# Atlassian App Change Impact Auditor (`venturesome_lunar/atlassian-app-change-impact-auditor`) Actor

Audit Atlassian Connect and Forge apps for migration blockers, unsupported modules, deprecated Jira and Confluence APIs, scope and remote mismatches, SARIF, JUnit, and CI release gates.

- **URL**: https://apify.com/venturesome\_lunar/atlassian-app-change-impact-auditor.md
- **Developed by:** [Yuuki Tachibana](https://apify.com/venturesome_lunar) (community)
- **Categories:** Developer tools
- **Stats:** 1 total users, 0 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $490.00 / 1,000 complete atlassian app audits

This Actor is paid per event and usage. You are charged both the fixed price for specific events and for Apify platform usage.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## Atlassian App Change Impact Auditor

Find Connect-to-Forge migration blockers before they become production incidents.

This Actor cross-checks an `atlassian-connect.json` descriptor, a Forge `manifest.yml`, and optional source files. It returns evidence-linked migration findings, module coverage, deprecated REST API usage, permission and remote mismatches, a readiness score, and CI-ready release artifacts.

It is designed for Marketplace vendors, solution partners, and teams maintaining private Jira, Jira Service Management, or Confluence apps as Atlassian Connect approaches end of support in December 2026.

### What it checks

- Connect and Forge app-key, licensing, base URL, and remote consistency.
- Missing or invalid Connect JWT and lifecycle configuration.
- Retained `connectModules` and current Connect-to-Forge module mappings.
- Modules and web-item locations with no generally available Forge equivalent.
- Migration identity requirements such as same-key modules and `migratedFromConnect`.
- Jira issue glance to issue context migration.
- Confluence macro and content-property compatibility risks.
- Forge remote keys, HTTPS URLs, data-residency declarations, and token scopes.
- Source calls matched against 69 deprecated operations from six official Atlassian OpenAPI documents, snapshot on 2026-07-11.
- Removed Jira pagination/search APIs, legacy user identifiers, dynamic Connect modules, AUI CDN, Connect frameworks, and removed Atlaskit icon imports.

Each finding includes a stable rule ID, severity, confidence, file and line when available, recommended action, deadline when known, and a direct Atlassian documentation URL.

### Input options

You can use any combination of:

1. A parsed `connectDescriptor` JSON object.
2. `forgeManifestYaml` text.
3. `uploadedFiles` from Apify's file uploader or authorized public HTTPS URLs.
4. Inline `sourceFiles` for API, CLI, MCP, and CI workflows.

Uploaded ZIP projects are expanded with strict entry-count, per-file, and total-size limits. Path traversal, symlinks, encrypted entries, oversized entries, private-network URLs, credential-bearing URLs, and non-HTTP protocols are rejected. `node_modules`, build output, vendor directories, tests, fixtures, and Markdown are excluded from production source findings by default.

Customer source code is parsed as bounded text and is **never installed or executed**.

### Quick start

```json
{
  "connectDescriptor": {
    "key": "com.example.app",
    "name": "Example",
    "baseUrl": "https://app.example.com",
    "authentication": { "type": "jwt" },
    "lifecycle": { "installed": "/installed" },
    "enableLicensing": true,
    "scopes": ["READ"],
    "modules": {
      "jiraIssueGlances": [{ "key": "summary", "url": "/summary" }]
    }
  },
  "forgeManifestYaml": "app:\n  id: ari:cloud:ecosystem::app/...\n  connect:\n    key: com.example.app\n    remote: backend\n  licensing:\n    enabled: true\nmodules:\n  jira:issueContext:\n    - key: summary\n      resource: main\nremotes:\n  - key: backend\n    baseUrl: https://app.example.com\n    operations: [compute]\npermissions:\n  scopes: []\n",
  "releaseGate": {
    "enabled": true,
    "failOnSeverity": "high",
    "failOnNotAvailableModule": true
  }
}
```

The report is written before a configured release gate fails the run, so CI can still retrieve all evidence.

### Outputs

- Default Dataset: one complete structured audit report.
- `OUTPUT`: validated run summary with readiness score, gate status, and billing evidence.
- `REPORT.md`: human-readable migration plan.
- `REPORT.sarif`: findings for code scanning and engineering tools.
- `junit.xml`: findings for CI test-report consumers.

### Severity and confidence

Only deterministic, high-confidence conditions are treated as blockers. When Atlassian documentation sources conflict or a value is dynamically constructed, the Actor reports a review finding instead of claiming certainty. Official changelogs and current module references take priority over older capability tables.

The API/CLI default release gate fails on `high` or `critical` findings and on modules currently classified as not available. Set `releaseGate.enabled` to `false` for an advisory report. The Store's prefilled demonstration input uses advisory mode so it can return a complete example report successfully; enable the gate explicitly for CI enforcement.

### Billing

Launch Pay Per Event pricing:

- `apify-actor-start`: $0.00005 once per run, charged automatically by Apify.
- `app-audited`: $0.49 once after a valid structured report is produced.

Invalid input, blocked file retrieval, unsafe archives, and parsing failures do not emit `app-audited`. The removable synthetic `apify-default-dataset-item` event must stay unpriced. Platform compute, storage, and transfer usage is passed through to the caller so failed or adversarial uploads cannot create unbounded author cost.

Set a positive run-level `maxTotalChargeUsd` when invoking the Actor through API or MCP. Do not set zero as a limit.

### Privacy and security

The Actor does not require an Atlassian account, site URL, API token, session cookie, or Marketplace credential. It does not log or publish source-file bodies. Output evidence is limited to rule-relevant API paths, module keys, import paths, and configuration values. Named storage contains billing idempotency markers only; the supplied source remains in the run input/storage controlled by Apify retention settings.

Do not include secrets in source input. Remove credentials, private keys, production tokens, and customer data before upload.

### Limitations

- This is deterministic static analysis, not Atlassian certification, legal advice, or a guarantee that migration will succeed.
- Dynamically built URLs, runtime module registrations, tenant data migrations, feature flags, and behavior inside Atlassian sites can require manual testing.
- The bundled official-rule snapshot is versioned. Re-run after Actor updates and Atlassian platform changes.
- The Actor is an independent developer tool and is not affiliated with, endorsed by, or sponsored by Atlassian.

Atlassian, Jira, Confluence, and Forge are trademarks of Atlassian and/or its affiliates.

# Actor input Schema

## `appLabel` (type: `string`):

Optional label for the report. The Connect app name or key is used when omitted.

## `product` (type: `string`):

Auto detects Jira or Confluence from Connect modules when possible.

## `connectDescriptor` (type: `object`):

Optional parsed atlassian-connect.json object. Use this field for API and JSON-input workflows.

## `forgeManifestYaml` (type: `string`):

Optional manifest.yml content. Source values are parsed but never executed.

## `uploadedFiles` (type: `array`):

Optional files uploaded through Apify or public HTTPS URLs. ZIP contents are bounded and source code is inspected as text only; it is never executed.

## `sourceFiles` (type: `array`):

Optional source snippets for API-usage scanning. Useful for API, MCP, and CI calls.

## `baselineNamespace` (type: `string`):

Stable namespace used for billing idempotency and future comparison history.

## `releaseGate` (type: `object`):

Fail the run after writing the paid report when findings reach the threshold.

## `artifacts` (type: `object`):

Generate Markdown, SARIF, and JUnit reports in the default Key-Value Store.

## `limits` (type: `object`):

Bounds uploaded archives and public file retrieval.

## Actor input object example

```json
{
  "product": "auto",
  "connectDescriptor": {
    "key": "com.example.connect-app",
    "name": "Example Connect App",
    "baseUrl": "https://app.example.com",
    "authentication": {
      "type": "jwt"
    },
    "lifecycle": {
      "installed": "/installed"
    },
    "enableLicensing": true,
    "scopes": [
      "READ"
    ],
    "modules": {
      "jiraIssueGlances": [
        {
          "key": "example-glance",
          "name": {
            "value": "Example"
          },
          "url": "/glance"
        }
      ]
    }
  },
  "forgeManifestYaml": "app:\n  id: ari:cloud:ecosystem::app/00000000-0000-0000-0000-000000000000\n  connect:\n    key: com.example.connect-app\n    remote: connect-backend\n  licensing:\n    enabled: true\nmodules:\n  jira:issueContext:\n    - key: example-context\n      resource: main\nresources:\n  - key: main\n    path: static/app/build\nremotes:\n  - key: connect-backend\n    baseUrl: https://app.example.com\n    operations:\n      - compute\npermissions:\n  scopes: []\n",
  "sourceFiles": [],
  "baselineNamespace": "default",
  "releaseGate": {
    "enabled": false,
    "failOnSeverity": "high",
    "failOnNotAvailableModule": true
  },
  "artifacts": {
    "markdown": true,
    "sarif": true,
    "junit": true
  },
  "limits": {
    "requestTimeoutSeconds": 30,
    "maxUploadedFileBytes": 10000000,
    "maxArchiveEntries": 500,
    "maxExtractedBytes": 20000000,
    "maxSourceFileBytes": 1000000,
    "maxRedirects": 3
  }
}
```

# Actor output Schema

## `report` (type: `string`):

No description

## `summary` (type: `string`):

No description

## `markdown` (type: `string`):

No description

## `sarif` (type: `string`):

No description

## `junit` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "connectDescriptor": {
        "key": "com.example.connect-app",
        "name": "Example Connect App",
        "baseUrl": "https://app.example.com",
        "authentication": {
            "type": "jwt"
        },
        "lifecycle": {
            "installed": "/installed"
        },
        "enableLicensing": true,
        "scopes": [
            "READ"
        ],
        "modules": {
            "jiraIssueGlances": [
                {
                    "key": "example-glance",
                    "name": {
                        "value": "Example"
                    },
                    "url": "/glance"
                }
            ]
        }
    },
    "forgeManifestYaml": `app:
  id: ari:cloud:ecosystem::app/00000000-0000-0000-0000-000000000000
  connect:
    key: com.example.connect-app
    remote: connect-backend
  licensing:
    enabled: true
modules:
  jira:issueContext:
    - key: example-context
      resource: main
resources:
  - key: main
    path: static/app/build
remotes:
  - key: connect-backend
    baseUrl: https://app.example.com
    operations:
      - compute
permissions:
  scopes: []`,
    "releaseGate": {
        "enabled": false,
        "failOnSeverity": "high",
        "failOnNotAvailableModule": true
    }
};

// Run the Actor and wait for it to finish
const run = await client.actor("venturesome_lunar/atlassian-app-change-impact-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "connectDescriptor": {
        "key": "com.example.connect-app",
        "name": "Example Connect App",
        "baseUrl": "https://app.example.com",
        "authentication": { "type": "jwt" },
        "lifecycle": { "installed": "/installed" },
        "enableLicensing": True,
        "scopes": ["READ"],
        "modules": { "jiraIssueGlances": [{
                    "key": "example-glance",
                    "name": { "value": "Example" },
                    "url": "/glance",
                }] },
    },
    "forgeManifestYaml": """app:
  id: ari:cloud:ecosystem::app/00000000-0000-0000-0000-000000000000
  connect:
    key: com.example.connect-app
    remote: connect-backend
  licensing:
    enabled: true
modules:
  jira:issueContext:
    - key: example-context
      resource: main
resources:
  - key: main
    path: static/app/build
remotes:
  - key: connect-backend
    baseUrl: https://app.example.com
    operations:
      - compute
permissions:
  scopes: []
""",
    "releaseGate": {
        "enabled": False,
        "failOnSeverity": "high",
        "failOnNotAvailableModule": True,
    },
}

# Run the Actor and wait for it to finish
run = client.actor("venturesome_lunar/atlassian-app-change-impact-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "connectDescriptor": {
    "key": "com.example.connect-app",
    "name": "Example Connect App",
    "baseUrl": "https://app.example.com",
    "authentication": {
      "type": "jwt"
    },
    "lifecycle": {
      "installed": "/installed"
    },
    "enableLicensing": true,
    "scopes": [
      "READ"
    ],
    "modules": {
      "jiraIssueGlances": [
        {
          "key": "example-glance",
          "name": {
            "value": "Example"
          },
          "url": "/glance"
        }
      ]
    }
  },
  "forgeManifestYaml": "app:\\n  id: ari:cloud:ecosystem::app/00000000-0000-0000-0000-000000000000\\n  connect:\\n    key: com.example.connect-app\\n    remote: connect-backend\\n  licensing:\\n    enabled: true\\nmodules:\\n  jira:issueContext:\\n    - key: example-context\\n      resource: main\\nresources:\\n  - key: main\\n    path: static/app/build\\nremotes:\\n  - key: connect-backend\\n    baseUrl: https://app.example.com\\n    operations:\\n      - compute\\npermissions:\\n  scopes: []\\n",
  "releaseGate": {
    "enabled": false,
    "failOnSeverity": "high",
    "failOnNotAvailableModule": true
  }
}' |
apify call venturesome_lunar/atlassian-app-change-impact-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,venturesome_lunar/atlassian-app-change-impact-auditor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/xcrkBQkyXcdxKdl84/builds/7Aorhwopbvl0ZHvaC/openapi.json