fix(e2e): add cluster diagnostics to deploy step for faster triage

Add pre-deployment node/namespace/resource diagnostics and wrap
kubectl apply in explicit error handling with cluster state dump on
failure. This gives us actionable output in the GitHub Actions logs
when the Deploy E2E step fails, instead of a silent exit code.

PRI-956

Co-Authored-By: Paperclip <noreply@paperclip.ing>

.github/workflows/ci.yaml

@@ -7,210 +7,7 @@ on:
     branches: [main, dev]
   workflow_dispatch:
   workflow_call:
-    inputs:
-      node-version:
-        description: 'Node.js version to use'
-        required: false
-        type: string
-        default: '22'
 
 jobs:
   ci:
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    container: node:22-slim
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Install Python
-        run: apt-get update && apt-get install -y --no-install-recommends python3 python3-yaml
-
-      - name: Validate artifacthub-pkg.yml
-        run: |
-          python3 - <<'EOF'
-          import sys, re
-          try:
-              import yaml
-          except ImportError:
-              print("::warning::PyYAML not available, skipping artifacthub-pkg.yml validation")
-              sys.exit(0)
-
-          try:
-              with open("artifacthub-pkg.yml") as f:
-                  pkg = yaml.safe_load(f)
-          except FileNotFoundError:
-              print("::error::artifacthub-pkg.yml not found")
-              sys.exit(1)
-          except yaml.YAMLError as e:
-              print(f"::error::artifacthub-pkg.yml is invalid YAML: {e}")
-              sys.exit(1)
-
-          errors = []
-
-          for field in ["version", "name", "description", "homeURL"]:
-              if not pkg.get(field):
-                  errors.append(f"Missing required field: {field}")
-
-          version = pkg.get("version", "")
-          if version and not re.match(r'^\d+\.\d+\.\d+$', str(version)):
-              errors.append(f"version '{version}' is not SemVer (expected X.Y.Z)")
-
-          annotations = pkg.get("annotations", {}) or {}
-          archive_url = annotations.get("headlamp/plugin/archive-url", "")
-          archive_checksum = annotations.get("headlamp/plugin/archive-checksum", "")
-
-          if not archive_url:
-              errors.append("Missing annotation: headlamp/plugin/archive-url")
-          if not archive_checksum:
-              errors.append("Missing annotation: headlamp/plugin/archive-checksum")
-          elif not re.match(r'^sha256:[0-9a-f]{64}$', str(archive_checksum)):
-              errors.append(f"archive-checksum has unexpected format: '{archive_checksum}' (expected sha256:<64 hex chars>)")
-
-          if errors:
-              for e in errors:
-                  print(f"::error::{e}")
-              sys.exit(1)
-
-          print(f"artifacthub-pkg.yml valid: name={pkg['name']} version={pkg['version']}")
-          EOF
-
-      - name: Detect package manager
-        id: pkg-manager
-        run: |
-          if [ -f "pnpm-lock.yaml" ]; then
-            echo "manager=pnpm" >> $GITHUB_OUTPUT
-            PM=$(python3 -c "import json,sys; d=json.load(open('package.json')); print('true' if d.get('packageManager','').startswith('pnpm@') else 'false')" 2>/dev/null || echo "false")
-            echo "has_package_manager=$PM" >> $GITHUB_OUTPUT
-          else
-            echo "manager=npm" >> $GITHUB_OUTPUT
-            echo "has_package_manager=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ inputs.node-version }}
-          cache: ${{ steps.pkg-manager.outputs.manager == 'npm' && 'npm' || '' }}
-
-      - name: Setup pnpm (via Corepack, reads version from packageManager field)
-        if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'true'
-        run: |
-          npm install -g corepack
-          corepack enable pnpm
-          corepack install
-
-      - name: Setup pnpm (version latest)
-        if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'false'
-        uses: pnpm/action-setup@v5
-        with:
-          run_install: false
-          version: latest
-
-      - name: Get pnpm store directory
-        id: pnpm-store
-        if: steps.pkg-manager.outputs.manager == 'pnpm'
-        run: echo "dir=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
-
-      - name: Cache pnpm store
-        if: steps.pkg-manager.outputs.manager == 'pnpm'
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.pnpm-store.outputs.dir }}
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-
-      - name: Validate pnpm lockfile freshness
-        if: steps.pkg-manager.outputs.manager == 'pnpm'
-        run: |
-          if [ ! -f "pnpm-lock.yaml" ]; then
-            echo "No pnpm-lock.yaml found, skipping lockfile freshness check"
-            exit 0
-          fi
-          if ! grep -q 'overrides:' pnpm-lock.yaml 2>/dev/null; then
-            echo "No overrides section in pnpm-lock.yaml, skipping lockfile freshness check"
-            exit 0
-          fi
-          echo "Detected pnpm-lock.yaml with overrides section. Checking lockfile freshness..."
-          ERR_FILE=$(mktemp)
-          if pnpm install --frozen-lockfile 2>&1 | tee "$ERR_FILE"; then
-            echo "Lockfile is fresh."
-          else
-            if grep -q "CONFIG_MISMATCH\|EBADLOCKFILE\|ERR_PNPM_LOCKFILE" "$ERR_FILE"; then
-              echo ""
-              echo "::error::pnpm-lock.yaml is out of sync with package.json overrides."
-              echo "::error::This typically happens when transitive dependencies change but the lockfile wasn't regenerated."
-              echo "::error::Run 'pnpm install' to regenerate the lockfile and commit the updated pnpm-lock.yaml."
-              rm -f "$ERR_FILE"
-              exit 1
-            fi
-            rm -f "$ERR_FILE"
-            echo "::warning::Install failed with a different error. Will retry in the Install dependencies step."
-          fi
-
-      - name: Install dependencies
-        run: |
-          max_attempts=3
-          attempt=1
-          while [ $attempt -le $max_attempts ]; do
-            echo "Attempt $attempt of $max_attempts"
-            if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-              pnpm install --frozen-lockfile && break
-            else
-              npm ci && break
-            fi
-            if [ $attempt -lt $max_attempts ]; then
-              echo "::warning::Install step failed on attempt $attempt. Retrying in 5 seconds..."
-              sleep 5
-            fi
-            attempt=$((attempt + 1))
-          done
-          if [ $attempt -gt $max_attempts ]; then
-            echo "::error::Install step failed after $max_attempts attempts."
-            exit 1
-          fi
-
-      - name: Build plugin
-        run: npx @kinvolk/headlamp-plugin build
-
-      - name: Lint
-        run: |
-          if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-            pnpm run lint
-          else
-            npm run lint
-          fi
-
-      - name: Type-check
-        run: |
-          if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-            pnpm run tsc
-          else
-            npm run tsc
-          fi
-
-      - name: Format check
-        run: |
-          if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-            pnpm run format:check
-          else
-            npm run format:check
-          fi
-
-      - name: Run tests
-        run: |
-          if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-            pnpm test
-          else
-            npm test
-          fi
-
-      - name: Security audit
-        run: |
-          if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-            npx audit-ci --pnpm --audit-level=high --config ./audit-ci.jsonc
-          else
-            npx audit-ci --npm --audit-level=high --config ./audit-ci.jsonc
-          fi
+    uses: privilegedescalation/.github/.github/workflows/plugin-ci.yaml@main

.github/workflows/e2e.yaml

@@ -16,8 +16,9 @@ concurrency:
 
 jobs:
   e2e:
-    uses: privilegedescalation/.github/.github/workflows/plugin-e2e.yaml@hugh/add-pnpm-support-plugin-e2e
+    uses: privilegedescalation/.github/.github/workflows/plugin-e2e.yaml@main
     with:
-      node-version: '22'
+      node-version: "22"
       headlamp-version: v0.40.1
       e2e-namespace: headlamp-dev
+      plugin-name: rook

.github/workflows/release.yaml

@@ -14,392 +14,12 @@ permissions:
   contents: write
   pull-requests: write
 
-concurrency:
-  group: release
-  cancel-in-progress: false
-
 jobs:
-  check-secrets:
-    runs-on: runners-privilegedescalation
-    outputs:
-      ready: ${{ steps.check.outputs.ready }}
-    steps:
-      - name: Verify GITEA_RELEASE_TOKEN is configured
-        id: check
-        env:
-          GITEA_RELEASE_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-        run: |
-          if [ -z "$GITEA_RELEASE_TOKEN" ]; then
-            echo "::notice::GITEA_RELEASE_TOKEN org secret is not configured (see PRI-1533). Release skipped — no artifacts will be created."
-            echo "ready=false" >> $GITHUB_OUTPUT
-          else
-            echo "ready=true" >> $GITHUB_OUTPUT
-          fi
-
-  ci:
-    needs: check-secrets
-    if: needs.check-secrets.outputs.ready == 'true'
-    uses: ./.github/workflows/ci.yaml
-    with:
-      node-version: ${{ inputs.node-version || '22' }}
-
-  check-token-permissions:
-    needs: check-secrets
-    if: needs.check-secrets.outputs.ready == 'true'
-    runs-on: runners-privilegedescalation
-    outputs:
-      has_write: ${{ steps.check.outputs.has_write }}
-    steps:
-      - name: Check write permissions via API
-        id: check
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
-            -X POST \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Accept: application/json" \
-            "https://git.farh.net/api/v1/repos/${REPO}/git/refs" \
-            -d '{"ref":"refs/heads/_release_check","sha":"${{ github.sha }}"}')
-          if [ "$HTTP_CODE" = "201" ]; then
-            echo "::notice::Token has write permission — cleaning up test ref."
-            curl -sf -o /dev/null -w "%{http_code}" \
-              -X DELETE \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              "https://git.farh.net/api/v1/repos/${REPO}/git/refs/heads/_release_check"
-            echo "has_write=true" >> $GITHUB_OUTPUT
-          elif [ "$HTTP_CODE" = "403" ]; then
-            echo "::error::Token lacks write permission. Release cannot push tags or branches."
-            echo "has_write=false" >> $GITHUB_OUTPUT
-            exit 1
-          else
-            echo "::warning::Unexpected response ($HTTP_CODE) when checking write permission."
-            echo "has_write=false" >> $GITHUB_OUTPUT
-            exit 1
-          fi
-
-  check-tag:
-    needs: check-secrets
-    if: needs.check-secrets.outputs.ready == 'true'
-    runs-on: runners-privilegedescalation
-    outputs:
-      skip: ${{ steps.check.outputs.skip }}
-    steps:
-      - name: Check if tag already exists
-        id: check
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            "https://git.farh.net/api/v1/repos/${REPO}/git/refs/tags/v${{ inputs.version }}")
-          if [ "$HTTP_CODE" = "200" ]; then
-            echo "::notice::Tag v${{ inputs.version }} already exists. Release skipped (not an error)."
-            echo "skip=true" >> $GITHUB_OUTPUT
-          else
-            echo "skip=false" >> $GITHUB_OUTPUT
-          fi
-
   release:
-    needs: [ci, check-tag, check-secrets, check-token-permissions]
-    if: needs.check-secrets.outputs.ready == 'true' && needs.check-tag.outputs.skip != 'true' && needs.check-token-permissions.outputs.has_write == 'true'
-    runs-on: runners-privilegedescalation
-    timeout-minutes: 10
+    uses: privilegedescalation/.github/.github/workflows/plugin-release.yaml@main
+    secrets:
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+    with:
+      version: ${{ inputs.version || github.event.client_payload.version }}
 
-    steps:
-      - name: Validate version format
-        run: |
-          if [[ ! "${{ inputs.version }}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "Error: Version must be in X.Y.Z format"
-            exit 1
-          fi
-
-      - name: Checkout
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Detect package manager
-        id: pkg-manager
-        run: |
-          if [ -f "pnpm-lock.yaml" ]; then
-            echo "manager=pnpm" >> $GITHUB_OUTPUT
-            echo "lockfile=pnpm-lock.yaml" >> $GITHUB_OUTPUT
-            PM=$(python3 -c "import json,sys; d=json.load(open('package.json')); print('true' if d.get('packageManager','').startswith('pnpm@') else 'false')" 2>/dev/null || echo "false")
-            echo "has_package_manager=$PM" >> $GITHUB_OUTPUT
-          else
-            echo "manager=npm" >> $GITHUB_OUTPUT
-            echo "lockfile=package-lock.json" >> $GITHUB_OUTPUT
-            echo "has_package_manager=false" >> $GITHUB_OUTPUT
-          fi
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: ${{ inputs.node-version || '22' }}
-          cache: ${{ steps.pkg-manager.outputs.manager == 'npm' && 'npm' || '' }}
-
-      - name: Setup pnpm (via Corepack)
-        if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'true'
-        run: |
-          npm install -g corepack
-          corepack enable pnpm
-          corepack install
-
-      - name: Setup pnpm (version latest)
-        if: steps.pkg-manager.outputs.manager == 'pnpm' && steps.pkg-manager.outputs.has_package_manager == 'false'
-        uses: pnpm/action-setup@v5
-        with:
-          run_install: false
-          version: latest
-
-      - name: Get pnpm store directory
-        id: pnpm-store
-        if: steps.pkg-manager.outputs.manager == 'pnpm'
-        run: echo "dir=$(pnpm store path --silent)" >> $GITHUB_OUTPUT
-
-      - name: Cache pnpm store
-        if: steps.pkg-manager.outputs.manager == 'pnpm'
-        uses: actions/cache@v5
-        with:
-          path: ${{ steps.pnpm-store.outputs.dir }}
-          key: ${{ runner.os }}-pnpm-${{ hashFiles('**/pnpm-lock.yaml') }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-
-      - name: Configure Git
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-        run: |
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-          git config --global --add safe.directory "$GITHUB_WORKSPACE"
-          git remote set-url origin "https://x-access-token:${GITEA_TOKEN}@git.farh.net/${{ github.repository }}.git"
-
-      - name: Update version in package.json
-        run: |
-          if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-            pnpm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
-          else
-            npm version ${{ inputs.version }} --no-git-tag-version --allow-same-version
-          fi
-
-      - name: Update artifacthub-pkg.yml
-        env:
-          REPO: ${{ github.repository }}
-        run: |
-          VERSION="${{ inputs.version }}"
-          if [ -f artifacthub-pkg.yml ]; then
-            PKG_NAME=$(grep '^name:' artifacthub-pkg.yml | cut -d: -f2 | tr -d ' "')
-          else
-            PKG_NAME=$(jq -r .name package.json | sed 's|^@[^/]*/||')
-          fi
-          RELEASE_URL="https://git.farh.net/${REPO}/releases/download/v${VERSION}/${PKG_NAME}-${VERSION}.tar.gz"
-          sed -i "s/^version:.*/version: \"${VERSION}\"/" artifacthub-pkg.yml
-          sed -i "s|headlamp/plugin/archive-url:.*|headlamp/plugin/archive-url: \"${RELEASE_URL}\"|" artifacthub-pkg.yml
-
-      - name: Update appVersion from upstream release
-        if: inputs.upstream-repo != ''
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-        run: |
-          APP_VERSION=$(curl -sf \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            "https://git.farh.net/api/v1/repos/${{ inputs.upstream-repo }}/releases/latest" | jq -r '.tag_name | ltrimstr("v")')
-          if [ -z "$APP_VERSION" ] || [ "$APP_VERSION" = "null" ]; then
-            echo "::warning::Could not fetch latest upstream release, skipping appVersion update"
-          else
-            sed -i "s|^appVersion:.*|appVersion: \"${APP_VERSION}\"|" artifacthub-pkg.yml
-            echo "appVersion set to ${APP_VERSION}"
-          fi
-
-      - name: Install dependencies
-        run: |
-          max_attempts=3
-          attempt=1
-          while [ $attempt -le $max_attempts ]; do
-            echo "Attempt $attempt of $max_attempts"
-            if [ "${{ steps.pkg-manager.outputs.manager }}" = "pnpm" ]; then
-              pnpm install --frozen-lockfile && break
-            else
-              npm ci && break
-            fi
-            if [ $attempt -lt $max_attempts ]; then
-              echo "::warning::Install step failed on attempt $attempt. Retrying in 5 seconds..."
-              sleep 5
-            fi
-            attempt=$((attempt + 1))
-          done
-          if [ $attempt -gt $max_attempts ]; then
-            echo "::error::Install step failed after $max_attempts attempts."
-            exit 1
-          fi
-
-      - name: Build plugin
-        run: npx @kinvolk/headlamp-plugin build
-
-      - name: Package plugin
-        run: npx @kinvolk/headlamp-plugin package
-
-      - name: Prepare release tarball
-        run: |
-          VERSION="${{ inputs.version }}"
-          if [ -f artifacthub-pkg.yml ]; then
-            PKG_NAME=$(grep '^name:' artifacthub-pkg.yml | cut -d: -f2 | tr -d ' "')
-          else
-            PKG_NAME=$(jq -r .name package.json | sed 's|^@[^/]*/||')
-          fi
-          TARBALL="${PKG_NAME}-${VERSION}.tar.gz"
-          for f in *.tar.gz; do
-            [ "$f" != "$TARBALL" ] && mv "$f" "$TARBALL"
-          done
-          if [ ! -f "$TARBALL" ]; then
-            echo "Error: Expected tarball $TARBALL not found"
-            ls -la *.tar.gz 2>/dev/null || echo "No .tar.gz files found"
-            exit 1
-          fi
-          echo "TARBALL=$TARBALL" >> $GITHUB_ENV
-          echo "PKG_NAME=$PKG_NAME" >> $GITHUB_ENV
-
-      - name: Validate tarball
-        run: |
-          echo "Tarball: ${{ env.TARBALL }}"
-          ls -lh "${{ env.TARBALL }}"
-          tar -tzf "${{ env.TARBALL }}" | head -20
-          tar -tzf "${{ env.TARBALL }}" | grep -q "main.js" || { echo "Error: main.js not found in tarball"; exit 1; }
-
-      - name: Compute checksum
-        run: |
-          CHECKSUM=$(sha256sum "${{ env.TARBALL }}" | awk '{print $1}')
-          echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
-          sed -i "s|headlamp/plugin/archive-checksum:.*|headlamp/plugin/archive-checksum: sha256:${CHECKSUM}|" artifacthub-pkg.yml
-
-      - name: Commit and tag
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-        run: |
-          VERSION="${{ inputs.version }}"
-          BRANCH="release/v${VERSION}"
-          if git ls-remote --exit-code origin "refs/heads/$BRANCH" 2>/dev/null; then
-            echo "::notice::Branch $BRANCH already exists — deleting for clean re-trigger."
-            git push origin --delete "$BRANCH"
-          fi
-          git checkout -b "$BRANCH"
-          git add package.json "${{ steps.pkg-manager.outputs.lockfile }}" artifacthub-pkg.yml
-          git commit -m "release: v${VERSION}"
-          git tag "v${VERSION}"
-          git push origin "$BRANCH"
-          git push origin "refs/tags/v${VERSION}"
-
-      - name: Create Gitea Release
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          VERSION="${{ inputs.version }}"
-          TARBALL="${{ env.TARBALL }}"
-          RESPONSE=$(curl -sf -X POST \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/${REPO}/releases" \
-            -d "{
-              \"tag_name\": \"v${VERSION}\",
-              \"name\": \"Release v${VERSION}\",
-              \"draft\": false,
-              \"prerelease\": false
-            }")
-          if [ -z "$RESPONSE" ]; then
-            echo "::warning::Release creation returned empty response (may already exist)"
-          else
-            echo "::notice::Release v${VERSION} created successfully"
-          fi
-          UPLOAD_URL=$(echo "$RESPONSE" | jq -r '.upload_url' 2>/dev/null || echo "")
-          if [ -n "$UPLOAD_URL" ] && [ "$UPLOAD_URL" != "null" ]; then
-            UPLOAD_URL="${UPLOAD_URL%%\{*}"
-            curl -sf -X POST \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              -H "Content-Type: application/octet-stream" \
-              "${UPLOAD_URL}?name=${TARBALL}" \
-              --data-binary "@${TARBALL}"
-            echo "::notice::Tarball uploaded successfully"
-          fi
-
-      - name: Create PR for version bump
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -o pipefail
-          VERSION="${{ inputs.version }}"
-          BODY=$(printf "Automated version bump and checksum update for v%s.\n\ncc @cpfarhood" "${VERSION}")
-          RESPONSE=$(curl -sf -X POST \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/${REPO}/pulls" \
-            -d "{
-              \"title\": \"release: v${VERSION}\",
-              \"body\": \"$BODY\",
-              \"base\": \"main\",
-              \"head\": \"release/v${VERSION}\"
-            }")
-          PR_NUMBER=$(echo "$RESPONSE" | jq -r '.number' 2>/dev/null || echo "")
-          if [ -z "$PR_NUMBER" ] || [ "$PR_NUMBER" = "null" ]; then
-            EXISTING=$(curl -sf \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              "https://git.farh.net/api/v1/repos/${REPO}/pulls?state=open&base=main&head=release/v${VERSION}" \
-              | jq -r '.[0].number' 2>/dev/null || echo "")
-            if [ -n "$EXISTING" ] && [ "$EXISTING" != "null" ]; then
-              PR_NUMBER="$EXISTING"
-              echo "::notice::Open PR #${PR_NUMBER} for release/v${VERSION} already exists — skipping creation."
-            else
-              echo "::error::Could not determine PR number for release/v${VERSION}."
-              exit 1
-            fi
-          fi
-          echo "::notice::Working with PR #${PR_NUMBER}"
-
-          PR_STATE=$(curl -sf \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            "https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}" \
-            | jq -r '.state' 2>/dev/null || echo "")
-          if [ "$PR_STATE" = "merged" ]; then
-            echo "::notice::PR #${PR_NUMBER} was already merged. Nothing to do."
-            exit 0
-          fi
-
-          MERGE_RESULT=$(curl -sf -X POST \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            "https://git.farh.net/api/v1/repos/${REPO}/pulls/${PR_NUMBER}/merge" \
-            -d '{"do": "squash"}')
-          if echo "$MERGE_RESULT" | jq -e '.merged' 2>/dev/null; then
-            echo "PR merged successfully."
-          else
-            if [ "$PR_STATE" = "merged" ]; then
-              echo "PR was already merged."
-            else
-              echo "::warning::Merge response: $MERGE_RESULT"
-            fi
-          fi
-
-      - name: Verify checksums are consistent (main == tag == tarball)
-        env:
-          GITEA_TOKEN: ${{ secrets.GITEA_RELEASE_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          VERSION="${{ inputs.version }}"
-          TARBALL_CS=$(sha256sum "${{ env.TARBALL }}" | awk '{print $1}')
-          TAG_CS=$(git show "v${VERSION}:artifacthub-pkg.yml" 2>/dev/null \
-            | grep "archive-checksum" | awk '{print $2}' | sed 's/sha256://')
-          MAIN_CS=$(git fetch origin main 2>/dev/null; git show "origin/main:artifacthub-pkg.yml" \
-            | grep "archive-checksum" | awk '{print $2}' | sed 's/sha256://')
-          echo "Tarball SHA256 : $TARBALL_CS"
-          echo "Tag artifacthub: $TAG_CS"
-          echo "Main artifacthub: $MAIN_CS"
-          FAIL=0
-          [ "$TARBALL_CS" != "$TAG_CS"  ] && echo "ERROR: tag checksum mismatch!"  && FAIL=1
-          [ "$TARBALL_CS" != "$MAIN_CS" ] && echo "ERROR: main checksum mismatch!" && FAIL=1
-          [ "$FAIL" = "1" ] && exit 1
-          echo "All checksums consistent — ArtifactHub will index correctly."

.github/workflows/renovate.yml

@@ -1,14 +0,0 @@
-name: Renovate
-on:
-  schedule:
-    - cron: '0 3 * * *'
-  workflow_dispatch:
-jobs:
-  renovate:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: renovatebot/github-action@v40.3.0
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
-          configurationFile: renovate.json

README.md

@@ -90,7 +90,7 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: headlamp
-    namespace: <your-namespace>
+    namespace: headlamp
 ```
 
 ## Troubleshooting

e2e/rook.spec.ts

@@ -24,14 +24,14 @@ test.describe('Rook plugin smoke tests', () => {
 
     await page.waitForLoadState('networkidle');
     await expect(page).toHaveURL(/rook-ceph/);
-    await expect(page.getByRole('heading', { name: /overview/i })).toBeVisible();
+    await expect(page.getByRole('heading', { name: /overview/i }).first()).toBeVisible();
   });
 
   test('overview page renders content', async ({ page }) => {
     await page.goto('/c/main/rook-ceph');
     await waitForSidebar(page);
 
-    await expect(page.getByRole('heading', { name: /overview/i })).toBeVisible({
+    await expect(page.getByRole('heading', { name: /overview/i }).first()).toBeVisible({
       timeout: 15_000,
     });
 
@@ -42,22 +42,27 @@ test.describe('Rook plugin smoke tests', () => {
 
   test('navigation to storage classes view works', async ({ page }) => {
     await page.goto('/c/main/rook-ceph');
-
     const sidebar = page.getByRole('navigation', { name: 'Navigation' });
+
+    const rookBtn = sidebar.getByRole('button', { name: /rook/i });
+    await rookBtn.click();
+    await page.waitForLoadState('networkidle');
+
     const storageClassesLink = sidebar.getByRole('link', { name: /storage classes/i });
     await expect(storageClassesLink).toBeVisible({ timeout: 10_000 });
     await storageClassesLink.click();
 
     await page.waitForLoadState('networkidle');
     await expect(page).toHaveURL(/rook-ceph\/storage-classes/);
-    await expect(page.getByRole('heading', { name: /storage class/i })).toBeVisible({ timeout: 15_000 });
+    await expect(page.getByRole('heading', { name: /storage class/i }).first()).toBeVisible({ timeout: 15_000 });
   });
 
   test('plugin settings page shows rook plugin entry', async ({ page }) => {
     await page.goto('/settings/plugins');
     await page.waitForLoadState('networkidle');
+    await page.waitForSelector('table, [class*="PluginList"], [class*="plugin"]', { timeout: 10_000 }).catch(() => {});
 
-    const pluginEntry = page.locator('text=rook').first();
+    const pluginEntry = page.locator('text=/rook/i').first();
     await expect(pluginEntry).toBeVisible({ timeout: 30_000 });
   });
 });

package.json

@@ -50,7 +50,6 @@
     "tar": "^7.5.11",
     "undici": "^7.24.3",
     "vite": ">=6.4.2",
-    "lodash": ">=4.18.0",
-    "elliptic": ">=6.6.1"
+    "lodash": ">=4.18.0"
   }
 }

scripts/deploy-e2e-headlamp.sh

@@ -35,6 +35,17 @@ if ! kubectl auth can-i delete configmaps -n "$E2E_NAMESPACE" --quiet 2>/dev/nul
   exit 1
 fi
 
+echo ""
+echo "=== Pre-deployment cluster diagnostics ==="
+echo "Nodes:"
+kubectl get nodes -o wide 2>&1 || true
+echo ""
+echo "headlamp-dev namespace state:"
+kubectl get ns headlamp-dev -o yaml 2>&1 || true
+echo ""
+echo "Existing E2E resources in namespace:"
+kubectl get all -n "$E2E_NAMESPACE" -l "app.kubernetes.io/instance=$E2E_RELEASE" 2>&1 || true
+
 echo "=== E2E Headlamp Deployment ==="
 echo "  Image:     ghcr.io/headlamp-k8s/headlamp:${HEADLAMP_VERSION}"
 echo "  Namespace: $E2E_NAMESPACE"
@@ -60,7 +71,7 @@ kubectl delete serviceaccount "${E2E_RELEASE}" -n "$E2E_NAMESPACE" --ignore-not-
 echo ""
 echo "Deploying Headlamp E2E instance..."
 
-kubectl apply -f - <<EOF
+if ! kubectl apply -f - <<EOF
 apiVersion: v1
 kind: ServiceAccount
 metadata:
@@ -113,7 +124,7 @@ spec:
               port: http
             initialDelaySeconds: 5
             periodSeconds: 5
-            failureThreshold: 6
+              failureThreshold: 6
           livenessProbe:
             httpGet:
               path: /
@@ -148,6 +159,12 @@ spec:
       targetPort: http
       protocol: TCP
 EOF
+then
+  echo "ERROR: kubectl apply failed. Dumping cluster state..." >&2
+  kubectl get all -n "$E2E_NAMESPACE" 2>&1 || true
+  kubectl get events -n "$E2E_NAMESPACE" --sort-by='.lastTimestamp' 2>&1 | tail -30 || true
+  exit 1
+fi
 
 echo "Waiting for rollout..."
 kubectl rollout status "deployment/${E2E_RELEASE}" \