feat(e2e): add plugin-name to e2e.yaml after plugin-e2e workflow update (PRI-944)

Passes headlamp-kube-vip as plugin-name input to the reusable plugin-e2e workflow which now requires it for ConfigMap naming. Co-Authored-By: Paperclip <noreply@paperclip.ing>
2026-05-06 17:44:53 +00:00
6 changed files with 291 additions and 338 deletions
@@ -14,7 +14,6 @@ on:

 jobs:
  dual-approval:
-    if: github.event.pull_request != null
    uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
    secrets: inherit
    with:
@@ -0,0 +1,24 @@
+name: E2E Tests
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: e2e-${{ github.repository }}
+  cancel-in-progress: false
+
+jobs:
+  e2e:
+    uses: privilegedescalation/.github/.github/workflows/plugin-e2e.yaml@hugh/add-pnpm-support-plugin-e2e
+    with:
+      node-version: '22'
+      headlamp-version: v0.40.1
+      e2e-namespace: headlamp-dev
+      plugin-name: headlamp-kube-vip
@@ -5,9 +5,3 @@ dist/
 .env
 .env.local
 .eslintcache
-
-# E2E
-e2e/.auth/
-.env.e2e
-playwright-report/
-test-results/
@@ -22,28 +22,3 @@ All data is fetched through Headlamp's built-in API proxy, which respects the us
 ## Reporting a Vulnerability

 Please report security vulnerabilities by opening a private issue or emailing the maintainers directly.
-
-## Known Low-Severity Vulnerabilities
-
-### GHSA-848j-6mx2-7j84 (elliptic)
-
-**Severity:** High (but not exploitable in this plugin's context)
-
-**Affected component:** `elliptic` (transitive, via `vite-plugin-node-polyfills` → `node-stdlib-browser` → `crypto-browserify` → `browserify-sign`)
-
-**Description:** The elliptic library used in this plugin's development dependencies contains a prototype pollution vulnerability. This plugin is a **read-only** Headlamp plugin that never executes any cryptographic operations at runtime. The vulnerable code path requires:
- Use of `elliptic` curve operations on untrusted input, AND
- Ability for an attacker to influence the `elliptic` curve key generation input
-
-Neither condition is met in this plugin's runtime context.
-
-**Remediation:** No patched version of `elliptic` exists on npm. The current override in `package.json` (`"elliptic": ">=6.6.1"`) is a placeholder — no resolvable version satisfies this constraint.
-
-**Risk acceptance rationale:**
-1. Plugin has no write operations against the cluster
-2. All data flows through Headlamp's API proxy with standard RBAC enforcement
-3. The vulnerable dependency is only in the development/build toolchain, not runtime
-4. No untrusted input can reach `elliptic` curve operations through this plugin
-
-**Review date:** 2026-05-05
-**Reviewed by:** Hugh Hackman (VP Engineering Operations)
@@ -33,8 +33,7 @@
    "tar": "^7.5.11",
    "undici": "^7.24.3",
    "lodash": ">=4.18.0",
-    "vite": ">=6.4.2",
-    "elliptic": ">=6.6.1"
+    "vite": ">=6.4.2"
  },
  "devDependencies": {
    "@headlamp-k8s/eslint-config": "^0.6.0",