feat: add Artifact Hub metadata and GitHub Actions release workflow

Artifact Hub requires a GitHub-hosted repo for Headlamp plugins.
Since Gitea push-mirrors git objects but not releases, a GitHub
Actions workflow builds and publishes GitHub Releases with the
tarball that Artifact Hub needs.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/release.yml

@@ -0,0 +1,37 @@
+name: GitHub Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build plugin
+        run: npx @kinvolk/headlamp-plugin build
+
+      - name: Package tarball
+        run: npx @kinvolk/headlamp-plugin package
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: "*.tar.gz"
+          generate_release_notes: true

README.md

@@ -0,0 +1,194 @@
+# polaris-headlamp-plugin
+
+A [Headlamp](https://headlamp.dev/) plugin that surfaces [Fairwinds Polaris](https://polaris.docs.fairwinds.com/) audit results directly in the Headlamp UI.
+
+## What It Does
+
+Adds a **Polaris** sidebar entry to Headlamp that displays:
+
+- **Cluster Score** -- overall Polaris score as a percentage (color-coded green/amber/red)
+- **Check Summary** -- total, pass, warning, and danger counts across all workloads
+- **Cluster Info** -- node, pod, namespace, and controller counts
+
+Data is read from the `ConfigMap/polaris-dashboard` in the `polaris` namespace (key: `dashboard.json`), which is created by the standard Polaris Helm chart. The plugin is read-only -- it never writes to the cluster.
+
+Results are cached and refreshed on a user-configurable interval (1 / 5 / 10 / 30 minutes, default 5). The setting persists in the browser's localStorage.
+
+Error states are handled explicitly: RBAC denied (403), Polaris not installed (404), malformed JSON, and loading.
+
+## Prerequisites
+
+- **Headlamp** >= v0.26 deployed in your cluster
+- **Polaris** installed via the [official Helm chart](https://github.com/FairwindsOps/polaris) with the dashboard component enabled
+- The Headlamp service account must have RBAC permission to `get` ConfigMaps in the `polaris` namespace
+
+## Development
+
+### Setup
+
+```bash
+git clone https://git.farh.net/farhoodliquor/polaris-headlamp-plugin.git
+cd polaris-headlamp-plugin
+npm install
+```
+
+### Run locally (hot reload)
+
+```bash
+npm start
+```
+
+This starts the Headlamp plugin dev server. Point a running Headlamp instance at the dev server to see changes live.
+
+### Build for production
+
+```bash
+npm run build        # outputs dist/main.js
+npm run package      # creates polaris-headlamp-plugin-<version>.tar.gz
+```
+
+### Type-check
+
+```bash
+npm run tsc
+```
+
+## Project Structure
+
+```
+src/
+  index.tsx                  -- Entry point. Registers sidebar entry and route at /polaris.
+  api/
+    polaris.ts               -- TypeScript types matching the Polaris AuditData schema,
+                                usePolarisData() hook with caching, countResults() utility,
+                                and refresh interval settings (localStorage).
+  components/
+    PolarisView.tsx          -- Main page component. Score badge, check summary cards,
+                                cluster info, error states, refresh interval selector.
+```
+
+## Deploying to Headlamp
+
+### Option 1: Docker init container (recommended for Kubernetes)
+
+The plugin ships as a container image at `git.farh.net/farhoodliquor/polaris-headlamp-plugin`.
+
+Add it as an init container in your Headlamp Helm values:
+
+```yaml
+initContainers:
+  - name: polaris-plugin
+    image: git.farh.net/farhoodliquor/polaris-headlamp-plugin:v0.0.1
+    command: ["sh", "-c", "cp -r /plugins/* /headlamp/plugins/"]
+    volumeMounts:
+      - name: plugins
+        mountPath: /headlamp/plugins
+
+volumes:
+  - name: plugins
+    emptyDir: {}
+
+volumeMounts:
+  - name: plugins
+    mountPath: /headlamp/plugins
+```
+
+### Option 2: Manual tarball install
+
+Download the `.tar.gz` from the [releases page](https://git.farh.net/farhoodliquor/polaris-headlamp-plugin/releases), then extract into Headlamp's plugin directory:
+
+```bash
+tar xzf polaris-headlamp-plugin-0.0.1.tar.gz -C /headlamp/plugins/
+```
+
+### Option 3: Build from source
+
+```bash
+npm install
+npm run build
+npx @kinvolk/headlamp-plugin extract . /headlamp/plugins
+```
+
+## Releasing
+
+Releases are automated via Gitea Actions. To cut a release:
+
+```bash
+# Bump version in package.json, then:
+git add package.json package-lock.json
+git commit -m "chore: bump version to 0.0.2"
+git tag v0.0.2
+git push origin main v0.0.2
+```
+
+The CI pipeline (`.gitea/workflows/release.yaml`) will:
+
+1. Build the plugin in a `node:20` container
+2. Package a `.tar.gz` tarball
+3. Build and push a Docker image to `git.farh.net/farhoodliquor/polaris-headlamp-plugin:{tag}` and `:latest`
+4. Create a Gitea release with the tarball attached
+
+### CI secrets
+
+| Secret | Purpose |
+|---|---|
+| `REGISTRY_TOKEN` | Gitea personal access token with `package:write` scope, used to push Docker images to the container registry |
+
+The release creation itself uses the built-in `github.token` -- no extra secret needed for that.
+
+## RBAC
+
+The plugin reads a single ConfigMap. Minimum RBAC required for the Headlamp service account:
+
+```yaml
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: headlamp-polaris-reader
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    resourceNames: ["polaris-dashboard"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: headlamp-polaris-reader
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: headlamp-polaris-reader
+subjects:
+  - kind: ServiceAccount
+    name: headlamp
+    namespace: headlamp
+```
+
+## Data Source
+
+The plugin reads from:
+
+- **ConfigMap**: `polaris-dashboard`
+- **Namespace**: `polaris`
+- **Key**: `dashboard.json`
+
+This ConfigMap is created automatically when Polaris is installed with the dashboard enabled. The JSON structure matches Polaris's `AuditData` schema (`pkg/validator/output.go`):
+
+```
+AuditData
+  Score            -- cluster score (0-100)
+  ClusterInfo      -- nodes, pods, namespaces, controllers
+  Results[]        -- per-workload results
+    Results{}      -- top-level check results (ResultSet)
+    PodResult
+      Results{}    -- pod-level check results
+      ContainerResults[]
+        Results{}  -- container-level check results
+```
+
+Each check in a `ResultSet` has `Success` (bool) and `Severity` (`"warning"` or `"danger"`).
+
+## License
+
+MIT

artifacthub-pkg.yml

@@ -0,0 +1,28 @@
+version: 0.0.1
+name: polaris-headlamp-plugin
+displayName: Polaris
+createdAt: "2026-02-05T19:00:00Z"
+description: Surfaces Fairwinds Polaris audit results inside the Headlamp UI.
+license: MIT
+homeURL: "https://github.com/cpfarhood/polaris-headlamp-plugin"
+category: security
+keywords:
+  - polaris
+  - fairwinds
+  - security
+  - audit
+  - headlamp
+  - kubernetes
+links:
+  - name: Source
+    url: "https://github.com/cpfarhood/polaris-headlamp-plugin"
+  - name: Polaris
+    url: "https://polaris.docs.fairwinds.com/"
+maintainers:
+  - name: cpfarhood
+    email: ""
+annotations:
+  headlamp/plugin/archive-url: "https://github.com/cpfarhood/polaris-headlamp-plugin/releases/download/v0.0.1/polaris-headlamp-plugin-0.0.1.tar.gz"
+  headlamp/plugin/version-compat: ">=0.26"
+  headlamp/plugin/archive-checksum: sha256:456f09cf8b126816b80c723b6c6f300b2af0c2e1288ee67da13f435b0e35c04d
+  headlamp/plugin/distro-compat: in-cluster

artifacthub-repo.yml

@@ -1,4 +1,4 @@
 repositoryID: polaris-headlamp-plugin
 owners:
-  - name: farhoodliquor
+  - name: cpfarhood
     email: ""