fix(app-defaults): pin electron-to-chromium for hermetic Konflux

[nickboldt]

Summary

• Pin electron-to-chromium to 1.5.349 via workspace resolutions so Hermeto/Konflux cannot float to freshly published versions (e.g. 1.5.402) that 404 on the cluster npm proxy.
• Refresh workspaces/app-defaults/yarn.lock to an exact descriptor (electron-to-chromium@npm:1.5.349).

Context

Downstream Konflux builds fail with:

YN0035: electron-to-chromium@npm:1.5.402: Package not found (404)

Public npm has the tarball; the artifact-registry proxy does not yet. browserslist depends on ^1.5.328, which floats daily.

Follow-ups (after merge)

1. Overlays: bump workspaces/app-defaults/source.json repo-ref to this merge SHA.
2. Catalog midstream: sync overlay-repo/ + workspaces/ so Hermeto picks up the pin.

Test plan

• CI green on this PR
• After overlays + catalog sync: Hermeto prefetch for app-defaults no longer 404s on electron-to-chromium

Generated-by: cursor

Ref: https://redhat.atlassian.net/browse/RHIDP-16097

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rhdh-qodo-merge]

PR Summary by Qodo

Pin electron-to-chromium in app-defaults to prevent Konflux 404s

🐞 Bug fix ⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Pin transitive electron-to-chromium to a known-available version for Konflux/Hermeto builds.
• Add a Yarn workspace resolutions override to stop lockfile floating.
• Refresh yarn.lock to use the exact pinned descriptor.

Diagram

graph TD
  build["Konflux/Hermeto build"] --> pkg["app-defaults package.json (resolutions)"] --> lock["app-defaults yarn.lock (pinned)"] --> proxy{{"Cluster npm proxy"}} --> npm{{"Public npm"}}

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Fix/seed the cluster npm proxy sync

• ➕ Eliminates the root cause for all projects (not just app-defaults)
• ➕ Avoids repo-level pins that may require periodic maintenance
• ➖ Requires infra changes and coordination outside this repo
• ➖ Doesn't guarantee immediate availability during future publish/proxy lag windows

2. Pin the upstream dependency instead (e.g., browserslist)

• ➕ May reduce the need for explicit transitive overrides
• ➕ Keeps dependency graph closer to upstream intent
• ➖ Still indirectly couples builds to proxy availability
• ➖ Less targeted; may introduce broader behavior changes than pinning the single problematic package

Recommendation: Prefer this PR’s resolutions pin + lockfile refresh as the most targeted, repo-controlled way to make Konflux/Hermeto installs hermetic against proxy lag. Infrastructure sync improvements can follow as a broader, longer-term fix.

Files changed (2) +3 / -2

Bug fix (1) +2 / -1

package.jsonAdd Yarn resolution pin for electron-to-chromium +2/-1

Add Yarn resolution pin for electron-to-chromium

• Adds a workspace 'resolutions' entry to force 'electron-to-chromium' to '1.5.349'. This prevents transitive version drift that can break hermetic installs when the cluster npm proxy lags public npm.

workspaces/app-defaults/package.json

Other (1) +1 / -1

yarn.lockRefresh lockfile to exact electron-to-chromium descriptor +1/-1

Refresh lockfile to exact electron-to-chromium descriptor

• Updates the lockfile key from a caret range descriptor to the exact 'electron-to-chromium@npm:1.5.349' entry. Ensures the lockfile cannot float to newly published versions unavailable in the cluster proxy.

workspaces/app-defaults/yarn.lock

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.33%. Comparing base (e632466) to head (1e109ee).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4203   +/-   ##
=======================================
  Coverage   58.33%   58.33%           
=======================================
  Files        2432     2432           
  Lines       96775    96775           
  Branches    26912    26914    +2     
=======================================
  Hits        56455    56455           
  Misses      40121    40121           
  Partials      199      199           

Flag	Coverage Δ		*Carryforward flag
adoption-insights	84.55% <ø> (ø)		Carriedforward from e632466
ai-integrations	69.76% <ø> (ø)		Carriedforward from e632466
app-defaults	69.79% <ø> (ø)
augment	46.67% <ø> (ø)		Carriedforward from e632466
boost	76.77% <ø> (ø)		Carriedforward from e632466
bulk-import	72.79% <ø> (ø)		Carriedforward from e632466
cost-management	13.55% <ø> (ø)		Carriedforward from e632466
dcm	67.21% <ø> (ø)		Carriedforward from e632466
extensions	56.59% <ø> (ø)		Carriedforward from e632466
global-floating-action-button	71.18% <ø> (ø)		Carriedforward from e632466
global-header	66.50% <ø> (ø)		Carriedforward from e632466
homepage	47.50% <ø> (ø)		Carriedforward from e632466
install-dynamic-plugins	59.95% <ø> (ø)		Carriedforward from e632466
intelligent-assistant	75.24% <ø> (ø)		Carriedforward from e632466
konflux	91.98% <ø> (ø)		Carriedforward from e632466
lightspeed	69.02% <ø> (ø)		Carriedforward from e632466
mcp-integrations	83.40% <ø> (ø)		Carriedforward from e632466
orchestrator	66.91% <ø> (ø)		Carriedforward from e632466
quickstart	63.74% <ø> (ø)		Carriedforward from e632466
sandbox	79.56% <ø> (ø)		Carriedforward from e632466
scorecard	86.17% <ø> (ø)		Carriedforward from e632466
theme	88.77% <ø> (ø)		Carriedforward from e632466
translations	5.12% <ø> (ø)		Carriedforward from e632466
x2a	79.20% <ø> (ø)		Carriedforward from e632466

*This pull request uses carry forward flags. Click here to find out more.

---

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update e632466...1e109ee. Read the comment docs.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[rhdh-qodo-merge]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 🔗 Cross-repo conflicts (1) 📜 Skill insights (0)

1. Pin not coordinated with RHDH 🔗 Cross-repo conflict ☼ Reliability

Description

This PR pins electron-to-chromium in rhdh-plugins/workspaces/app-defaults, but the rhdh repo
also pulls electron-to-chromium transitively via browserslist and does not appear to have an
explicit resolution/pin; if rhdh is built with the same Konflux/Hermeto behavior that re-resolves
caret ranges, it could still hit the same “freshly published tarball 404 on proxy” failure mode.
Consider a coordinated pin (version chosen to match what your cluster proxy has) or confirm the
rhdh build strictly honors yarn.lock during Hermeto prefetch/install.

Code

workspaces/app-defaults/package.json[R54-58]

  "resolutions": {
    "@types/react": "^18",
    "@types/react-dom": "^18",
-    "@backstage/plugin-catalog-react": "^3.1.0"
+    "@backstage/plugin-catalog-react": "^3.1.0",
+    "electron-to-chromium": "1.5.349"

Relevance

● Weak

Cross-repo coordination asks follow-up outside this repo; similar downstream-rhdh coordination note
was rejected.

PR-#3896

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The PR introduces an explicit resolutions pin for electron-to-chromium and updates the lockfile
to an exact descriptor. In the rhdh repo, browserslist pulls electron-to-chromium via a caret
range, and electron-to-chromium appears as a resolved package in both the main and dynamic-plugins
lockfiles—indicating rhdh shares the same transitive dependency surface that motivated this pin.

workspaces/app-defaults/package.json[54-59]
workspaces/app-defaults/yarn.lock[17896-17901]
External repo: redhat-developer/rhdh, yarn.lock [17189-17195]
External repo: redhat-developer/rhdh, yarn.lock [19851-19853]
External repo: redhat-developer/rhdh, dynamic-plugins/yarn.lock [17709-17715]
External repo: redhat-developer/rhdh, dynamic-plugins/yarn.lock [20300-20302]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`rhdh-plugins` `app-defaults` now pins `electron-to-chromium` to avoid Konflux/Hermeto fetching newly published versions that may 404 on the cluster npm proxy. The `rhdh` repo also depends on `electron-to-chromium` (via `browserslist`), so if `rhdh` uses the same Konflux/Hermeto flow that re-resolves semver ranges instead of honoring `yarn.lock`, it may still be vulnerable to the same 404.

## Issue Context
- This PR adds a Yarn `resolutions` pin and refreshes the lock entry to an exact descriptor.
- In `rhdh`, `browserslist` includes a caret-range dependency on `electron-to-chromium` in its lockfile dependency set.

## Fix Focus Areas
- workspaces/app-defaults/package.json[54-59]
- /cross_repos/rhdh/yarn.lock[17189-17195]
- /cross_repos/rhdh/yarn.lock[19851-19853]
- /cross_repos/rhdh/dynamic-plugins/yarn.lock[17709-17715]
- /cross_repos/rhdh/dynamic-plugins/yarn.lock[20300-20302]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

⚠️ Tickets: not configured — ticket URL found in PR but could not be fetched — check ticket provider credentials

✅ Compliance rules (platform): 11 rules

✅ Cross-repo context

  Explored: repo: redhat-developer/rhdh (sha: 4c5a4e85)

  Not relevant to this PR: redhat-developer/rhdh-chart

  Not relevant to this PR: redhat-developer/rhdh-operator

  Not relevant to this PR: redhat-developer/rhdh-local

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[rhdh-bot]

/lgtm
/approve