Skip to content

fix: bundle workspace deps and add config-resolver to release-please#309

Merged
JoshMock merged 4 commits into
mainfrom
claude/exciting-shaw-937e0b
May 13, 2026
Merged

fix: bundle workspace deps and add config-resolver to release-please#309
JoshMock merged 4 commits into
mainfrom
claude/exciting-shaw-937e0b

Conversation

@MattDevy
Copy link
Copy Markdown
Contributor

@MattDevy MattDevy commented May 13, 2026

Summary

Fixes #308npm install @elastic/cli was failing with E404 because @elastic/config-resolver and @elastic/es-schemas are declared as runtime dependencies but were never published to npm.

  • Add bundledDependencies for both workspace packages in the root package.json. npm will include them verbatim in the published tarball so consumers never need to fetch them from the registry.
  • Add packages/config-resolver to .github/release-please-config.json so it gets its own changelog, tags, and version bumps tracked by release-please.
  • Add the node-workspace plugin to release-please config so that when either workspace package is versioned, the CLI's dependency references in package.json are updated automatically in the release PR (and the CLI gets a patch bump if it has no other changes).

What to verify

  • npm pack --dry-run shows @elastic/config-resolver and @elastic/es-schemas in the tarball listing
  • .github/release-please-config.json — all three packages tracked, node-workspace plugin present
  • The publish step in release.yml (npm publish without --workspaces) continues to publish only @elastic/cli; workspace packages are not published separately

- Add bundledDependencies for @elastic/config-resolver and
  @elastic/es-schemas so npm install @elastic/cli works without
  those packages being published to the registry (fixes #308)
- Remove "private": true from config-resolver to allow future
  independent publishing
- Add packages/config-resolver entry to release-please config so
  it gets versioned and tagged alongside the CLI
- Add the node-workspace plugin so release-please automatically
  updates inter-package dependency versions in the release PR
@MattDevy MattDevy requested a review from JoshMock May 13, 2026 10:01
@github-actions
Copy link
Copy Markdown

github-actions Bot commented May 13, 2026

MegaLinter analysis: Success

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ COPYPASTE jscpd yes no no 7.44s
✅ REPOSITORY gitleaks yes no no 53.33s
✅ REPOSITORY git_diff yes no no 0.62s
✅ REPOSITORY secretlint yes no no 29.06s
✅ REPOSITORY trivy yes no no 16.75s

See detailed reports in MegaLinter artifacts
Set VALIDATE_ALL_CODEBASE: true in mega-linter.yml to validate all sources, not only the diff

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

@MattDevy MattDevy requested a review from margaretjgu May 13, 2026 10:04
MattDevy added 3 commits May 13, 2026 11:11
bundledDependencies doesn't consult the private flag of the bundled
package — npm pack follows workspace symlinks regardless. Keeping
private: true prevents accidental independent publishing until we are
ready to release it separately.
@elastic/es-schemas is now marked private (c57a0fe), so license-checker
reports it as UNLICENSED. Same pattern as @elastic/config-resolver.
@MattDevy
Copy link
Copy Markdown
Contributor Author

Heads up on the NOTICE.txt regeneration in this PR: marking @elastic/es-schemas as private: true causes license-checker to report it as UNLICENSED in NOTICE.txt, even though its package.json still declares "license": "Apache-2.0". The same already happens for @elastic/config-resolver.

@JoshMock is this expected/correct behaviour? A couple of options if not:

  1. Leave as-is — private workspace packages appear as UNLICENSED in NOTICE.txt (current convention).
  2. Filter @elastic/* workspace packages out of scripts/generate-notice.mjs entirely, since they're first-party code rather than third-party dependencies.

Going with option 1 here to unblock CI, happy to do option 2 in a follow-up if preferred.

@MattDevy MattDevy assigned MattDevy and unassigned MattDevy May 13, 2026
@JoshMock
Copy link
Copy Markdown
Member

yep, option 1 is fine for now

Copy link
Copy Markdown
Member

@JoshMock JoshMock left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for fixing this @MattDevy! thought this was how it was already working or I'd have double-checked before publish.

@JoshMock JoshMock merged commit 39d98c5 into main May 13, 2026
19 checks passed
@JoshMock JoshMock deleted the claude/exciting-shaw-937e0b branch May 13, 2026 14:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

npm install @elastic/cli fails with E404: workspace dependencies not published to npm

2 participants