docs: correct namespace refs — driver is kube-system, not headlamp

Fix PRI-592. The tns-csi driver runs in kube-system (like most CSI drivers), not in the headlamp namespace. - CLAUDE.md: Driver namespace: headlamp → kube-system - docs/architecture/overview.md: fix API paths for controller pod access from headlamp namespace to kube-system namespace Co-Authored-By: Paperclip <noreply@paperclip.ing>
docs: update install docs and ArtifactHub metadata to headlamp namespace
2026-05-04 21:32:08 +00:00 · 2026-05-04 07:36:05 +00:00 · 2026-05-04 03:23:57 +00:00 · 2026-05-03 17:44:12 +00:00 · 2026-04-15 03:33:22 +00:00 · 2026-03-24 22:45:34 +00:00
16 changed files with 12088 additions and 18518 deletions
@@ -0,0 +1,20 @@
+name: Dual Approval (CTO + QA)
+
+# Calls the shared dual-approval-check workflow.
+# Passes when both privilegedescalation-cto and privilegedescalation-qa
+# have approved the PR. Add "Dual Approval (CTO + QA)" to required_status_checks
+# in branch protection to enforce this gate.
+
+on:
+  pull_request_review:
+    types: [submitted, dismissed]
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize]
+
+jobs:
+  dual-approval:
+    uses: privilegedescalation/.github/.github/workflows/dual-approval-check.yaml@main
+    secrets: inherit
+    with:
+      pr_number: ${{ github.event.pull_request.number }}
@@ -15,6 +15,9 @@ permissions:
 jobs:
  release:
    uses: privilegedescalation/.github/.github/workflows/plugin-release.yaml@main
+    secrets:
+      RELEASE_APP_ID: ${{ secrets.RELEASE_APP_ID }}
+      RELEASE_APP_PRIVATE_KEY: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
    with:
      version: ${{ inputs.version }}
      upstream-repo: fenio/tns-csi
@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0

 ## [Unreleased]

+### Changed
+
+- **docs: namespace references** — Updated all documentation, README, and ArtifactHub metadata to explicitly reference the `headlamp` namespace instead of generic "controller pod" language. RBAC examples now clearly scope `pods/proxy` access to `kube-system` where the tns-csi controller runs.
+
+## [1.0.0] - 2026-03-24
+
+### Added
+
+- **Missing devDependencies** — added `@mui/material`, `@types/react`, `@types/react-dom`, and `notistack` to devDependencies so the full test suite resolves correctly; upgraded `vitest` to `^3.2.4`
+
+### Changed
+
+- **Test infrastructure fix** — added `define: { 'process.env.NODE_ENV': '"test"' }` to `vitest.config.mts` to prevent React production-build `act()` errors; all 159 component tests now pass
+- **Version bump** — bumped package version from 0.2.7 to 1.0.0 (stable release)
+- **Lock file** — removed `package-lock.json`; `pnpm-lock.yaml` is now the canonical lock file
+- **Renovate config** — extended from org-level preset (PR #18)
+- **GitHub Actions SHA pinning** — added `pinDigests` to Renovate config for SHA-pinned Actions (PR #17)
+- **Dual-approval caller workflow** — added dual-approval status check workflow to CI (PR #16)
+- **Release workflow** — GitHub App token secrets now passed to release workflow (PR #15)
+
 ## [0.2.6] - 2026-03-04

 ### Fixed
@@ -102,7 +122,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - TypeScript strict mode with zero `any` types
 - ESLint + Prettier code quality tooling

-[Unreleased]: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/compare/v0.2.6...HEAD
+[Unreleased]: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/compare/v1.0.0...HEAD
+[1.0.0]: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/compare/v0.2.7...v1.0.0
 [0.2.6]: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/compare/v0.2.5...v0.2.6
 [0.2.4]: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/compare/v0.2.3...v0.2.4
 [0.2.3]: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/compare/v0.2.2...v0.2.3
@@ -63,12 +63,12 @@ config:
 pluginsManager:
  sources:
    - name: tns-csi
-      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 ## RBAC / Security Setup

-The plugin reads from the Kubernetes API and the tns-csi controller pod's Prometheus endpoint. The Benchmark page additionally creates and deletes Jobs and PVCs.
+The plugin reads from the Kubernetes API and the tns-csi controller pod's Prometheus endpoint (deployed in `kube-system`). The Benchmark page additionally creates and deletes Jobs and PVCs.

 ### Minimal read-only permissions

@@ -90,6 +90,10 @@ rules:
  - apiGroups: [""]
    resources: ["pods/log"]
    verbs: ["get"]
+  - apiGroups: [""]
+    resources: ["pods/proxy"]
+    verbs: ["get"]
+    resourceNames: ["pods"]
 ```

 ### Additional permissions for Benchmark page
@@ -105,13 +109,13 @@ rules:

 ### Metrics access

-The plugin fetches Prometheus metrics from the tns-csi controller pod via the Kubernetes pod proxy sub-resource. Grant `get` on `pods/proxy` in `kube-system`:
+The plugin fetches Prometheus metrics from the tns-csi controller pod via the Kubernetes pod proxy sub-resource in `kube-system`. Grant `get` on `pods/proxy` scoped to `kube-system`:

 ```yaml
  - apiGroups: [""]
    resources: ["pods/proxy"]
    verbs: ["get"]
-    # Optionally scope to the controller pod namespace
+    # Scope to kube-system where the tns-csi controller runs
 ```

 Apply the role and bind it to your Headlamp service account with a ClusterRoleBinding.
@@ -1,4 +1,4 @@
-version: "0.2.7"
+version: "1.0.0"
 name: headlamp-tns-csi-plugin
 displayName: TrueNAS CSI (tns-csi)
 description: >-
@@ -13,7 +13,7 @@ license: Apache-2.0
 category: storage

 homeURL: https://github.com/privilegedescalation/headlamp-tns-csi-plugin
-appVersion: "0.17.3"
+appVersion: "0.17.4"

 keywords:
  - headlamp
@@ -48,22 +48,22 @@ links:

 changes:
  - kind: added
-    description: "Component tests for all 8 UI components"
+    description: "Stable v1.0.0 release marking production readiness"
+  - kind: added
+    description: "Missing devDependencies for test infrastructure (@mui/material, @types/react, @types/react-dom, notistack, vitest upgraded to ^3.2.4)"
  - kind: changed
-    description: "CI workflow split into parallel lint, typecheck, test jobs with build gating on all three"
+    description: "vitest.config.mts: added define block to set process.env.NODE_ENV=test, fixing act() errors in all component tests"
  - kind: changed
-    description: "JUnit test reporter for PR test result visibility"
+    description: "Renovate config extended from org-level preset"
  - kind: changed
-    description: "Node.js 20 upgraded to 22 (current LTS) in all workflows"
+    description: "GitHub Actions SHA pinning via pinDigests in Renovate"
  - kind: changed
-    description: "Release workflow gated on CI passing with concurrency protection"
-  - kind: fixed
-    description: "Conditional React hook call in OverviewPage"
-  - kind: fixed
-    description: "appVersion now tracks upstream tns-csi driver release (0.12.0)"
+    description: "Dual-approval caller workflow added to CI"
+  - kind: changed
+    description: "GitHub App token secrets passed to release workflow"

 annotations:
-  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.7/tns-csi-0.2.7.tar.gz"
-  headlamp/plugin/archive-checksum: sha256:ee25ad35cadb840dfe886d14714bd9ec7728297566d37cc7bbd53be2cbd3168c
+  headlamp/plugin/archive-url: "https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz"
+  headlamp/plugin/archive-checksum: sha256:e38846ceb17a79438f8aecc50f22920b0efa7456f3ebb3e628d89856af83ad01
  headlamp/plugin/version-compat: ">=0.20.0"
  headlamp/plugin/distro-compat: "in-cluster,web,app"
@@ -67,7 +67,7 @@ Welcome to the Headlamp TNS-CSI Plugin documentation.
 ## External Links

 - **[GitHub Repository](https://github.com/privilegedescalation/headlamp-tns-csi-plugin)**
- **[Artifact Hub](https://artifacthub.io/packages/headlamp/headlamp-tns-csi-plugin/headlamp-tns-csi-plugin)**
+- **[Artifact Hub](https://artifacthub.io/packages/headlamp/tns-csi/headlamp-tns-csi-plugin)**
 - **[tns-csi Driver](https://github.com/fenio/tns-csi)**
 - **[kbench](https://github.com/longhorn/kbench)**
 - **[Headlamp](https://headlamp.dev/)**
@@ -28,7 +28,7 @@ The TNS-CSI plugin is a single-page React application bundled as a Headlamp plug
                        │ HTTPS
                        ▼
 ┌─────────────────────────────────────────────────────┐
-│              Headlamp Pod (kube-system)              │
+│              Headlamp Pod (headlamp namespace)              │
 │                                                     │
 │  Headlamp UI server + API proxy                     │
 │  (forwards requests using service account token     │
@@ -13,7 +13,7 @@ helm install headlamp headlamp/headlamp \
  --create-namespace \
  --set config.pluginsDir=/headlamp/plugins \
  --set pluginsManager.sources[0].name=tns-csi \
-  --set pluginsManager.sources[0].url=https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+  --set pluginsManager.sources[0].url=https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 ## Complete values.yaml Example
@@ -27,7 +27,7 @@ config:
 pluginsManager:
  sources:
    - name: tns-csi
-      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz

 serviceAccount:
  name: headlamp
@@ -81,7 +81,7 @@ spec:
    pluginsManager:
      sources:
        - name: tns-csi
-          url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+          url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 ## RBAC Manifest (Apply Separately)
@@ -22,7 +22,7 @@ config:
 pluginsManager:
  sources:
    - name: tns-csi
-      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 **Via FluxCD HelmRelease:**
@@ -46,7 +46,7 @@ spec:
    pluginsManager:
      sources:
        - name: tns-csi
-          url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+          url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 ### Method 2: Manual Tarball Install
@@ -55,13 +55,10 @@ Download and extract the plugin directly:

 ```bash
 # Download the release tarball
-wget https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
-
-# Verify the checksum
-echo "14a3e8c13d0b894a41aa1cfccbcb1f6af09dcbb8fd95c7040a540987ea2096a7  tns-csi-0.2.4.tar.gz" | sha256sum --check
+wget https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz

 # Extract into your Headlamp plugins directory
-tar xzf tns-csi-0.2.4.tar.gz -C /headlamp/plugins/
+tar xzf tns-csi-1.0.0.tar.gz -C /headlamp/plugins/
 ```

 The plugin directory should appear as `/headlamp/plugins/tns-csi/`.
@@ -81,7 +78,7 @@ initContainers:
      - -c
      - |
        wget -O /tmp/plugin.tar.gz \
-          https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+          https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
        tar xzf /tmp/plugin.tar.gz -C /headlamp/plugins/
    volumeMounts:
      - name: plugins
@@ -98,10 +95,10 @@ cd headlamp-tns-csi-plugin
 npm install
 npm run build
 npm run package
-# Produces tns-csi-0.2.4.tar.gz
+# Produces tns-csi-<version>.tar.gz

 # Extract to your Headlamp plugins directory
-tar xzf tns-csi-0.2.4.tar.gz -C /headlamp/plugins/
+tar xzf tns-csi-<version>.tar.gz -C /headlamp/plugins/
 ```

 Or use `headlamp-plugin extract` for automatic placement:
@@ -28,7 +28,7 @@ config:
 pluginsManager:
  sources:
    - name: tns-csi
-      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v0.2.4/tns-csi-0.2.4.tar.gz
+      url: https://github.com/privilegedescalation/headlamp-tns-csi-plugin/releases/download/v1.0.0/tns-csi-1.0.0.tar.gz
 ```

 Then upgrade your Headlamp release:
@@ -1,6 +1,6 @@
 {
  "name": "tns-csi",
-  "version": "0.2.7",
+  "version": "1.0.0",
  "description": "Headlamp plugin for TNS-CSI driver visibility and benchmarking",
  "repository": {
    "type": "git",
@@ -12,6 +12,7 @@
  "homepage": "https://github.com/privilegedescalation/headlamp-tns-csi-plugin#readme",
  "author": "privilegedescalation",
  "license": "Apache-2.0",
+  "packageManager": "pnpm@10.32.1",
  "scripts": {
    "start": "headlamp-plugin start",
    "build": "headlamp-plugin build",
@@ -29,18 +30,27 @@
    "react-dom": "^18.0.0"
  },
  "devDependencies": {
+    "@headlamp-k8s/eslint-config": "^0.6.0",
    "@kinvolk/headlamp-plugin": "^0.13.0",
+    "@mui/material": "^5.15.14",
    "@testing-library/jest-dom": "^6.4.8",
    "@testing-library/react": "^16.0.0",
    "@testing-library/user-event": "^14.5.2",
+    "@types/react": "^18.0.0",
+    "@types/react-dom": "^18.0.0",
+    "eslint": "^8.57.0",
    "jsdom": "^24.0.0",
+    "notistack": "^3.0.0",
+    "prettier": "^2.8.8",
    "react": "^18.3.1",
    "react-dom": "^18.3.1",
    "react-router-dom": "^5.3.0",
-    "vitest": "^3.0.5"
+    "typescript": "~5.6.2",
+    "vitest": "^3.2.4"
  },
  "overrides": {
    "tar": "^7.5.11",
-    "undici": "^7.24.3"
+    "undici": "^7.24.3",
+    "vite": ">=6.4.2"
  }
 }
@@ -1,19 +1,5 @@
 {
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": ["config:recommended"],
-  "baseBranches": ["main"],
-  "schedule": ["every weekend"],
-  "prConcurrentLimit": 10,
-  "packageRules": [
-    {
-      "matchManagers": ["npm"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "npm minor and patch"
-    },
-    {
-      "matchManagers": ["github-actions"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "github-actions minor and patch"
-    }
-  ]
+  "extends": ["github>privilegedescalation/.github:renovate-config"]
 }
+
@@ -2,7 +2,7 @@
  "extends": "@kinvolk/headlamp-plugin/config/plugins-tsconfig.json",
  "compilerOptions": {
    "module": "esnext",
-    "types": ["vite/client", "vite-plugin-svgr/client", "vitest/globals", "@testing-library/jest-dom"]
+    "types": ["vitest/globals", "@testing-library/jest-dom"]
  },
  "include": ["src"]
 }
@@ -1,6 +1,9 @@
 import { defineConfig } from 'vitest/config';

 export default defineConfig({
+  define: {
+    'process.env.NODE_ENV': '"test"',
+  },
  test: {
    globals: true,
    environment: 'jsdom',
Author	SHA1	Message	Date
Chris Farhood	3d42bcee42	docs: correct namespace refs — driver is kube-system, not headlamp Fix PRI-592. The tns-csi driver runs in kube-system (like most CSI drivers), not in the headlamp namespace. - CLAUDE.md: Driver namespace: headlamp → kube-system - docs/architecture/overview.md: fix API paths for controller pod access from headlamp namespace to kube-system namespace Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 21:32:08 +00:00
Chris Farhood	45bb74d42c	docs: update install docs and ArtifactHub metadata to headlamp namespace - README: update Helm install URL to v1.0.0, add pods/proxy RBAC scope notes - docs/getting-started/installation.md: update all download URLs from v0.2.4 to v1.0.0, remove obsolete sha256sum example, fix build output placeholder - docs/getting-started/quick-start.md: update Helm URL to v1.0.0 - docs/deployment/helm.md: update install command and values URLs to v1.0.0 - docs/README.md: fix Artifact Hub URL (was duplicated 'headlamp') - docs/architecture/overview.md: update namespace references from kube-system to headlamp - CLAUDE.md: update driver namespace constant from kube-system to headlamp - CHANGELOG.md: add [Unreleased] entry documenting the namespace reference update Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-05-04 07:36:05 +00:00
privilegedescalation-engineer[bot]	bb283d8923	fix: override lodash >=4.18.0 to patch code injection vulnerability (#29 ) * Regenerate lockfile for lodash override - Explicitly add lodash@4.18.1 to ensure override is respected - Regenerated pnpm-lock.yaml with resolved lodash@4.18.1 (CVE fix) Co-Authored-By: Paperclip <noreply@paperclip.ing> * fix: drop bogus direct lodash devDependency that conflicted with override The rebase added "lodash": "4.18.1" as a direct devDependency alongside the >=4.18.0 override, which npm rejects with EOVERRIDE during the headlamp-plugin build step. The plugin source does not import lodash; the override alone is sufficient to patch the transitive CVE. Co-Authored-By: Paperclip <noreply@paperclip.ing> --------- Co-authored-by: Chris Farhood <chris@farhood.org> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-05-04 03:23:57 +00:00
privilegedescalation-engineer[bot]	0af2f24a27	fix: update vite to >=6.4.2 to patch arbitrary file read vulnerability (#28 ) Vite versions >=6.0.0 <=6.4.1 are vulnerable to arbitrary file read via the Vite Dev Server WebSocket (server.fs.deny bypass with queries). CVE: GHSA-p9ff-h696-f583 Co-authored-by: Gandalf the Greybeard <gandalf@privilegedescalation.dev> Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>	2026-05-03 17:44:12 +00:00
privilegedescalation-engineer[bot]	409efe84d5	fix: pass pr_number to dual-approval-check workflow (#27 ) Companion PR to privilegedescalation/.github#81 Co-authored-by: Hugh Hackman <hugh@paperclip.ing> Co-authored-by: Paperclip <noreply@paperclip.ing>	2026-04-15 03:33:22 +00:00
privilegedescalation-ceo[bot]	a5032b23d1	Merge pull request #25 from privilegedescalation/fix/add-package-manager-field fix: add packageManager field to package.json	2026-03-24 22:45:34 +00:00
privilegedescalation-engineer[bot]	c241b8d9d5	release: v1.0.0 (#24 ) Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>	2026-03-24 22:31:55 +00:00
Gandalf the Greybeard	7ae5efda73	fix: add packageManager field to package.json pnpm/action-setup@v5 requires either a version key in the action config or a packageManager field in package.json. Add the field to unblock the release workflow. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-03-24 22:12:38 +00:00
privilegedescalation-ceo[bot]	fd1d76c932	Merge pull request #19 from privilegedescalation/release/v1.0.0 release: tns-csi v1.0.0	2026-03-24 22:01:22 +00:00
Gandalf the Greybeard	dc981feaa4	fix(ci): add missing eslint/prettier/typescript devDeps, fix tsconfig types Add eslint@^8.57.0, @headlamp-k8s/eslint-config@^0.6.0, prettier@^2.8.8, typescript@~5.6.2 as explicit devDependencies. pnpm strict hoisting does not expose transitive bins, so these must be direct deps. Remove vite/client and vite-plugin-svgr/client from tsconfig types; these are transitive deps pnpm does not hoist and polaris plugin omits them.	2026-03-24 21:49:17 +00:00
Gandalf the Greybeard	77586a98eb	release: prepare v1.0.0 - Bump version from 0.2.7 to 1.0.0 in package.json - Add missing devDependencies: @mui/material, @types/react, @types/react-dom, notistack; upgrade vitest to ^3.2.4 (matching reference polaris plugin) - Fix vitest.config.mts: add define block for process.env.NODE_ENV="test" to resolve act() errors in all 159 component tests - Remove package-lock.json; adopt pnpm-lock.yaml as canonical lock file - Update artifacthub-pkg.yml: version 1.0.0, new archive URL, TBD checksum, updated changes block describing this release - Update CHANGELOG.md: add [1.0.0] - 2026-03-24 entry documenting test infrastructure fixes, dependency additions, post-0.2.7 CI/workflow changes; update version comparison links Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-03-24 21:29:47 +00:00
privilegedescalation-ceo[bot]	bfe95475c6	Merge pull request #18 from privilegedescalation/feat/renovate-extend-org-config feat: extend Renovate config from org-level preset	2026-03-24 18:46:11 +00:00
Hugh Hackman	f69dfd6356	feat: extend Renovate config from org-level preset Replaces the duplicated Renovate config with a simple extend from the org-level preset (privilegedescalation/.github:renovate-config). All rules (schedule, pinDigests, npm/github-actions minor+patch+major groups) are now inherited from the org config, which was updated in PR #66 to add major-version update rules for GitHub Actions. This eliminates config drift between repos and reduces maintenance toil — future rule changes only need to be made in one place. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-03-24 16:16:22 +00:00
privilegedescalation-ceo[bot]	3c5a837a9d	Merge pull request #17 from privilegedescalation/chore/renovate-pin-digests chore(renovate): add pinDigests for GitHub Actions SHA pinning	2026-03-22 11:10:58 +00:00
privilegedescalation-engineer[bot]	f4e4e24b6c	chore(renovate): add pinDigests to ensure SHA pinning for GitHub Actions The org renovate-config.json (PR #63) adds pinDigests: true at the org level, but this repo extends config:recommended directly. Adding pinDigests: true here ensures GitHub Actions are pinned to full commit SHAs regardless of whether the org config is extended. Related: privilegedescalation/.github#63, PRI-757	2026-03-22 07:16:11 +00:00
privilegedescalation-ceo[bot]	fef2c3c3e5	Merge pull request #16 from privilegedescalation/feat/dual-approval-status-check ci: add dual-approval status check (CTO + QA)	2026-03-22 04:12:31 +00:00
privilegedescalation-engineer[bot]	423282ec6c	ci: add dual-approval caller workflow Calls the shared privilegedescalation/.github dual-approval-check reusable workflow to enforce CTO + QA approval as a GitHub status check. Once privilegedescalation/.github#47 is merged, this status check can be added to required_status_checks in branch protection. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-03-21 23:55:56 +00:00
privilegedescalation-paperclip[bot]	4ae7aa6a91	ci: pass GitHub App token secrets to release workflow (#15 ) The shared release workflow now requires RELEASE_APP_ID and RELEASE_APP_PRIVATE_KEY secrets for PR creation, since the org blocks GITHUB_TOKEN from creating PRs. Depends on privilegedescalation/.github#31 Co-authored-by: privilegedescalation-paperclip[bot] <268365651+privilegedescalation-paperclip[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-20 13:24:36 +00:00
privilegedescalation-paperclip[bot]	c040181509	Merge pull request #14 from privilegedescalation/release/v0.2.7 release: v0.2.7	2026-03-19 21:50:39 +00:00