ci: replace auto and lerna with release-please

.github/workflows/check-release-config.yml

@@ -0,0 +1,24 @@
+name: Check release-please config
+on:
+  pull_request:
+    paths:
+      - 'packages/**'
+      - 'release-please-config.json'
+permissions:
+  contents: read
+jobs:
+  check:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Verify release-please config covers every package
+        run: |
+          set -euo pipefail
+          declared=$(jq -r '.packages | keys[]' release-please-config.json | sort)
+          actual=$(find packages -mindepth 1 -maxdepth 1 -type d | sort)
+          diff <(echo "$declared") <(echo "$actual") || {
+            echo "release-please-config.json is out of sync with packages/ directory" >&2
+            exit 1
+          }

.github/workflows/ci.yml

@@ -512,69 +512,3 @@ jobs:
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           retention-days: 7
-
-  release:
-    runs-on: ubuntu-latest
-    needs: [test, generate-plugins]
-    if: |
-      !contains(github.event.head_commit.message, 'ci skip')
-      && !contains(github.event.head_commit.message, 'skip ci')
-      && github.actor != 'dependabot[bot]'
-      && github.event_name == 'push'
-      && github.ref == 'refs/heads/main'
-    name: Release packages
-    env:
-      NX_BRANCH: ${{ github.event.number || github.ref_name }}
-    permissions:
-      contents: read
-      id-token: write
-    steps:
-      - id: get-secrets
-        uses: grafana/shared-workflows/actions/get-vault-secrets@f1614b210386ac420af6807a997ac7f6d96e477a # get-vault-secrets/v1.3.1
-        with:
-          # Secrets placed in the ci/repo/grafana/plugin-tools in vault
-          repo_secrets: |
-            SLACK_WEBHOOK_URL=slack_webhook_url:slack_webhook_url_fp
-            NX_CLOUD_ACCESS_TOKEN=nx_token:nx_token
-          export_env: false
-
-        # As recommended on NX docs the NX Cloud token should be set as an environment variable:
-        # https://nx.dev/ci/recipes/security/access-tokens#setting-ci-access-tokens
-      - id: add-nx-cloud-access-token-to-env
-        run: |
-          echo "NX_CLOUD_ACCESS_TOKEN=${{ fromJSON(steps.get-secrets.outputs.secrets).NX_CLOUD_ACCESS_TOKEN }}" >> $GITHUB_ENV
-
-      - name: Generate token
-        id: generate-token
-        uses: grafana/shared-workflows/actions/create-github-app-token@259ba21cb3ff07724f331e26d926d655d24b317b # create-github-app-token/v0.2.3
-        with:
-          github_app: grafana-plugins-platform-bot
-          permission_set: ${{ github.event_name == 'push' && github.ref == 'refs/heads/main' && 'release' || 'default' }}
-
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          token: ${{ steps.generate-token.outputs.token }}
-          persist-credentials: false
-
-      - name: Prepare repository
-        run: git fetch --unshallow --tags
-
-      - name: Setup nodejs
-        uses: actions/setup-node@6044e13b5dc448c55e2357c09f80417699197238 # v6.2.0
-        with:
-          node-version-file: '.nvmrc'
-          registry-url: 'https://registry.npmjs.org'
-          # disabled caching to prevent a poisoned cache affecting releases.
-          package-manager-cache: false
-
-      - name: Install dependencies
-        run: npm ci --no-audit
-
-      - name: Build
-        run: npm run build
-
-      - name: Create Release
-        env:
-          GITHUB_TOKEN: ${{ steps.generate-token.outputs.token }}
-          SLACK_WEBHOOK_URL: ${{ fromJSON(steps.get-secrets.outputs.secrets).SLACK_WEBHOOK_URL }}
-        run: npm run release

.github/workflows/release-please.yml

@@ -0,0 +1,124 @@
+name: Release
+on:
+  push:
+    branches: [main]
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required to assume roles from GitHub's OIDC.
+    concurrency:
+      group: release
+      cancel-in-progress: false
+    outputs:
+      releases_created: ${{ steps.release.outputs.releases_created }}
+      paths_released: ${{ steps.release.outputs.paths_released }}
+    steps:
+      - name: Generate token
+        id: app-token
+        uses: grafana/shared-workflows/actions/create-github-app-token@259ba21cb3ff07724f331e26d926d655d24b317b # create-github-app-token/v0.2.3
+        with:
+          github_app: grafana-plugins-platform-bot
+          permission_set: release
+
+      - id: release
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+
+  publish:
+    needs: release
+    if: ${{ needs.release.outputs.releases_created == 'true' }}
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for npm Trusted Publishing (OIDC)
+    environment: npm-publish
+    concurrency:
+      group: npm-publish
+      cancel-in-progress: false
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version-file: .nvmrc
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+
+      - name: Install npm for npm stage publish
+        run: npm install -g npm@11.15.0
+
+      - name: Install dependencies
+        run: npm ci --no-audit
+
+      # Build all packages to ensure dist files are present for publishing
+      # Nx and release please don't share the same dependency graph so safer to build everything.
+      - name: Build all packages
+        run: npm run build
+
+      - name: Publish to npm
+        env:
+          PATHS_RELEASED: ${{ needs.release.outputs.paths_released }}
+        run: |
+          set -euo pipefail
+          echo "$PATHS_RELEASED" | jq -r '.[]' | while read -r path; do
+            echo "Publishing $path"
+            (cd "$path" && npm stage publish --provenance --access public)
+          done
+
+      - name: Build Slack payload
+        id: slack-payload
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PATHS_RELEASED: ${{ needs.release.outputs.paths_released }}
+          REPO: ${{ github.repository }}
+        with:
+          script: |
+            const fs = require('node:fs');
+            const paths = JSON.parse(process.env.PATHS_RELEASED);
+            const lines = paths.map((p) => {
+              const { name, version } = JSON.parse(fs.readFileSync(`${p}/package.json`, 'utf8'));
+              const tag = `${name}@${version}`;
+              const releaseUrl = `https://github.com/${process.env.REPO}/releases/tag/${encodeURIComponent(tag)}`;
+              const npmUrl = `https://www.npmjs.com/package/${name}`;
+              return [
+                `• *<${releaseUrl}|${tag}>* - <${npmUrl}|npm>`
+              ].join('\n');
+            });
+            const payload = {
+              channel: 'C09CY9URN31',
+              text: `:package: Beep Boop! :robot: Plugin tools ${paths.length} package${paths.length === 1 ? '' : 's'} staged for release`,
+              blocks: [
+                {
+                  type: 'header',
+                  text: { type: 'plain_text', text: `:package: Beep Boop! :robot: Plugin tools ${paths.length} package${paths.length === 1 ? '' : 's'} staged for release` },
+                },
+                {
+                  type: 'section',
+                  text: { type: 'mrkdwn', text: lines.join('\n') },
+                },
+                {
+                  type: 'context',
+                  elements: [
+                    {
+                      type: 'mrkdwn',
+                      text: `Please login to <https://www.npmjs.com/|npmjs> to approve publishing. See <https://github.com/${process.env.REPO}/blob/main/CONTRIBUTING.md#create-a-release|CONTRIBUTING.md> for the full release walkthrough.`,
+                    },
+                  ],
+                },
+              ],
+            };
+            core.setOutput('payload', JSON.stringify(payload));
+
+      - name: Notify Slack
+        uses: grafana/shared-workflows/actions/send-slack-message@eb1fbd807f87aea8f40ff08dc9cd02872cad55b3 # send-slack-message/v2.0.5
+        with:
+          method: chat.postMessage
+          payload: ${{ steps.slack-payload.outputs.payload }}

.release-please-manifest.json

@@ -0,0 +1,12 @@
+{
+  "packages/create-plugin": "7.7.0",
+  "packages/eslint-plugin-plugins": "0.7.0",
+  "packages/plugin-docs-cli": "0.1.0",
+  "packages/plugin-docs-parser": "0.1.0",
+  "packages/plugin-e2e": "3.9.0",
+  "packages/plugin-meta-extractor": "0.13.0",
+  "packages/plugin-types-bundler": "0.6.0",
+  "packages/react-detect": "0.7.0",
+  "packages/sign-plugin": "3.3.0",
+  "packages/tsconfig": "2.2.0"
+}

AGENTS.md

@@ -16,8 +16,8 @@ You are an expert in TypeScript and Node.js development. You are also an expert
 
 The applications in this mono-repo use the following tech stack:
 
-- Nx >=21
-- TypeScript >=5.8
+- Nx >=22
+- TypeScript >=5.9
 - Node.js 24
 - Vitest 4
 - Rollup