Release without Grafana's catalog validator; run CI on main

.github/workflows/ci.yml

@@ -3,10 +3,10 @@ name: CI
 on:
   push:
     branches:
-      - master
+      - main
   pull_request:
     branches:
-      - master
+      - main
 
 permissions:
   contents: read

.github/workflows/codeql-analysis.yml

@@ -13,10 +13,10 @@ name: "CodeQL"
 
 on:
   push:
-    branches: [ master ]
+    branches: [ main ]
   pull_request:
     # The branches below must be a subset of the branches above
-    branches: [ master ]
+    branches: [ main ]
   schedule:
     - cron: '18 0 * * 2'
 
@@ -42,7 +42,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@v4
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +53,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@v4
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -67,4 +67,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@v4

.github/workflows/release.yml

@@ -1,28 +1,84 @@
-# This GitHub Action automates the process of building Grafana plugins.
-# (For more information, see https://github.com/grafana/plugin-actions/blob/main/build-plugin/README.md)
+# Builds the plugin on a version tag and publishes it as a GitHub release, with
+# the zip that Grafana installs (see the Helm example in the README).
+#
+# This deliberately does not use grafana/plugin-actions/build-plugin. That
+# action runs Grafana's catalog-submission validator as a hard gate: it requires
+# the plugin ID's prefix to be a registered Grafana Cloud account, and it fails on
+# any high-severity advisory in package-lock.json, including development-only
+# tools that never reach the plugin bundle. This plugin is installed directly
+# rather than published to the catalog, so those rules do not apply. Grafana's
+# plugin.json check still runs in CI. If the plugin is ever submitted to the
+# catalog, switch back to build-plugin.
 name: Release
 
 on:
   push:
     tags:
-      - 'v*' # Run workflow on version tags, e.g. v1.0.0.
+      - 'v*' # e.g. v2.0.0
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   release:
-    permissions:
-      contents: write
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to create the release
     steps:
       - uses: actions/checkout@v6
         with:
           persist-credentials: false
 
-      - uses: grafana/plugin-actions/build-plugin@build-plugin/v1.2.0
-        # Uncomment to enable plugin signing
-        # (For more info on how to generate the access policy token see
-        # https://grafana.com/developers/plugin-tools/publish-a-plugin/sign-a-plugin#generate-an-access-policy-token)
-        # with:
-        #   # Make sure to save the token in your repository secrets
-        #   policy_token: ${{ secrets.GRAFANA_ACCESS_POLICY_TOKEN }}
+      - name: Setup Node.js environment
+        uses: actions/setup-node@v6
+        with:
+          node-version-file: .nvmrc
+          cache: 'npm'
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Check types
+        run: npm run typecheck
+      - name: Lint
+        run: npm run lint
+      - name: Unit tests
+        run: npm run test:ci
+      - name: Build frontend
+        run: npm run build
+
+      - name: Check the tag matches the plugin version
+        id: metadata
+        run: |
+          PLUGIN_ID=$(jq -r .id dist/plugin.json)
+          PLUGIN_VERSION=$(jq -r .info.version dist/plugin.json)
+          if [ "v${PLUGIN_VERSION}" != "${GITHUB_REF_NAME}" ]; then
+            echo "::error::Tag ${GITHUB_REF_NAME} does not match the version in package.json (${PLUGIN_VERSION})"
+            exit 1
+          fi
+          echo "plugin-id=${PLUGIN_ID}" >> "$GITHUB_OUTPUT"
+          echo "archive=${PLUGIN_ID}-${PLUGIN_VERSION}.zip" >> "$GITHUB_OUTPUT"
+
+      - name: Package plugin
+        run: |
+          # Grafana expects the zip to hold a single folder named after the plugin ID
+          mv dist "${PLUGIN_ID}"
+          zip -qr "${ARCHIVE}" "${PLUGIN_ID}"
+          sha1sum "${ARCHIVE}" > "${ARCHIVE}.sha1"
+        env:
+          PLUGIN_ID: ${{ steps.metadata.outputs.plugin-id }}
+          ARCHIVE: ${{ steps.metadata.outputs.archive }}
+
+      - name: Release notes from the changelog
+        # The first "## " section of CHANGELOG.md, i.e. the latest version's entry
+        run: awk '/^## /{n++} n==1' CHANGELOG.md > release-notes.md
+
+      - name: Create release
+        run: |
+          gh release create "${GITHUB_REF_NAME}" "${ARCHIVE}" "${ARCHIVE}.sha1" \
+            --verify-tag \
+            --title "${GITHUB_REF_NAME}" \
+            --notes-file release-notes.md
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ARCHIVE: ${{ steps.metadata.outputs.archive }}

CONTRIBUTING.md

@@ -106,14 +106,16 @@ for the supported ways to customise it.
 
 ## Releasing a new version
 
-1. Update the CHANGELOG.md document to include changes of the new release
-1. Bump `version` in `package.json` to match
-1. Tag the master with the new version:
+1. Add a `## vX.Y.Z` section at the top of CHANGELOG.md for the new release
+1. Bump `version` in `package.json` to match (`npm version --no-git-tag-version X.Y.Z`)
+1. Merge to `main`, then tag that commit:
     ```sh
-    git tag v2.0.0
-    git push origin v2.0.0
+    git tag vX.Y.Z
+    git push origin vX.Y.Z
     ```
-1. Complete the release information in github.
+1. The Release workflow builds, tests and packages the plugin, then publishes a
+   GitHub release with the zip attached and the changelog section as its notes.
+   It fails if the tag doesn't match the version in `package.json`.
 
 ## Notes
 

README.md

@@ -5,7 +5,7 @@
 > to its authors. That project is no longer maintained. TransitApp has modified
 > this fork since October 2026: it runs on current Grafana (12.3 and later) and
 > adds layer reordering, per-layer query handling and other fixes; see the
-> [changelog](CHANGELOG.md). It remains licensed under the [AGPL-3.0](LICENSE).
+> [changelog](https://github.com/TransitApp/map-panel/blob/main/CHANGELOG.md). It remains licensed under the [AGPL-3.0](https://github.com/TransitApp/map-panel/blob/main/LICENSE).
 >
 > **Maintenance:** TransitApp maintains this fork for its own use. Issues and pull
 > requests are welcome and handled on a best-effort basis.
@@ -20,9 +20,9 @@ panel with several functionalities:
 * A new map layer leveraging [Inverse distance weighting](https://en.wikipedia.org/wiki/Inverse_distance_weighting)
   (IDW) interpolation for scattered data points using Shepard's method.
 
-![Marker layer](https://github.com/TransitApp/map-panel/raw/master/example.png)
+![Marker layer](https://github.com/TransitApp/map-panel/raw/main/example.png)
 
-![IDW layer](https://github.com/TransitApp/map-panel/raw/master/example4.png)
+![IDW layer](https://github.com/TransitApp/map-panel/raw/main/example4.png)
 
 
 New customization options available for the markers layer:
@@ -31,7 +31,7 @@ New customization options available for the markers layer:
 * A fully customizable pin with the possibility to change colors, shapes and sizes
 * The possibility to select which properties to be displayed on the popup
 
-![Marker layer options](https://github.com/TransitApp/map-panel/raw/master/example2.png)
+![Marker layer options](https://github.com/TransitApp/map-panel/raw/main/example2.png)
 
 Cluster options:
 
@@ -52,7 +52,7 @@ Popup Options:
 * Display the Timestamp
 * Selectable properties
 
-![Marker layer options](https://github.com/TransitApp/map-panel/raw/master/example3.png)
+![Marker layer options](https://github.com/TransitApp/map-panel/raw/main/example3.png)
 
 Options available for the IDW layer:
 
@@ -70,10 +70,31 @@ Pupup Options:
 * Selectable properties
 
 
-![Marker layer options](https://github.com/TransitApp/map-panel/raw/master/example5.png)
+![Marker layer options](https://github.com/TransitApp/map-panel/raw/main/example5.png)
 
 It requires Grafana 12.3 or later.
 
+## Installation
+
+The plugin is not in Grafana's plugin catalog and is not signed. Grafana
+installs it from the zip attached to each
+[GitHub release](https://github.com/TransitApp/map-panel/releases), and has to be
+told to allow it. With the
+[Grafana Helm chart](https://github.com/grafana-community/helm-charts/tree/main/charts/grafana):
+
+```yaml
+plugins:
+  - transitapp-map-panel@2.0.0@https://github.com/TransitApp/map-panel/releases/download/v2.0.0/transitapp-map-panel-2.0.0.zip
+grafana.ini:
+  plugins:
+    allow_loading_unsigned_plugins: transitapp-map-panel
+```
+
+The version in the entry decides which release is installed; change it to
+upgrade. Without Helm, set `GF_PLUGINS_PREINSTALL_SYNC` to the same
+`id@version@url` value and `GF_PLUGINS_ALLOW_LOADING_UNSIGNED_PLUGINS` to the
+plugin ID.
+
 ## Migrating from the Orchestra Cities Map Panel
 
 The plugin ID changed from `orchestracities-map-panel` to `transitapp-map-panel`.
@@ -114,4 +135,4 @@ For more information about panels, refer to the documentation on [Panels](https:
 
 ## Set up dev environment
 
-See [Contributing](CONTRIBUTING.md).
+See [Contributing](https://github.com/TransitApp/map-panel/blob/main/CONTRIBUTING.md).

package.json

@@ -95,6 +95,7 @@
   },
   "packageManager": "npm@11.19.1",
   "overrides": {
-    "ol": "$ol"
+    "ol": "$ol",
+    "basic-ftp": "^6.2.2"
   }
 }

src/plugin.json

@@ -27,7 +27,7 @@
       },
       {
         "name": "License",
-        "url": "https://github.com/TransitApp/map-panel/blob/master/LICENSE"
+        "url": "https://github.com/TransitApp/map-panel/blob/main/LICENSE"
       },
       {
         "name": "Original project (Orchestra Cities)",