Feature/grafana irm plugin(#9127) (#9160)

* feat(grafana_irm): add Grafana IRM incident collection plugin

* test(grafana_irm): add richer live-captured e2e/unit fixtures; implement TestConnection

- Seed 2 more real (non-drill) incidents on the dev stack with a real role
  assignment and multi-label data, closing gaps the original 2-incident
  fixture never exercised (assignment mapping, per-scope label exclusion).
- Add a second e2e scenario proving label-based scope filtering end-to-end.
- Update the extractor unit test to use real captured incident data instead
  of a drill incident's.
- Implement TestConnection/TestExistingConnection via a cheap
  IncidentsService.QueryIncidents call, verified live against the real API.

* refactor(grafana_irm): revert to connection-wide scoping, drop label filtering

The originating feature request only asks for org-wide DORA correlation and
never mentions per-team scoping. The label-based per-scope filtering added
earlier this session was real and tested, but solved a problem nobody asked
for, and config-ui has no generic manual-scope-entry component to build a UI
for it on top of. Revert GrafanaIrmScopeConfig/GrafanaIrmOptions/the
collector/converter to a single connection-wide scope with no filtering, same
shape as incidentio/pagerduty. All incident labels are still collected and
stored unconditionally, just no longer used to gate conversion.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(grafana_irm): add config-ui frontend and single-scope remote API
Backend: add remote_api.go returning the one synthetic scope every
connection has (config-ui's data-scope picker has no manual-entry flow to
fall back to, so this feeds the standard remote-picker UI a single 'All
Incidents' entry instead), wired into impl.go's routes. Frontend: add config-ui/src/plugins/register/grafana_irm (connection form,
icon, registration) mirroring incidentio's shape, using the Grafana logo
already vendored under grafana/img/. No custom scope-config UI is needed
since GrafanaIrmScopeConfig carries no extra fields (Option A). Verified
with tsc, eslint, and a production vite build - all clean.

* fix(grafana_irm): fix error raised during testing

* refactor(grafana_irm): collapse collect+refresh into one FinalizableApiCollector subtask

The two-subtask design (CollectIncidents + RefreshOpenIncidents) caused three
real bugs found via live pipeline testing: a panic, "Re-transform Data"
silently deleting resolved incidents, and a genuine full sync also losing
data because both subtasks independently wiped the raw table with no
coordination between them.

pagerduty solves the identical "list new/changed, then refresh still-open"
need with DevLake's own FinalizableApiCollector as a single subtask, which
prevents these bugs by construction (the framework never builds the
"refresh" half on a full sync, and there's only one subtask name for
Re-transform Data's filter to strip). Migrated CollectIncidents to that
pattern; all existing collector logic (query building, change-detection via
a request-scoped header) preserved, just re-wired. Live-verified against a
real server: full sync restores all incidents correctly, incremental sync
has no regression, and Re-transform Data no longer drops resolved incidents.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* feat(grafana_irm): add dedicated Grafana dashboard, docs, and domain board mapping

- Add dedicated Grafana dashboards for MySQL and PostgreSQL dialects
- Populate domain ticket.Board in ConvertIncidents to enable board filtering and joins
- Update config-ui brand icon with official Grafana flame SVG
- Add plugin documentation in backend/plugins/grafana_irm/README.md
- Fix struct alignment formatting in models/incident.go

* fix(grafana_irm): improve connection test error messages and add docs link

* fix(grafana_irm): truncate timestamps to milliseconds and fix e2e postgres scope setup

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

build(deps): bump inflect in /backend/python/pydevlake (#9108)

Bumps [inflect](https://github.com/jaraco/inflect) from 6.2.0 to 7.5.0.
- [Release notes](https://github.com/jaraco/inflect/releases)
- [Changelog](https://github.com/jaraco/inflect/blob/main/NEWS.rst)
- [Commits](jaraco/inflect@v6.2.0...v7.5.0)

---
updated-dependencies:
- dependency-name: inflect
  dependency-version: 7.5.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

fix: build image failed

feat: add Kiro commit attribution helper (#9074)

* feat: add Kiro commit attribution helper

Signed-off-by: warren <warren.chen830@gmail.com>

* fix: add Apache license headers

Signed-off-by: warren <warren.chen830@gmail.com>

---------

Signed-off-by: warren <warren.chen830@gmail.com>

fix(jira): change _tool_jira_issues.fix_versions column to text (#8988)

The `fix_versions` field on the jira issue model is declared as
`gorm:"type:text"`, but the original migration
(20250619_add_fix_versions_to_issue) created the column as
`varchar(255)`. Installations that ran the earlier migration therefore
have a `varchar(255)` column that no longer matches the model and
truncates long fix version lists.

This migration alters `_tool_jira_issues.fix_versions` to `text` so the
database schema matches the model definition and can store values longer
than 255 characters.

Signed-off-by: DoDiODev <DoDiDev@proton.me>
Co-authored-by: Klesh Wong <klesh@qq.com>

feat(auth): add OIDC allowlist restrictions (#8984)

fix(security): update nginx-unprivileged to 1.30.3 (#8940)

fix(ci): pin docker/* actions in build.yml to ASF-approved SHAs (#8852)

Signed-off-by: yamoyamoto <yamo7yamoto@gmail.com>

fix: disable API client caching for GitHub App connections (#8850)

GitHub App installation tokens expire after ~1 hour, causing admin APIs
(remote-scopes, test-connection) to fail silently after token expiry.

This fix overrides GetHash() to return empty string for GitHub App connections,
disabling client caching and ensuring fresh tokens are fetched for each admin request.

PAT connections continue to use default caching behavior.

Fixes #8847

fix: throwing on parsing for a 204 response (#8825)