ci: release the skeleton with release-please by aryanjasala · Pull Request #66 · rtCamp/plugin-elementary

aryanjasala · 2026-11-04T12:40:52Z

What this PR does

Releases the skeleton itself with release-please, the flow proposed in rtCamp/wp-shared-workflows#45: pull requests are squash-merged with Conventional Commit titles, release-please keeps one release pull request open that bumps the version and writes CHANGELOG.md, and merging it tags vX.Y.Z and publishes the GitHub release.

Projects made from the skeleton are unchanged: init cleanup removes these release files, and projects keep releasing by hand with npm run release:bump, npm run release:changelog and npm run release:zip.

Closes

N/A

Changes

.github/workflows/release-starter.yml runs googleapis/release-please-action v5.0.0 (pinned by SHA) on every push to main, with write permissions on that job only.
.github/release-starter/config.json uses release-type: node (package.json, package-lock.json and the plugin header Version: line, the last through extra-files and x-release-please-start-version / x-release-please-end marker lines, since WordPress reads the rest of the Version: line as the value). Commit types map to Keep a Changelog headings: feat Added, fix Fixed, perf/revert/build Changed; docs, chore, ci, test, refactor and style are hidden and cut no release. manifest.json starts at 1.0.0, the latest release.
Init cleanup removes .github/workflows/release-starter.yml and .github/release-starter/. Both are named for the skeleton: cleanup also runs on re-init and --clean, so a generic path such as .github/release-please/ could delete a project's own release-please files.
Init cleanup is switched on with only those two targets (it was off on main).
PROJECT_NAME_FEATURES_VERSION is not bumped by releases: init rewrites the header and package.json for a new project but not the constant, so a moving constant would disagree with every new project's header. The maintainer docs say why.
pr-title.yml drops wip mode: it posts a commit status, which a fork pull request's read-only token can't write.
dependabot.yml sets the build prefix (build(deps) / build(deps-dev) with include: scope). New projects come from composer create-project, which installs the latest tag, so dependency fixes have to be released to reach anyone: build is listed under Changed and counts as releasable. Each merge only updates the open release pull request; a release happens when a maintainer merges that.
CHANGELOG.md keeps ## Unreleased (projects inherit this file and release:changelog needs that heading); release-please inserts each release below it, and a comment says not to add entries there in the skeleton.
Docs: CONTRIBUTING.md asks for a Conventional PR title; docs/internal/maintenance.md gains a "Releasing" section; docs/initialization.md lists the new cleanup targets.

How I verified

actionlint and yamllint pass on the workflows; the JSON files parse; bin/scaffold.config.js loads.
release-please 17.11.2's own updaters, run against the real files: the version updater changes exactly one Version: line, and the changelog updater puts a sample release between ## Unreleased and ## 1.0.0.
main has no commits since v1.0.0. The first releasable merge (any of the open build(deps) Dependabot PRs, or a fix: such as fix(ci): separate file and project lint commands #65) opens the 1.0.1 release PR.

Acceptance criteria

Runtime behavior

After merge, the Release (skeleton) run passes
Init cleanup removes the skeleton's release files from new projects

Code quality

Lint: zero errors
Static analysis: n/a
Tests pass (no PHP or JS source changed)

Housekeeping

No hand-written CHANGELOG.md entry: release-please writes it

Reviewer notes

Repository settings to change when this merges:

Allow squash merging only, with the pull request title as the default commit title (PR_TITLE).
Keep "Validate PR title" out of the required checks: the release pull request is opened with GITHUB_TOKEN, which starts no workflow runs. A GitHub App token would fix that later.

Release automation for projects made from the skeleton is left for later: it needs a one-time setup hook in wp-tooling's init engine to give each project a fresh release history.

Dependabot copies build(deps) from history. release-please treats every type with a visible changelog section as releasable, so pin chore to keep dependency bumps from cutting a release on their own.

Pull request titles, already checked by pr-title.yml, become the Conventional Commit subjects on main. release-please reads them, keeps a release pull request open that bumps package.json, package-lock.json and the plugin header Version, and writes CHANGELOG.md; merging it tags vX.Y.Z and publishes the release. - release.yml, with changelog sections mapped to Keep a Changelog - "## Unreleased" stays for projects' npm run release:changelog; release-please inserts below it - init cleanup is switched on, removing only the release workflow and config, so a new plugin does not inherit the skeleton's history - PROJECT_NAME_FEATURES_VERSION is left out of the bump on purpose: init does not rewrite it, so it must stay at the project start version - contributing, initialization and maintainer docs follow the new flow

Init used to remove the release workflow and config, so a new plugin fell back to release:bump and release:changelog. A new "release" feature (on by default, under Developer Tooling) now sets the project up for release-please: - it copies bin/features/release/release.yml to .github/workflows/release.yml and release-please-config.json to the root, pointing extra-files at the renamed main file (the engine never rewrites files under bin/, so the template still names the skeleton's); - it seeds .release-please-manifest.json at 0.0.0 (nothing released yet), sets initial-version to the version init wrote, so the first release is exactly that version, and sets bootstrap-sha to the HEAD init ran on, so skeleton commits stay out of the first changelog; - during first setup it removes the skeleton's CHANGELOG.md, which release-please writes afresh on the first release. Turning the feature off removes the workflow and config and keeps the manifest; turning it on again carries on from the recorded version. The skeleton's own release machinery moves to skeleton-only paths (.github/workflows/release-starter.yml, .github/release-please/), which cleanup removes, so it never ships into a project, including one that opts out. The project workflow documents the GITHUB_TOKEN limits: tags it creates don't start `on: push: tags` workflows, so deploys belong in the release workflow, gated on its release-created output.

wp-shared-workflows is not adding cd-release-please.yml after all: the release workflow stays a plain release-please-action job in each project.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

2 open issues

Prefer ${{ github.token }} over ${{ secrets.GITHUB_TOKEN }} for the built-in workflow token… · New
“Cleanup removes all three” is slightly ambiguous since cleanup targets are two paths… · New

What changed in this PR

Adds automated releases for the skeleton and for newly-initialized plugins using release-please, with init support to scaffold and seed release history.

Changes:

Add release-please workflows/configs for the skeleton and for generated plugins (via new release init feature).
Update init scaffolding to seed release-please manifest/config and enable cleanup of skeleton-only release automation.
Update docs and contributor guidance to align with Conventional PR titles and release-please-managed changelogs.

File	Description
project-name-features.php	Adds release-please version markers around the plugin header `Version:` line.
docs/internal/maintenance.md	Documents how skeleton releases are cut via release-please and related repo settings.
docs/initialization.md	Documents the new `release` feature, first-release setup requirements, and cleanup behavior.
bin/scaffold.config.js	Introduces `release` feature; seeds manifest/config and enables cleanup targets.
bin/features/release/release.yml	Adds the plugin release workflow template using release-please.
bin/features/release/release-please-config.json	Adds the plugin release-please config template (extra-files/changelog sections).
CONTRIBUTING.md	Updates contributor workflow to rely on PR titles and release-please for changelog entries.
CHANGELOG.md	Adds guidance comment indicating release-please owns changelog entries for the skeleton.
.github/workflows/release-starter.yml	Adds skeleton-only release-please workflow targeting skeleton-only config/manifest.
.github/release-please/manifest.json	Adds skeleton-only release-please manifest starting at 1.0.0.
.github/release-please/config.json	Adds skeleton-only release-please config, including extra-files for plugin header.
.github/dependabot.yml	Forces Dependabot commit prefix to `chore` to avoid release-please-triggered releases.

_{Review effort: Lite}

New plugins no longer get release-please from init: the release feature, its bin/features/release/ templates and the seeding of a fresh release history are gone, so there is one release workflow to maintain and Dependabot keeps its pins current. Init cleanup still removes the skeleton's own release workflow, config and manifest, which live at skeleton-only paths, so projects keep releasing by hand as before. Also from review: the PR title check no longer uses wip mode, which posts a commit status a fork's read-only token can't write; the workflows use github.token; and the security changelog section is gone, since the title check doesn't accept a security type.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

5 open issues

amannn/action-semantic-pull-request typically requires statuses: write permission to… · New
The PR description says Dependabot is pinned to chore(deps), but the config uses prefix: chore… · New
The PR description states commit type security maps to a visible \"Security\" changelog section,… · New
This change also removes the prior with: wip: true configuration. If the repo still relies on… · New
“Cleanup removes all three” is slightly ambiguous since cleanup targets are two paths…

1 resolved since last review

Prefer ${{ github.token }} over ${{ secrets.GITHUB_TOKEN }} for the built-in workflow token…

_{Review effort: Lite}

Init cleanup also runs on re-init and --clean and deletes its targets recursively, so the generic .github/release-please/ would take a project's own release-please config and manifest with it if the project used that layout. Name the folder for the skeleton, like release-starter.yml, so cleanup only ever removes the skeleton's files.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

With amannn/action-semantic-pull-request, removing statuses: write commonly causes the action… · New
Using a generic concurrency group name like release can unintentionally serialize this workflow… · New
The PR description says Dependabot is pinned to the chore(deps) prefix, but this configuration… · New

5 resolved since last review

_{Review effort: Lite}

Adi-ty

Approving just two things worth considering:

The 20 open Dependabot PRs (#42–#64) are still build(deps), so each would cut a patch release, even if merged before this one (release-please counts everything since v1.0.0). Retitle them to chore(deps…) before merging, or @dependabot recreate once this is on main.
With "Validate PR title" no longer required, a bad title can be merged and release-please skips it. A GitHub App token for the release workflow would let us require the check again.

New projects come from composer create-project, which installs the latest tag, so a dependency fix on main reaches nobody until it is released. Prefix Dependabot commits with build, which the changelog lists under Changed and release-please counts as releasable. Each merge only updates the open release pull request; a release still happens only when a maintainer merges that.

aryanjasala · 2026-11-05T07:56:39Z

@Adi-ty thanks. On the Dependabot point I went the other way after checking how the starters are used: both are on Packagist and the READMEs say composer create-project, which installs the latest tag. So a dependency fix on main reaches no new project until it's released, and the bumps should be releasable rather than hidden. 1355356 sets the Dependabot prefix to build (listed under Changed). The open build(deps) PRs are then already right as they are, and merging them only updates the one release PR; a release happens when we merge that. The push dismissed your approval, so could you take another look?

On the title check: agreed, an org GitHub App token is the way to make it required again. Until then, a PR merged with a bad title can be fixed by adding a BEGIN_COMMIT_OVERRIDE ... END_COMMIT_OVERRIDE block with the right Conventional Commit to its description, which release-please reads instead of the subject.

Copilot

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

3 open issues

With pull-requests: read only, this workflow may fail for the common configuration of… · New
The PR description says Dependabot is pinned to the chore(deps) prefix, but the change sets the… · New
Using a $schema URL pinned to the main branch can cause editor/CI validation to change… · New

3 resolved since last review

_{Review effort: Lite}

aryanjasala added 4 commits November 4, 2026 04:45

ci: prefix Dependabot commits with chore

8e8aca6

Dependabot copies build(deps) from history. release-please treats every type with a visible changelog section as releasable, so pin chore to keep dependency bumps from cutting a release on their own.

docs(init): drop the note about a reusable release workflow

8f8d061

wp-shared-workflows is not adding cd-release-please.yml after all: the release workflow stays a plain release-please-action job in each project.

aryanjasala requested review from Adi-ty and AnuragVasanwala as code owners November 4, 2026 12:40

Copilot AI balanced review requested due to automatic review settings November 4, 2026 12:40

Copilot AI reviewed Nov 4, 2026

View reviewed changes

Comment thread .github/workflows/release-starter.yml Resolved

Comment thread docs/internal/maintenance.md Resolved

Copilot AI balanced review requested due to automatic review settings November 4, 2026 13:17

aryanjasala changed the title ~~feat(init): cut releases with release-please, for the skeleton and for new plugins~~ ci: release the skeleton with release-please Nov 4, 2026

Copilot AI reviewed Nov 4, 2026

View reviewed changes

Comment thread .github/workflows/pr-title.yml Resolved

Comment thread .github/dependabot.yml Resolved

Comment thread .github/release-starter/config.json Resolved

Comment thread .github/workflows/pr-title.yml Resolved

Adi-ty reviewed Nov 4, 2026

View reviewed changes

Comment thread bin/scaffold.config.js Resolved

Comment thread docs/internal/maintenance.md Resolved

Copilot AI balanced review requested due to automatic review settings November 4, 2026 21:22

Copilot AI reviewed Nov 4, 2026

View reviewed changes

Comment thread .github/workflows/pr-title.yml Resolved

Comment thread .github/workflows/release-starter.yml Resolved

Comment thread .github/dependabot.yml Resolved

Adi-ty previously approved these changes Nov 5, 2026

View reviewed changes

aryanjasala dismissed Adi-ty’s stale review via 1355356 November 5, 2026 07:55

Copilot AI balanced review requested due to automatic review settings November 5, 2026 07:55

Adi-ty approved these changes Nov 5, 2026

View reviewed changes

Copilot AI reviewed Nov 5, 2026

View reviewed changes

Comment thread .github/workflows/pr-title.yml Resolved

Comment thread .github/dependabot.yml Resolved

Comment thread .github/release-starter/config.json Resolved

aryanjasala merged commit 2af22e3 into main Nov 5, 2026
46 of 51 checks passed

aryanjasala mentioned this pull request Nov 5, 2026

chore: reconcile issue forms and add SECURITY.md and labels #76

Open

6 tasks done

Conversation

aryanjasala commented Nov 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Closes

Changes

How I verified

Acceptance criteria

Runtime behavior

Code quality

Housekeeping

Reviewer notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Adi-ty left a comment

Choose a reason for hiding this comment

Uh oh!

aryanjasala commented Nov 5, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Copilot review overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aryanjasala commented Nov 4, 2026 •

edited

Loading