release: v1.0.0

release: sealed-secrets v1.0.0

.github/workflows/dual-approval.yaml

@@ -0,0 +1,18 @@
+name: Dual Approval (CTO + QA)
+
+# Calls the shared dual-approval-check workflow.
+# Passes when both privilegedescalation-cto and privilegedescalation-qa
+# have approved the PR. Add "Dual Approval (CTO + QA)" to required_status_checks
+# in branch protection to enforce this gate.
+
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize]
+
+jobs:
+  dual-approval:
+    uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
+    secrets: inherit

.github/workflows/release.yaml

@@ -10,10 +10,14 @@ on:
 
 permissions:
   contents: write
+  pull-requests: write
 
 jobs:
   release:
     uses: privilegedescalation/.github/.github/workflows/plugin-release.yaml@main
+    secrets:
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
     with:
       version: ${{ inputs.version }}
       upstream-repo: 'bitnami-labs/sealed-secrets'

CHANGELOG.md

@@ -7,6 +7,48 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.0] - 2026-03-24
+
+### Added
+- Explicit `vitest`, `@testing-library/react`, `@testing-library/jest-dom`, `jsdom`, `react`, and `react-dom` devDependencies so tests run reliably without relying on transitive hoisting
+
+### Changed
+- Bump to v1.0.0 — stable public API, comprehensive test coverage, ArtifactHub-only installation
+
+### Fixed
+- Removed `install-plugin.sh` custom install script in compliance with ArtifactHub-only installation policy
+
+## [0.2.24] - 2026-03-19
+
+### Fixed
+- Added npm overrides for `tar` (>=7.5.11) and `undici` (>=7.24.3) to resolve security advisories
+- Added `pull-requests: write` permission to release workflow to unblock PR creation
+
+### Changed
+- Added ArtifactHub-only installation policy (INSTALLATION_POLICY.md)
+- Removed manual install instructions from README
+- Dependency bumps: `tar` 7.5.7→7.5.11, `undici` 7.14.0→7.24.4, `rollup` 4.46.3→4.59.0, `minimatch` 3.1.2→3.1.5, `qs` 6.14.1→6.15.0, `storybook` 9.1.17→9.1.20
+
+## [0.2.23] - 2026-03-09
+
+### Changed
+- Internal release-pipeline stabilization (re-release of v0.2.22 fixes)
+
+## [0.2.22] - 2026-03-09
+
+### Added
+- Architecture decision records for error boundaries and hooks architecture
+
+### Fixed
+- Removed remaining `any` types, dead code, and unused exports; added comprehensive tests
+- Added missing `archive-checksum` annotation to `artifacthub-pkg.yml`
+- Upstream `appVersion` tracking in release workflow (automatically syncs sealed-secrets controller version)
+- Package renamed to `headlamp-sealed-secrets` on ArtifactHub for discoverability
+- Added `FUNDING.yml` and Apache-2.0 `LICENSE` file
+
+### Changed
+- Enhanced Renovate configuration
+
 ## [0.2.21] - 2026-03-04
 
 ### Added
@@ -126,11 +168,15 @@ Version 0.2.3 was published but with checksum mismatch on Artifact Hub. Supersed
 - Dependencies: node-forge for cryptography
 - Compatible with Headlamp v0.13.0+
 
-[Unreleased]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.21...HEAD
+[Unreleased]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.24...v1.0.0
+[0.2.24]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.23...v0.2.24
+[0.2.23]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.22...v0.2.23
+[0.2.22]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.21...v0.2.22
 [0.2.21]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/compare/v0.2.20...v0.2.21
-[0.1.0]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.1.0
 [0.2.4]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.4
 [0.2.3]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.3
 [0.2.2]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.2
 [0.2.1]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.1
 [0.2.0]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.2.0
+[0.1.0]: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/tag/v0.1.0

INSTALLATION_POLICY.md

@@ -0,0 +1,24 @@
+# Installation Policy
+
+## Approved Installation Method
+
+**The ONLY approved method for installing this plugin is via [Artifact Hub](https://artifacthub.io/) using the Headlamp plugin installer.**
+
+No other installation method is acceptable. This includes but is not limited to:
+
+- Direct installation from GitHub release assets
+- Manual npm pack / tarball extraction
+- initContainer workarounds that bypass Artifact Hub
+- Direct file copy or sidecar injection
+
+## Enforcement
+
+All deployment configurations, CI/CD pipelines, and documentation MUST reference Artifact Hub as the sole plugin distribution channel. Any pull request that introduces an alternative installation method will be rejected.
+
+## Rationale
+
+Artifact Hub provides verified checksums, consistent versioning, and a standard discovery mechanism for the CNCF ecosystem. Bypassing it introduces security and integrity risks.
+
+---
+
+*This policy is set by the CTO and approved by the CEO of Privileged Escalation.*

README.md

@@ -25,34 +25,8 @@ A comprehensive [Headlamp](https://headlamp.dev) plugin for managing [Bitnami Se
 
 ### Installation
 
-#### Option 1: Headlamp Plugin Manager (Recommended)
-
 Browse the Headlamp Plugin Manager (Settings → Plugins → Catalog) and install **sealed-secrets** directly.
 
-#### Option 2: Manual Tarball Install
-
-Download the latest tarball from the [Releases page](https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases), then extract it into your Headlamp plugins directory:
-
-```bash
-# macOS
-tar -xzf sealed-secrets-*.tar.gz -C ~/Library/Application\ Support/Headlamp/plugins/
-
-# Linux
-tar -xzf sealed-secrets-*.tar.gz -C ~/.config/Headlamp/plugins/
-
-# Restart Headlamp after installing
-```
-
-#### Option 3: Build from Source
-
-```bash
-git clone https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin.git
-cd headlamp-sealed-secrets-plugin
-npm install
-npm run build
-npx @kinvolk/headlamp-plugin extract . /headlamp/plugins
-```
-
 ### First Secret
 
 ```bash
@@ -321,4 +295,3 @@ Built with:
 
 
 # Test runner
-

artifacthub-pkg.yml

@@ -1,13 +1,13 @@
 # Artifact Hub package metadata file
 # https://github.com/artifacthub/hub/blob/master/docs/metadata/artifacthub-pkg.yml
-version: "0.2.23"
+version: "1.0.0"
 name: headlamp-sealed-secrets
 displayName: Sealed Secrets
 createdAt: "2026-02-12T00:00:00Z"
 description: A comprehensive Headlamp plugin for managing Bitnami Sealed Secrets with client-side encryption and RBAC-aware UI
 license: Apache-2.0
 homeURL: https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin
-appVersion: "0.36.0"
+appVersion: "0.36.1"
 containersImages:
   - name: sealed-secrets-controller
     image: docker.io/bitnami/sealed-secrets-controller:v0.24.0
@@ -19,8 +19,8 @@ keywords:
   - encryption
   - security
 annotations:
-  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/download/v0.2.23/sealed-secrets-0.2.23.tar.gz"
-  headlamp/plugin/archive-checksum: sha256:8396d64f86443172771e79fe0967dbf5e982413d8229f29b874a796f0ac39efb
+  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/releases/download/v1.0.0/sealed-secrets-1.0.0.tar.gz"
+  headlamp/plugin/archive-checksum: sha256:d387f156b7bf5628073116ef1e406d8038cf60eabefe46e220a0db2d67f5530a
   headlamp/plugin/version-compat: ">=0.13.0"
   headlamp/plugin/distro-compat: "desktop,in-cluster,web,docker-desktop"
 links:
@@ -35,31 +35,19 @@ install: |
 
   ### Prerequisites
 
-  1. Headlamp v0.13.0 or later
+  1. [Headlamp](https://headlamp.dev) v0.13.0 or later
   2. Sealed Secrets controller installed on your cluster:
      ```bash
      kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml
      ```
 
-  ### Install the Plugin
+  ### Install via Headlamp Plugin Catalog
 
-  #### Option 1: From NPM
-  ```bash
-  npm install -g headlamp-sealed-secrets
-  ```
+  1. Open Headlamp and navigate to **Settings → Plugin Catalog**
+  2. Search for **"Sealed Secrets"**
+  3. Click **Install** and restart Headlamp when prompted
 
-  #### Option 2: Build from Source
-  ```bash
-  git clone https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin
-  cd headlamp-sealed-secrets-plugin
-  npm install
-  npm run build
-  ```
-
-  Then copy the `dist` folder to your Headlamp plugins directory:
-  - **Linux**: `~/.config/Headlamp/plugins/headlamp-sealed-secrets/`
-  - **macOS**: `~/Library/Application Support/Headlamp/plugins/headlamp-sealed-secrets/`
-  - **Windows**: `%APPDATA%\Headlamp\plugins\headlamp-sealed-secrets\`
+  The plugin is sourced directly from [ArtifactHub](https://artifacthub.io/packages/headlamp/headlamp/headlamp-sealed-secrets).
 
   ## Usage
 
@@ -70,6 +58,13 @@ install: |
   - Configure controller settings
 
   For detailed usage instructions, see the [README](https://github.com/privilegedescalation/headlamp-sealed-secrets-plugin/blob/main/README.md).
+changes:
+  - kind: changed
+    description: "Bump to v1.0.0 — stable public release with comprehensive tests, ArtifactHub-only installation, and full RBAC-aware UI"
+  - kind: added
+    description: Explicit vitest and @testing-library devDependencies for reliable test execution
+  - kind: fixed
+    description: Removed install-plugin.sh custom install script (ArtifactHub-only policy)
 maintainers:
   - name: privilegedescalation
     email: privilegedescalation@users.noreply.github.com

install-plugin.sh

@@ -1,79 +0,0 @@
-#!/bin/bash
-#
-# Install Headlamp Sealed Secrets Plugin
-#
-# This script builds and installs the plugin to your local Headlamp installation.
-#
-
-set -e
-
-# Colors for output
-RED='\033[0;31m'
-GREEN='\033[0;32m'
-YELLOW='\033[1;33m'
-NC='\033[0m' # No Color
-
-echo -e "${GREEN}Headlamp Sealed Secrets Plugin Installer${NC}"
-echo "=========================================="
-echo
-
-# Detect OS and set plugin directory
-if [[ "$OSTYPE" == "darwin"* ]]; then
-    PLUGIN_DIR="$HOME/Library/Application Support/Headlamp/plugins/headlamp-sealed-secrets"
-    echo -e "${YELLOW}Detected: macOS${NC}"
-elif [[ "$OSTYPE" == "linux-gnu"* ]]; then
-    PLUGIN_DIR="$HOME/.config/Headlamp/plugins/headlamp-sealed-secrets"
-    echo -e "${YELLOW}Detected: Linux${NC}"
-else
-    echo -e "${RED}Unsupported OS: $OSTYPE${NC}"
-    echo "For Windows, please see HEADLAMP_INSTALLATION.md"
-    exit 1
-fi
-
-echo "Plugin will be installed to: $PLUGIN_DIR"
-echo
-
-# Check if node/npm are available
-if ! command -v npm &> /dev/null; then
-    echo -e "${RED}Error: npm is not installed${NC}"
-    echo "Please install Node.js and npm first"
-    exit 1
-fi
-
-# Navigate to plugin directory
-cd "$(dirname "$0")"
-
-echo -e "${GREEN}Step 1: Installing dependencies...${NC}"
-npm install
-
-echo
-echo -e "${GREEN}Step 2: Building plugin...${NC}"
-npm run build
-
-echo
-echo -e "${GREEN}Step 3: Creating plugin directory...${NC}"
-mkdir -p "$PLUGIN_DIR"
-
-echo
-echo -e "${GREEN}Step 4: Copying plugin files...${NC}"
-cp -v dist/main.js "$PLUGIN_DIR/"
-cp -v package.json "$PLUGIN_DIR/"
-cp -v README.md "$PLUGIN_DIR/" 2>/dev/null || true
-cp -v LICENSE "$PLUGIN_DIR/" 2>/dev/null || true
-
-echo
-echo -e "${GREEN}✓ Installation complete!${NC}"
-echo
-echo "Plugin installed to: $PLUGIN_DIR"
-echo
-echo "Next steps:"
-echo "1. Restart Headlamp desktop application"
-echo "2. Open Headlamp and connect to your cluster"
-echo "3. Look for 'Sealed Secrets' in the sidebar"
-echo
-echo "To verify sealed-secrets controller is installed:"
-echo "  kubectl get pods -n kube-system -l name=sealed-secrets-controller"
-echo
-echo "To install sealed-secrets controller (if not present):"
-echo "  kubectl apply -f https://github.com/bitnami-labs/sealed-secrets/releases/download/v0.24.0/controller.yaml"
-echo

package.json

@@ -1,6 +1,6 @@
 {
   "name": "sealed-secrets",
-  "version": "0.2.23",
+  "version": "1.0.0",
   "description": "Headlamp plugin for Bitnami Sealed Secrets - manage encrypted Kubernetes secrets",
   "files": [
     "dist",
@@ -47,16 +47,33 @@
     "k8s"
   ],
   "overrides": {
-    "typescript": "5.6.2"
+    "tar": "^7.5.11",
+    "undici": "^7.24.3"
   },
   "dependencies": {
     "node-forge": "^1.3.1"
   },
   "devDependencies": {
+    "@headlamp-k8s/eslint-config": "^0.6.0",
     "@iconify/react": "^6.0.2",
     "@kinvolk/headlamp-plugin": "^0.13.0",
+    "@mui/material": "^5.15.14",
+    "@testing-library/jest-dom": "^6.4.8",
+    "@testing-library/react": "^16.0.0",
+    "@testing-library/user-event": "^14.5.2",
     "@types/node-forge": "^1.3.11",
+    "@types/react": "^18.0.0",
+    "@types/react-dom": "^18.0.0",
+    "eslint": "^8.57.0",
+    "jsdom": "^24.0.0",
+    "notistack": "^3.0.0",
+    "prettier": "^2.8.8",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1",
+    "react-router-dom": "^5.3.0",
     "typedoc": "^0.28.16",
-    "typedoc-plugin-markdown": "^4.10.0"
+    "typescript": "~5.6.2",
+    "typedoc-plugin-markdown": "^4.10.0",
+    "vitest": "^3.2.4"
   }
 }

renovate.json

@@ -1,19 +1,5 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "baseBranches": ["main"],
-  "schedule": ["every weekend"],
-  "prConcurrentLimit": 10,
-  "packageRules": [
-    {
-      "matchManagers": ["npm"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "npm minor and patch"
-    },
-    {
-      "matchManagers": ["github-actions"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "github-actions minor and patch"
-    }
-  ]
+  "extends": ["github>privilegedescalation/.github:renovate-config"]
 }
+

tsconfig.json

@@ -1,7 +1,7 @@
 {
   "extends": "@kinvolk/headlamp-plugin/config/plugins-tsconfig.json",
   "compilerOptions": {
-    "types": ["vite/client", "vite-plugin-svgr/client", "vitest/globals", "@testing-library/jest-dom"]
+    "types": ["vitest/globals", "@testing-library/jest-dom"]
   },
   "include": ["src"]
 }

vitest.config.mts

@@ -1,6 +1,9 @@
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
+  define: {
+    'process.env.NODE_ENV': '"test"',
+  },
   test: {
     globals: true,
     environment: 'jsdom',