[innerdvations]

What does it do?

Removes Changesets and publishes @strapi/sdk-plugin the same way @strapi/client does.

• Deletes .changeset/, the Changesets dependencies, and the release:* / prerelease:* scripts.
• Replaces the push-to-main Changesets action with a manually run Release workflow. A maintainer bumps package.json on a releases/<version> branch, tags that commit, and runs the workflow with the latest or next dist-tag. The workflow builds, then runs npm publish --provenance --access public.
• prepack runs format, lint, types, unit tests, and the build before publish. That is the check @strapi/client runs from its prepack script. This package did not have one.
• Slack success and failure messages match the client workflow.
• Maintainer steps are in CONTRIBUTING.md. Creating the git tag and the GitHub Release stays manual, same as client.

Pending Changesets files on main are removed. They described changes already committed since v6.1.1. The next GitHub Release should use generated notes.

Why is it needed?

@strapi/sdk-plugin is one package. Changesets required a changeset file on each change, and missed files had to be backfilled. @strapi/client already publishes from a manually run workflow with npm trusted publishing.

How to test it?

• CI on this PR should pass lint, types, unit tests, and the build. The Release workflow does not run on pull requests.
• Confirm .changeset/ is gone and package.json has no @changesets/* dependency.
• Leave the Release workflow unrun on this branch. The package version is still 6.1.1, and a run would try to publish that version again.

Related issue(s)/PR(s)

Fixes CMS-1994

#177 is the open Changesets version PR (changeset-release/main). Close it when this merges so it cannot version the package with Changesets again.

Secrets and npm access

Set this before the first release:

• SLACK_RELEASE_WEBHOOK_URL on strapi/sdk-plugin. This is a repository Actions secret: a Slack incoming webhook. strapi/client already has this secret, and its Release workflow posts success and failure with it. This repo does not have it. The publish job can still succeed; the Slack jobs fail until the secret exists.

No other new GitHub secret is required.

• NPM_TOKEN is already set on this repo (updated 2026-05-20). This workflow does not read it. strapi/client has no NPM_TOKEN secret. Publish uses npm trusted publishing (OIDC, id-token: write).
• npm trusted publisher for @strapi/sdk-plugin must allow repository strapi/sdk-plugin and workflow .github/workflows/release.yml. That setting lives on npmjs.com, not in GitHub secrets. feature: adding trusted publishing #185 already used this workflow filename for trusted publishing. Confirm the publisher is still saved for that file. CMS-1372 is still in Backlog, so the npmjs.com publisher may never have been saved. If it is missing, add a trusted publisher for this repository and .github/workflows/release.yml. The workflow does not use a GitHub environment, so leave the publisher environment empty.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4ec14c6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[sonarqubecloud]

Quality Gate failed

Failed conditions
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE