Merge pull request 'fix(ci): pass pr_number to dual-approval-check workflow' (#11 ) from fix/dual-approval-pr-number into main

merge
Merge pull request 'fix: add missing GITHUB_TOKEN to Renovate workflow' (#16 ) from gandalf/fix-renovate-token into main
2026-05-20 03:04:24 +00:00 · 2026-05-20 03:03:47 +00:00 · 2026-05-12 22:22:41 +00:00 · 2026-05-11 23:06:37 +00:00 · 2026-05-10 19:43:36 +00:00 · 2026-05-06 11:04:51 +00:00
6 changed files with 11683 additions and 0 deletions
@@ -15,4 +15,6 @@ on:
 jobs:
  dual-approval:
    uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
    secrets: inherit
@@ -0,0 +1,15 @@
+name: Renovate
+on:
+  schedule:
+    - cron: '0 3 * * *'
+  workflow_dispatch:
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: renovatebot/github-action@v40.3.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          configurationFile: renovate.json
+          renovate-json5: true
@@ -0,0 +1,20 @@
+{
+  // Allowlist for inherited dev-dependency CVEs from @kinvolk/headlamp-plugin
+  // CTO decision (PRI-854): these high-severity vulns are dev/build-time only,
+  // trace to @kinvolk/headlamp-plugin transitive deps (Picomatch, Vite, lodash),
+  // and do NOT ship in production plugin artifacts.
+  "allowlist": [
+    {
+      "id": "GHSA-hhpm-516h-p3p6",
+      "reason": "Picomatch ReDoS: devDependency only, does not ship in production plugin bundle"
+    },
+    {
+      "id": "GHSA-36xf-7xpp-53w5",
+      "reason": "Vite arbitrary file read: devDependency only, does not ship in production plugin bundle"
+    },
+    {
+      "id": "GHSA-jf8v-p3pp-93qh",
+      "reason": "lodash code injection via _.template: devDependency only, does not ship in production plugin bundle"
+    }
+  ]
+}
@@ -29,10 +29,20 @@
    "@testing-library/jest-dom": "^6.4.8",
    "@testing-library/react": "^16.0.0",
    "@testing-library/user-event": "^14.5.2",
+    "eslint": "^8.57.0",
    "jsdom": "^24.0.0",
+    "prettier": "^3.0.0",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-router-dom": "^5.3.0",
+    "typescript": "^5.6.2",
+    "vite": "^6.4.1",
+    "vite-plugin-svgr": "^4.5.0",
    "vitest": "^3.0.5"
+  },
+  "pnpm": {
+    "overrides": {
+      "elliptic": ">=6.6.1"
+    }
  }
 }
@@ -2,6 +2,7 @@
  "extends": "@kinvolk/headlamp-plugin/config/plugins-tsconfig.json",
  "compilerOptions": {
    "jsx": "react",
+    "skipLibCheck": true,
    "types": ["vite/client", "vite-plugin-svgr/client", "vitest/globals", "@testing-library/jest-dom"]
  },
  "include": ["src"]
Author	SHA1	Message	Date
Countess von Containerheim	1d1cb6babe	Merge pull request 'fix(ci): pass pr_number to dual-approval-check workflow' (#11 ) from fix/dual-approval-pr-number into main CI / ci (push) Failing after 8s Details merge	2026-05-20 03:04:24 +00:00
Countess von Containerheim	e66ea0dcd2	Merge pull request 'fix: add missing GITHUB_TOKEN to Renovate workflow' (#16 ) from gandalf/fix-renovate-token into main CI / ci (push) Failing after 3s Details fix: add missing GITHUB_TOKEN to Renovate workflow	2026-05-20 03:03:47 +00:00
privilegedescalation-engineer[bot]	46e7733cf5	chore(ci): add audit-ci allowlist for inherited @kinvolk/headlamp-plugin CVEs (PRI-855) QA reviewed and approved. Adds audit-ci.jsonc with 3 CVE allowlist entries for dev-only dependencies.	2026-05-12 22:22:41 +00:00
Chris Farhood	23db059a23	fix: add missing GITHUB_TOKEN to Renovate workflow The Renovate workflow was failing because the token parameter was removed in commit `0955832`. This commit restores the required GITHUB_TOKEN parameter so Renovate can authenticate and create PRs for dependency updates. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-11 23:06:37 +00:00
privilegedescalation-ceo[bot]	fc5796d2ca	chore(renovate): add self-hosted Renovate GitHub Action workflow chore(renovate): add self-hosted Renovate GitHub Action workflow	2026-05-10 19:43:36 +00:00
Chris Farhood	0955832d4a	chore(renovate): pin action to v40.3.0, fix inputs per spec	2026-05-06 11:04:51 +00:00
privilegedescalation-engineer[bot]	b704a381d4	chore(renovate): add self-hosted Renovate GitHub Action workflow	2026-05-06 10:51:38 +00:00
Chris Farhood	066db0b902	fix(ci): pass pr_number to dual-approval-check workflow Passes github.event.pull_request.number to the reusable workflow so dual-approval status checks work correctly on PRs instead of always receiving pr_number=0.	2026-05-06 02:18:50 +00:00
privilegedescalation-engineer[bot]	59cfa0bd78	fix: override elliptic for GHSA-848j-6mx2-7j84 * fix: override elliptic to patched version for GHSA-848j-6mx2-7j84 * chore: regenerate pnpm-lock.yaml for elliptic override Co-Authored-By: Paperclip <noreply@paperclip.ing> --------- Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-05-06 02:14:16 +00:00
privilegedescalation-ceo[bot]	d30d4894cf	Merge pull request #8 from privilegedescalation/fix/add-eslint-direct-dependency fix: add eslint as direct devDependency (unblocks PRI-556, PRI-568)	2026-05-05 10:30:59 +00:00
Chris Farhood	514d306eea	fix: add prettier as direct devDependency prettier is needed by the format:check script but was only available as a transitive dependency of @kinvolk/headlamp-plugin. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 20:00:49 +00:00
Chris Farhood	f07a4c7775	fix: add missing direct devDependencies to package.json This is a prerequisite for CI to work with pnpm --frozen-lockfile. Missing direct devDependencies that were only available transitively: - eslint (lint script needs it) - typescript (tsc script needs it) - vite (provides vite/client.d.ts type definitions) - vite-plugin-svgr (provides vite-plugin-svgr/client.d.ts type definitions) Also fixed: tsconfig.json was missing skipLibCheck: true which caused errors when type definitions referenced packages not in node_modules. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 19:58:07 +00:00
Chris Farhood	b204491808	fix: add typescript as direct devDependency (fixes tsc not found) PR #8 revealed that typescript is also missing as a direct dependency. The tsc script calls 'tsc --noEmit' but typescript was only available as a transitive dependency, causing CI to fail with 'tsc: not found'. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 19:53:42 +00:00
Chris Farhood	8600cedb64	fix: add eslint as direct devDependency ESLint was only a transitive dependency of @kinvolk/headlamp-plugin. Without it as a direct devDependency, CI fails at the lint step with 'eslint: not found' when using --frozen-lockfile. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 19:51:07 +00:00