monorepo: import postguard-outlook-addon as apps/outlook-addon, upgrading to pg-js v2 in the move

[rubenhensen]

History-preserving import of encryption4all/postguard-outlook-addon into apps/outlook-addon, doing the pg-js v1→v2 migration as part of the move (closes encryption4all/postguard-outlook-addon#125 — the fleet's largest version drift). Keep the ghcr image + release-please manifest-asset flow; preserve the X-PostGuard-Client-Version: …,pg4ol,… header contract (PKG Prometheus keys on it). Transfer open issues, archive the source repo.

Child of the monorepo umbrella; part of encryption4all/postguard#247 (workstream B).

[rubenhensen]

Reopened — this was closed by accident, not completed.

The tb-addon import (#137) brought 435 commits in via a subtree merge, and three of them carry closing keywords for #127/#128/#129 — referring to postguard-tb-addon issues. GitHub resolved those against this repo's numbering, so merging the import silently closed B4, B5 and B6.

Guard for the remaining imports, in #139.

[rubenhensen]

Part one is #141 (import + workspace SDK + security floors, release path untouched). This is the plan for part two, recorded from the recon so it does not have to be re-derived.

Facts from postguard-outlook-addon's workflows

release.yml (on push to master) runs release-please, then one of two Docker jobs:

• IMAGE: ghcr.io/${{ github.repository }} — appears twice (build-edge, build-release).
• build-release tags :${tag_name}, :${version} and :latest.
• build-args bake ADDIN_PUBLIC_URL=https://${ADDIN_HOST}/ plus PKG_URL, CRYPTIFY_URL, POSTGUARD_WEBSITE_URL.
• ADDIN_HOST: addin.staging.postguard.eu at job level; check whether build-release overrides it for prod, since baking the staging host into a production image would point every install at staging.
• After the image, it rebuilds with production URLs and runs gh release upload "$tag_name" dist/manifest.xml --clobber — the versioned sideload URL admins use.

ci.yml has check (lint, prettier, tsc, build, manifest validate), test, nginx.

Work

1. Hardcode the image name in both places → ghcr.io/encryption4all/postguard-outlook-addon. In the monorepo github.repository is postguard-js, which postguard-ops does not pin (prod pins postguard-outlook-addon:0.4.0), so deriving it publishes to a name nothing deploys. Same trap as B2; third repo it appears in.
2. release-please → changesets. Delete release-please-config.json / .release-please-manifest.json. Check whether release-please also syncs manifest.xml's <Version> (it is a 4-part Office version, distinct from package.json's) — if so, port that to a sync-version script as apps/tb-addon has, with a check-version CI gate.
3. App-scoped release tags: outlook-addin-v<version>, never v*. The tag namespace is shared with @e4a/pg-js's changesets releases and the pre-monorepo v2.3.3-style pg-js tags.
4. Keep the manifest.xml release asset, uploaded against the app-scoped tag. Unlike tb-addon's updates.json this is not a live update channel — admins pull a versioned URL — so it does not need the releases/latest migration, but confirm nothing references releases/latest for it.
5. apps/website/scripts/sync-addons.mjs: its outlook target still has repo: 'encryption4all/postguard-outlook-addon' with assetPattern: /^manifest\.xml$/i. Needs the repo swapped and tagPattern: /^outlook-addin-v/, exactly as the thunderbird target got — a bare asset pattern over a shared release namespace would consider every pg-js release.
6. Port ci.yml to a root outlook-addon.yml, path-unfiltered (an SDK change must test its consumers), pnpm, working-directory: apps/outlook-addon.
7. Check whether its build needs env vars that the workspace aggregate now inherits — the tb-addon lesson. Its webpack build succeeded locally without any, so the DefinePlugin values likely have defaults; confirm rather than assume.

Sequencing

Do not archive postguard-outlook-addon until this lands — it is still the release path. Archiving the website repo before its docker half moved is what left that image frozen in B2.

First release from the monorepo should be gated on a manual sideload test in Outlook: nothing in CI exercises Office.js, so part one's green checks say nothing about the compose or read flows.