feat: add root package-lock.json support

[tada5hi]

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #2161
Fixes #1842

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[chingor13]

Rather than explicitly adding a check for a root package-lock.json, would it work if the node-workspace plugin respected the considerAllArtifacts option that other workspace plugins can use?

This option tells the plugin to scan for all "artifacts" (e.g. paths that have a package.json) even if they are undeclared as paths in the release-please-config.json. When building the dependency graph of artifacts that affect each other, the plugin would find the root package.json and create updates for it and its related package-lock.json.

[tada5hi]

@chingor13 I am unsure, as far as I can tell with my knowledge so far, I would say that this is not the case.

Another problem is that the workspace packages are not (necessarily) part of the root package.json file, but only part of the package-lock.json file. For example, the docs describe a scenario in which the root package is also published and references parts of the workspace packages. However, in most cases this is not the case, as the root package should also be published.

The cargo-workspace plugin follows a similar mechanism as I have planned for the node-workspace plugin, as far as I can tell. However, this assumes that another file in the root directory is already part of the pull request.

[blaine-arcjet]

@chingor13 I just ran into this same problem. What would it take to get this across the finish line?

[tada5hi]

@chingor13 ?