privilegedescalation/headlamp-argocd-plugin
12
0
Fork 0
Code Issues 4 Pull Requests 3 Actions Packages Projects Releases 2 Wiki Activity

add dual approval gate workflow #17

Merged
privilegedescalation-engineer[bot] merged 6 commits from hugh/add-dual-approval-gate into dev 2026-05-05 10:30:31 +00:00
Conversation 1 Commits 6 Files Changed 7
+84 -13

6 Commits

Author SHA1 Message Date
Chris Farhood e4d7a56547 add dual approval gate workflow 
headlamp-argocd-plugin was missing the dual-approval (CTO + QA) gate
required by SDLC. Added identical workflow to all other plugin repos.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
 2026-05-05 04:54:58 +00:00
privilegedescalation-engineer[bot] 0e41bb649d fix: resolve markdownlint CI failures in headlamp-argocd-plugin (#9) 
* Remove duplicate tar/undici from devDependencies (already in pnpm.overrides)

Consolidates dual override blocks by removing the duplicate entries
from devDependencies. These packages are already pinned via pnpm.overrides
and should not appear in devDependencies.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix: add markdownlint config to resolve CI failures

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix: sync pnpm-lock.yaml after removing tar and undici deps

The pnpm-lock.yaml was out of sync with package.json after tar and undici
were removed. Regenerated to resolve pnpm install failure in CI.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

---------

Co-authored-by: Chris Farhood <chris@farhood.org>
Co-authored-by: Paperclip <noreply@paperclip.ing>
 2026-05-05 00:24:20 +00:00
privilegedescalation-engineer[bot] 320154f29b Cleanup: consolidate dual override blocks in package.json (#8) 
Removed duplicate tar/undici devDeps (already pinned in pnpm.overrides), removed stale overrides.lodash block, regenerated lockfile. QA: privilegedescalation-qa ✅ | CTO: privilegedescalation-cto ✅ | CI: green ✅
 2026-05-04 21:03:17 +00:00
privilegedescalation-engineer[bot] 34f6e0e13b fix(ci): add dev branch to pull_request trigger 
Aligns PR trigger with push trigger. QA approved (PRI-547), CTO approved, CI green.
 2026-05-04 18:59:37 +00:00
privilegedescalation-engineer[bot] 557a00a758 fix: enable CI on feature branches and add workflow_dispatch (#13) 
Fixes PRI-524. Changes push trigger from branches:[main] to branches:['**'] so CI fires on every branch. Adds workflow_dispatch for manual trigger. Adds permissions: contents: read for least-privilege hardening.

All gates clear: CI green, UAT correctly skipped (YAML-only), QA approved (Regina), CTO approved (Nancy).
 2026-05-04 18:26:45 +00:00
privilegedescalation-engineer[bot] 730f7cbe54 fix: override lodash >=4.18.0 to patch code injection vulnerability (#7) 
* fix: override lodash >=4.18.0 to patch code injection vulnerability

GHSA-r5fr-rjxr-66jc is a code injection vulnerability in lodash
below 4.18.0. The vulnerable transitive dependency comes through
@kinvolk/headlamp-plugin.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

* Regenerate lockfile for lodash override

Co-Authored-By: Paperclip <noreply@paperclip.ing>

---------

Co-authored-by: Gandalf the Greybeard <gandalf@privilegedescalation.dev>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>
Co-authored-by: Chris Farhood <chris@farhood.org>
Co-authored-by: Paperclip <noreply@paperclip.ing>
 2026-05-04 03:24:00 +00:00