[Adi-ty]

What this PR does

Releases all six packages with release-please, as wp-shared-workflows, plugin-elementary and theme-elementary already do.

• The PR title becomes the changelog entry.
• release-please keeps a release PR open for each package with changes to release.
• Merging a release PR bumps that package's version, writes its CHANGELOG.md, tags it and publishes a GitHub release.
• npm packages then publish through ci(npm): publish workspaces to npm from main with trusted publishing #71's workflow, and Composer packages split through feat(release): release Composer packages separately #97's.

Closes

N/A

Changes

• release-please-config.json and .release-please-manifest.json:
  • six packages, with separate-pull-requests on;
  • tags look like @rtcamp/<package>@<version> for npm and rtcamp/<package>@<version> for Composer, the form release-php.yml acts on;
  • commit types map to sections: feat is Added, fix is Fixed, and perf, revert and build are Changed. Other types release nothing.
• npm packages:
  • release-please bumps package.json. A json extra-files entry bumps the package's entry in the root package-lock.json, which the node strategy leaves alone.
  • An @rtcamp/eslint-config release also rewrites the other three workspaces' @rtcamp/eslint-config devDependency range to ^<new version>, in their package.json and in the root lockfile. Those workspaces are not bumped or released.
  • No node-workspace plugin: it gives every dependent a patch release, and none of node-workspace: always-link-local: false is ignored, so dependents are pulled into a release even when their declared range already covers the new version googleapis/release-please#2876, #2908 or #2419 changes that.
• Composer packages: composer.json has no version, so only CHANGELOG.md changes.
• release.yml runs googleapis/release-please-action v5.0.0 (pinned by SHA) with GITHUB_TOKEN.
  • Tags created with GITHUB_TOKEN start no workflows, so its release-php job calls release-php.yml for each Composer release.
  • npm needs no call: the merged release PR changes package.json, which already starts publish-npm-packages.yml. Publishing has to stay in that file, because the trusted publisher is tied to its name.
• release-php.yml gains a workflow_call entry point that takes the tag and the two deploy keys, and checks out the tagged commit. A tag pushed by hand still releases through the tag trigger.
• pr-title.yml is the same title check that plugin-elementary and theme-elementary run.
• Changelogs and docs:
  • Each package's CHANGELOG.md loses ## [Unreleased], because release-please inserts each release above the first version heading and would strand anything left under it. In its place, a line names the last hand-written release ("Entries for releases after 2.0.0 are written by release-please …").
  • AGENTS.md (root and wp-tooling), CONTRIBUTING.md, the PR template and the task template describe the new flow. The task template now targets main with a Conventional PR title, since a [<milestone>] title fails the check.
• Not touched: .github/release.yml and .github/labels.yml (both chore: add issue forms, SECURITY.md, CODEOWNERS, labels and release notes config #92), and monorepo-builder.php.

How I verified

• actionlint passes on every workflow, both JSON files parse, and npm run check passes.
• I ran release-please 17.6.0's own code (the version the pinned action bundles) read-only against this repo's main, with this branch's config:

  • With bootstrap-sha at the feat(eslint-config): accept @wordpress/eslint-plugin 26 and 27 #79 merge and today's versions, it opens exactly two release PRs:

    • @rtcamp/wp-tooling 2.1.0 (feat(detect-changes): count ES-module and TypeScript files in the js bucket #80);
    • rtcamp/wp-phpstan 1.1.0 (feat(phpstan): run shared baseline at level 8 #83).

    The new CHANGELOG sections land above the top version heading, the lockfile's wp-tooling version becomes 2.1.0, and composer.json is unchanged.

  • With bootstrap-sha at main's head and the cut-over manifest, it opens none.

• I applied the updates of a simulated @rtcamp/eslint-config 3.0.0 release to feat(eslint-config)!: match the @wordpress/scripts default config #94's branch, using release-please's own updaters.
  • Exactly eight lines change: the version and the three ranges, each in package.json and in the lockfile, with ^ kept.
  • npm ci passes, and npm install --package-lock-only changes nothing.
• I smoke-tested the full flow end to end in a test monorepo with the same layout: two Composer packages with mirror repos, and npm workspaces where one devDepends on another. I merged Conventional PRs, then merged the release PRs they opened.
  • Composer: the release PR merge tagged the package, and release.yml called release-php.yml. The mirror got exactly the expected git subtree split commit and tag, and the other package was untouched.
  • npm: a breaking eslint-config release also rewrote the dependent workspace's range in its package.json and in the lockfile. The dependent got no release of its own, and npm ci passes on the result.

Reviewer notes

• Stacked on feat(release): release Composer packages separately #97, which sits on ci(npm): publish workspaces to npm from main with trusted publishing #71. This stays a draft until the cut-over:

  1. Merge ci(npm): publish workspaces to npm from main with trusted publishing #71, then feat(release): release Composer packages separately #97.
  2. Release wp-phpstan 2.0.0 by hand: cut its CHANGELOG, then tag rtcamp/wp-phpstan@2.0.0 on that commit.
  3. Merge feat(eslint-config)!: match the @wordpress/scripts default config #94, then approve the publish of eslint-config 2.0.0.
  4. Release wp-tooling 2.1.0 by hand: bump the version and the root lockfile entry, and cut the CHANGELOG.
  5. Rebase this PR onto main, set bootstrap-sha to main's head, and check the manifest against npm and Packagist.

  The first run after this merges should open no release PR.

• Why bootstrap-sha goes at the cut-over: release-please assigns commits to packages by the files they touch, not by scope. feat(eslint-config)!: match the @wordpress/scripts default config #94 (feat(eslint-config)!) also edits the other three workspaces, so an earlier SHA would propose a major release of all four.

• Open PRs: a PR that merges before the cut-over goes into the hand releases. One that merges after it drops its CHANGELOG hunk, and its title becomes the entry. This covers feat(init): add cleanup.replace and cleanup.unset #68, fix(scaffolds): ask for lint/phpstan paths instead of hardcoding them #84, fix(scaffolds): call wp-shared-workflows at @v1 and let .nvmrc pick Node #89, fix(detect-changes): bucket the tool config files each job depends on #90, feat(iapi-check): flag Interactivity API usages that WordPress 7.2 removes #91, fix(cli): flush stdout before exiting #93 and chore(wp-tooling): move the ESLint scaffold to @rtcamp/eslint-config 2 and fix JSDoc warnings #95.