Placeholder same-repository check breaks cross-repository template composition

Issue Labels

• Please familiarize yourself with the issue labels used in this project: LABELS.md

Search Terms

placeholder same repository, PlaceholderProcessor could not form a URL, $yaml $text cross repo, may only reference files from the same repository

️ Project Area

Catalog

External Integration

N/A

Description & Context

Since @backstage/[email protected], PlaceholderProcessor rejects any $yaml / $text / $json placeholder whose absolute URL points to a repository different from the entity being processed.

We use this pattern a lot: templates pull in shared parameters and steps from a central repo so teams don't have to copy them around. That's what breaks now.

Error:

Processor PlaceholderProcessor threw an error while preprocessing; caused by Error: Placeholder $yaml could not form a URL out of https://<scm-host>/org-a/repo-a/-/blob/main/template.yaml and https://<scm-host>/org-b/shared-templates/-/blob/main/parameters/prerequisites.yaml, Error: Placeholder may only reference files from the same repository as the entity

Both URLs are on the same SCM host, different repositories.

Introduced by commit 7761a50 ("Improved path validation for catalog entity placeholders"), released as a patch. We understand this addresses the exfiltration concern in #17337, but it removes a legitimate pattern entirely, and shipping it as a patch means it can be pulled in unintentionally.

Expected Behavior

Absolute-URL placeholders pointing to another repository on the same SCM integration should still resolve, so shared template parameters/steps can be reused across repositories. I believe if a restriction is needed for security, it could be opt-in/configurable (allowlist of trusted repos/hosts, or same-integration-by-default) rather than an unconditional block.

Reproduction Repo

No response

Reproduction steps

1. Run @backstage/plugin-catalog-backend >= 3.9.2-next.0 (or any 4.x).
2. Register an entity in repo A that references a file in repo B via an absolute-URL $yaml/$text/$json placeholder on the same SCM host.
3. Processing fails with the error above.

Have you read the Code of Conduct?

• I have read the Code of Conduct

Are you willing to submit PR?

Yes, but I would like some more guidance