This PR refactors the `verifyAuth` function replacing the normal push
dry-run (which could result in a branch outdated error/notice) with a
tags dry-run push. It does this by separating the push permission check
operation in the `verifyAuth` logic from the `isBranchUpdated` logic
that lived in thesame execution block via a `try-catch` into standalone
operations; this branch status check only occured when the push
permission check fails.
### Changes Made
- Modify `verifyAuth` logic to do a tags dry run instead of a branch
dry-run push
- Separate `verifyAuth` to a standalone block to throw a
`"EGITNOPERMISSION"` if no push permission is found
- Improved the `isBranchUpdated` helper to ensure it checks for cases
where local branch is either behind, ahead or diverged of head remote
branch and return appropriate boolean response which in this case is...
- `false` - when local branch is behind remote branch
- `true` - when local branch is ahead of remote branch
- `false` - when local branch and remote branch have commits that the
other doesn't
- Make the branch up to date check a standalone process in the release
verification process returning `false` when branch is considered not
up-to-date - with a message
```js
if (!(await isBranchUpToDate(options.repositoryUrl, context.branch.name,
{ cwd, env }))) {
logger.log(
`The local branch ${context.branch.name} is behind the remote one,
therefore a new version won't be published.`
);
return false;
}
```
### Related Issue
Fixes#3437
BREAKING CHANGE: `semantic-release` now checks if your local branch is
up-to-date with your remote repo branch after of push permission
verification.
This pull request updates the version of a dependency in the
`package.json` file to ensure compatibility with the latest features and
bug fixes.
Dependency updates:
* Upgraded `@semantic-release/commit-analyzer` from version `^13.0.1` to
`^14.0.0-beta.4` to incorporate the latest improvements and potential
breaking changes from the new major version.
## Problem
`EGITNOPERMISSION` interpolates `options.repositoryUrl` into the error
`details`. By the time this error is thrown (`index.js`, after
`verifyAuth` fails), `options.repositoryUrl` has been replaced with the
result of `getGitAuthUrl()`, which can embed CI credentials (`GH_TOKEN`,
`GITHUB_TOKEN`, `GL_TOKEN`, `BB_TOKEN`, …) as basic-auth in the URL.
The existing masking covers most paths — terminal output goes through
the `hookStd(hideSensitive(env))` hook, the CLI masks the inspected
error before printing, and fail-plugin inputs are masked via
`hideSensitiveValues` — but the thrown error object itself is rethrown
**unmasked** to programmatic API consumers after `unhook()`. Any wrapper
that catches the error and reports `error.details` elsewhere (PR
comment, CI annotation, error tracker) would leak the token.
## Fix
Use `options.originalRepositoryURL` — the URL as configured, saved
before `getGitAuthUrl()` rewrites it — in the error details, falling
back to `repositoryUrl` when it isn't set (e.g. when the error factory
is invoked directly with a partial context).
## Testing
- Added `test/definitions/errors.test.js` covering that the details
contain the original URL and not the credential-bearing one, plus the
fallback.
- `npx ava test/definitions/` and `npm run lint:prettier` pass.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* fix: ensure percent-encoded secrets get masked
Co-authored-by: Gregor Martynus <39992+gr2m@users.noreply.github.com>
* fix: mask secrets in the exact form url.format() embeds them in git URLs
The authenticated repository URL is built with the legacy url.format(),
which encodes the auth field like encodeURIComponent() except that ":"
separators are kept as is. A GIT_CREDENTIALS value such as
"user:abc@def-secret" therefore appears as "user:abc%40def-secret" in a
failing git command, a form matched by neither the raw value, encodeURI(),
nor encodeURIComponent() candidates, and leaked unmasked.
Add the colon-preserving encoded form to the redaction candidates, assert
the unit tests against URLs built the same way get-git-auth-url.js builds
them, and add an integration test reproducing the leak end-to-end with a
git remote on a closed loopback port.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Matt Travi <programmer@travi.org>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This change makes the second segment the optional one rather than the third segment. That ensures that a maintenance branch always needs to end with `.x`
Co-authored-by: Matt Travi <programmer@travi.org>
* chore(deps): update @semantic-release/github to v11.0.0
* refactor: Update e2e.test.js to include clone_url in GET request
* refactor: Update e2e.test.js to include clone_url in GET request
* refactor: Include clone_url in GET request in e2e.test.js
* add `warn` type to logger in `getLogger`
* test: update test case `'Expose "error", "success" and "log" functions'`
* type: add `warn` to `logger` type interface
* doc: add available logger function to docs
* type: update type interface doc for `logger`
* ci: win32 escape slash as doubleslash for test
Pathing in stderr output has double backslash in the filename. The test
will now use double backslash in the existence test.
Signed-off-by: Chris. Webster <chris@webstech.net>
* ci: avoid Windows pop-up in credential tests
Windows uses a `credential.helper` that will open a pop-up for
credentials if they are missing. A git config parameter will now be set
to avoid the pop-up.
Signed-off-by: Chris. Webster <chris@webstech.net>
---------
Signed-off-by: Chris. Webster <chris@webstech.net>
There is legacy support for PortBindings and Binds at the root level of
the config. Currently (including Windows) these reside under the
HostConfig. ExposedPorts is now used to identify the externally
available ports.
Signed-off-by: Chris. Webster <chris@webstech.net>
Matt Travi