Upgrade Nx

[lucacavallaro]

Upgrade Nx to version 23 and refactor target configuration

Upgraded Nx to version 23. Took the opportunity to clean up and update
the Nx targets configuration:

• Removed format and format:check targets in favor of native nx format commands.
• Removed redundant build: tsc NPM targets (Nx automatically infers build scripts for TypeScript).
• Refactored targetDefaults using the new filter property to limit configuration scope (test and build targetDefaults now apply only to tasks inferred by official Nx plugins, rather than all matching target names).
• Removed build targetDefaults to rely on the official plugin default values.

[dx-release-internal]

⚠️ Missing Nx Version Plan

Nx Release reports that this PR has touched projects without version plan coverage.

Run pnpm nx release plan and add the generated version plans.

Nx Plan Check result:

NX   Touched projects based on changed files

  - dx-metrics-import
  - @pagopa/opex-dashboard
  - dx-metrics
  - @pagopa/dx-mcpserver
  - docs
  - @pagopa/dx-cli
  - @pagopa/dx-metrics-core
  - @pagopa/eslint-config
  - @pagopa/dx-savemoney
  - @pagopa-dx/terraform-plan-storage-download
  - @pagopa-dx/terraform-plan-storage-upload
  - incremental-rollout
  - setup-telemetry-action
  - nx-release
  - pr-comment-action

NOTE: You can adjust your "versionPlans.ignorePatternsForPlanCheck" config to stop certain files from resulting in projects being classed as touched for the purposes of this command.


 NX   Project "renew-tls-certificate" has pending bumps in version plan(s)

  - "patch" in version-plan-1785250247375.md


 NX   Project "@pagopa/docker-build-push" has pending bumps in version plan(s)

  - "patch" in version-plan-1785250247375.md



 NX   Touched projects missing version plans

The following touched projects do not feature in any version plan files:
  - dx-metrics-import
  - @pagopa/opex-dashboard
  - dx-metrics
  - @pagopa/dx-mcpserver
  - docs
  - @pagopa/dx-cli
  - @pagopa/dx-metrics-core
  - @pagopa/eslint-config
  - @pagopa/dx-savemoney
  - @pagopa-dx/terraform-plan-storage-download
  - @pagopa-dx/terraform-plan-storage-upload
  - incremental-rollout
  - setup-telemetry-action
  - nx-release
  - pr-comment-action

Please use `nx release plan` to generate missing version plans, or adjust your "versionPlans.ignorePatternsForPlanCheck" config stop certain files from affecting the projects for the purposes of this command.

Run with --verbose to see the full list of changed files used for the touched projects logic.

This comment is managed automatically by Nx Release. Version plan guide

[github-actions]

Azure Static Web Apps: Your stage site is ready! Visit it here: https://proud-mud-0405c6703-2028.westeurope.1.azurestaticapps.net

[github-actions]

Code Review Report

Terraform Plan: infra/policy/dev - ✅ Success

Plan: 2 to add, 0 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/dev - ❌ Failed

Warning

Warning: Reference to undefined provider

on aws.tf line 12, in module "mcp_server":
12: aws.us_east_1 = aws.us-east-1

There is no explicit declaration for local provider name "aws.us_east_1" in
module.mcp_server, so Terraform is assuming you mean to pass a configuration
for "hashicorp/aws".

If you also control the child module, add a required_providers entry named
"aws.us_east_1" with the source address "hashicorp/aws".
::error::Terraform exited with code 1.

Caution

Error: retrieving Operation (Subscription: "35e6e3b2-4388-470e-a1b9-ad3bc34326d1"
Resource Group Name: "dx-d-itn-ai-rg-01"
Service Name: "dx-d-itn-ai-apim-01"
Api: "ai-foundry"
Operation: "create-response"): unexpected status 422 (422 Unprocessable Entity) with error: ManagementApiRequestFailed: Failed to connect to management endpoint dx-d-itn-ai-apim-01.management.azure-api.net:3443 for a service deployed in a Virtual Network. Make sure to follow guidance at https://aka.ms/apim-vnet-common-issues for Inbound connectivity to Management endpoint. Check 'ApiManagement Control Plane - inbound' connectivity at https://aka.ms/apimnetworkstatus.

Caution

Error: retrieving Backend (Subscription: "35e6e3b2-4388-470e-a1b9-ad3bc34326d1"
Resource Group Name: "dx-d-itn-ai-rg-01"
Service Name: "dx-d-itn-ai-apim-01"
Backend: "foundry"): unexpected status 422 (422 Unprocessable Entity) with error: ManagementApiRequestFailed: Failed to connect to management endpoint dx-d-itn-ai-apim-01.management.azure-api.net:3443 for a service deployed in a Virtual Network. Make sure to follow guidance at https://aka.ms/apim-vnet-common-issues for Inbound connectivity to Management endpoint. Check 'ApiManagement Control Plane - inbound' connectivity at https://aka.ms/apimnetworkstatus.

Caution

Error: retrieving Api Version Set (Subscription: "35e6e3b2-4388-470e-a1b9-ad3bc34326d1"
Resource Group Name: "dx-d-itn-ai-rg-01"
Service Name: "dx-d-itn-ai-apim-01"
Version Set: "ai-foundry"): unexpected status 422 (422 Unprocessable Entity) with error: ManagementApiRequestFailed: Failed to connect to management endpoint dx-d-itn-ai-apim-01.management.azure-api.net:3443 for a service deployed in a Virtual Network. Make sure to follow guidance at https://aka.ms/apim-vnet-common-issues for Inbound connectivity to Management endpoint. Check 'ApiManagement Control Plane - inbound' connectivity at https://aka.ms/apimnetworkstatus.

Caution

Error: retrieving Api (Subscription: "35e6e3b2-4388-470e-a1b9-ad3bc34326d1"
Resource Group Name: "dx-d-itn-ai-rg-01"
Service Name: "dx-d-itn-ai-apim-01"
Api: "ai-foundry;rev=1"): unexpected status 422 (422 Unprocessable Entity) with error: ManagementApiRequestFailed: Failed to connect to management endpoint dx-d-itn-ai-apim-01.management.azure-api.net:3443 for a service deployed in a Virtual Network. Make sure to follow guidance at https://aka.ms/apim-vnet-common-issues for Inbound connectivity to Management endpoint. Check 'ApiManagement Control Plane - inbound' connectivity at https://aka.ms/apimnetworkstatus.

Caution

Error: retrieving Logger (Subscription: "35e6e3b2-4388-470e-a1b9-ad3bc34326d1"
Resource Group Name: "dx-d-itn-ai-rg-01"
Service Name: "dx-d-itn-ai-apim-01"
Logger: "dx-d-itn-ai-apim-01-logger"): unexpected status 422 (422 Unprocessable Entity) with error: ManagementApiRequestFailed: Failed to connect to management endpoint dx-d-itn-ai-apim-01.management.azure-api.net:3443 for a service deployed in a Virtual Network. Make sure to follow guidance at https://aka.ms/apim-vnet-common-issues for Inbound connectivity to Management endpoint. Check 'ApiManagement Control Plane - inbound' connectivity at https://aka.ms/apimnetworkstatus.

Caution

Error: retrieving Policy for Service (Subscription: "35e6e3b2-4388-470e-a1b9-ad3bc34326d1"
Resource Group Name: "dx-d-itn-ai-rg-01"
Service Name: "dx-d-itn-ai-apim-01"): unexpected status 422 (422 Unprocessable Entity) with error: ManagementApiRequestFailed: Failed to connect to management endpoint dx-d-itn-ai-apim-01.management.azure-api.net:3443 for a service deployed in a Virtual Network. Make sure to follow guidance at https://aka.ms/apim-vnet-common-issues for Inbound connectivity to Management endpoint. Check 'ApiManagement Control Plane - inbound' connectivity at https://aka.ms/apimnetworkstatus.

Plan: 0 to add, 1 to change, 6 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/resources/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.container_app_infra.azurerm_monitor_diagnostic_setting.container_app_environment,
on .terraform/modules/container_app_infra/monitoring.tf line 3, in resource "azurerm_monitor_diagnostic_setting" "container_app_environment":
3: resource "azurerm_monitor_diagnostic_setting" "container_app_environment" {

metric has been deprecated in favour of the enabled_metric property and
will be removed in v5.0 of the AzureRM provider

Plan: 0 to add, 7 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/dev - ✅ Success

Plan: 0 to add, 44 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/core/prod - ✅ Success

Plan: 0 to add, 2 to change, 0 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/dev - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.integration_tests_client_id[0],
on ../_modules/azure/custom_environments.tf line 16, in resource "github_actions_environment_secret" "integration_tests_client_id":
16: plaintext_value = azurerm_user_assigned_identity.integration_tests[0].client_id

Use value.

(and 26 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 3 to add, 14 to change, 14 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

Terraform Plan: infra/bootstrapper/prod - ✅ Success

Warning

Warning: Argument is deprecated

with module.azure.github_actions_environment_secret.automation_infra_cd_client_id,
on ../_modules/azure/custom_environments.tf line 32, in resource "github_actions_environment_secret" "automation_infra_cd_client_id":
32: plaintext_value = module.bootstrap.identities.infra.cd.client_id

Use value.

(and 23 more similar warnings elsewhere)

Warning

Warning: Redundant ignore_changes element

on ../_modules/azure/secrets.tf line 1, in resource "github_actions_secret" "codecov_token":
1: resource "github_actions_secret" "codecov_token" {

Adding an attribute name to ignore_changes tells Terraform to ignore future
changes to the argument in configuration after the object has been created,
retaining the value originally configured.

The attribute remote_updated_at is decided by the provider alone and
therefore there can be no configured value to compare with. Including this
attribute in ignore_changes has no effect. Remove the attribute from
ignore_changes to quiet this warning.

(and one more similar warning elsewhere)

Plan: 14 to add, 16 to change, 58 to destroy.

Note

Full plan output is not included in this comment.
See the workflow run logs or downloaded Terraform plan report artifacts for the complete output.

---

Triggered by @lucacavallaro, commit: 22517eded3c15e75a8af0450041d561ca8bd5fb8.