fix(boost): add caData, skipTLSVerify to OgxEntityProviderConfig

[gabemontero]

Summary

Add per-provider TLS connection settings to the Boost OGX catalog entity provider so OgxModelEntityProvider can fetch /v1/models from OGX endpoints that use a private CA or, for development only, a certificate that must not be verified.

Add these optional fields to OgxEntityProviderConfig:

/** PEM-encoded CA certificate or certificate bundle used to verify OGX. */
caData?: string;

/** Disable TLS certificate verification. Development use only. */
skipTLSVerify?: boolean;

The existing behavior must remain unchanged when neither field is configured.

Scope

1. Extend and read the OGX entity-provider configuration

Update:

• workspaces/boost/plugins/ogx-entity-provider/src/types.ts
• workspaces/boost/plugins/ogx-entity-provider/src/module.ts

Read caData and skipTLSVerify from both supported config locations:

• boost.entityProviders.ogx (standalone catalog module)
• boost.providers.ogx (composed Boost provider configuration)

Use Backstage Config accessors (getOptionalString and getOptionalBoolean) and pass the values through OgxEntityProviderConfig.

2. Apply TLS settings to the model discovery request

Update:

• workspaces/boost/plugins/ogx-entity-provider/src/providers/OgxModelEntityProvider.ts

Configure the HTTPS connection used by fetchModels() before requesting ${baseUrl}/v1/models:

• caData is PEM text and must be supplied as the request's custom CA bundle.
• skipTLSVerify: true must set rejectUnauthorized: false and log a warning through the provider's child logger. Do not log caData or other secrets.
• When skipTLSVerify is false or unset, certificate verification remains enabled.
• If both fields are set, skipTLSVerify: true takes precedence; the request is made with certificate verification disabled.
• Preserve the existing Accept and optional bearer-token headers, response parsing, errors, and entity emission behavior.
• Plain HTTP endpoints and configurations without either TLS option continue to use the existing fetch behavior.

Use request configuration that is actually supported by Node's Fetch/Undici implementation. A Node https.Agent passed as a non-standard fetch agent property is not sufficient for the built-in Node fetch. If Undici types/runtime are imported directly, declare undici as a direct dependency of ogx-entity-provider.

Do not create a second model-fetching implementation with node:http.request / node:https.request; keep one fetch-based request path.

OgxAgentEntityProvider is out of scope: it reads static agent entries from configuration and makes no outbound request.

3. Tests

Add or update focused tests in:

• workspaces/boost/plugins/ogx-entity-provider/src/module.test.ts (create this file if configuration parsing is not currently covered elsewhere)
• workspaces/boost/plugins/ogx-entity-provider/src/providers/OgxModelEntityProvider.test.ts

Cover at least:

• both fields are read from boost.entityProviders.ogx;
• both fields are read from fallback boost.providers.ogx;
• no TLS configuration preserves the existing fetch call;
• caData configures an HTTPS request with the custom CA and verification enabled;
• skipTLSVerify: true configures the request with rejectUnauthorized: false and logs a warning on the child logger;
• both fields together follow the precedence described above;
• the API key Authorization header is preserved when TLS settings are used;
• non-2xx responses retain the existing error behavior.

Tests must inspect the connection/dispatcher options passed to the request; do not make real network calls.

4. Examples and package metadata

• Add commented examples for caData and skipTLSVerify under the OGX entity-provider configuration in workspaces/boost/app-config.yaml.
• If a new direct runtime import is introduced, update workspaces/boost/plugins/ogx-entity-provider/package.json and the workspace lockfile.
• Add a changeset for the affected published package because this adds user-visible configuration behavior.

Acceptance criteria

• OgxEntityProviderConfig contains optional caData and skipTLSVerify fields.
• Both supported OGX config paths populate both fields.
• fetchModels() successfully supports a PEM custom CA.
• skipTLSVerify: true disables certificate verification and emits a warning without exposing secrets.
• Default behavior, bearer authentication, response parsing, and catalog entity output are unchanged.
• No TLS/network changes are made to OgxAgentEntityProvider.
• Unit tests cover configuration parsing and request connection options without real network access.
• Formatting, type checks, package tests, and API reports pass.

Verification

From workspaces/boost:

YARN_ENABLE_SCRIPTS=false yarn install --immutable
yarn prettier:fix
CI=true yarn workspace @red-hat-developer-hub/backstage-plugin-ogx-entity-provider test --watchAll=false
yarn tsc:full
yarn build:api-reports:only

Commit any lockfile, changeset, formatting, and report.api.md changes produced by the implementation. The Fullsend agent should commit the completed change so its post-processing step can push the branch and open the pull request.

Out of scope

• Changing the OGX backend provider's chat/session HTTP client
• Changing other connectors' TLS configuration
• Refactoring the shared boost-connector-utils CA-bundle API
• Adding outbound network behavior to OgxAgentEntityProvider

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:18 PM UTC · Completed 8:24 PM UTC

Commit: 6c8f76d · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.34

[fullsend-ai-triage]

Scope correction from prior triage: OgxAgentEntityProvider is explicitly out of scope — it reads static agent entries from configuration and makes no outbound request. Only OgxModelEntityProvider.fetchModels() needs TLS changes.

Implementation approach: The issue specifies using Fetch/Undici-compatible request configuration — a Node https.Agent passed via a non-standard agent property is not sufficient for built-in Node fetch. Use Undici's dispatcher mechanism to configure TLS options. If Undici types/runtime are imported directly, add undici as a direct dependency of ogx-entity-provider.

The existing boost-connector-utils createHttpsAgent() pattern creates an https.Agent, which is not directly usable with Node's built-in fetch. Refactoring that shared utility is out of scope per the issue.

Proposed test case:

describe('OGX TLS configuration', () => {
  // Config parsing
  it('reads caData and skipTLSVerify from boost.entityProviders.ogx');
  it('reads caData and skipTLSVerify from fallback boost.providers.ogx');

  // Request configuration
  it('passes custom CA to dispatcher when caData is set');
  it('sets rejectUnauthorized=false when skipTLSVerify is true');
  it('logs a warning via child logger when skipTLSVerify is enabled');
  it('skipTLSVerify takes precedence when both fields are set');
  it('preserves Authorization header when TLS settings are used');
  it('preserves existing fetch behavior when neither field is set');
  it('retains non-2xx error handling with TLS settings');
});

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

Previous run

The boost-connector-utils package already provides loadCaBundle() and createHttpsAgent() in ca-bundle.ts — consider reusing or adapting that pattern. The createHttpsAgent() helper creates an https.Agent with { ca: caBundle, rejectUnauthorized: true }. For skipTLSVerify, a separate agent with { rejectUnauthorized: false } and a startup warning would follow the same pattern.

Files to modify:

• plugins/ogx-entity-provider/src/types.ts — add caData?: string and skipTLSVerify?: boolean to OgxEntityProviderConfig
• plugins/ogx-entity-provider/src/module.ts — read the new fields in readOgxEntityProviderConfig()
• plugins/ogx-entity-provider/src/providers/OgxModelEntityProvider.ts — wire HTTPS agent into fetchModels()
• plugins/ogx-entity-provider/src/providers/OgxAgentEntityProvider.ts — wire HTTPS agent into agent fetch calls

Proposed test case:

describe('OgxEntityProviderConfig TLS support', () => {
  it('should read caData and skipTLSVerify from config');
  it('should create HTTPS agent with custom CA when caData is provided');
  it('should set rejectUnauthorized=false when skipTLSVerify is true');
  it('should log a warning when skipTLSVerify is enabled');
});

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

Previous run (2)

Triage summary

The OgxEntityProviderConfig interface currently lacks TLS configuration, so both OgxModelEntityProvider and OgxAgentEntityProvider use bare fetch() and cannot connect to OGX endpoints behind self-signed or internal CA certificates.

Recommended approach: The boost-connector-utils package already provides loadCaBundle() and createHttpsAgent() in ca-bundle.ts — consider reusing or adapting that pattern rather than building from scratch. The createHttpsAgent() helper creates an https.Agent with { ca: caBundle, rejectUnauthorized: true }. For skipTLSVerify, a separate agent with { rejectUnauthorized: false } and a startup warning would follow the same pattern.

Files to modify:

• plugins/ogx-entity-provider/src/types.ts — add caData?: string and skipTLSVerify?: boolean to OgxEntityProviderConfig
• plugins/ogx-entity-provider/src/module.ts — read the new fields in readOgxEntityProviderConfig()
• plugins/ogx-entity-provider/src/providers/OgxModelEntityProvider.ts — wire HTTPS agent into fetchModels()
• plugins/ogx-entity-provider/src/providers/OgxAgentEntityProvider.ts — wire HTTPS agent into agent fetch calls

Proposed test case:

describe('OgxEntityProviderConfig TLS support', () => {
  it('should read caData and skipTLSVerify from config');
  it('should create HTTPS agent with custom CA when caData is provided');
  it('should set rejectUnauthorized=false when skipTLSVerify is true');
  it('should log a warning when skipTLSVerify is enabled');
});

---

Next steps:

• /fs-code — agent creates a PR to implement this issue
• /fs-code <your instruction> — agent implements with your specific guidance

[fullsend-ai-coder]

🤖 Code · ❌ Terminated · Started 8:27 PM UTC · Ended 8:58 PM UTC

Commit: 6c8f76d · View workflow run →

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 8:28 PM UTC · Completed 8:32 PM UTC

Commit: 6c8f76d · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.74

[fullsend-ai-coder]

🤖 Finished Code · ❌ Failure · Started 8:27 PM UTC · Completed 8:58 PM UTC

Commit: 6c8f76d · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $5.19

[fullsend-ai-coder]

🤖 Finished Code · ✅ Success · Started 9:03 PM UTC · Completed 9:19 PM UTC

Commit: 6c8f76d · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Cost: $2.62

[fullsend-ai-triage]

🤖 Finished Triage · ✅ Success · Started 6:45 PM UTC · Completed 6:51 PM UTC

Commit: 193b36a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $0.94