chore: add catalog metadata

[kycheng]

Summary

• add a Backstage catalog component definition for shiro
• classify the repository as a library component

Testing

• not run (YAML metadata only)

[alaudabot]

Warning (style/inconsistent-language): The code contains a Chinese comment # 组件属性，区别是否部署时必带的核心组件,可选值为 core 和 plugin。 in an otherwise English-language file. For consistency, consider either translating the comment to English or removing it if the annotation name is self-explanatory.

[alaudabot]

Suggestion (style/clarity): The annotation # acp.cpaas.io/ci-pipeline: "" is commented out. If intentionally disabled, consider adding a brief comment explaining why, or remove it entirely to reduce confusion.

[alaudabot]

🤖 AI Code Review

Property	Value
Model	opencode/minimax-m2.5-free
Style	strict
Issues Found	0
Config Source	centralized
Profile	❌ Not Found
Personalized Prompt	❌ No
Prompt Path	.github/review/profiles/alaudadevops/shiro/pr-review.md
Alauda Skills	✅ base-acp-operator-list, base-acp-operator-release, base-authoring, base-m365, base-ocp-operator-list, base-skill-setup, builders-component-knowledge, builders-confluence, builders-jira, builders-prd-to-testcase, builders-publish-errata, builders-roadmap-studio, builders-story-split, cross-repo-add-mirror, cross-repo-publish, devops-autodns, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-upgrade-test, devops-connectors-write-user-docs, devops-fix-go-vulns, devops-fork-alauda-binary-release, devops-gen-advanced-form-descriptors, devops-knowledge-adoption, devops-refresh-containerfile-digests, devops-refresh-containerfile-tags, devops-replace-strings, devops-scan-docker-keywords, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-upgrade-go, devops-upstream-backport-cve, devops-upstream-upgrade
Reviewed at	2026-04-29 09:45:39 UTC

---

Summary

This PR adds a Backstage catalog component definition file (.catalog/shiro.yaml) for the Apache Shiro fork repository. The metadata is well-structured with proper annotations for GitHub, SonarQube, and ACP integration. A minor consistency issue with the comment language was identified.

Review Statistics

Category	Count
Critical Issues	0
Warnings	1
Suggestions	1
Files Reviewed	1

Critical Issues

Issues that MUST be addressed before merging (security, bugs, breaking changes)

None.

Warnings

Issues that SHOULD be addressed but are not blocking

• [:21] style/inconsistent-language (WARNING): The code contains a Chinese comment # 组件属性，区别是否部署时必带的核心组件,可选值为 core 和 plugin。 in an otherwise English-language file. For consistency, consider either translating the comment to English or removing it if the annotation name is self-explanatory.

Suggestions

Recommendations for improvement (nice to have)

• [:15] style/clarity (INFO): The annotation # acp.cpaas.io/ci-pipeline: "" is commented out. If intentionally disabled, consider adding a brief comment explaining why, or remove it entirely to reduce confusion.

Positive Feedback

The catalog file is well-structured and follows Backstage catalog metadata conventions:

• Correct apiVersion and kind values for Backstage Component definition
• Proper metadata annotations for GitHub, SonarQube, and ACP integration
• Clear separation of technical metadata in annotations vs. component specification in spec
• Appropriate lifecycle set to production for a maintained fork
• Good use of descriptive description field explaining it's a CVE backport fork

---

---

ℹ️ About this review

This review was automatically generated using the run-actions workflow.

• Shared prompt: .github/prompts/code-review.md
• Config source: centralized
• Profile path: Not Found
• Profile ref: ebb6c9593926ecbd0b2b1d3ebde0c09c862ff8bf
• No repository-specific prompt configured
• Alauda skills: base-acp-operator-list, base-acp-operator-release, base-authoring, base-m365, base-ocp-operator-list, base-skill-setup, builders-component-knowledge, builders-confluence, builders-jira, builders-prd-to-testcase, builders-publish-errata, builders-roadmap-studio, builders-story-split, cross-repo-add-mirror, cross-repo-publish, devops-autodns, devops-candidate-version-supervisor, devops-connectors-acceptance-test, devops-connectors-explore, devops-connectors-poc-case, devops-connectors-review, devops-connectors-unit-test, devops-connectors-upgrade-test, devops-connectors-write-user-docs, devops-fix-go-vulns, devops-fork-alauda-binary-release, devops-gen-advanced-form-descriptors, devops-knowledge-adoption, devops-refresh-containerfile-digests, devops-refresh-containerfile-tags, devops-replace-strings, devops-scan-docker-keywords, devops-sync-alauda-github-releases, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-overview-template, devops-tekton-task-version-upgrade, devops-tekton-upgrade-notes, devops-tool-report-troubleshoot, devops-ui-e2e-code-audit, devops-ui-e2e-fix-base-on-report, devops-ui-e2e-regression-and-fix, devops-ui-generate-e2e-from-feature, devops-ui-pre-setup, devops-upgrade-go, devops-upstream-backport-cve, devops-upstream-upgrade