This pull request refactors the core logic of the package to use the
`@semantic-release/core` engine directly, removes legacy and duplicated
code, and centralizes configuration. The changes simplify the codebase
by delegating most of the release logic to the upstream core package,
making the CLI wrapper thinner and easier to maintain. Several internal
utility files for branch and tag handling are also removed, as their
logic is now handled by `@semantic-release/core`.
### Migration to Core Engine
* The CLI now delegates release logic to `@semantic-release/core`, using
its `resolveConfig`, `getLogger`, and other helpers, instead of
maintaining a custom implementation. This reduces maintenance overhead
and ensures alignment with the core release logic.
* The documentation is updated to explain that `semantic-release` uses
`@semantic-release/core` as its engine, and provides guidance for
advanced use cases.
### Configuration and Defaults
* A new `SEMANTIC_RELEASE_DEFAULT_CONFIG` constant is introduced,
centralizing the default plugin stack for releases.
### Codebase Simplification
* Removes internal implementations for branch expansion, tag retrieval,
and normalization, as well as related validation and error handling
logic. These are now handled by the core engine.
## Problem
`EGITNOPERMISSION` interpolates `options.repositoryUrl` into the error
`details`. By the time this error is thrown (`index.js`, after
`verifyAuth` fails), `options.repositoryUrl` has been replaced with the
result of `getGitAuthUrl()`, which can embed CI credentials (`GH_TOKEN`,
`GITHUB_TOKEN`, `GL_TOKEN`, `BB_TOKEN`, …) as basic-auth in the URL.
The existing masking covers most paths — terminal output goes through
the `hookStd(hideSensitive(env))` hook, the CLI masks the inspected
error before printing, and fail-plugin inputs are masked via
`hideSensitiveValues` — but the thrown error object itself is rethrown
**unmasked** to programmatic API consumers after `unhook()`. Any wrapper
that catches the error and reports `error.details` elsewhere (PR
comment, CI annotation, error tracker) would leak the token.
## Fix
Use `options.originalRepositoryURL` — the URL as configured, saved
before `getGitAuthUrl()` rewrites it — in the error details, falling
back to `repositoryUrl` when it isn't set (e.g. when the error factory
is invoked directly with a partial context).
## Testing
- Added `test/definitions/errors.test.js` covering that the details
contain the original URL and not the credential-bearing one, plus the
fallback.
- `npx ava test/definitions/` and `npm run lint:prettier` pass.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: ensure percent-encoded secrets get masked
Co-authored-by: Gregor Martynus <39992+gr2m@users.noreply.github.com>
* fix: mask secrets in the exact form url.format() embeds them in git URLs
The authenticated repository URL is built with the legacy url.format(),
which encodes the auth field like encodeURIComponent() except that ":"
separators are kept as is. A GIT_CREDENTIALS value such as
"user:abc@def-secret" therefore appears as "user:abc%40def-secret" in a
failing git command, a form matched by neither the raw value, encodeURI(),
nor encodeURIComponent() candidates, and leaked unmasked.
Add the colon-preserving encoded form to the redaction candidates, assert
the unit tests against URLs built the same way get-git-auth-url.js builds
them, and add an integration test reproducing the leak end-to-end with a
git remote on a closed loopback port.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Matt Travi <programmer@travi.org>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This change makes the second segment the optional one rather than the third segment. That ensures that a maintenance branch always needs to end with `.x`
Co-authored-by: Matt Travi <programmer@travi.org>
* add `warn` type to logger in `getLogger`
* test: update test case `'Expose "error", "success" and "log" functions'`
* type: add `warn` to `logger` type interface
* doc: add available logger function to docs
* type: update type interface doc for `logger`
for #2543
BREAKING CHANGE: semantic-release is now ESM-only. since it is used through its own executable, the impact on consuming projects should be minimal
BREAKING CHANGE: references to plugin files in configs need to include the file extension because of executing in an ESM context
the performance and readability of reduce is not a concern in this project since maintainers are
familiar with the idiom and are iterating over small lists. the filter rule is disabled selectively
since the filter being identified is not Array.filter
closes#2403
This change adds support for `*.cjs` config files by removing the
explicit use of `searchPlaces` options and relying and the default
search places generated by `cosmicconfig`. As per the docs for
[`cosmicconfig`][cc], the defaults include all the extensions/formats
previously supported by semantic-release in addition to the new .cjs
variants.
Resolves [#1814][issue].
[issue]: https://github.com/semantic-release/semantic-release/issues/1814
[cc]: https://github.com/davidtheclark/cosmiconfig#searchplaces
Olabode Lawal-Shittabey