chore(release): automate releases with Release Please and document released versions

[christso]

What

Two related changes: the changelog now covers every released version, and releases are automated end to end with Release Please.

1. CHANGELOG.md documented every stable release

The file previously had a single ## [Unreleased] section plus ## [1.0.0]. Fifty stable releases (v1.0.1 … v1.16.6) had shipped without entries. The changelog now carries one dated section per stable release, reconstructed from that release's commit window (207 commits) and checked against the tagged source.

• Every non-release-bump commit is either documented or excluded as internal with a reason: 116 documented, 8 carried over from the maintainer's Unreleased prose, 83 excluded (tests, CI, release tooling, dependency bumps, docs-site copy, repo-internal guidance, example workspaces, net-zero revert pairs).
• Four adversarial audits re-checked the claims against git show <tag>:src/... and produced seven corrections (v1.3.0 workspace update alias, v1.0.9 scope default, v1.0.10 output claim, v1.11.9 managed-repository environment, v1.15.0 skipped-reporting clause, and unsupported mcp auth / plugin list clauses), one removal (a v1.13.1 heading bullet that netted out in its own window), and three missing entries (Copilot and Codex global profiles, MCP --scope/--profile destinations, the engineering plugin introduction).
• v1.4.9 has no section (no user-facing change). v1.15.0, v1.16.0 and v1.16.3 keep the maintainer's curated wording.

2. Release Please owns versions, tags, and the changelog

• release-please-config.json + .release-please-manifest.json (at 1.16.6): node release type, vX.Y.Z tags, feat → Added, fix → Fixed, perf → Performance, every other type hidden from the changelog while still counting toward the bump. Validated against the official Release Please config schema.
• .github/workflows/release-please.yml: on every push, Release Please maintains a release pull request that bumps package.json, the manifest, and CHANGELOG.md. Merging that pull request is the finalize step: it creates the tag and GitHub release and publishes to npm latest through the reusable Publish workflow. No manual bump, no dispatch, no next-tag step.
• next previews: every push that has an open release pull request stamps the pending version as <pending>-next.<run>, publishes it to npm next, tags that commit v<pending>-next.<run>, and creates a GitHub prerelease. Nothing is published when main already matches the last release. latest only ever moves on a release pull request merge.
• .github/workflows/publish.yml became a reusable publisher: it takes a release tag, validates the tag against package.json at that commit, ensures the GitHub release exists, and publishes idempotently. The manual next/finalize/stable channels are gone.
• scripts/release.ts and its tests are deleted; conventional-commit versioning replaces manual bumping.
• Docs: .agents/publishing.md, AGENTS.md, CONTRIBUTING.md.

No binaries are published to GitHub releases. The distributed artifact stays the npm package (currently a 1.97 MB JS bundle run by Node ≥22 or bun), matching what shipped before.

Maintainer workflow after this lands

1. Merge conventional commits to main as usual. feat → minor, fix/perf → patch, ! or BREAKING CHANGE: → major.
2. Review the release pull request Release Please opens (edit the changelog wording there if needed) and squash merge it. That merge is the finalize step: tag, GitHub release, npm latest. Minutes after merging a fix, if that's what you want.
3. Recovery: dispatch Publish with the release tag.

Notes:

• Set the repository secret RELEASE_PLEASE_TOKEN (a PAT) if CI checks should run on the release pull request; the default token cannot trigger other workflows.
• npm trusted publishing is unchanged: the reusable publisher is still .github/workflows/publish.yml, so the existing binding still matches.
• npm's trusted publishing covers only npm publish, so CI cannot move a dist-tag by hand. Between a release and the next preview, next therefore points at the last preview; bun scripts/tag-channel.ts next <version> covers that locally if it ever matters.
• The two bullets that used to sit under ## [Unreleased] (plugin-update classification, update progress) will be regenerated from their commit subjects by the first Release Please release pull request; the curated wording is preserved here:
  • `plugin update` now classifies an already-current plugin as skipped instead of updated: it is not re-applied and its marketplace registry timestamp is left untouched. Client synchronization for its scope still runs.
  • Plugin and skill updates now expose truthful live progress. Direct plugin updates check each source without mutating it, report how many plugin updates were found, then name each source as it is applied. Direct skill updates check each source first, report the number of discovered skill updates, then name each skill as it is applied. **Plugins → Update all** keeps the current source on its existing spinner. Warnings and failures remain detailed; JSON and redirected direct output remain one-shot and batched.

Verification

Changelog reconstruction:

git log --format=%h --reverse origin/main -- CHANGELOG.md   # attribution per release window
git tag --contains <hash> --list 'v1.*'                     # entry → first stable release
git show v1.4.5:src/cli/commands/workspace.ts               # per-entry source checks

Every section date equals its tag date, every stable tag has exactly one section, and the 207-commit coverage list accounts for every commit in every window.

Release automation:

bun run src/cli/index.ts --help --json        # help surface unchanged
git tag -a v1.16.7-next.999 -m "..." && git push origin …   # preview tag mechanics in a scratch clone
node -e "…stamp version…" && bun run build && bun run dist/index.js --version   # → 1.16.7-next.999
actionlint .github/workflows/*.yml                          # clean (1.7.7)

A dry run of Release Please's changelog updater against the rewritten file inserts the next release directly under # Changelog, above ## [1.16.6], with no Unreleased section left behind. The Release Please config validates against its published JSON schema.

Repository checks:

bun run typecheck   # clean
bun run lint        # clean
bun test            # full suite
bun run build && bun run package:smoke   # packed artifact smoke passed
bun run schema:check                     # no drift
bun run docs:build                       # 13 pages built

Notes for reviewers

• Historical sections keep the file's existing heading style (## [1.16.6] - 2026-09-22); Release Please writes its own heading style for new releases and does not rewrite history.
• A pre-existing bug found while auditing (src/cli/metadata/plugin.ts advertising a removed flag) is fixed in fix(plugin): remove the unused --force flag from marketplace add #518, not here.

[cloudflare-workers-and-pages]

Deploying allagents with    Cloudflare Pages

Latest commit:	f001159
Status:	✅  Deploy successful!
Preview URL:	https://0fe22fdf.allagents.pages.dev
Branch Preview URL:	https://chore-changelog.allagents.pages.dev

View logs