Use npm workspaces for packages (second attempt)

bin/check-licenses.mjs

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+
+/**
+ * External dependencies
+ */
+import { spawnSync } from 'node:child_process';
+
+/**
+ * Internal dependencies
+ */
+import { checkDepsInTree } from '../packages/scripts/utils/license.js';
+
+const ignored = [ '@ampproject/remapping' ];
+
+/*
+ * `wp-scripts check-licenses` uses prod and dev dependencies of the package to scan for dependencies. With npm workspaces, workspace packages (the @wordpress/* packages) are not listed in the main package json and this approach does not work.
+ *
+ * Instead, work from an npm query that uses some custom information in package.json files to declare packages that are shipped with WordPress (and must be GPLv2 compatible) or other files that may use more permissive licenses.
+ */
+
+/**
+ * @typedef PackageInfo
+ * @property {string} name Package name.
+ */
+
+/** @type {ReadonlyArray<PackageInfo>} */
+const workspacePackages = JSON.parse(
+	spawnSync(
+		'npm',
+		[
+			'query',
+			'.workspace:attr([wpScript]), .workspace:attr([wpScriptModuleExports])',
+		],
+		/*
+		 * Set the max buffer to ~157MB, since the output size for
+		 * prod is ~21 MB and dev is ~110 MB
+		 */
+		{ maxBuffer: 1024 * 1024 * 150 }
+	).stdout
+);
+
+const packageNames = workspacePackages.map( ( { name } ) => name );
+
+const dependenciesToProcess = JSON.parse(
+	spawnSync(
+		'npm',
+		[
+			'ls',
+			'--json',
+			'--long',
+			'--all',
+			'--lockfile-only',
+			'--omit=dev',
+			...packageNames.map(
+				( packageName ) => `--workspace=${ packageName }`
+			),
+		],
+		/*
+		 * Set the max buffer to ~157MB, since the output size for
+		 * prod is ~21 MB and dev is ~110 MB
+		 */
+		{ maxBuffer: 1024 * 1024 * 150 }
+	).stdout
+).dependencies;
+
+checkDepsInTree( dependenciesToProcess, {
+	ignored,
+	gpl2: true,
+} );

docs/contributors/code/managing-packages.md

@@ -1,11 +1,7 @@
 # Managing Packages
 
-This repository uses [monorepo] to manage WordPress modules and publish them with [lerna] as packages to [npm]. This enforces certain steps in the workflow which are described in details in [packages](https://github.com/WordPress/gutenberg/blob/HEAD/packages/README.md) documentation.
+This repository uses [npm workspaces](https://docs.npmjs.com/cli/v10/using-npm/workspaces) to manage WordPress packages and [lerna](https://lerna.js.org/) to publish them to [npm](https://www.npmjs.com/). This enforces certain steps in the workflow which are described in details in [packages](https://github.com/WordPress/gutenberg/blob/HEAD/packages/README.md) documentation.
 
 Maintaining dozens of npm packages is difficult—it can be tough to keep track of changes. That's why we use `CHANGELOG.md` files for each package to simplify the release process. As a contributor, you should add an entry to the aforementioned file each time you contribute adding production code as described in [Maintaining Changelogs](https://github.com/WordPress/gutenberg/blob/HEAD/packages/README.md#maintaining-changelogs) section.
 
 Publishing WordPress packages to npm is automated by synchronizing it with the bi-weekly Gutenberg plugin RC1 release. You can learn more about this process and other ways to publish new versions of npm packages in the [Gutenberg Release Process document](/docs/contributors/code/release.md#packages-releases-to-npm-and-wordpress-core-updates).
-
-[lerna]: https://lerna.js.org/
-[monorepo]: https://monorepo.tools
-[npm]: https://www.npmjs.com/