From 990c796d042eb89241c6a0433c31132bfac2c97c Mon Sep 17 00:00:00 2001
From: Chris Farhood <chris@farhood.org>
Date: Thu, 14 May 2026 04:28:08 +0000
Subject: [PATCH] Add audit-ci.jsonc allowlist and fix trailing newline

audit-ci.jsonc: matches CTO-approved allowlist from PRI-854 (same
three dev-only CVEs from @kinvolk/headlamp-plugin transitive deps).
Required by shared plugin-ci.yaml (updated 2026-05-06).

dual-approval.yaml: add trailing newline per POSIX standard.
---
 audit-ci.jsonc | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 audit-ci.jsonc

diff --git a/audit-ci.jsonc b/audit-ci.jsonc
new file mode 100644
index 0000000..0921bea
--- /dev/null
+++ b/audit-ci.jsonc
@@ -0,0 +1,20 @@
+{
+  // Allowlist for inherited dev-dependency CVEs from @kinvolk/headlamp-plugin
+  // CTO decision (PRI-854): these high-severity vulns are dev/build-time only,
+  // trace to @kinvolk/headlamp-plugin transitive deps (Picomatch, Vite, lodash),
+  // and do NOT ship in production plugin artifacts.
+  "allowlist": [
+    {
+      "id": "GHSA-hhpm-516h-p3p6",
+      "reason": "Picomatch ReDoS: devDependency only, does not ship in production plugin bundle"
+    },
+    {
+      "id": "GHSA-36xf-7xpp-53w5",
+      "reason": "Vite arbitrary file read: devDependency only, does not ship in production plugin bundle"
+    },
+    {
+      "id": "GHSA-jf8v-p3pp-93qh",
+      "reason": "lodash code injection via _.template: devDependency only, does not ship in production plugin bundle"
+    }
+  ]
+}
\ No newline at end of file