backstage-plugin-lightwell-backend 0.0.6 β†’ 0.0.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +88 -15
  2. package/package.json +3 -4
package/README.md CHANGED
@@ -1,22 +1,95 @@
1
- # backstage-plugin-lightwell-backend
1
+ # Backstage Plugin for Red Hat Lightwell
2
2
 
3
- > Official Backstage & Red Hat Developer Hub (RHDH) backend plugin for Red Hat Lightwell vulnerability remediation.
3
+ [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
4
+ [![npm version](https://img.shields.io/npm/v/backstage-plugin-lightwell.svg?color=blue&label=npm%20frontend)](https://www.npmjs.com/package/backstage-plugin-lightwell)
5
+ [![npm version](https://img.shields.io/npm/v/backstage-plugin-lightwell-backend.svg?color=blue&label=npm%20backend)](https://www.npmjs.com/package/backstage-plugin-lightwell-backend)
6
+ [![Ecosystem](https://img.shields.io/badge/Ecosystem-Red_Hat_Developer_Hub_(RHDH)-red.svg)](https://developers.redhat.com/products/developer-hub/overview)
4
7
 
5
- Initiated, architected, and maintained by **Maxime Gaillard** (<maxime.gaillard@devoteam.com>).
8
+ > The official Backstage & Red Hat Developer Hub (RHDH) dynamic plugin for enterprise open-source vulnerability remediation powered by **Red Hat Lightwell**.
6
9
 
7
- ## Overview
8
- Backend service responsible for analyzing project dependencies (POM, requirements, SBOM CycloneDX/SPDX) and checking against the Red Hat Lightwell remediation catalog.
10
+ Initiated, architected, and maintained by **Maxime Gaillard** ([STARTX | Part of Devoteam](https://startx.fr)).
9
11
 
10
- ## Features
11
- - Inspects repository dependency trees from Git integrations.
12
- - Queries Red Hat Lightwell Network APIs for signed, remediated package availability.
13
- - Matches CVEs with zero-breaking-change enterprise patches.
12
+ ---
14
13
 
15
- ## Author & Lead Architect
16
- - **Maxime Gaillard** β€” Managing Director & Lead Architect
14
+ ## 🎯 Overview
15
+
16
+ Enterprise application security tools (SCA, SAST) detect open-source vulnerabilities at rapid scale, but engineering teams are frequently unable to remediate them. The standard recommendationβ€”bumping to a major new versionβ€”introduces breaking API changes, extensive regression testing, and lengthy PSSI recertification delays. This operational bottleneck is defined by Red Hat and IBM as the **"Vulnerability Remediation Gap"**.
17
+
18
+ **Red Hat Lightwell** provides an authoritative third path: version-specific, cryptographically signed backported patches for enterprise dependencies (Java, Python) with zero breaking changes and full SBOM provenance.
19
+
20
+ This plugin bridges **Spotify Backstage / Red Hat Developer Hub** and the **Red Hat Lightwell Network**, giving developers in-context security intelligence and one-click backported remediation directly within their internal developer portal.
21
+
22
+ ---
23
+
24
+ ## πŸ›οΈ Architecture
25
+
26
+ ```text
27
+ [ Developer on Backstage / RHDH ]
28
+ β”‚
29
+ β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
30
+ β–Ό β–Ό
31
+ [ Frontend Plugin UI ] [ Software Catalog ]
32
+ β€’ Supply Chain Badge (Service / Repo Entity)
33
+ β€’ "Lightwell Security" Tab β”‚
34
+ β€’ CVEs + One-Click Remediation β”‚
35
+ β”‚ β”‚
36
+ β””β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”¬β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”˜
37
+ β”‚
38
+ β–Ό
39
+ [ Backend Plugin (Node.js/TS) ]
40
+ β”‚
41
+ β”Œβ”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”΄β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”€β”
42
+ β–Ό β–Ό
43
+ [ Dependency Extraction ] [ Lightwell API Client ]
44
+ β€’ Git Manifests (pom, req) β€’ REST Lightwell Network API
45
+ β€’ CI SBOMs (CycloneDX) β€’ Vulnerability ↔ Fix Matching
46
+ β”‚
47
+ β–Ό
48
+ [ Secured Lightwell Repository ]
49
+ (Signed Red Hat Java / PyPI Packages)
50
+ ```
51
+
52
+ ---
53
+
54
+ ## πŸ“¦ Packages in this Repository
55
+
56
+ | Package | npm | Description |
57
+ | :--- | :--- | :--- |
58
+ | **`backstage-plugin-lightwell`** | [![npm](https://img.shields.io/npm/v/backstage-plugin-lightwell.svg)](https://www.npmjs.com/package/backstage-plugin-lightwell) | Frontend UI plugin (Entity tab, cards, and remediation workflows) |
59
+ | **`backstage-plugin-lightwell-backend`** | [![npm](https://img.shields.io/npm/v/backstage-plugin-lightwell-backend.svg)](https://www.npmjs.com/package/backstage-plugin-lightwell-backend) | Backend plugin (Git manifests, SBOM ingestion, and Lightwell API client) |
60
+
61
+ ---
62
+
63
+ ## πŸš€ Red Hat Developer Hub (Dynamic Plugin)
64
+
65
+ This plugin conforms to the **RHDH Dynamic Plugin specification**, enabling zero-compilation runtime installation on Red Hat OpenShift:
66
+
67
+ ```yaml
68
+ # dynamic-plugins.yaml
69
+ plugins:
70
+ - package: 'backstage-plugin-lightwell'
71
+ disabled: false
72
+ - package: 'backstage-plugin-lightwell-backend'
73
+ disabled: false
74
+ pluginConfig:
75
+ lightwell:
76
+ baseUrl: https://api.lightwell.redhat.com
77
+ token: ${LIGHTWELL_API_TOKEN}
78
+ ```
79
+
80
+ ---
81
+
82
+ ## πŸ‘€ Author & Lead Architect
83
+
84
+ - **Maxime Gaillard** β€” Managing Director & Lead Cloud Architect
85
+ - **Organization:** STARTX | Part of Devoteam
17
86
  - **Email:** <maxime.gaillard@devoteam.com>
18
- - **Website:** <https://lightwell.startx.fr>
19
- - **Organization:** STARTX | Part of Devoteam (<https://devoteam.com>)
87
+ - **Enterprise Portal:** <https://devoteam.com>
88
+ - **Official Gateway:** <https://lightwell.startx.fr>
89
+
90
+ ---
91
+
92
+ ## πŸ“œ License
20
93
 
21
- ## License
22
- Apache-2.0 Β© 2026 Maxime Gaillard β€” STARTX | Part of Devoteam
94
+ Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for details.
95
+ Copyright Β© 2026 Maxime Gaillard β€” STARTX | Part of Devoteam
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "backstage-plugin-lightwell-backend",
3
- "version": "0.0.6",
3
+ "version": "0.0.7",
4
4
  "description": "Backstage backend plugin for Red Hat Lightwell open source vulnerability remediation",
5
5
  "main": "dist/index.cjs.js",
6
6
  "types": "dist/index.d.ts",
@@ -9,7 +9,7 @@
9
9
  "homepage": "https://lightwell.startx.fr",
10
10
  "repository": {
11
11
  "type": "git",
12
- "url": "git+https://github.com/startxfr/backstage-plugin-lightwell.git"
12
+ "url": "git+https://github.com/maximegaillard-devoteam/backstage-plugin-lightwell.git"
13
13
  },
14
14
  "keywords": [
15
15
  "backstage",
@@ -21,7 +21,6 @@
21
21
  "janus-idp",
22
22
  "security",
23
23
  "cve",
24
- "remediation",
25
- "software-supply-chain"
24
+ "remediation"
26
25
  ]
27
26
  }