            path: file.path,\n            base64Content: base64EncodeContent(file.content),\n          })),\n        },\n        { credentials },\n      );\n\n      return {\n        output: {\n          valid: true,\n          message: 'Template validation successful',\n          log: result.log?.map(entry => ({\n            message: entry.body.message,\n            stepId: entry.body.stepId,\n            status: entry.body.status,\n          })),\n          output: result.output,\n          steps: result.steps,\n        },\n      };\n    },\n  });\n};\n"],"names":["yaml"],"mappings":";;;;;;;;AAoBA,MAAM,mBAAmB,EAAA,GAAK,IAAA;AAE9B,SAAS,oBAAoB,OAAA,EAAyB;AACpD,EAAA,IAAI,OAAA,CAAQ,SAAS,gBAAA,EAAkB;AACrC,IAAA,OAAO,OAAO,IAAA,CAAK,kBAAA,EAAoB,MAAM,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,OAAA,EAAS,MAAM,CAAA,CAAE,SAAS,QAAQ,CAAA;AACvD;AAEO,MAAM,6BAA6B,CAAC;AAAA,EACzC,eAAA;AAAA,EACA;AACF,CAAA,KAGM;AACJ,EAAA,eAAA,CAAgB,QAAA,CAAS;AAAA,IACvB,IAAA,EAAM,kBAAA;AAAA,IACN,KAAA,EAAO,6BAAA;AAAA,IACP,UAAA,EAAY;AAAA,MACV,WAAA,EAAa,KAAA;AAAA,MACb,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY;AAAA,KACd;AAAA,IACA,WAAA,EACE,+IAAA;AAAA,IACF,MAAA,EAAQ;AAAA,MACN,KAAA,EAAO,CAAA,CAAA,KACL,CAAA,CAAE,MAAA,CAAO;AAAA,QACP,YAAA,EAAc,CAAA,CACX,MAAA,EAAO,CACP,QAAA;AAAA,UACC;AAAA,SACF;AAAA,QACF,MAAA,EAAQ,CAAA,CACL,MAAA,CAAO,CAAA,CAAE,OAAA,EAAS,CAAA,CAClB,QAAA,EAAS,CACT,QAAA,CAAS,sCAAsC,CAAA;AAAA,QAClD,OAAO,CAAA,CACJ,KAAA;AAAA,UACC,EAAE,MAAA,CAAO;AAAA,YACP,IAAA,EAAM,CAAA,CACH,MAAA,EAAO,CACP,SAAS,qCAAqC,CAAA;AAAA,YACjD,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAAA,WAC5C;AAAA,SACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,yCAAyC;AAAA,OACtD,CAAA;AAAA,MACH,MAAA,EAAQ,CAAA,CAAA,KACN,CAAA,CAAE,MAAA,CAAO;AAAA,QACP,KAAA,EAAO,CAAA,CAAE,OAAA,EAAQ,CAAE,SAAS,+BAA+B,CAAA;AAAA,QAC3D,OAAA,EAAS,CAAA,CACN,MAAA,EAAO,CACP,SAAS,6CAA6C,CAAA;AAAA,QACzD,MAAA,EAAQ,CAAA,CACL,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA,EAAS,CACT,QAAA,CAAS,2BAA2B,CAAA;AAAA,QACvC,KAAK,CAAA,CACF,KAAA;AAAA,UACC,EAAE,MAAA,CAAO;AAAA,YACP,OAAA,EAAS,EAAE,MAAA,EAAO;AAAA,YAClB,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,YAC5B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,WAC7B;AAAA,SACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,4BAA4B,CAAA;AAAA,QACxC,MAAA,EAAQ,CAAA,CACL,MAAA,CAAO,CAAA,CAAE,OAAA,EAAS,CAAA,CAClB,QAAA,EAAS,CACT,QAAA,CAAS,wBAAwB,CAAA;AAAA,QACpC,OAAO,CAAA,CACJ,KAAA;AAAA,UACC,EAAE,MAAA,CAAO;AAAA,YACP,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,YACb,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,YACf,MAAA,EAAQ,EAAE,MAAA;AAAO,WAClB;AAAA,SACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,uBAAuB;AAAA,OACpC;AAAA,KACL;AAAA,IACA,MAAA,EAAQ,OAAO,EAAE,KAAA,EAAO,aAAY,KAAM;AACxC,MAAA,MAAM,EAAE,cAAc,MAAA,GAAS,IAAI,KAAA,GAAQ,IAAG,GAAI,KAAA;AAElD,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAWA,qBAAA,CAAK,MAAM,YAAY,CAAA;AAAA,MACpC,SAAS,UAAA,EAAY;AACnB,QAAA,MAAM,SAAA,GAAY,UAAA;AAClB,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ;AAAA,YACN,KAAA,EAAO,KAAA;AAAA,YACP,OAAA,EAAS,+BAAA;AAAA,YACT,MAAA,EAAQ;AAAA,cACN,CAAA,oBAAA,EAAuB,UAAU,OAAO,CAAA,CAAA;AAAA,cACxC,SAAA,CAAU,OAAA,GACN,CAAA,QAAA,EAAW,SAAA,CAAU,QAAQ,CAAC,CAAA,CAAE,IAAI,CAAA,SAAA,EAAY,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,CAAE,GAAG,CAAA,CAAA,GACxE;AAAA,aACN,CAAE,OAAO,OAAO;AAAA;AAClB,SACF;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,MAAA;AAAA,QACrC;AAAA,UACE,QAAA;AAAA,UACA,MAAA;AAAA,UACA,iBAAA,EAAmB,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,MAAS;AAAA,YACpC,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,aAAA,EAAe,mBAAA,CAAoB,IAAA,CAAK,OAAO;AAAA,WACjD,CAAE;AAAA,SACJ;AAAA,QACA,EAAE,WAAA;AAAY,OAChB;AAEA,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ;AAAA,UACN,KAAA,EAAO,IAAA;AAAA,UACP,OAAA,EAAS,gCAAA;AAAA,UACT,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,GAAA,CAAI,CAAA,KAAA,MAAU;AAAA,YAC7B,OAAA,EAAS,MAAM,IAAA,CAAK,OAAA;AAAA,YACpB,MAAA,EAAQ,MAAM,IAAA,CAAK,MAAA;AAAA,YACnB,MAAA,EAAQ,MAAM,IAAA,CAAK;AAAA,WACrB,CAAE,CAAA;AAAA,UACF,QAAQ,MAAA,CAAO,MAAA;AAAA,UACf,OAAO,MAAA,CAAO;AAAA;AAChB,OACF;AAAA,IACF;AAAA,GACD,CAAA;AACH;;;;"}
+{"version":3,"file":"createDryRunTemplateAction.cjs.js","sources":["../../src/actions/createDryRunTemplateAction.ts"],"sourcesContent":["/*\n * Copyright 2026 The Backstage Authors\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *     http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\nimport { ActionsRegistryService } from '@backstage/backend-plugin-api/alpha';\nimport { templateDryRunPermission } from '@backstage/plugin-scaffolder-common/alpha';\nimport { ScaffolderService } from '@backstage/plugin-scaffolder-node';\nimport { JsonObject } from '@backstage/types';\nimport yaml from 'yaml';\n\nconst MAX_CONTENT_SIZE = 64 * 1024;\n\nfunction base64EncodeContent(content: string): string {\n  if (content.length > MAX_CONTENT_SIZE) {\n    return Buffer.from('<file too large>', 'utf8').toString('base64');\n  }\n  return Buffer.from(content, 'utf8').toString('base64');\n}\n\nexport const createDryRunTemplateAction = ({\n  actionsRegistry,\n  scaffolderService,\n}: {\n  actionsRegistry: ActionsRegistryService;\n  scaffolderService: ScaffolderService;\n}) => {\n  actionsRegistry.register({\n    name: 'dry-run-template',\n    title: 'Dry Run Scaffolder Template',\n    attributes: {\n      destructive: false,\n      readOnly: true,\n      idempotent: true,\n    },\n    description:\n      'Dry-runs a scaffolder template to validate it without making changes. Returns success with execution logs, or errors for validation failures.',\n    visibilityPermission: templateDryRunPermission,\n    schema: {\n      input: z =>\n        z.object({\n          templateYaml: z\n            .string()\n            .describe(\n              'The YAML content of the scaffolder template to validate',\n            ),\n          values: z\n            .record(z.unknown())\n            .optional()\n            .describe('Input values for template parameters'),\n          files: z\n            .array(\n              z.object({\n                path: z\n                  .string()\n                  .describe('File path relative to template root'),\n                content: z.string().describe('File content'),\n              }),\n            )\n            .optional()\n            .describe('Files required for running the template'),\n        }),\n      output: z =>\n        z.object({\n          valid: z.boolean().describe('Whether the template is valid'),\n          message: z\n            .string()\n            .describe('Success message or validation error details'),\n          errors: z\n            .array(z.string())\n            .optional()\n            .describe('List of validation errors'),\n          log: z\n            .array(\n              z.object({\n                message: z.string(),\n                stepId: z.string().optional(),\n                status: z.string().optional(),\n              }),\n            )\n            .optional()\n            .describe('Execution log from dry-run'),\n          output: z\n            .record(z.unknown())\n            .optional()\n            .describe('Template output values'),\n          steps: z\n            .array(\n              z.object({\n                id: z.string(),\n                name: z.string(),\n                action: z.string(),\n              }),\n            )\n            .optional()\n            .describe('Parsed template steps'),\n        }),\n    },\n    action: async ({ input, credentials }) => {\n      const { templateYaml, values = {}, files = [] } = input;\n\n      let template;\n      try {\n        template = yaml.parse(templateYaml);\n      } catch (parseError) {\n        const yamlError = parseError as yaml.YAMLParseError;\n        return {\n          output: {\n            valid: false,\n            message: 'Failed to parse YAML template',\n            errors: [\n              `YAML parsing error: ${yamlError.message}`,\n              yamlError.linePos\n                ? `At line ${yamlError.linePos[0].line}, column ${yamlError.linePos[0].col}`\n                : '',\n            ].filter(Boolean),\n          },\n        };\n      }\n\n      const result = await scaffolderService.dryRun(\n        {\n          template,\n          values: values as JsonObject,\n          directoryContents: files.map(file => ({\n            path: file.path,\n            base64Content: base64EncodeContent(file.content),\n          })),\n        },\n        { credentials },\n      );\n\n      return {\n        output: {\n          valid: true,\n          message: 'Template validation successful',\n          log: result.log?.map(entry => ({\n            message: entry.body.message,\n            stepId: entry.body.stepId,\n            status: entry.body.status,\n          })),\n          output: result.output,\n          steps: result.steps,\n        },\n      };\n    },\n  });\n};\n"],"names":["templateDryRunPermission","yaml"],"mappings":";;;;;;;;;AAqBA,MAAM,mBAAmB,EAAA,GAAK,IAAA;AAE9B,SAAS,oBAAoB,OAAA,EAAyB;AACpD,EAAA,IAAI,OAAA,CAAQ,SAAS,gBAAA,EAAkB;AACrC,IAAA,OAAO,OAAO,IAAA,CAAK,kBAAA,EAAoB,MAAM,CAAA,CAAE,SAAS,QAAQ,CAAA;AAAA,EAClE;AACA,EAAA,OAAO,OAAO,IAAA,CAAK,OAAA,EAAS,MAAM,CAAA,CAAE,SAAS,QAAQ,CAAA;AACvD;AAEO,MAAM,6BAA6B,CAAC;AAAA,EACzC,eAAA;AAAA,EACA;AACF,CAAA,KAGM;AACJ,EAAA,eAAA,CAAgB,QAAA,CAAS;AAAA,IACvB,IAAA,EAAM,kBAAA;AAAA,IACN,KAAA,EAAO,6BAAA;AAAA,IACP,UAAA,EAAY;AAAA,MACV,WAAA,EAAa,KAAA;AAAA,MACb,QAAA,EAAU,IAAA;AAAA,MACV,UAAA,EAAY;AAAA,KACd;AAAA,IACA,WAAA,EACE,+IAAA;AAAA,IACF,oBAAA,EAAsBA,8BAAA;AAAA,IACtB,MAAA,EAAQ;AAAA,MACN,KAAA,EAAO,CAAA,CAAA,KACL,CAAA,CAAE,MAAA,CAAO;AAAA,QACP,YAAA,EAAc,CAAA,CACX,MAAA,EAAO,CACP,QAAA;AAAA,UACC;AAAA,SACF;AAAA,QACF,MAAA,EAAQ,CAAA,CACL,MAAA,CAAO,CAAA,CAAE,OAAA,EAAS,CAAA,CAClB,QAAA,EAAS,CACT,QAAA,CAAS,sCAAsC,CAAA;AAAA,QAClD,OAAO,CAAA,CACJ,KAAA;AAAA,UACC,EAAE,MAAA,CAAO;AAAA,YACP,IAAA,EAAM,CAAA,CACH,MAAA,EAAO,CACP,SAAS,qCAAqC,CAAA;AAAA,YACjD,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAAA,WAC5C;AAAA,SACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,yCAAyC;AAAA,OACtD,CAAA;AAAA,MACH,MAAA,EAAQ,CAAA,CAAA,KACN,CAAA,CAAE,MAAA,CAAO;AAAA,QACP,KAAA,EAAO,CAAA,CAAE,OAAA,EAAQ,CAAE,SAAS,+BAA+B,CAAA;AAAA,QAC3D,OAAA,EAAS,CAAA,CACN,MAAA,EAAO,CACP,SAAS,6CAA6C,CAAA;AAAA,QACzD,MAAA,EAAQ,CAAA,CACL,KAAA,CAAM,CAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA,EAAS,CACT,QAAA,CAAS,2BAA2B,CAAA;AAAA,QACvC,KAAK,CAAA,CACF,KAAA;AAAA,UACC,EAAE,MAAA,CAAO;AAAA,YACP,OAAA,EAAS,EAAE,MAAA,EAAO;AAAA,YAClB,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,YAC5B,MAAA,EAAQ,CAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,WAC7B;AAAA,SACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,4BAA4B,CAAA;AAAA,QACxC,MAAA,EAAQ,CAAA,CACL,MAAA,CAAO,CAAA,CAAE,OAAA,EAAS,CAAA,CAClB,QAAA,EAAS,CACT,QAAA,CAAS,wBAAwB,CAAA;AAAA,QACpC,OAAO,CAAA,CACJ,KAAA;AAAA,UACC,EAAE,MAAA,CAAO;AAAA,YACP,EAAA,EAAI,EAAE,MAAA,EAAO;AAAA,YACb,IAAA,EAAM,EAAE,MAAA,EAAO;AAAA,YACf,MAAA,EAAQ,EAAE,MAAA;AAAO,WAClB;AAAA,SACH,CACC,QAAA,EAAS,CACT,QAAA,CAAS,uBAAuB;AAAA,OACpC;AAAA,KACL;AAAA,IACA,MAAA,EAAQ,OAAO,EAAE,KAAA,EAAO,aAAY,KAAM;AACxC,MAAA,MAAM,EAAE,cAAc,MAAA,GAAS,IAAI,KAAA,GAAQ,IAAG,GAAI,KAAA;AAElD,MAAA,IAAI,QAAA;AACJ,MAAA,IAAI;AACF,QAAA,QAAA,GAAWC,qBAAA,CAAK,MAAM,YAAY,CAAA;AAAA,MACpC,SAAS,UAAA,EAAY;AACnB,QAAA,MAAM,SAAA,GAAY,UAAA;AAClB,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ;AAAA,YACN,KAAA,EAAO,KAAA;AAAA,YACP,OAAA,EAAS,+BAAA;AAAA,YACT,MAAA,EAAQ;AAAA,cACN,CAAA,oBAAA,EAAuB,UAAU,OAAO,CAAA,CAAA;AAAA,cACxC,SAAA,CAAU,OAAA,GACN,CAAA,QAAA,EAAW,SAAA,CAAU,QAAQ,CAAC,CAAA,CAAE,IAAI,CAAA,SAAA,EAAY,SAAA,CAAU,OAAA,CAAQ,CAAC,CAAA,CAAE,GAAG,CAAA,CAAA,GACxE;AAAA,aACN,CAAE,OAAO,OAAO;AAAA;AAClB,SACF;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAS,MAAM,iBAAA,CAAkB,MAAA;AAAA,QACrC;AAAA,UACE,QAAA;AAAA,UACA,MAAA;AAAA,UACA,iBAAA,EAAmB,KAAA,CAAM,GAAA,CAAI,CAAA,IAAA,MAAS;AAAA,YACpC,MAAM,IAAA,CAAK,IAAA;AAAA,YACX,aAAA,EAAe,mBAAA,CAAoB,IAAA,CAAK,OAAO;AAAA,WACjD,CAAE;AAAA,SACJ;AAAA,QACA,EAAE,WAAA;AAAY,OAChB;AAEA,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ;AAAA,UACN,KAAA,EAAO,IAAA;AAAA,UACP,OAAA,EAAS,gCAAA;AAAA,UACT,GAAA,EAAK,MAAA,CAAO,GAAA,EAAK,GAAA,CAAI,CAAA,KAAA,MAAU;AAAA,YAC7B,OAAA,EAAS,MAAM,IAAA,CAAK,OAAA;AAAA,YACpB,MAAA,EAAQ,MAAM,IAAA,CAAK,MAAA;AAAA,YACnB,MAAA,EAAQ,MAAM,IAAA,CAAK;AAAA,WACrB,CAAE,CAAA;AAAA,UACF,QAAQ,MAAA,CAAO,MAAA;AAAA,UACf,OAAO,MAAA,CAAO;AAAA;AAChB,OACF;AAAA,IACF;AAAA,GACD,CAAA;AACH;;;;"}

package/dist/scaffolder/tasks/DatabaseTaskStore.cjs.js

@@ -6,7 +6,6 @@ var node_crypto = require('node:crypto');
 var luxon = require('luxon');
 var taskRecoveryHelper = require('./taskRecoveryHelper.cjs.js');
 var dbUtil = require('./dbUtil.cjs.js');
-var alpha = require('@backstage/plugin-scaffolder-node/alpha');
 var helpers = require('../../service/helpers.cjs.js');
 var pluginPermissionNode = require('@backstage/plugin-permission-node');
 var lodash = require('lodash');
@@ -33,11 +32,16 @@ const parseSqlDateToIsoString = (input) => {
 class DatabaseTaskStore {
   db;
   events;
+  recoverTasksEnabled;
   static async create(options) {
     const { database } = options;
     const client = await this.getClient(database);
     await this.runMigrations(database, client);
-    return new DatabaseTaskStore(client, options.events);
+    return new DatabaseTaskStore(
+      client,
+      options.events,
+      options.recoverTasksEnabled ?? false
+    );
   }
   isRecoverableTask(spec) {
     return ["startOver"].includes(
@@ -79,9 +83,10 @@ class DatabaseTaskStore {
       });
     }
   }
-  constructor(client, events) {
+  constructor(client, events, recoverTasksEnabled) {
     this.db = client;
     this.events = events;
+    this.recoverTasksEnabled = recoverTasksEnabled;
   }
   getState(task) {
     try {
@@ -163,7 +168,14 @@ class DatabaseTaskStore {
       queryBuilder.offset(pagination.offset);
     }
     const [results, [{ count }]] = await Promise.all([
-      queryBuilder.select(),
+      queryBuilder.select([
+        "id",
+        "spec",
+        "status",
+        "created_by",
+        "last_heartbeat_at",
+        "created_at"
+      ]),
       countQuery
     ]);
     const tasks = results.map((result) => ({
@@ -183,7 +195,16 @@ class DatabaseTaskStore {
     return { tasks, totalTasks };
   }
   async getTask(taskId) {
-    const [result] = await this.db("tasks").where({ id: taskId }).select();
+    const [result] = await this.db("tasks").where({ id: taskId }).select([
+      "id",
+      "spec",
+      "status",
+      "state",
+      "last_heartbeat_at",
+      "created_at",
+      "created_by",
+      "secrets"
+    ]);
     if (!result) {
       throw new errors.NotFoundError(`No task with id '${taskId}' found`);
     }
@@ -232,7 +253,16 @@ class DatabaseTaskStore {
     return this.db.transaction(async (tx) => {
       const [task] = await tx("tasks").where({
         status: "open"
-      }).limit(1).select();
+      }).limit(1).select([
+        "id",
+        "spec",
+        "status",
+        "state",
+        "last_heartbeat_at",
+        "created_at",
+        "created_by",
+        "secrets"
+      ]);
       if (!task) {
         return void 0;
       }
@@ -240,8 +270,11 @@ class DatabaseTaskStore {
       const updateCount = await tx("tasks").where({ id: task.id, status: "open" }).update({
         status: "processing",
         last_heartbeat_at: this.db.fn.now(),
-        // remove the secrets for non-recoverable tasks when moving to processing state.
-        secrets: this.isRecoverableTask(spec) ? task.secrets : null
+        // Retain secrets only when recovery is enabled (globally or via the
+        // legacy per-template strategy) so recovered tasks can resume.
+        // Otherwise clear them on claim to preserve the default security
+        // lifecycle.
+        secrets: this.recoverTasksEnabled || this.isRecoverableTask(spec) ? task.secrets : null
       });
       if (updateCount < 1) {
         return void 0;
@@ -274,7 +307,7 @@ class DatabaseTaskStore {
   async listStaleTasks(options) {
     const { timeoutS } = options;
     const heartbeatInterval = dbUtil.intervalFromNowTill(timeoutS, this.db);
-    const rawRows = await this.db("tasks").where("status", "processing").andWhere("last_heartbeat_at", "<=", heartbeatInterval);
+    const rawRows = await this.db("tasks").where("status", "processing").andWhere("last_heartbeat_at", "<=", heartbeatInterval).select(["id", "spec"]);
     const tasks = rawRows.map((row) => ({
       recovery: JSON.parse(row.spec).EXPERIMENTAL_recovery,
       taskId: row.id
@@ -294,7 +327,14 @@ class DatabaseTaskStore {
     await this.db.transaction(async (tx) => {
       const [task] = await tx("tasks").where({
         id: taskId
-      }).limit(1).select();
+      }).limit(1).select([
+        "id",
+        "status",
+        "state",
+        "last_heartbeat_at",
+        "created_at",
+        "created_by"
+      ]);
       const updateTask = async (criteria) => {
         const updateCount = await tx("tasks").where(criteria).update({
           status,
@@ -367,7 +407,7 @@ class DatabaseTaskStore {
     }
   }
   async listEvents(options) {
-    const { isTaskRecoverable, taskId, after } = options;
+    const { taskId, after, isTaskRecoverable } = options;
     const rawEvents = await this.db("task_events").where({
       task_id: taskId
     }).andWhere((builder) => {
@@ -422,34 +462,18 @@ class DatabaseTaskStore {
       }
     });
   }
-  async rehydrateWorkspace(options) {
-    const [result] = await this.db("tasks").where({ id: options.taskId }).select("workspace");
-    await alpha.restoreWorkspace({
-      path: options.targetPath,
-      buffer: result.workspace
-    });
-  }
-  async cleanWorkspace({ taskId }) {
-    await this.db("tasks").where({ id: taskId }).update({
-      workspace: null
-    });
-  }
-  async serializeWorkspace(options) {
-    if (options.path) {
-      const workspace = (await alpha.serializeWorkspace(options)).contents;
-      await this.db("tasks").where({ id: options.taskId }).update({
-        workspace
-      });
-    }
-  }
   async cancelTask(options) {
     const { taskId, body } = options;
     const serializedBody = JSON.stringify(body);
-    const [ret] = await this.db("task_events").insert({
-      task_id: taskId,
-      event_type: "cancelled",
-      body: serializedBody
-    }).returning("id");
+    const ret = await this.db.transaction(async (tx) => {
+      await tx("tasks").where({ id: taskId }).update({ secrets: null });
+      const [event] = await tx("task_events").insert({
+        task_id: taskId,
+        event_type: "cancelled",
+        body: serializedBody
+      }).returning("id");
+      return event;
+    });
     this.events?.publish({
       topic: "scaffolder.task",
       eventPayload: {