What happened
On PR #3476, the code agent created a CodeCoverageClient that calls the code-coverage-backend plugin API using bare fetch() without Backstage service-to-service authentication. The review agent flagged this as medium severity on 2026-06-19 and escalated to high severity on 2026-06-22, noting it would fail at runtime in any deployment with default auth settings. The human then directed the fix agent on 2026-07-27 to add AuthService with getOwnServiceCredentials() and getPluginRequestToken(). The fix was implemented in commit ad65b31. A sibling issue #3473 (codecov module) will require the same pattern, suggesting this will recur.
What could go better
The code agent should have included Backstage service-to-service authentication from the start. This is a standard Backstage requirement for backend modules that call other plugin APIs — the discovery service resolves internal URLs, and the auth service provides tokens. The issue description even specified the API endpoint format, which implies an internal plugin-to-plugin call. The code agent likely missed this because .fullsend/AGENTS.md has no mention of Backstage auth patterns, and the pattern requires injecting coreServices.auth into the module's dependency list. Confidence is high — this is a well-documented Backstage requirement, the review agent correctly identified it, and the same pattern will be needed for at least one more planned module (#3473).
Proposed change
Add a Backstage-specific instruction to .fullsend/AGENTS.md: When creating a backend module or plugin that calls another Backstage plugin's API (e.g., via DiscoveryService.getBaseUrl()), always include service-to-service authentication. Inject coreServices.auth into the module dependencies, call auth.getOwnServiceCredentials() to get the caller identity, then auth.getPluginRequestToken({ onBehalfOf: credentials, targetPluginId: '<plugin>' }) to get a token, and include it as Authorization: Bearer *** in the fetch headers. Reference existing modules like scorecard-backend-module-code-coverage` as examples.
Validation criteria
The next agent-authored PR that creates a backend module calling another Backstage plugin's API (such as the codecov module from #3473) should include service-to-service authentication in the initial code agent commit, without requiring a review finding or /fs-fix command to add it.
Generated by retro agent from #3476
What happened
On PR #3476, the code agent created a
CodeCoverageClientthat calls thecode-coverage-backendplugin API using barefetch()without Backstage service-to-service authentication. The review agent flagged this as medium severity on 2026-06-19 and escalated to high severity on 2026-06-22, noting it would fail at runtime in any deployment with default auth settings. The human then directed the fix agent on 2026-07-27 to addAuthServicewithgetOwnServiceCredentials()andgetPluginRequestToken(). The fix was implemented in commitad65b31. A sibling issue #3473 (codecov module) will require the same pattern, suggesting this will recur.What could go better
The code agent should have included Backstage service-to-service authentication from the start. This is a standard Backstage requirement for backend modules that call other plugin APIs — the
discoveryservice resolves internal URLs, and theauthservice provides tokens. The issue description even specified the API endpoint format, which implies an internal plugin-to-plugin call. The code agent likely missed this because.fullsend/AGENTS.mdhas no mention of Backstage auth patterns, and the pattern requires injectingcoreServices.authinto the module's dependency list. Confidence is high — this is a well-documented Backstage requirement, the review agent correctly identified it, and the same pattern will be needed for at least one more planned module (#3473).Proposed change
Add a Backstage-specific instruction to
.fullsend/AGENTS.md: When creating a backend module or plugin that calls another Backstage plugin's API (e.g., viaDiscoveryService.getBaseUrl()), always include service-to-service authentication. InjectcoreServices.authinto the module dependencies, callauth.getOwnServiceCredentials()to get the caller identity, thenauth.getPluginRequestToken({ onBehalfOf: credentials, targetPluginId: '<plugin>' })to get a token, and include it asAuthorization: Bearer *** in the fetch headers. Reference existing modules likescorecard-backend-module-code-coverage` as examples.Validation criteria
The next agent-authored PR that creates a backend module calling another Backstage plugin's API (such as the codecov module from #3473) should include service-to-service authentication in the initial code agent commit, without requiring a review finding or
/fs-fixcommand to add it.Generated by retro agent from #3476