chore: trigger CI run [skip ci]

* chore(e2e): delete all E2E files and cleanup

Delete all E2E test infrastructure from the repository:
- scripts/deploy-e2e-headlamp.sh
- scripts/teardown-e2e-headlamp.sh
- .github/workflows/e2e.yaml
- playwright.config.ts
- e2e/ directory (auth.setup.ts, kube-vip.spec.ts)

Also removed e2e and e2e:headed scripts from package.json and removed
@playwright/test devDependency.

Context: [PRI-1133](https://github.com/privilegedescalation/paperclip-internal/issues/PRI-1133) — full E2E purge across org.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* fix: update pnpm-lock.yaml after E2E deletion

Remove @playwright/test dependencies after E2E infrastructure cleanup.
Resolves ERR_PNPM_OUTDATED_LOCKFILE on PR.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

* Add self-hosted Renovate runner workflow

Creates .github/workflows/renovate.yaml using renovatebot/github-action
with a GitHub App token on a weekly schedule. Extends the shared
 renovate-config from the privilegedescalation/.github repository.

Part of PRI-413

Co-Authored-By: Paperclip <noreply@paperclip.ing>

---------

Co-authored-by: Chris Farhood <chris@farhood.org>
Co-authored-by: Paperclip <noreply@paperclip.ing>

.github/workflows/ci.yaml

@@ -2,9 +2,9 @@ name: CI
 
 on:
   push:
-    branches: [main]
+    branches: [main, dev, uat]
   pull_request:
-    branches: [main]
+    branches: [main, dev, uat]
   workflow_call:
   workflow_dispatch:
 

.github/workflows/dual-approval.yaml

@@ -0,0 +1,21 @@
+name: Promotion Gate
+
+# Calls the shared promotion gate workflow.
+# dev PRs: no gate (engineer self-merges).
+# uat PRs: QA approval required.
+# main PRs: UAT approval required (uat→main promotions).
+
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+  pull_request:
+    branches: [uat, main]
+    types: [opened, reopened, synchronize]
+
+jobs:
+  promotion-gate:
+    uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
+    secrets: inherit
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
+

.github/workflows/release.yaml

@@ -7,6 +7,8 @@ on:
         description: 'Release version (e.g. 1.0.0)'
         required: true
         type: string
+  repository_dispatch:
+    types: [release]
 
 permissions:
   contents: write
@@ -15,6 +17,10 @@ permissions:
 jobs:
   release:
     uses: privilegedescalation/.github/.github/workflows/plugin-release.yaml@main
+    secrets:
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     with:
-      version: ${{ inputs.version }}
+      version: ${{ inputs.version || github.event.client_payload.version }}
       upstream-repo: 'kube-vip/kube-vip'
+

.github/workflows/renovate-app-token.yaml

@@ -0,0 +1,21 @@
+name: Mend Renovate GitHub App Token
+
+on:
+  workflow_call:
+    outputs:
+      token:
+        description: "Short-lived GitHub App installation token"
+        value: ${{ jobs.app-token.outputs.token }}
+
+jobs:
+  app-token:
+    runs-on: runners-privilegedescalation
+    outputs:
+      token: ${{ steps.app-token.outputs.token }}
+    steps:
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}

.github/workflows/renovate.yaml

@@ -0,0 +1,20 @@
+name: Renovate
+on:
+  schedule:
+    - cron: '0 3 * * 0'
+  workflow_dispatch:
+jobs:
+  renovate:
+    runs-on: runners-privilegedescalation
+    steps:
+      - uses: actions/checkout@v4
+      - name: Generate GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@v3
+        with:
+          app-id: ${{ secrets.RELEASE_APP_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+      - uses: renovatebot/github-action@v40.3.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          configurationFile: renovate.json

.gitignore

@@ -5,3 +5,9 @@ dist/
 .env
 .env.local
 .eslintcache
+
+# E2E
+e2e/.auth/
+.env.e2e
+playwright-report/
+test-results/

.markdownlint-cli2.jsonc

@@ -0,0 +1,53 @@
+{
+  "config": {
+    // Line length — not enforced for docs with code examples
+    "MD013": false,
+    // First line heading — files use YAML frontmatter, not headings
+    "MD041": false,
+    // Emphasis as heading — common pattern for Option 1/2/3 sections
+    "MD036": false,
+    // No duplicate heading — changelog files repeat section names intentionally
+    "MD024": false,
+    // Fenced code language — not always applicable for diagram blocks
+    "MD040": false,
+    // Table column style — table alignment is visual, not semantic
+    "MD060": false,
+    // Ordered list item prefix — number resets are intentional in documents
+    "MD029": false,
+    // No inline HTML — each elements are valid in valid Markdown
+    "MD033": false,
+    // List marker space — spacing after list markers varies by editor
+    "MD030": false,
+    // Blanks around headings — not always needed in compact docs
+    "MD022": false,
+    // Blanks around lists — not always needed in compact docs
+    "MD032": false,
+    // Blanks around fences — not always needed between adjacent blocks
+    "MD031": false,
+    // Multiple blanks — editor artifacts, not semantic
+    "MD012": false,
+    // Single title — files may have multiple H1 sections
+    "MD025": false,
+    // Trailing spaces — editor artifacts
+    "MD009": false,
+    // Bare URLs — URL shortening not always needed
+    "MD034": false,
+    // Single trailing newline — editor artifacts
+    "MD047": false,
+    // Trailing punctuation — heading punctuation is intentional
+    "MD026": false,
+    // Space in emphasis — double-asterisk bold spacing varies by renderer
+    "MD037": false,
+    // No hard tabs — some generated docs use tabs for indentation
+    "MD010": false,
+    // Code block style — generated docs may use inconsistent styles
+    "MD046": false,
+    // Comment style — generated docs have no comments
+    "MD048": false,
+    // Commands show output — shell examples intentionally show only commands
+    "MD014": false
+  },
+  "ignores": [
+    "docs/api-reference/generated/**"
+  ]
+}

.markdownlintignore

@@ -0,0 +1 @@
+docs/api-reference/generated/**

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## [1.0.0] - 2026-03-24
+
+### Added
+
+- Add missing devDependencies to align with reference plugin: `@mui/material`, `@types/react`, `@types/react-dom`, `notistack`
+- Pin `vitest` to `^3.2.4`
+- Add dual-approval caller workflow for CI
+
+### Changed
+
+- Bump version from 0.1.5 to 1.0.0 (stable release)
+- Extend Renovate config from org-level preset
+- Add pinDigests for GitHub Actions SHA pinning
+
 ## [0.1.3] - 2026-03-04
 
 ### Fixed
@@ -38,3 +52,9 @@
 - Nodes page with kube-vip pod status and leader designation
 - Configuration page with DaemonSet config, IP pools, leases
 - Service detail section injected into native Headlamp Service views
+
+[1.0.0]: https://github.com/privilegedescalation/headlamp-kube-vip-plugin/compare/v0.1.5...v1.0.0
+[0.1.3]: https://github.com/privilegedescalation/headlamp-kube-vip-plugin/compare/v0.1.2...v0.1.3
+[0.1.2]: https://github.com/privilegedescalation/headlamp-kube-vip-plugin/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/privilegedescalation/headlamp-kube-vip-plugin/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/privilegedescalation/headlamp-kube-vip-plugin/releases/tag/v0.1.0

SECURITY.md

@@ -22,3 +22,28 @@ All data is fetched through Headlamp's built-in API proxy, which respects the us
 ## Reporting a Vulnerability
 
 Please report security vulnerabilities by opening a private issue or emailing the maintainers directly.
+
+## Known Low-Severity Vulnerabilities
+
+### GHSA-848j-6mx2-7j84 (elliptic)
+
+**Severity:** High (but not exploitable in this plugin's context)
+
+**Affected component:** `elliptic` (transitive, via `vite-plugin-node-polyfills` → `node-stdlib-browser` → `crypto-browserify` → `browserify-sign`)
+
+**Description:** The elliptic library used in this plugin's development dependencies contains a prototype pollution vulnerability. This plugin is a **read-only** Headlamp plugin that never executes any cryptographic operations at runtime. The vulnerable code path requires:
+- Use of `elliptic` curve operations on untrusted input, AND
+- Ability for an attacker to influence the `elliptic` curve key generation input
+
+Neither condition is met in this plugin's runtime context.
+
+**Remediation:** No patched version of `elliptic` exists on npm. The current override in `package.json` (`"elliptic": ">=6.6.1"`) is a placeholder — no resolvable version satisfies this constraint.
+
+**Risk acceptance rationale:**
+1. Plugin has no write operations against the cluster
+2. All data flows through Headlamp's API proxy with standard RBAC enforcement
+3. The vulnerable dependency is only in the development/build toolchain, not runtime
+4. No untrusted input can reach `elliptic` curve operations through this plugin
+
+**Review date:** 2026-05-05
+**Reviewed by:** Hugh Hackman (VP Engineering Operations)

artifacthub-pkg.yml

@@ -1,4 +1,4 @@
-version: "0.1.4"
+version: "1.0.2"
 name: headlamp-kube-vip
 displayName: kube-vip
 createdAt: "2026-03-04T00:00:00Z"
@@ -25,7 +25,22 @@ maintainers:
 provider:
   name: privilegedescalation
 annotations:
-  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-kube-vip-plugin/releases/download/v0.1.4/kube-vip-0.1.4.tar.gz"
-  headlamp/plugin/archive-checksum: sha256:d926d467a091e7b346afd3f6a09abc2205b7a8c290ecf65920f45df6206f7017
+  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-kube-vip-plugin/releases/download/v1.0.2/kube-vip-1.0.2.tar.gz"
+  headlamp/plugin/archive-checksum: sha256:cb6b8b6d93a41c129304c57ed705cdafbcb4d6e7511ce5bad0aa05d5762c3fbf
   headlamp/plugin/version-compat: ">=0.26"
   headlamp/plugin/distro-compat: "in-cluster"
+changes:
+  - kind: changed
+    description: "Fix ArtifactHub checksum for v1.0.0 release tarball"
+  - kind: added
+    description: "v1.0.0 stable release"
+  - kind: changed
+    description: "Bump version from 0.1.5 to 1.0.0"
+  - kind: changed
+    description: "Add missing devDependencies: @mui/material, @types/react, @types/react-dom, notistack; pin vitest to ^3.2.4"
+  - kind: changed
+    description: "Extend Renovate config from org-level preset"
+  - kind: changed
+    description: "Add pinDigests for GitHub Actions SHA pinning"
+  - kind: changed
+    description: "Add dual-approval caller workflow"

audit-ci.jsonc

@@ -0,0 +1,20 @@
+{
+  // Allowlist for inherited dev-dependency CVEs from @kinvolk/headlamp-plugin
+  // CTO decision (PRI-854): these high-severity vulns are dev/build-time only,
+  // trace to @kinvolk/headlamp-plugin transitive deps (Picomatch, Vite, lodash),
+  // and do NOT ship in production plugin artifacts.
+  "allowlist": [
+    {
+      "id": "GHSA-hhpm-516h-p3p6",
+      "reason": "Picomatch ReDoS: devDependency only, does not ship in production plugin bundle"
+    },
+    {
+      "id": "GHSA-36xf-7xpp-53w5",
+      "reason": "Vite arbitrary file read: devDependency only, does not ship in production plugin bundle"
+    },
+    {
+      "id": "GHSA-jf8v-p3pp-93qh",
+      "reason": "lodash code injection via _.template: devDependency only, does not ship in production plugin bundle"
+    }
+  ]
+}

package.json

@@ -1,6 +1,6 @@
 {
   "name": "kube-vip",
-  "version": "0.1.4",
+  "version": "1.0.2",
   "description": "Headlamp plugin for kube-vip virtual IP and load balancer visibility",
   "repository": {
     "type": "git",
@@ -12,6 +12,7 @@
   "homepage": "https://github.com/privilegedescalation/headlamp-kube-vip-plugin#readme",
   "author": "privilegedescalation",
   "license": "Apache-2.0",
+  "packageManager": "pnpm@10.32.1",
   "scripts": {
     "start": "headlamp-plugin start",
     "build": "headlamp-plugin build",
@@ -30,17 +31,28 @@
   },
   "overrides": {
     "tar": "^7.5.11",
-    "undici": "^7.24.3"
+    "undici": "^7.24.3",
+    "lodash": ">=4.18.0",
+    "vite": ">=6.4.2",
+    "elliptic": ">=6.6.1"
   },
   "devDependencies": {
+    "@headlamp-k8s/eslint-config": "^0.6.0",
     "@kinvolk/headlamp-plugin": "^0.13.0",
+    "@mui/material": "^5.15.14",
     "@testing-library/jest-dom": "^6.4.8",
     "@testing-library/react": "^16.0.0",
     "@testing-library/user-event": "^14.5.2",
+    "@types/react": "^18.0.0",
+    "@types/react-dom": "^18.0.0",
+    "eslint": "^8.57.0",
     "jsdom": "^24.0.0",
+    "notistack": "^3.0.0",
+    "prettier": "^2.8.8",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
     "react-router-dom": "^5.3.0",
-    "vitest": "^3.0.5"
+    "typescript": "~5.6.2",
+    "vitest": "^3.2.4"
   }
 }

renovate.json

@@ -1,19 +1,21 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "baseBranches": ["main"],
-  "schedule": ["every weekend"],
-  "prConcurrentLimit": 10,
+  "extends": ["github>privilegedescalation/.github:renovate-config"],
   "packageRules": [
     {
-      "matchManagers": ["npm"],
+      "description": "Auto-merge minor and patch updates for @kinvolk/headlamp-plugin",
+      "matchPackageNames": ["@kinvolk/headlamp-plugin"],
       "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "npm minor and patch"
+      "automerge": true,
+      "automergeType": "pr"
     },
     {
-      "matchManagers": ["github-actions"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "github-actions minor and patch"
+      "description": "Auto-merge security patches for @kinvolk/headlamp-plugin immediately",
+      "matchPackageNames": ["@kinvolk/headlamp-plugin"],
+      "matchUpdateTypes": ["security"],
+      "automerge": true,
+      "automergeType": "pr",
+      "labels": ["security"]
     }
   ]
 }