fix(ci): make release-please able to open a release PR

The workflow ran green every time and did nothing. Two faults:

- changelog-notes-type is not a valid input for the v5 action, which
  warned 'Unexpected input(s)' and ignored it.
- More seriously, it logged 'No version for path .' on every run. With no
  release ever tagged there is nothing to derive the current version from,
  so it could never propose the next one. A release PR would never have
  appeared, and the failure mode is a green check.

Adds .release-please-manifest.json pinning the current version and
release-please-config.json holding the rest, with changelog sections that
hide ci/chore/docs/test noise from release notes.

The checklist also gains the step this exposed: release-please only bumps
on feat and fix, and everything merged so far is ci/chore/docs/test, so
1.0.0 has to be requested with a Release-As commit rather than waited for.

Going public and publishing to npm are also separated: CodeQL has skipped
itself on every run so far, so its findings are unknown. Going public is
reversible and npm publish is not — read the findings in between.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: mschmicking

.github/workflows/release-please.yml

@@ -21,7 +21,9 @@ jobs:
     steps:
       - uses: googleapis/release-please-action@v5
         with:
-          release-type: node
-          # Keeps the existing hand-written CHANGELOG entries intact by appending
-          # below the header rather than replacing the file.
-          changelog-notes-type: default
+          # Configuration lives in release-please-config.json and the current version
+          # in .release-please-manifest.json. Without the manifest the action logs
+          # 'No version for path .' and never opens a release PR — it cannot know
+          # what the previous version was, since no release has ever been tagged.
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "0.1.0"
+}

docs/GOING-PUBLIC.md

@@ -53,16 +53,39 @@ These change how merges behave, and the release automation depends on them.
 - [ ] Decide the version. `package.json` still says `0.1.0`; releasing as `1.0.0` is a
       commitment to the current CLI surface under semver.
 
+## 3b. Cut the release
+
+release-please only bumps on `feat` and `fix` commits. Everything merged so far is
+`ci`/`chore`/`docs`/`test`, so **no release PR will appear on its own**, and the first
+release has to be asked for explicitly.
+
+To go straight to 1.0.0, land an empty commit naming the version:
+
+```bash
+git commit --allow-empty -m "chore: release 1.0.0" -m "Release-As: 1.0.0"
+git push
+```
+
+release-please then opens a "chore(main): release 1.0.0" PR that bumps
+`package.json`, rewrites `CHANGELOG.md` and updates
+`.release-please-manifest.json`. Merging that PR creates the `v1.0.0` tag.
+
+- [ ] Land the `Release-As` commit
+- [ ] Review and merge the release PR it opens
+- [ ] Confirm the `v1.0.0` tag exists
+
 ## 4. Publish and flip — in this order
 
 `npm publish --provenance` attaches a signed attestation that the tarball was built from
 a specific commit in this repository. **It only works on a public repository**, so the
 release workflow fails while private. That forces this sequence:
 
 1. [ ] **Make the repository public** (Settings → General → Danger Zone)
-2. [ ] Remove the `> **Not released yet.**` blockquote from the README quick start, and
+2. [ ] **Wait for CodeQL to finish its first run**, and read the findings. It has been
+       skipping itself this whole time, so its output is genuinely unknown. Going public
+       is reversible; `npm publish` is not — so look before you publish.
+3. [ ] Remove the `> **Not released yet.**` blockquote from the README quick start, and
        the `RELEASE CHECKLIST` HTML comment beside it
-3. [ ] Bump the version and merge the release-please PR (or bump manually and tag)
 4. [ ] Run **Actions → Release to npm** with `dry_run: true` and read the file list
 5. [ ] Run it again with `dry_run: false`
 6. [ ] Verify: `npm view iobroker-sync`, then in a clean directory

release-please-config.json

@@ -0,0 +1,22 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "node",
+      "package-name": "iobroker-sync",
+      "changelog-path": "CHANGELOG.md",
+      "include-v-in-tag": true,
+      "bump-minor-pre-major": false,
+      "changelog-sections": [
+        { "type": "feat", "section": "Added" },
+        { "type": "fix", "section": "Fixed" },
+        { "type": "perf", "section": "Performance" },
+        { "type": "refactor", "section": "Changed" },
+        { "type": "docs", "section": "Documentation", "hidden": true },
+        { "type": "test", "section": "Tests", "hidden": true },
+        { "type": "ci", "section": "CI", "hidden": true },
+        { "type": "chore", "section": "Chores", "hidden": true }
+      ]
+    }
+  }
+}