backstage-plugin-lightwell-backend 0.0.6 → 0.0.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +95 -15
  2. package/package.json +3 -4
package/README.md CHANGED
@@ -1,22 +1,102 @@
1
- # backstage-plugin-lightwell-backend
1
+ # Backstage Plugin for Red Hat Lightwell
2
2
 
3
- > Official Backstage & Red Hat Developer Hub (RHDH) backend plugin for Red Hat Lightwell vulnerability remediation.
3
+ [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
4
+ [![npm version](https://img.shields.io/npm/v/backstage-plugin-lightwell.svg?color=blue&label=npm%20frontend)](https://www.npmjs.com/package/backstage-plugin-lightwell)
5
+ [![npm version](https://img.shields.io/npm/v/backstage-plugin-lightwell-backend.svg?color=blue&label=npm%20backend)](https://www.npmjs.com/package/backstage-plugin-lightwell-backend)
6
+ [![Ecosystem](https://img.shields.io/badge/Ecosystem-Red_Hat_Developer_Hub_(RHDH)-red.svg)](https://developers.redhat.com/products/developer-hub/overview)
7
+ [![Status](https://img.shields.io/badge/Status-Under_Active_Development-orange.svg)]()
4
8
 
5
- Initiated, architected, and maintained by **Maxime Gaillard** (<maxime.gaillard@devoteam.com>).
9
+ > The official Backstage & Red Hat Developer Hub (RHDH) dynamic plugin for enterprise open-source vulnerability remediation powered by **Red Hat Lightwell**.
6
10
 
7
- ## Overview
8
- Backend service responsible for analyzing project dependencies (POM, requirements, SBOM CycloneDX/SPDX) and checking against the Red Hat Lightwell remediation catalog.
11
+ Initiated, architected, and maintained by **Maxime Gaillard** (<maxime.gaillard@devoteam.com>) — [STARTX | Part of Devoteam](https://startx.fr).
9
12
 
10
- ## Features
11
- - Inspects repository dependency trees from Git integrations.
12
- - Queries Red Hat Lightwell Network APIs for signed, remediated package availability.
13
- - Matches CVEs with zero-breaking-change enterprise patches.
13
+ ---
14
14
 
15
- ## Author & Lead Architect
16
- - **Maxime Gaillard** — Managing Director & Lead Architect
15
+ > 🚧 **Notice: Upcoming Code Delivery**
16
+ > This plugin is currently under active engineering by STARTX | Part of Devoteam.
17
+ > The core implementation, UI components, and Lightwell Network API integrations will be delivered and released shortly in the upcoming `v0.1.0` milestone.
18
+
19
+ ---
20
+
21
+ ## 🎯 Overview
22
+
23
+ Enterprise application security tools (SCA, SAST) detect open-source vulnerabilities at rapid scale, but engineering teams are frequently unable to remediate them. The standard recommendation—bumping to a major new version—introduces breaking API changes, extensive regression testing, and lengthy PSSI recertification delays. This operational bottleneck is defined by Red Hat and IBM as the **"Vulnerability Remediation Gap"**.
24
+
25
+ **Red Hat Lightwell** provides an authoritative third path: version-specific, cryptographically signed backported patches for enterprise dependencies (Java, Python) with zero breaking changes and full SBOM provenance.
26
+
27
+ This plugin bridges **Spotify Backstage / Red Hat Developer Hub** and the **Red Hat Lightwell Network**, giving developers in-context security intelligence and one-click backported remediation directly within their internal developer portal.
28
+
29
+ ---
30
+
31
+ ## 🏛️ Architecture
32
+
33
+ ```text
34
+ [ Developer on Backstage / RHDH ]
35
+ │
36
+ ┌───────────────┴───────────────┐
37
+ ▼ ▼
38
+ [ Frontend Plugin UI ] [ Software Catalog ]
39
+ • Supply Chain Badge (Service / Repo Entity)
40
+ • "Lightwell Security" Tab │
41
+ • CVEs + One-Click Remediation │
42
+ │ │
43
+ └───────────────┬───────────────┘
44
+ │
45
+ ▼
46
+ [ Backend Plugin (Node.js/TS) ]
47
+ │
48
+ ┌───────────────┴───────────────┐
49
+ ▼ ▼
50
+ [ Dependency Extraction ] [ Lightwell API Client ]
51
+ • Git Manifests (pom, req) • REST Lightwell Network API
52
+ • CI SBOMs (CycloneDX) • Vulnerability ↔ Fix Matching
53
+ │
54
+ ▼
55
+ [ Secured Lightwell Repository ]
56
+ (Signed Red Hat Java / PyPI Packages)
57
+ ```
58
+
59
+ ---
60
+
61
+ ## 📦 Packages in this Repository
62
+
63
+ | Package | npm | Description |
64
+ | :--- | :--- | :--- |
65
+ | **`backstage-plugin-lightwell`** | [![npm](https://img.shields.io/npm/v/backstage-plugin-lightwell.svg)](https://www.npmjs.com/package/backstage-plugin-lightwell) | Frontend UI plugin (Entity tab, cards, and remediation workflows) |
66
+ | **`backstage-plugin-lightwell-backend`** | [![npm](https://img.shields.io/npm/v/backstage-plugin-lightwell-backend.svg)](https://www.npmjs.com/package/backstage-plugin-lightwell-backend) | Backend plugin (Git manifests, SBOM ingestion, and Lightwell API client) |
67
+
68
+ ---
69
+
70
+ ## 🚀 Red Hat Developer Hub (Dynamic Plugin)
71
+
72
+ This plugin conforms to the **RHDH Dynamic Plugin specification**, enabling zero-compilation runtime installation on Red Hat OpenShift:
73
+
74
+ ```yaml
75
+ # dynamic-plugins.yaml
76
+ plugins:
77
+ - package: 'backstage-plugin-lightwell'
78
+ disabled: false
79
+ - package: 'backstage-plugin-lightwell-backend'
80
+ disabled: false
81
+ pluginConfig:
82
+ lightwell:
83
+ baseUrl: https://api.lightwell.redhat.com
84
+ token: ***}
85
+ ```
86
+
87
+ ---
88
+
89
+ ## 👤 Author & Lead Architect
90
+
91
+ - **Maxime Gaillard** — Managing Director & Lead Cloud Architect
92
+ - **Organization:** STARTX | Part of Devoteam
17
93
  - **Email:** <maxime.gaillard@devoteam.com>
18
- - **Website:** <https://lightwell.startx.fr>
19
- - **Organization:** STARTX | Part of Devoteam (<https://devoteam.com>)
94
+ - **Enterprise Portal:** <https://devoteam.com>
95
+ - **Official Gateway:** <https://lightwell.startx.fr>
96
+
97
+ ---
98
+
99
+ ## 📜 License
20
100
 
21
- ## License
22
- Apache-2.0 © 2026 Maxime Gaillard — STARTX | Part of Devoteam
101
+ Licensed under the Apache License, Version 2.0. See [LICENSE](LICENSE) for details.
102
+ Copyright © 2026 Maxime Gaillard — STARTX | Part of Devoteam
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "backstage-plugin-lightwell-backend",
3
- "version": "0.0.6",
3
+ "version": "0.0.8",
4
4
  "description": "Backstage backend plugin for Red Hat Lightwell open source vulnerability remediation",
5
5
  "main": "dist/index.cjs.js",
6
6
  "types": "dist/index.d.ts",
@@ -9,7 +9,7 @@
9
9
  "homepage": "https://lightwell.startx.fr",
10
10
  "repository": {
11
11
  "type": "git",
12
- "url": "git+https://github.com/startxfr/backstage-plugin-lightwell.git"
12
+ "url": "git+https://github.com/maximegaillard-devoteam/backstage-plugin-lightwell.git"
13
13
  },
14
14
  "keywords": [
15
15
  "backstage",
@@ -21,7 +21,6 @@
21
21
  "janus-idp",
22
22
  "security",
23
23
  "cve",
24
- "remediation",
25
- "software-supply-chain"
24
+ "remediation"
26
25
  ]
27
26
  }