fix(#3750): add signIn resolvers to bulk-import GitHub auth config

[fullsend-ai-coder]

The bulk-import workspace sets auth.environment: development and defines github.development credentials, but omits signIn.resolvers. The base e2e-test-utils config provides resolvers under github.production, but since auth.environment is development those resolvers are never used. This causes Login failed: GitHub provider not configured for sign-in errors.

Add signIn.resolvers with usernameMatchingUserEntityName to both app-config-rhdh.yaml and app-config-rhdh-orchestrator-mode.yaml.

---

Closes #3750

Post-script verification

• Branch is not main/master (agent/3750-bulk-import-github-signin-resolvers)
• Secret scan passed (gitleaks — 899b60c9a39cb8e4d1b78fc23d2e2f0505a97fb3..HEAD)
• Pre-commit hooks passed (authoritative run on runner)
• Tests ran inside sandbox

[openshift-ci]

Hi @fullsend-ai-coder[bot]. Thanks for your PR.

I'm waiting for a redhat-developer member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:13 AM UTC · Completed 6:19 AM UTC

Commit: 7b2ff9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $0.89

[fullsend-ai-review]

Review — approve

Summary

This PR adds missing signIn.resolvers configuration to the bulk-import workspace's E2E test config files. The workspace sets auth.environment: development and defines github.development credentials, but omitted the signIn section. The base e2e-test-utils config provides resolvers under github.production, which are ignored when the environment is explicitly development — causing "GitHub provider not configured for sign-in" errors in CI.

Changes reviewed

File	Change
workspaces/bulk-import/e2e-tests/tests/config/app-config-rhdh.yaml	Add signIn.resolvers with usernameMatchingUserEntityName under github.development
workspaces/bulk-import/e2e-tests/tests/config/app-config-rhdh-orchestrator-mode.yaml	Same addition for orchestrator mode config

Analysis

Correctness ✅ — The fix correctly places the signIn block under auth.providers.github.development, at the same YAML nesting level as clientSecret, clientId, and callbackUrl. The usernameMatchingUserEntityName resolver matches what the e2e-test-utils base config provides for github.production, maintaining consistency. Both affected config files receive the fix — the regular mode config (used by bulk-import and bulk-import-app-next projects) and the orchestrator mode config (used by bulk-import-orchestrator).

Security ✅ — No credentials or secrets introduced. The change only adds authentication resolver configuration to E2E test configs.

Scope ✅ — Well-scoped to exactly the two files that need the fix. The analytics workspace also uses auth.environment: development but only uses guest auth, so no change is needed there. Other workspaces with GitHub auth (quickstart, topology) use different auth providers or already have resolvers configured.

Resolver choice ✅ — usernameMatchingUserEntityName is appropriate for GitHub OAuth. Other workspaces (quickstart, topology) use emailLocalPartMatchingUserEntityName for OIDC auth, which is a different resolver for a different provider — not inconsistent.

No blocking findings. The change is minimal, well-targeted, and directly addresses the root cause identified in #3750.

[subhashkhileri]

/test e2e-ocp-helm-nightly-pr-scoped

[rhdh-test-bot]

❌ Failed E2E Tests (-w bulk-import)

Platform: ocp 4.20 | RHDH Version: 1.11 | Duration: 9m 39s
Passed: 13 | Failed: 2 | Flaky: 0 | Skipped: 7
Playwright Report | Build Log | Logs | Artifacts

[openshift-ci]

@fullsend-ai-coder[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-ocp-helm-nightly-pr-scoped	7b2ff9f	link	false	/test e2e-ocp-helm-nightly-pr-scoped

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[fullsend-ai-review]

🤖 Finished Ci Diagnose · ✅ Success · Started 8:10 AM UTC · Completed 8:20 AM UTC

Commit: 7b2ff9f · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $2.51

[fullsend-ai-review]

🔍 CI Diagnosis — 1 of 1 curated checks failing · 7b2ff9f

Verdict: Not this PR's fault — both test failures are pre-existing issues documented in #3694, already being fixed in #3717. This PR's auth config change is working correctly (13 tests now pass that previously failed at login).

❌ ci/prow/e2e-ocp-helm-nightly-pr-scoped — pre_existing

Root cause: Two pre-existing bulk-import test failures, now visible because this PR's auth fix allows tests to proceed past login:

1. bulk-import-app-next — openSidebar timeout (line 237): uiHelper.openSidebar("Catalog") is blocked by the NFS global header overlay in the app-next project. The overlay intercepts click events, preventing the sidebar item from being reached. Because this test is in a test.describe.serial block, the subsequent test at line 247 is cascade-skipped.

2. bulk-import-orchestrator — backend TypeError (line 93): The released bulk-import-backend plugin has a bug — TypeError: Cannot read properties of undefined (reading 'statusCode') at router.cjs.js:616 — that occurs during orchestrator workflow response processing in nightly mode.

Evidence: 13/22 tests pass, 2 fail, 7 skipped. Both failures are documented in issue #3694. The PR's changes (adding signIn.resolvers with usernameMatchingUserEntityName) fixed the GitHub auth failures that previously blocked all tests from proceeding past login.

Open PR: #3717 — fix(#3694): bulk-import E2E NFS sidebar nav and orchestrator skip

logs

---

_{Automated CI diagnosis · updates as checks complete · not a substitute for review. For bot-authored PRs, pr_regression failures are handed to the fix agent automatically (up to 2 attempts). pre_existing failures are linked to an open PR when one already exists. A maintainer can take over any time with /fs-fix <instruction>, or stop auto-fix with /fs-fix-stop — see the fix agent docs.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[github-actions]

Successfully updated file versions.jsonfrom branch main into this PR in commit f6107a6

[github-actions]

Publish workflow has completed with failure.

Publishing process

❌ Plugins with errors during export or container image publishing:

• plugins/bulk-import
• plugins/bulk-import-backend

Backstage-incompatible workspaces

Some workspaces have a backstage version (in sources or in their overlay folder) which is incompatible with the target Backstage version (1.54.6).
1 incompatible workspaces, 0 of which are mandatory:

Folder	Backstage version	Mandatory	Info
workspaces/bulk-import	1.52.0	⚪	BS Version History

How to fix

You have 3 main options:

• Use the already-opened PR : For automatically-discovered workspaces, there might already be an automatically-opened PR that updates the commit to the target backstage version (Automatic PR link in column 4 above): just publish the plugins and test them from the PR by following the PR instructions.
• Manually update the workspace commit :
  • Find a newer commit, with a backstage version compatible with the target backstage version :__*
    • Backstage version history available: A BS Version History link might be available in column 4: in the workspace source repository, it points to the list of commits touching the backstage.json file. This would help you finding out whether this workspace has a commit that has been published for the target backstage version.
    • No info available: If no information is is provided in column 4, the backstage.json probably does not exist in workspace sources. You would have to look deeper into the newer commits of workspace sources, possibly in the low-level dependencies in the package.json files, to find out a commit with an underlying backstage version compatible with the target backstage version.
  • Then, in the overlay repository, update the repo-ref field of the source.json file to the new source commit, and remember to also change the repo-backstage-version field to the corresponding compatible backstage version.
• No compatible commit : If the workspace sources contain no compatible newer commit ( == a commit that provides a backstage.json version compatible with the target backstage), but the current workspace commit is known to work with the target backstage version, then you can override the declared backstage version compatibility for this workspace commit in the overlay repository using the /override-backstage command which will add a backstage.json file at the root of the overlay workspace folder with the desired target backstage version. This would require full testing of the workspace plugins on the target backstage though.

Metadata Validation

✅ All metadata files validated successfully.

[christoph-jerolimov]

/ok-to-test