ci-cd-workflows: v7.2.0

7.2.0 (2026-04-15)

🎉 Features

• cd: argo-workflow-slack-mention-trigger-user defaults to false (#665) (b1289af)
• ci: add playwright-gar-registry to authente to GAR Docker registry in e2e tests (#653) (609c55b)

🐛 Bug Fixes

• cd: replace branch usage by commit hash (#657) (12762c8)
• cd: skip latest GCS artifact upload for non-release branches (#663) (bb1c5f8)

🔧 Chores

• deps: update dependency act to v0.2.87 (#671) (e91911c)
• deps: update dependency actionlint to v1.7.12 (#667) (752f770)
• deps: update dependency mage to v1.17.1 (#669) (fc7275f)
• deps: update dependency plugin-validator to v0.39.2 (#664) (953bb0d)
• deps: update googleapis/release-please-action action to v4.4.1 (#666) (79423d6)
• deps: update step-security/harden-runner action to v2.16.1 (#668) (e958609)

ci-cd-workflows: v7.1.0

7.1.0 (2026-04-10)

🎉 Features

• cd: add argo-workflows-slack-silent parameter to silence Argo Slack notifications (#608) (eb7d1dd)
• cd: allow mentioning trigger user and extra handles in Argo Slack notifications (#641) (d7520ff)
• ci: allow specifying a custom mage target when building the backend (#651) (ade016d)
• ci: consider "release" event as trusted (#639) (de0a247)

♻️ Code Refactoring

• security: change GCOM_TOKEN to be an output rather than a workflow-level env var (#624) (e10bfe1)
• security: mask and unexport secrets when necessary (#625) (54e4c09)

🔧 Chores

• deps: update actions/cache action to v5.0.4 (#642) (9bf555f)
• deps: update actions/create-github-app-token action to v3 (#632) (6ff19d7)
• deps: update actions/setup-go action to v6.4.0 (#643) (5ec398b)
• deps: update actions/setup-node action to v6.3.0 (#609) (ad3390e)
• deps: update dependency act to v0.2.85 (#648) (0bd6b04)
• deps: update dependency act to v0.2.86 (#649) (824fbf3)
• deps: update dependency golangci-lint to v2.11.2 (#615) (cacc155)
• deps: update dependency golangci-lint to v2.11.3 (#620) (562df76)
• deps: update dependency golangci-lint to v2.11.4 (#647) (289b7df)
• deps: update dependency mage to v1.16.0 (#616) (af41523)
• deps: update dependency mage to v1.17.0 (#655) (064ec68)
• deps: update dependency plugin-validator to v0.38.0 (#618) (27cbc36)
• deps: update dependency plugin-validator to v0.38.1 (#621) (960f98e)
• deps: update dependency plugin-validator to v0.38.2 (#628) (9063847)
• deps: update dependency plugin-validator to v0.39.0 (#650) (3add886)
• deps: update dependency plugin-validator to v0.39.1 (#658) (8d779e5)
• deps: update dependency trufflehog to v3.93.7 (#611) (7031cfa)
• deps: update dependency trufflehog to v3.93.8 (#617) (ae7a0e3)
• deps: update dependency trufflehog to v3.94.0 (#646) (806fc27)
• deps: update dependency trufflehog to v3.94.1 (#654) (3b0704a)
• deps: update pnpm/action-setup action to v4.3.0 (#622) (b663db6)
• deps: update pnpm/action-setup action to v5 (#644) (08ce291)
• deps: update softprops/action-gh-release action to v2.6.1 (#633) (e2794e5)
• deps: update step-security/harden-runner action to v2.15.1 (#614) (d3e262a)
• deps: update step-security/harden-runner action to v2.16.0 (#634) (e5f674e)

ci-cd-workflows: v7.0.0

7.0.0 (2026-03-16)

🚨 IMPORTANT NOTE

This version of plugin-ci-workflows comes with some major improvements to the CD GitHub Actions Workflow and the Argo Workflow for provisioned plugins.
The CD GitHub Actions Workflow and its complementary Argo Workflow for deploying to Grafana Cloud can now be customized to accommodate for different release flows.

We highly recommend reading the "Concepts" and "Customization" sections in the EngHub docs to understand how deployments work and how to customize them.

⚠ BREAKING CHANGES

• deps: remove "v" prefix from mage-version input (#576)

🎉 Features

• cd: argo: support per-environment auto-approval durations, add input to deploy only to prod when targeting prod (rather than all envs) (#544) (07d2504)
• plugin-validator: provide a better default plugin-validator config (#600) (2a407c4)

🐛 Bug Fixes

• remove gcs artifact exists step (#590) (264b037)

🔧 Chores

• deps: remove "v" prefix from mage-version input (#576) (093ef76)
• deps: update actions/attest-build-provenance action to v4 (#597) (d41630f)
• deps: update actions/attest-build-provenance action to v4.1.0 (#604) (847aaf6)
• deps: update actions/setup-go action to v6.3.0 (#596) (b5d1276)
• deps: update dependency actionlint to v1.7.11 (#578) (35f5b60)
• deps: update dependency golangci-lint to v2.10.1 (#584) (e6e0e96)
• deps: update dependency trufflehog to v3.93.4 (#586) (97dbc0b)
• deps: update dependency trufflehog to v3.93.5 (#603) (3ece790)
• deps: update dependency trufflehog to v3.93.6 (#606) (bc2067b)
• deps: update grafana/shared-workflows/get-vault-secrets action to v1.3.1 (#587) (331d439)
• deps: update grafana/shared-workflows/trigger-argo-workflow action to v1.2.2 (#585) (60f35d3)
• deps: update step-security/harden-runner action to v2.15.0 (#595) (1783a6d)

ci-cd-workflows: v6.1.1

6.1.1 (2026-02-27)

🐛 Bug Fixes

• ci: fix plugin-validator failing with non-standard frontend build tooling error (#564) (fc2c645)

✅ Tests

• act: add cd deployment logic tests (#509) (2ca4b67)
• add tests for workflows consistency (#568) (3de0393)

🔧 Chores

• act: remove DO-NOT-USE-gcom-api-url and use workflow mutator instead (#548) (52bd8cf)
• act: run act tests when actions or cd workflow change (#526) (9d2b383)
• bumping e2e version package (#546) (95d139e)
• ci: pin plugin-validator to 0.37.1 rather than using the latest version from main (#566) (cf1d120)
• deps: configure renovate for nektos/act (#550) (cf54bbf)
• deps: update actions/attest-build-provenance action to v3.2.0 (#555) (cf43518)
• deps: update actions/cache action to v5.0.2 (#543) (fedc555)
• deps: update actions/cache action to v5.0.3 (#557) (3a8eba4)
• deps: update actions/checkout action to v6.0.2 (#529) (352ce11)
• deps: update actions/setup-go action to v6.2.0 (#540) (6af0e79)
• deps: update actions/setup-node action to v6.2.0 (#541) (e029b6b)
• deps: update dependency act to v0.2.84 (#560) (a1bcdf9)
• deps: update dependency actionlint to v1.7.10 (#561) (6d8b6a2)
• deps: update dependency golangci-lint to v2.8.0 (#562) (d5db4fc)
• deps: update dependency golangci-lint to v2.9.0 (#575) (16aa7b7)
• deps: update dependency trufflehog to v3.92.5 (#563) (9bdb106)
• deps: update dependency trufflehog to v3.93.0 (#569) (c9ff19d)
• deps: update dependency trufflehog to v3.93.1 (#571) (7c9c73d)
• deps: update dependency trufflehog to v3.93.3 (#574) (109184c)
• deps: update peter-evans/create-pull-request action to v8.1.0 (#545) (de45ad3)
• deps: update step-security/harden-runner action to v2.14.1 (#552) (27c6a06)
• deps: update step-security/harden-runner action to v2.14.2 (#572) (64ef0b5)
• renovate: handle default go, node and tooling versions in workflows via renovate (#533) (e8bea40)

ci-cd-workflows: v6.1.0

6.1.0 (2026-01-22)

🎉 Features

• cd: export ci outputs in cd job (#518) (ce2d1bb)

ci-cd-workflows: v6.0.0

6.0.0 (2026-01-19)

⚠ BREAKING CHANGES

• playwright: remove version and image arguments (#507)

GRAFANA_VERSION and GRAFANA_IMAGE aren't being passed to Playwright anymore.

For consumers of the shared workflows that wants to detect Grafana version within plugin-e2e tests, there's an alternative approach using the official API:

test('should be possible to enable advanced mode', async ({ grafanaVersion, alertRuleEditPage }) => {
   test.skip(semver.lt(grafanaVersion, '11.6.0'), 'Advanced mode is not supported in Grafana versions < 11.6.0');
   // test code
});

---

• cd: allow releasing to prod from non-main branches (#378)

Calls to cd.yml must be adjusted to include an additional permission: pull-requests: read, otherwise the workflow will fail with the following error:

Invalid workflow file: ...
The workflow is not valid. .github/workflows/publish.yaml (...): Error calling workflow 'grafana/plugin-ci-workflows/.github/workflows/cd.yml@.... The workflow is requesting 'pull-requests: read', but is only allowed 'pull-requests: none'.

Example on the required changes to cd.yml:

jobs:
  cd:
    name: CD
    uses: grafana/plugin-ci-workflows/.github/workflows/cd.yml@main
    permissions:
      contents: write
+     pull-requests: read
      id-token: write
      attestations: write

---

🎉 Features

• cd: allow releasing to prod from non-main branches (#378) (e1cf5f6)
• ci: add warning when ci and cd workflows are not on the same reference (#492) (4e9ca04)
• ci: support react image in e2e matrix (#496) (6d8cb8c)
• playwright: remove version and image arguments (#507) (f70e822)

✅ Tests

• act: add gcom mock, cd.yml changes for testing (#501) (e3f1779)
• act: fix validator tests (#506) (3c93dda)

🔧 Chores

• ci: run golangci-lint on internal go packages (#485) (303148f)
• deps: update actions/attest-build-provenance action to v3.1.0 (#484) (ba9c56e)
• deps: update actions/cache action to v5 (#481) (3eaee5a)
• deps: update stefanzweifel/git-auto-commit-action action to v7.1.0 (#483) (f9a22aa)
• deps: update step-security/harden-runner action to v2.14.0 (#477) (cdab179)

ci-cd-workflows: v5.1.0

5.1.0 (2026-01-07)

🎉 Features

• ci: setup Go version from go.mod if possible (#465) (5d5ab0a)

🐛 Bug Fixes

• tests: fix act checkout in pull_request events (#463) (56388a7)

⚡ Performance Improvements

• ci: cache mage, Trufflehog and golangci-lint binaries (#467) (b736834)

✅ Tests

• act: add plugin-validator tests (#457) (82db8bf)

🔧 Chores

• deps: update actions/create-github-app-token action to v2.2.1 (#475) (eeaa07a)
• deps: update actions/setup-node action to v6 (#362) (69022ab)
• deps: update peter-evans/create-pull-request action to v8 (#478) (8f4d6ea)
• main: release plugins-frontend-e2e-against-stack 1.0.1 (#432) (d3ca365)

plugins-frontend-e2e-against-stack: v1.0.1

1.0.1 (2025-12-19)

🔧 Chores

• deps: update actions/checkout action to v5.0.1 (#420) (f544369)
• deps: update actions/checkout action to v6 (#437) (949a63c)
• deps: update actions/checkout action to v6.0.1 (#455) (aec5016)
• deps: update dependency @types/bun to v1.3.3 (#423) (77a131b)
• deps: update dependency @types/bun to v1.3.4 (#443) (617ed2a)
• deps: update dependency eslint-plugin-jest to v29.2.1 (#424) (3bb9b51)
• deps: update dependency eslint-plugin-jest to v29.2.2 (#453) (8cba6b1)
• deps: update dependency eslint-plugin-jest to v29.4.0 (#458) (4c43b94)
• deps: update dependency eslint-plugin-jest to v29.5.0 (#462) (1486ae8)
• deps: update dependency prettier to v3.7.4 (#425) (f59c61c)
• deps: update dependency typescript to v5.9.3 (#421) (ffb220d)
• deps: update dependency typescript-eslint to v8.48.1 (#426) (c148ddd)
• deps: update dependency typescript-eslint to v8.49.0 (#446) (58230bf)
• deps: update dependency typescript-eslint to v8.50.0 (#469) (156eedd)
• deps: update eslint monorepo to v9.39.1 (#427) (4d305ae)
• deps: update eslint monorepo to v9.39.2 (#454) (b0b1e00)
• deps: update google-github-actions/auth action to v3 (#428) (f7db09b)

ci-cd-workflows: v5.0.0

5.0.0 (2025-12-17)

⚠ BREAKING CHANGES

• ci: universal-zip-url-* outputs are now URLs rather than paths
• deps: Update default Node version to 24 LTS (#439)
• deps: Update default golangci-lint version to 2.7.2 (#439)
• deps: Update default Go version to 1.25 (#439)
• ci: use pm-detect to understand nodejs package manager (#204)

---

The package-manager input has been removed from ci.yml. If you were using it, please remove it from your workflow. The correct package manager will now be detected automatically from the plugin's source code. Supported package managers are npm, yarn and pnpm.

---

golangci-lint has been bumped from v1 to v2 in order to support Go 1.25. The config file format for golangci-lint has changed and has to be migrated. Please follow golangci-lint's migration guide for more information. If you want to revert to Go 1.24 and golangci-lint v1, add the following to both your CI and your CD workflows:

inputs:
  go-version: "1.24"
  golangci-lint-version: "1.64.8"

🎉 Features

• ci: use pm-detect to understand nodejs package manager (#204) (e739fbe)

🐛 Bug Fixes

• ci: universal-zip-url-* outputs are now URLs rather than paths (b5e3ec2)
• ci: do not copy backend into the "dist" folder (b5e3ec2)
• use local exec for playwright test (#451) (b27d62d)

✅ Tests

• act: add pre-generated dist mockdata for test plugins (#417) (cb33db6)
• add concurrency to pr-checks-test-ci workflow (630b056)
• pin actions in pr-checks-test-ci workflow (630b056)
• run smoke tests with act (#389) (0f2f7c6)
• use local repository for release please manifest tag when running act (630b056)

🔧 Chores

• build and package plugin in its directory, better support for artifact prefix (#438) (dbbcc52)
• deps: update actions/checkout action to v5.0.1 (#413) (8c591cd)
• deps: update actions/checkout action to v6 (#437) (949a63c)
• deps: update actions/checkout action to v6.0.1 (#455) (aec5016)
• deps: update actions/create-github-app-token action to v2.2.0 (#435) (5b2407c)
• deps: update actions/setup-go action to v6.1.0 (#436) (5f5e089)
• deps: Update default Go version to 1.25 (b1f1b22)
• deps: Update default golangci-lint version to 2.7.2 (b1f1b22)
• deps: Update default Node version to 24 LTS (b1f1b22)
• deps: update grafana/shared-workflows/trigger-argo-workflow action to v1.2.1 (#433) (6c260c0)
• deps: update peter-evans/create-pull-request action to v7.0.9 (#434) (55c4108)
• deps: update pnpm/action-setup action to v4.2.0 (#450) (5fbf8e6)
• deps: update softprops/action-gh-release action to v2.5.0 (#452) (48548e8)
• deps: update step-security/harden-runner action to v2.13.3 (#456) (fccf74b)
• main: release plugins-frontend-e2e-against-stack 1.0.0 (#430) (6443ba2)

plugins-frontend-e2e-against-stack: v1.0.0

1.0.0 (2025-12-09)

🔧 Chores

• add release-please component for frontend-e2e-against-stack action (#419) (afed917)