release: prepare v1.0.0

- Bump version to 1.0.0 in package.json and artifacthub-pkg.yml
- Add explicit devDependencies: vitest, @testing-library/react,
  @testing-library/jest-dom, @testing-library/user-event, jsdom,
  react, react-dom, @types/react, @types/react-dom, react-router-dom,
  @mui/material, notistack — resolves phantom-dep test failures
- Add process.env.NODE_ENV define to vitest.config.mts (fixes
  "act() not supported in production builds" failures)
- Switch to pnpm lockfile (pnpm-lock.yaml), drop package-lock.json
- Remove install-plugin.sh (violates ArtifactHub-only install policy)
- Fill in CHANGELOG entries for v0.2.22, v0.2.23, v0.2.24
- Update CHANGELOG [1.0.0] and version comparison links
- All 233 tests pass

Co-Authored-By: Paperclip <noreply@paperclip.ing>

CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-03-24
+
+### Added
+- Explicit `vitest`, `@testing-library/react`, `@testing-library/jest-dom`, `jsdom`, `react`, and `react-dom` devDependencies so tests run reliably without relying on transitive hoisting
+
+### Changed
+- Bump to v1.0.0 — stable public API, comprehensive test coverage, ArtifactHub-only installation
+
+### Fixed
+- Removed `install-plugin.sh` custom install script in compliance with ArtifactHub-only installation policy
+
+## [0.2.24] - 2026-03-19
+
+### Fixed
+- Added npm overrides for `tar` (>=7.5.11) and `undici` (>=7.24.3) to resolve security advisories
+- Added `pull-requests: write` permission to release workflow to unblock PR creation
+
+### Changed
+- Added ArtifactHub-only installation policy (INSTALLATION_POLICY.md)
+- Removed manual install instructions from README
+- Dependency bumps: `tar` 7.5.7→7.5.11, `undici` 7.14.0→7.24.4, `rollup` 4.46.3→4.59.0, `minimatch` 3.1.2→3.1.5, `qs` 6.14.1→6.15.0, `storybook` 9.1.17→9.1.20
+
+## [0.2.23] - 2026-03-09
+
+### Changed
+- Internal release-pipeline stabilization (re-release of v0.2.22 fixes)
+
+## [0.2.22] - 2026-03-09
+
+### Added
+- Architecture decision records for error boundaries and hooks architecture
+
+### Fixed
+- Removed remaining `any` types, dead code, and unused exports; added comprehensive tests
+- Added missing `archive-checksum` annotation to `artifacthub-pkg.yml`
+- Upstream `appVersion` tracking in release workflow (automatically syncs sealed-secrets controller version)
+- Package renamed to `headlamp-sealed-secrets` on ArtifactHub for discoverability
+- Added `FUNDING.yml` and Apache-2.0 `LICENSE` file
+
+### Changed
+- Enhanced Renovate configuration
+
 ## [0.2.21] - 2026-03-04
 
 ### Added
@@ -126,11 +168,15 @@ Version 0.2.3 was published but with checksum mismatch on Artifact Hub. Supersed
 - Dependencies: node-forge for cryptography
 - Compatible with Headlamp v0.13.0+
 
-[Unreleased]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.21...HEAD
+[Unreleased]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.24...v1.0.0
+[0.2.24]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.23...v0.2.24
+[0.2.23]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.22...v0.2.23
+[0.2.22]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.21...v0.2.22
 [0.2.21]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.20...v0.2.21
-[0.1.0]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.1.0
 [0.2.4]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.4
 [0.2.3]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.3
 [0.2.2]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.2
 [0.2.1]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.1
 [0.2.0]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.0
+[0.1.0]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.1.0

artifacthub-pkg.yml

@@ -1,6 +1,6 @@
 # Artifact Hub package metadata file
 # https://github.com/artifacthub/hub/blob/master/docs/metadata/artifacthub-pkg.yml
-version: "0.2.24"
+version: "1.0.0"
 name: headlamp-sealed-secrets
 displayName: Sealed Secrets
 createdAt: "2026-02-12T00:00:00Z"
@@ -19,8 +19,8 @@ keywords:
   - encryption
   - security
 annotations:
-  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/download/v0.2.24/sealed-secrets-0.2.24.tar.gz"
+  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/download/v1.0.0/sealed-secrets-1.0.0.tar.gz"
-  headlamp/plugin/archive-checksum: sha256:c17cf3bed967062c3d364092af4637026f1e2628774f4c6242e0309d78133a25
+  headlamp/plugin/archive-checksum: sha256:TBD-set-by-release-workflow
   headlamp/plugin/version-compat: ">=0.13.0"
   headlamp/plugin/distro-compat: "desktop,in-cluster,web,docker-desktop"
 links:
@@ -59,24 +59,12 @@ install: |
 
   For detailed usage instructions, see the [README](https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/blob/main/README.md).
 changes:
-  - kind: added
-    description: SealedSecret list view with RBAC-aware actions
-  - kind: added
-    description: Encrypt dialog with client-side encryption using fetched controller certificate
-  - kind: added
-    description: Decrypt dialog for viewing secret data
-  - kind: added
-    description: SealingKeys view with key rotation and certificate expiry warnings
-  - kind: added
-    description: Controller health monitoring panel
-  - kind: added
-    description: Namespace-scoped and cluster-scoped sealing support
-  - kind: added
-    description: Settings page for controller URL configuration
-  - kind: added
-    description: Secret rotation support
   - kind: changed
-    description: Stable public API with hooks (useControllerHealth, usePermissions, useSealedSecretEncryption) and documented interfaces
+    description: "Bump to v1.0.0 — stable public release with comprehensive tests, ArtifactHub-only installation, and full RBAC-aware UI"
+  - kind: added
+    description: Explicit vitest and @testing-library devDependencies for reliable test execution
+  - kind: fixed
+    description: Removed install-plugin.sh custom install script (ArtifactHub-only policy)
 maintainers:
   - name: privilegedescalation
     email: privilegedescalation@users.noreply.github.com

install-plugin.sh

@@ -1,79 +0,0 @@
-#!/bin/bash
-#
-# Install Headlamp Sealed Secrets Plugin
-#
-# This script builds and installs the plugin to your local Headlamp installation.
-#
-
-set -e
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-echo -e "${GREEN}Headlamp Sealed Secrets Plugin Installer${NC}"
-echo "=========================================="
-echo
-
-# Detect OS and set plugin directory
-if [[ "$OSTYPE" == "darwin"* ]]; then
-    PLUGIN_DIR="$HOME/Library/Application Support/Headlamp/plugins/headlamp-sealed-secrets"
-    echo -e "${YELLOW}Detected: macOS${NC}"
-elif [[ "$OSTYPE" == "linux-gnu"* ]]; then
-    PLUGIN_DIR="$HOME/.config/Headlamp/plugins/headlamp-sealed-secrets"
-    echo -e "${YELLOW}Detected: Linux${NC}"
-else
-    echo -e "${RED}Unsupported OS: $OSTYPE${NC}"
-    echo "For Windows, please see HEADLAMP_INSTALLATION.md"
-    exit 1
-fi
-
-echo "Plugin will be installed to: $PLUGIN_DIR"
-echo
-
-# Check if node/npm are available
-if ! command -v npm &> /dev/null; then
-    echo -e "${RED}Error: npm is not installed${NC}"
-    echo "Please install Node.js and npm first"
-    exit 1
-fi
-
-# Navigate to plugin directory
-cd "$(dirname "$0")"
-
-echo -e "${GREEN}Step 1: Installing dependencies...${NC}"
-npm install
-
-echo
-echo -e "${GREEN}Step 2: Building plugin...${NC}"
-npm run build
-
-echo
-echo -e "${GREEN}Step 3: Creating plugin directory...${NC}"
-mkdir -p "$PLUGIN_DIR"
-
-echo
-echo -e "${GREEN}Step 4: Copying plugin files...${NC}"
-cp -v dist/main.js "$PLUGIN_DIR/"
-cp -v package.json "$PLUGIN_DIR/"
-cp -v README.md "$PLUGIN_DIR/" 2>/dev/null || true
-cp -v LICENSE "$PLUGIN_DIR/" 2>/dev/null || true
-
-echo
-echo -e "${GREEN}✓ Installation complete!${NC}"
-echo
-echo "Plugin installed to: $PLUGIN_DIR"
-echo
-echo "Next steps:"
-echo "1. Restart Headlamp desktop application"
-echo "2. Open Headlamp and connect to your cluster"
-echo "3. Look for 'Sealed Secrets' in the sidebar"
-echo
-echo "To verify sealed-secrets controller is installed:"
-echo "  kubectl get pods -n kube-system -l name=sealed-secrets-controller"
-echo
-echo "To install sealed-secrets controller (if not present):"
-echo "  kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml"
-echo

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealed-secrets",
-  "version": "0.2.24",
+  "version": "1.0.0",
   "description": "Headlamp plugin for Bitnami Sealed Secrets - manage encrypted Kubernetes secrets",
   "files": [
     "dist",
@@ -57,8 +57,20 @@
   "devDependencies": {
     "@iconify/react": "^6.0.2",
     "@kinvolk/headlamp-plugin": "^0.13.0",
+    "@mui/material": "^5.15.14",
+    "@testing-library/jest-dom": "^6.4.8",
+    "@testing-library/react": "^16.0.0",
+    "@testing-library/user-event": "^14.5.2",
     "@types/node-forge": "^1.3.11",
+    "@types/react": "^18.0.0",
+    "@types/react-dom": "^18.0.0",
+    "jsdom": "^24.0.0",
+    "notistack": "^3.0.0",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-router-dom": "^5.3.0",
     "typedoc": "^0.28.16",
-    "typedoc-plugin-markdown": "^4.10.0"
+    "typedoc-plugin-markdown": "^4.10.0",
+    "vitest": "^3.2.4"
   }
 }

vitest.config.mts

@@ -1,6 +1,9 @@
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
+  define: {
+    'process.env.NODE_ENV': '"test"',
+  },
   test: {
     globals: true,
     environment: 'jsdom',