feat: update release process

[nickolas-dimitrakas]

Background

• The SDK's kit integrations were previously maintained as separate standalone repositories. This PR consolidates all kit packages into the core Web SDK monorepo under a new kits/ directory, and updates the release pipeline to build and publish kit assets alongside the core SDK.

What Has Changed

• package.json exports: Added ESM file entries across all kit package.json files; IIFE files also included where missing
• scripts/release.sh: Extended to build kit bundles, stage their dist/ output, and bump kit package.json versions to match the core SDK release version
• release.config.js: Updated to support the new multi-package release flow
• CI workflows: Removed legacy release.yml; updated staging-step-1.yml to orchestrate kit builds and publishing; added pull-request.yml for PR-level checks; fixed trigger frequency across workflows
• Resolved sub-package publishing issues for Adobe and GA4 kits, corrected release branch checkout step, fixed package.json file path typos

Checklist

• I have performed a self-review of my own code.
• I have made corresponding changes to the documentation.
• I have added tests that prove my fix is effective or that my feature works.
• I have tested this locally.

Additional Notes

• This is a breaking change to the release process (feat!). Releasing the core SDK will now also build and publish all kit bundles in lockstep.

Reference Issue (For employees only. Ignore if you are an outside contributor)

• Closes NO JIRA

---

Note

High Risk
High risk because it rewires CI/release automation to build, commit, version-bump, and publish many kit packages alongside the core SDK; failures could block or corrupt releases across multiple artifacts.

Overview
Reworks the GitHub Actions and semantic-release flow to treat kits/ as first-class release artifacts. CI workflows switch several jobs to workflow_call, add PR-level invocations for Android bridge and BrowserStack runs, and remove the legacy release.yml in favor of staging/release orchestration.

Updates the release implementation to build and commit kit outputs and keep kit versions in lockstep. scripts/release.sh now builds the core bundle, iterates kits/matrix.json to install/build each kit, stages all dist/ directories, and bumps every kit package.json version before committing; release.config.js expands release rules (breaking/perf) and commits all package.json/package-lock.json changes repo-wide.

Standardizes kit packaging for module consumers. Many kit package.json/rollup.config.js files are updated to generate and publish esm bundles (and include missing iife/files entries), with kits/matrix.json split to target Adobe/GA4 subpackages and Adobe’s build inputs adjusted to use a temporary bundle input file.

^{Written by Cursor Bugbot for commit 0162689. This will update automatically on new commits. Configure here.}

[Copilot]

Pull request overview

This PR consolidates and modernizes the Web SDK release process to build and publish kit packages from the monorepo (kits/), adding ESM artifacts and updating CI workflows to test and release kits alongside the core SDK.

Changes:

• Extend the release script and semantic-release config to build/commit kit dist outputs and align kit versions with the SDK release version.
• Add ESM (and missing IIFE) bundle outputs and metadata across many kit packages (rollup + package.json updates).
• Update GitHub Actions workflows to support kit testing against a locally packed SDK and add post-release kit lockfile refresh automation.

Reviewed changes

Copilot reviewed 61 out of 63 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
scripts/release.sh	Builds core dist + kit bundles, stages/commits dist outputs, and bumps kit versions during release.
release.config.js	Adjusts semantic-release rules and broadens committed assets to cover monorepo packages/locks.
kits/matrix.json	Splits GA4 and Adobe entries into client/server package paths for the new monorepo layout.
kits/twitter/rollup.config.js	Adds ESM output build.
kits/twitter/package.json	Publishes common/esm/iife artifacts and sets module.
kits/taplytics/rollup.config.js	Adds ESM output build.
kits/taplytics/package.json	Publishes common/esm/iife artifacts and sets module.
kits/simplereach/rollup.config.js	Adds ESM output build.
kits/simplereach/package.json	Publishes common/esm/iife artifacts and sets module.
kits/rokt/rollup.config.js	Adds ESM output build.
kits/rokt/package.json	Publishes common/esm/iife artifacts and sets module.
kits/optimizely/rollup.config.js	Adds ESM production build variant.
kits/optimizely/package.json	Publishes common/esm/iife artifacts and sets module.
kits/onetrust/package.json	Adds ESM/iife artifacts and module metadata.
kits/mixpanel/mixpanel-2/rollup.config.js	Adds ESM output build.
kits/mixpanel/mixpanel-2/package.json	Publishes common/esm/iife artifacts and sets module.
kits/localytics/localytics-4/rollup.config.js	Adds ESM output build.
kits/localytics/localytics-4/package.json	Publishes common/esm/iife artifacts and sets module.
kits/leanplum/leanplum-1/rollup.config.js	Adds ESM output build.
kits/leanplum/leanplum-1/package.json	Publishes common/esm/iife artifacts and sets module.
kits/kissmetrics/package.json	Adds ESM/iife artifacts and module metadata.
kits/intercom/rollup.config.js	Adds ESM output build.
kits/intercom/package.json	Publishes common/esm/iife artifacts and sets module.
kits/inspectlet/package.json	Adds ESM/iife artifacts and module metadata.
kits/id5/id5-1/package.json	Adds ESM/iife artifacts and module metadata.
kits/heap/package.json	Adds ESM/iife artifacts and module metadata.
kits/google-tag-manager/package.json	Adds ESM/iife artifacts and module metadata.
kits/google-analytics-4/packages/GA4Server/rollup.config.js	Adds ESM output build.
kits/google-analytics-4/packages/GA4Server/package.json	Publishes common+esm artifacts and sets module.
kits/google-analytics-4/packages/GA4Client/rollup.config.js	Adds ESM production build variant.
kits/google-analytics-4/packages/GA4Client/package.json	Publishes common+esm artifacts and sets module.
kits/facebook/package.json	Adds missing IIFE artifact to published files.
kits/dynamic-yield/rollup.config.js	Adds ESM output build.
kits/dynamic-yield/package.json	Publishes common/esm/iife artifacts and sets module.
kits/doubleclick/rollup.config.js	Adds ESM output build.
kits/doubleclick/package.json	Publishes common/esm/iife artifacts and sets module.
kits/device-match/rollup.config.js	Adds ESM output build.
kits/device-match/package.json	Publishes common/esm/iife artifacts and sets module.
kits/criteo/rollup.config.js	Adds ESM output build.
kits/criteo/package.json	Publishes common/esm/iife artifacts and sets module.
kits/braze/braze-5/package.json	Adds missing IIFE artifact to published files.
kits/braze/braze-4/rollup.config.js	Adds ESM output build.
kits/braze/braze-4/package.json	Publishes common/esm/iife artifacts and sets module.
kits/braze/braze-3/rollup.config.js	Adds ESM output build.
kits/braze/braze-3/package.json	Publishes common/esm/iife artifacts and sets module.
kits/bingads/rollup.config.js	Adds ESM output build.
kits/bingads/package.json	Publishes common/esm/iife artifacts and sets module.
kits/adwords/rollup.config.js	Adds ESM output build.
kits/adwords/package.json	Publishes common/esm/iife artifacts and sets module (and fixes dist filename typo).
kits/adobe/packages/AdobeServer/package.json	Converts to monorepo-driven build/test scripts and publishes common+iife outputs.
kits/adobe/packages/AdobeServer/package-lock.json	Adds/updates lockfile for the AdobeServer package.
kits/adobe/packages/AdobeClient/package.json	Converts to monorepo-driven build/test scripts and publishes common+iife outputs.
kits/adobe/packages/AdobeClient/package-lock.json	Updates lockfile format/version for the AdobeClient package.
kits/adobe/package.json	Marks the Adobe aggregator package as private.
kits/adobe-target/rollup.config.js	Adds ESM production build variant.
kits/adobe-target/package.json	Publishes common/esm/iife artifacts and sets module (and fixes dist filename typo).
.github/workflows/staging-step-1.yml	Builds SDK tarball for kit tests, runs kit tests against packed SDK, publishes kits, and refreshes kit lockfiles post-release.
.github/workflows/release.yml	Removes the legacy release workflow.
.github/workflows/pull-request.yml	Adds BrowserStack and Android bridge tests via reusable workflows.
.github/workflows/cross-browser-testing.yml	Changes triggers to workflow_call/workflow_dispatch only.
.github/workflows/cross-browser-testing-beta.yml	Changes triggers to workflow_call/workflow_dispatch only.
.github/workflows/android-bridge-tests.yml	Changes trigger to workflow_call.

Files not reviewed (2)

• kits/adobe/packages/AdobeClient/package-lock.json: Language not supported
• kits/adobe/packages/AdobeServer/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[Copilot]

Pull request overview

This PR updates the Web SDK monorepo release process to build, version-bump, test, and publish kit packages (under kits/) alongside the core SDK, including adding ESM artifacts/metadata for many kits and updating CI workflows to support the new flow.

Changes:

• Extended the release script and semantic-release config to build/stage kit bundles and align kit package versions with the core SDK release version.
• Added ESM Rollup outputs and updated kit package.json metadata (files, module) to publish ESM/IIFE artifacts where applicable.
• Updated GitHub Actions workflows to run kit tests against a locally packed SDK, adjust workflow triggers, and add post-release kit lockfile refresh automation.

Reviewed changes

Copilot reviewed 67 out of 69 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
scripts/release.sh	Builds core + kits, stages kit dist/, bumps kit versions, and commits release artifacts.
release.config.js	Updates semantic-release rules, uses bash for prepare, and broadens committed release assets to multi-package scope.
kits/twitter/rollup.config.js	Adds ESM bundle output for the Twitter kit.
kits/twitter/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/taplytics/rollup.config.js	Adds ESM bundle output for the Taplytics kit.
kits/taplytics/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/simplereach/rollup.config.js	Adds ESM bundle output for the SimpleReach kit.
kits/simplereach/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/rokt/rollup.config.js	Adds ESM bundle output for the Rokt kit.
kits/rokt/package.json	Adds ESM artifact to files and sets module entry.
kits/optimizely/rollup.config.js	Adds ESM build variant for production builds.
kits/optimizely/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/onetrust/rollup.config.js	Adds ESM bundle output for the OneTrust kit.
kits/onetrust/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/mixpanel/mixpanel-2/rollup.config.js	Adds ESM bundle output for Mixpanel v2 kit.
kits/mixpanel/mixpanel-2/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/matrix.json	Splits GA4 and Adobe entries into distinct client/server package paths.
kits/localytics/localytics-4/rollup.config.js	Adds ESM bundle output for Localytics v4 kit.
kits/localytics/localytics-4/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/leanplum/leanplum-1/rollup.config.js	Adds ESM bundle output for Leanplum v1 kit.
kits/leanplum/leanplum-1/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/kissmetrics/rollup.config.js	Adds ESM bundle output for Kissmetrics kit.
kits/kissmetrics/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/intercom/rollup.config.js	Adds ESM bundle output for Intercom kit.
kits/intercom/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/inspectlet/rollup.config.js	Adds ESM bundle output for Inspectlet kit.
kits/inspectlet/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/id5/id5-1/rollup.config.js	Adds ESM build variant for production builds.
kits/id5/id5-1/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/heap/rollup.config.js	Adds ESM build variant for production builds.
kits/heap/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/google-tag-manager/rollup.config.js	Adds ESM build variant for production builds.
kits/google-tag-manager/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/google-analytics-4/packages/GA4Server/rollup.config.js	Adds ESM output for GA4 Server kit.
kits/google-analytics-4/packages/GA4Server/package.json	Publishes GA4 Server ESM artifact and adds module entry.
kits/google-analytics-4/packages/GA4Client/rollup.config.js	Adds ESM build variant for GA4 Client production builds.
kits/google-analytics-4/packages/GA4Client/package.json	Fixes files entry, adds ESM artifact, and adds module entry.
kits/facebook/package.json	Adds missing IIFE artifact to files.
kits/dynamic-yield/rollup.config.js	Adds ESM bundle output for Dynamic Yield kit.
kits/dynamic-yield/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/doubleclick/rollup.config.js	Adds ESM bundle output for DoubleClick kit.
kits/doubleclick/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/device-match/rollup.config.js	Adds ESM bundle output for Device Match kit.
kits/device-match/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/criteo/rollup.config.js	Adds ESM bundle output for Criteo kit.
kits/criteo/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/braze/braze-5/package.json	Adds missing IIFE artifact to files.
kits/braze/braze-4/rollup.config.js	Adds ESM bundle output for Braze v4 kit.
kits/braze/braze-4/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/braze/braze-3/rollup.config.js	Adds ESM bundle output for Braze v3 kit.
kits/braze/braze-3/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/bingads/rollup.config.js	Adds ESM bundle output for Bing Ads kit.
kits/bingads/package.json	Publishes ESM/IIFE outputs via files and adds module entry.
kits/adwords/rollup.config.js	Adds ESM bundle output for AdWords kit.
kits/adwords/package.json	Fixes files typo and publishes ESM/IIFE outputs with module entry.
kits/adobe/packages/AdobeServer/package.json	Adds files/browser, and routes build/test to the Adobe kit workspace scripts.
kits/adobe/packages/AdobeServer/package-lock.json	Adds lockfile for Adobe Server package.
kits/adobe/packages/AdobeClient/package.json	Adds files/browser, and routes build/test to the Adobe kit workspace scripts.
kits/adobe/packages/AdobeClient/package-lock.json	Updates lockfile format/version for Adobe Client package.
kits/adobe/package.json	Marks the Adobe aggregate package as private.
kits/adobe-target/rollup.config.js	Adds ESM build variant for production builds.
kits/adobe-target/package.json	Fixes files entry, adds ESM/IIFE outputs, and adds module entry.
.prettierignore	Fixes kit ignore path formatting and adds .claude/ ignore.
.github/workflows/staging-step-1.yml	Packs local SDK for kit tests, runs kits against it, adds post-release lockfile refresh + cleanup dependency updates.
.github/workflows/release.yml	Removes the legacy release workflow.
.github/workflows/pull-request.yml	Adds Android bridge and BrowserStack workflows into PR checks.
.github/workflows/cross-browser-testing.yml	Converts to reusable workflow (workflow_call) instead of push/PR triggers.
.github/workflows/cross-browser-testing-beta.yml	Converts to reusable workflow (workflow_call) instead of push triggers.
.github/workflows/android-bridge-tests.yml	Converts to reusable workflow (workflow_call).

Files not reviewed (2)

• kits/adobe/packages/AdobeClient/package-lock.json: Language not supported
• kits/adobe/packages/AdobeServer/package-lock.json: Language not supported

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[rmi22186]

Is the step to use 1 version from core for all kits coming later? I don't see that logic anywhere, just npm publish.

[nickolas-dimitrakas]

By the npm publish step the version should be the same across core and kits because the release.sh script has completed and synced the ecosystem version.

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 Security Hotspots
49.4% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

[cursor]

Local SDK tarball ignored by Adobe kit tests

Medium Severity

The npm install --no-save /tmp/sdk-pack/*.tgz installs the local SDK tarball into the Adobe sub-package's node_modules/. However, the Adobe sub-package build scripts do cd ../.. && npm ci && ..., which navigates to the parent kits/adobe/ directory and runs npm ci there — installing the registry version of @mparticle/web-sdk into a completely separate node_modules/. The local SDK tarball is silently discarded, so these kit tests never actually validate against the current SDK build despite the step name claiming otherwise.

Additional Locations (2)

• kits/adobe/packages/AdobeClient/package.json#L13-L15
• kits/adobe/packages/AdobeServer/package.json#L13-L15

 

[cursor]

Package-lock version drift after kit version bumps

Low Severity

npm pkg set version only updates package.json, not package-lock.json. The Adobe sub-packages (AdobeClient, AdobeServer) have committed package-lock.json files containing a version field. After each release, their package-lock.json versions will permanently drift from package.json, since nothing in the script updates or regenerates the lock files after the version bump.

 

The merge-base changed after approval.