chore(config-ui): sync with upstream apache/devlake

[muzamilkm]

Summary

Syncs config-ui with upstream Apache DevLake, as the sync plan lays out (config-ui-upstream-sync-plan.md, sections 2–7). It cherry-picks the 47-commit ledger in chronological order with -x and ports our fork-only code to the new stack: React 19, antd 6, React Router 7, Vite 8, TypeScript 6, Node 24, Yarn 4, ESLint flat config and Vitest. It also brings dark mode (#8865) and connection grouping (#9130), the foundations of the reskin. The e2e suite from #81 runs green on the new stack in both auth states.

Upstream cherry-picks

41 of the 47 ledger commits, in upstream order. Each keeps the upstream author, body and its (cherry picked from commit …) line. Numbers are upstream apache/devlake PRs.

Stack and theme

PR	What	How
#8865	Dark theme, theme/tokens.ts, colour refactor	Whole
#9006	React 19, antd 6, Router 7, Vite 8, TS 6, Node 24, Yarn 4, ESLint flat config, Vitest	Whole, then our fork code ported (below)
#9020	Dark-mode copy contrast	Whole
#9130	Group connections by name	Whole

Fixes and features for plugins we ship

PR	What	How
#8931 #8972 #9035	Jira: search API, extra JQL, project name in JQL	With backend
#9024 #9159	Jira: API Gateway auth, Cloud OAuth 2.0	With backend
#9034 #9047	Duplicate-scope warning: GitHub, GitLab/Bitbucket	With backend
#9014 #9152	Azure DevOps Server (on-prem), run name in pipeline regex	With backend
#8935	gh-copilot hyphenated enterprise slugs	With backend
#8918 #8952 #8995	Connection create: empty-plugin guard, "create a new connection", initialValues	Whole
#8903 #9153 #9135	"Jira Data Center" label, GitLab pathWithNamespace, scopeId encoding	Whole
#9097 #9144	PyDevLake deprecation notice	#9097 UI only, #9144 whole
#9166	VITE_DEVLAKE_URL dev proxy	Whole
#9093	incubator prefix removal	UI only (links, banner, .tool-versions)

New upstream plugins, UI only

#8877 Rootly · #8884 Tempo · #8900 Linear · #9009 ClickUp · #9023 incident.io · #9076 Kiro · #9160 Grafana IRM · #9169 YouTrack

These stay hidden: the UI lists only plugins the backend reports, and ours doesn't ship them.

Dependencies and images

#8940 #9100 #9188 nginx · #9044 images and frontend deps · #9112 #9113 #9114 #9121 #9158 frontend bumps. Each yarn.lock is regenerated with Yarn 4.17.0 rather than merged by hand.

Not taken

PR	Why
#8878 #9079 #9084	dbt / q-dev changes; our backend still ships both plugins
#9017	Upstream's cursor collides with ours
#9131	Upstream CI only
#8808	claude_code, already in via #79; resolves entirely to ours, so no commit

• No prerequisite backend commits were pulled. #8935 builds and passes its tests without upstream's user_teams_collector.go. #9159 registers only its own OAuth migration.
• The post-rename commits (#9159, #9152) have their imports rewritten to github.com/apache/incubator-devlake/.
• Rewritten subjects: 7 upstream subjects don't pass our commit-message check, so only their first line was rewritten (e.g. fix(gitlab) - fix added… → fix(gitlab): …). The body and the cherry picked from line are unchanged.

Conflicts resolved toward ours

• connection-form/index.tsx: our inline Test Connection payloads and payload.ts stay. Upstream's new fields are added to both: enterprise (#8935) and cloudId (#9159). So is YouTrack's opt-in test-result message (#9169).
• utils/request.ts: our session verification, CSRF and 428 handling stay. Upstream's #9159 change is added: a 401 from a plugin connection test no longer counts as a DevLake session expiry.
• routes/layout/layout.tsx and config.tsx: our account menu, OtelAttention, /access entry and Grafana login link stay. The theme toggle is added. Upstream's unused GRAFANA_PATH is dropped.
• routes/connection/connections.tsx: our Claude/OTel cards and credential counts stay. Grouping, the A–N / O–Z split by displayed name and the deprecation alert come from upstream.
• plugins/utils.ts: getPluginScopeId lives in our plugins/scope-id.ts, so the Linear (teamId) and ClickUp (folderId) cases go there. api/scope encodes scopeId, and scope-id.ts doesn't, so it's encoded exactly once.
• data-scope-select: our rewrite stays, with upstream's ?? [] guards from #9014 re-applied.
• vite.config.ts: upstream's file, plus our Grafana OAuth proxy entries.
• package.json: upstream's, plus @playwright/test, test:e2e and test:e2e:ui. yarn.lock is regenerated with Yarn 4.17.0 rather than merged by hand.
• Compose and Dockerfiles (#9044):
  • upstream image pins where ours were older;
  • ours where they were equal or newer (grafana/Dockerfile 13.2.2 and its provisioning lines);
  • files we had deleted stay deleted.

Fork code on the new stack

• antd 6, in fork-owned files only:
  • destroyOnClose → destroyOnHidden;
  • maskClosable → mask={{ closable: false }};
  • Space direction → orientation;
  • Alert message → title;
  • Input addonAfter → Space.Compact.
  • Upstream-owned lines are left as upstream wrote them.
• React 19: argument-less useRef<T>() calls become useRef<T | undefined>(undefined).
• ESLint flat config:
  • .eslintrc.js and e2e-tests/.eslintrc.cjs are gone;
  • no-console: 'warn' moves to eslint.config.mjs;
  • an e2e-tests/** block turns off react-hooks/rules-of-hooks for Playwright's use fixture;
  • the ASF header is now enforced by eslint-plugin-headers.
• Unit tests: our 10 node --test files are ported to Vitest with identical test and assertion counts, and tsconfig.test.json is deleted. yarn test runs upstream's and ours together.
  • One assertion was stale: access/utils.test.ts expected a disabled OIDC provider to show as Configured. c98969b4b deliberately added the Disabled state, and the test never ran because the old runner failed at tsc first. It now expects Disabled.

E2E

• antd 6 dropped .ant-modal-content. support/selectors.ts now finds modals by accessible role (getByRole('dialog', { name })), which also survives the reskin.
• Empty states. antd 6 Empty renders its text twice, so empty states get their own selector.
• OTel organization column. antd 6 now truncates Typography.Text ellipsis in JS and keeps the full value only in aria-label. The test reads the cell's accessible name and still requires an exact match with the API's organizationId. On screen nothing changed: it's a truncated UUID with a copy button, as before.
• New shell/theme spec (sync plan, section 8.4):
  • light, dark and follow-system each apply the right background;
  • the mode persists across reloads;
  • follow-system tracks the OS preference.

Other

• chore(grafana): the Claude dashboard is titled "Claude Usage" instead of "Claude - MySQL".

Test plan

• Rebuilt devlake and config-ui locally from this branch with FORCE_MIGRATION=true:
  • exactly the 6 new migrations ran (Jira 3, Azure DevOps Go 3), with no errors;
  • both images build and serve.
• Local auth on: 64 passed, 2 skipped, 0 failed, about 2 minutes. The 2 skips are the state-A auth specs.
• Local auth off (AUTH_LOCAL_ENABLED=false): 40 passed, 24 skipped, 0 failed, identical to main-arbisoft. The skips are exactly the local-auth specs.
• Config UI:
  • tsc --noEmit: 0 errors;
  • eslint .: 0 errors;
  • yarn test: 16 files, 91 tests passed;
  • yarn build;
  • yarn install --immutable.
• Backend: go build and go test pass for jira, github, gitlab, bitbucket, azuredevops_go and gh-copilot (the DB-backed e2e packages run in CI). gitextractor needs libgit2 and compiles in the backend image.
• No github.com/apache/devlake/ imports remain. Every new migration is registered, and none collides with a fork migration.
• Every upstream field in connection-form's test and save payloads is present in ours (scripted diff against upstream).
• Dark mode checked on /login, /access, /otel, /connections, /keys, projects and the account menu: everything is readable.
• The 8 upstream-only plugins don't appear in the catalog (connections/catalog spec).

Notes for reviewers

• Node 24 and Yarn 4 for everyone working on config-ui. Run corepack enable; the Yarn release is vendored under .yarn/releases. Node 18 and Yarn 3 no longer work.
• New migrations run on deploy: Jira (sub_query, extra_jql, OAuth 2.0 credentials) and Azure DevOps Go (endpoint, username, run_name). They're upstream migrations, but take a backup before deploying, as usual.
• yarn start dev proxy: Grafana now defaults to localhost:3001. Override it with VITE_GRAFANA_PROTOCOL / _HOST / _PORT if yours runs elsewhere.
• The diff is large because of #9006. Reviewing commit by commit is easier: our own commits are 227097827, bf0e167cf, d337cfed5, 1504fa137, 023691887, 2c8f1224a, 8a3dd355e and 3fcda8bfb. The rest are upstream picks.
• Out of scope (sync plan, section 10):
  • the full backend sync;
  • the Cursor convergence;
  • removing q-dev and dbt;
  • adopting the new upstream plugins' backends.