[`node-workspace` plugin] making the difference between npm workspaces and sub-packages in a monorepo

[aldbr]

Is your feature request related to a problem? Please describe.

I'm encountering a problem with the node-workspace plugin in a monorepo setup. Let's assume the following monorepo containing 3 packages:

• lib: react library of components
• app: nextJS application importing lib
• extension: another nextJS application using the published npm of lib, not the one available locally

In this context, lib and app are defined as npm workspaces and share a common package-lock.json at the root of the monorepo. The extension package is managed separately, with its own package-lock.json.

When using release-please with this configuration:

  "packages": {
    ".": {
      "component": "root"
    },
    "packages/lib": {
      "component": "lib"
    }
    "packages/app": {
      "component": "app"
    },
    "packages/extension": {
      "component": "extension"
    }
  },
  "plugins": [
    {
      "type": "node-workspace",
      "merge": false
    },
    {
      "type": "linked-versions",
      "groupName": "DiracX-Web",
      "components": ["root", "lib", "app", "extension"]
    }
  ],

The tool updates the versions of all packages simultaneously (role of linked-versions, including bumping the version of lib within both the root package-lock.json and extension/package-lock.json (role of node-workspace relying on packages). This leads to inconsistencies, as the extension package's package-lock.json may reference a version of lib that hasn't been published yet, resulting in discrepancies between the version and resolved fields:

"node_modules/lib": {
  "version": "0.1.0-a3", // bumped by release-please
  "resolved": "https://registry.npmjs.org/@org/lib/-/lib-0.1.0-a2.tgz",
  ...

Describe the solution you'd like

To prevent such inconsistencies, it would be beneficial if the node-workspace plugin could selectively update package versions. Specifically, for packages not part of the npm workspace (like extension), the plugin should update their version without altering dependencies related to the monorepo.

Implementing an option to define which packages should be managed as npm workspaces within the node-workspace plugin would allow for selective version updates. For example:

  "packages": {
    ".": {
      "component": "root"
    },
    "packages/lib": {
      "component": "lib"
    }
    "packages/app": {
      "component": "app"
    },
    "packages/extension": {
      "component": "extension"
    }
  },
  "plugins": [
    {
      "type": "node-workspace",
      "merge": false
      "components": ["root", "lib", "app"]
    },
    {
      "type": "linked-versions",
      "groupName": "DiracX-Web",
      "components": ["root", "lib", "app", "extension"]
    }
  ],

In this configuration, the node-workspace plugin would manage version updates for root, lib, and app, while excluding extension from workspace dependency updates. Nevertheless, the versions of all the packages would remain linked together.

Describe alternatives you've considered

An alternative approach involved excluding extension from the packages configuration and using the extra-files option to manually update its version:

  "packages": {
    ".": {
      "component": "root"
    },
    "packages/lib": {
      "component": "lib"
    }
    "packages/app": {
      "component": "app"
    }
  },
  "plugins": [
    {
      "type": "node-workspace",
      "merge": false
    },
    {
      "type": "linked-versions",
      "groupName": "DiracX-Web",
      "components": ["root", "lib", "app"]
    }
  ],
  "extra-files": [
    {
      "type": "json",
      "path": "packages/extension/package.json",
      "jsonpath": "$.version"
    },
    {
      "type": "json",
      "path": "packages/extension/package-lock.json",
      "jsonpath": "$.version"
    },
    {
      "type": "json",
      "path": "packages/extension/package-lock.json",
      "jsonpath": "$.packages[''].version"
    }
  ],  

However, this method does not fully resolve the issue, as the extension package's version remains unlinked from the other packages, leading to potential version mismatches.

Additional context

Why isn't extension part of the npm workspaces?
The extension package is designed to assist a community in developing their own applications, extending beyond the capabilities of app and lib. Including it in the npm workspaces could lead to unintended dependencies and versioning issues.

How do you update the lib dependency within extension?
The lib dependency in extension can be managed by Dependabot, treating it as an external dependency. This approach ensures that extension always uses the latest published version of lib, similar to how it would function for a communities developing their own extensions.

Thanks!