feat(TU-33149): Move to a new semantic release configuration file structure

[tom-ridsdale]

Current problems

• NPM packages published with main dist-tag instead of latest
• GitHub releases marked as "Pre-release" instead of regular releases

After playing around with the dry-run functionality of semantic-release locally I found:

• In a monorepo, semantic-release runs from each package directory (e.g., packages/embed/), not from the repo root.
• cosmiconfig stops searching at the first package.json it finds, so it never reached the root .releaserc. This is not an issue in single-package repos where the config lives alongside the only package.json.
• In a previous PR, the extends: ["semantic-release-monorepo"] was moved from .releaserc to a -e command line flag. This change assumed the root config would still be found, but due to the monorepo structure, it wasn't.
• Therefore semantic-release used its default config, main wasn't the first branch in the list (maintenance patterns and master come first). This meant:
  • Channel defaulted to the branch name (main) instead of null
  • main: false was set (only the first branch in the list gets main: true)
  • This caused npm to use --tag main and GitHub to mark releases as pre-release.

Changes

• Rather than trying to maintain the old/legacy structure, move to a new structure.
• Created a shared config file at the repo root (release.config.base.js) with:
  • Valid JavaScript syntax (not JSON, so no quoting issues)
  • extends: ['semantic-release-monorepo'] included
  • channel: false on the main branch
• Each package has a minimal release.config.js that imports the shared config, ensuring cosmiconfig finds it immediately when running from that package's directory.
• Removed the -e flag from package scripts since extends... is now in the base config file.

[github-actions]

TypeScript adoption

Current adoption level: 95.9%

[gitstream-cm]

🥷 Code experts: tf-security

tf-security has most 👩‍💻 activity in the files.
tf-security has most 🧠 knowledge in the files.

See details

packages/embed-react/package.json

Activity based on git-commit:

	tf-security
DEC
NOV
OCT
SEP
AUG
JUL	54 additions & 0 deletions

Knowledge based on git-blame:
tf-security: 88%

packages/embed/package.json

Activity based on git-commit:

	tf-security
DEC
NOV
OCT
SEP
AUG
JUL	77 additions & 0 deletions

Knowledge based on git-blame:
tf-security: 93%

✨ Comment /gs review for LinearB AI review. Learn how to automate it here.

[tom-ridsdale]

The CI Standard Checks workflow is failing because I am adding .js files - Only TypeScript is allowed for new changes; migrate file or extract changes to TS file.

I tried adding them to .eslintignore but that didn't resolve the issue.

I am going to bypass this check given it's a one-time setup and it will only fail again if these files are changed.

[typeform-ops-gha]

[BOT] Preview available with hash 1ce9976a74d53cd71fafb34c9e03c4befc3689d4 here.

[sonarqubecloud]

Quality Gate passed

Issues
60 New issues
0 Accepted issues

Measures
1 Security Hotspot
76.5% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[tom-ridsdale]

@joycevherck Would you mind approving again? & Are you comfortable with me bypassing the failure?

[typeform-ops-gha]

🎉 This PR is included in version @typeform/embed-react-v4.9.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀