45 Commits

Author SHA1 Message Date
Olabode Lawal-Shittabey 3e2a07107d feat: implement tags push in verifyAuth dry-run operation and isolate branch status check (#3447)
This PR refactors the `verifyAuth` function replacing the normal push
dry-run (which could result in a branch outdated error/notice) with a
tags dry-run push. It does this by separating the push permission check
operation in the `verifyAuth` logic from the `isBranchUpdated` logic
that lived in thesame execution block via a `try-catch` into standalone
operations; this branch status check only occured when the push
permission check fails.

### Changes Made

- Modify `verifyAuth` logic to do a tags dry run instead of a branch
dry-run push
- Separate `verifyAuth` to a standalone block to throw a
`"EGITNOPERMISSION"` if no push permission is found
- Improved the `isBranchUpdated` helper to ensure it checks for cases
where local branch is either behind, ahead or diverged of head remote
branch and return appropriate boolean response which in this case is...
    - `false` - when local branch is behind remote branch
    - `true` - when local branch is ahead of remote branch
- `false` - when local branch and remote branch have commits that the
other doesn't
- Make the branch up to date check a standalone process in the release
verification process returning `false` when branch is considered not
up-to-date - with a message
    ```js
if (!(await isBranchUpToDate(options.repositoryUrl, context.branch.name,
{ cwd, env }))) {
        logger.log(
`The local branch ${context.branch.name} is behind the remote one,
therefore a new version won't be published.`
        );
        return false;
      }
    ```

### Related Issue

Fixes #3437 

BREAKING CHANGE: `semantic-release` now checks if your local branch is
up-to-date with your remote repo branch after of push permission
verification.
2026-10-22 03:27:48 +01:00
Gregor Martynus c46dbdaeda fix: argument Injection via repositoryUrl in package.json (#4245)
Co-Authored-By: Abhijith S abh78i00@gmail.com
2026-07-12 22:23:08 -07:00
Tomáš Vojtášek 85187e2cb6 perf(get-tags.js): bulk get for tags notes (#3732)
Co-authored-by: Matt Travi <126441+travi@users.noreply.github.com>
2025-07-11 14:33:04 -05:00
Gregor Martynus d13ea9280e style: prettier (#2624) 2022-11-23 16:02:51 -08:00
Matt Travi 9eab1adb9d feat(esm): convert to esm (#2569)
for #2543

BREAKING CHANGE: semantic-release is now ESM-only. since it is used through its own executable, the impact on consuming projects should be minimal

BREAKING CHANGE: references to plugin files in configs need to include the file extension because of executing in an ESM context
2022-11-11 09:24:06 -06:00
Gregor Martynus caa3526caa style: xo 2020-04-08 15:13:33 -07:00
greenkeeper[bot] f899fa9a7c chore(package): update xo to version 0.28.1
Closes #1488
2020-03-26 23:55:26 -04:00
greenkeeper[bot] ef1b8a0b91 chore(package): update ava to version 3.1.0 2020-01-27 13:52:59 -05:00
Jozef Cipa c6b10766a7 fix: correct error when remote repository has no branches 2020-01-27 11:59:38 -05:00
Pierre Vanduynslager 6b5b02ea75 fix: fetch tags on repo cached by the CI 2020-01-15 13:43:44 -05:00
Pierre Vanduynslager a8747c4f86 fix: verify is branch is up to date by comparing remote and local HEAD 2019-12-10 00:23:38 -05:00
Pierre Vanduynslager ec54c0be8a test: fix calls to fetch in tests 2019-12-03 20:20:04 -05:00
Pierre Vanduynslager cbef9d18da fix: modify fetch function to handle CircleCI specifics 2019-12-03 18:07:12 -05:00
Pierre Vanduynslager b2c1b2c670 feat: use Git notes to store the channels on which a version has been released
BREAKING CHANGE: this feature change the way semantic-release keep track of the channels on which a version has been released.
It now use a JSON object stored in a [Git note](https://git-scm.com/docs/git-notes) instead of Git tags formatted as v{version}@{channel}.

The tags formatted as v{version}@{channel} will now be ignored. If you have made releases with v16.0.0 on branches other than the default one you will have to update your repository.

The changes to make consist in:
- Finding all the versions that have been released on a branch other than the default one by searching for all tags formatted v{version}@{channel}
- For each of those version:
  - Create a tag without the {@channel} if none doesn't already exists
  - Add a Git note to the tag without the {@channel} containing the channels on which the version was released formatted as `{"channels":["channel1","channel2"]}` and using `null` for the default channel (for example.`{"channels":[null,"channel1","channel2"]}`)
  - Push the tags and notes
  - Update the GitHub releases that refer to a tag formatted as v{version}@{channel} to use the tag without it
  - Delete the tags formatted as v{version}@{channel}
2019-12-02 23:38:40 -05:00
Pierre Vanduynslager 131734873e fix: throws error if the commit associated with a tag cannot be found 2019-11-07 14:33:53 -05:00
Pierre Vanduynslager cffe9a8d33 perf: use git tag --merge <branch> to filter tags present in a branch history
BREAKING CHANGE: Git CLI version 2.7.1 or higher is now required

The `--merge` option of the `git tag` command has been added in Git version 2.7.1 and is now used by semantic-release
2019-11-01 16:58:55 -04:00
Pierre Vanduynslager 844e0b07e0 fix: remove hack to workaround GitHub Rebase & Merge 2019-11-01 16:58:55 -04:00
Pierre Vanduynslager 0629f3cd8a revert: feat: create annotated tags
This reverts commit 4d581fc140.
2019-09-13 14:46:47 -04:00
Pierre Vanduynslager 4d581fc140 feat: create annotated tags 2019-06-07 16:03:30 -04:00
jmodjeski75 3610422959 fix(repositoryUrl): on beta repositoryUrl needs auth for pre-release flows (#1186) 2019-06-05 11:33:54 -07:00
greenkeeper[bot] ba00e16f43 chore(package): update ava to version 1.0.1 2018-12-27 15:04:57 -05:00
Pierre Vanduynslager 968b9968a1 fix: remove unnecessary branch parameter from push function 2018-11-29 20:44:31 -05:00
Pierre Vanduynslager b729183b4a fix: fetch all release branches on CI 2018-11-29 20:03:51 -05:00
Pierre Vanduynslager 7b4052470b feat: support multiple branches and distribution channels
- Allow to configure multiple branches to release from
- Allow to define a distribution channel associated with each branch
- Manage the availability on distribution channels based on git merges
- Support regular releases, maintenance releases and pre-releases
- Add the `addChannel` plugin step to make an existing release available on a different distribution channel

BREAKING CHANGE: the `branch` option has been removed in favor of `branches`

The new `branches` option expect either an Array or a single branch definition. To migrate your configuration:
- If you want to publish package from multiple branches, please the configuration documentation
- If you use the default configuration and want to publish only from `master`: nothing to change
- If you use the `branch` configuration and want to publish only from one branch: replace `branch` by `branches` (`"branch": "my-release-branch"` => `"branches": "my-release-branch"`)
2018-11-29 14:13:03 -05:00
Pierre Vanduynslager 2b082acc73 fix: push only tags to remote repo 2018-11-21 12:32:01 -05:00
Pierre Vanduynslager aa022e0ac2 test: clarify variables name 2018-11-21 12:32:01 -05:00
Pierre Vanduynslager 9f5645cfa0 refactor: harmonize git utils function names 2018-11-19 18:34:16 -05:00
Pierre Vanduynslager a94e08de9a feat: pass cwd and env context to plugins
- Allow to run semantic-release (via API) from anywhere passing the current working directory.
- Allows to simplify the tests and to run them in parallel in both the core and plugins.
2018-07-17 00:42:04 -04:00
Pierre Vanduynslager 071dccea4b fix: use unauthenticated URL to check if branch is up to date
In case the authentication token provided is unauthorized the call to `isBranchUpToDate` will fail due to lack of read permission if that URL is used. As a result the error about outdated local branch will be reported instead of the one about missing permission.
By using the original (unauthenticated) URL `isBranchUpToDate` shouldn't fail due to permission as it requires only read permissions, that are necessarly present as the CI wass able to clone the repo.
2018-07-10 13:07:00 -04:00
Pierre Vanduynslager 45eee4acdd fix: fetch all tags even if the repo is not shallow 2018-07-02 18:38:24 -04:00
Pierre Vanduynslager 2d3a5e53e9 test: harmonize git-utils functions name 2018-07-02 18:38:24 -04:00
Pierre Vanduynslager 2b6378f26f fix: use git ls-remote to verify if the remote branch is ahead 2018-06-15 16:16:55 -04:00
Cory Reed 4352144a98 fix: correct git merge-base error code handling 2018-05-08 10:03:46 -07:00
pvdlg d15905c0d5 fix: verify the local branch is up to date with the remote one 2018-05-01 09:59:57 -04:00
Anshuk Kumar 45d7e6f25f fix: unshallow repository with credentials 2018-05-01 09:47:15 -04:00
Pierre Vanduynslager c2beb643fa feat: add the prepare plugin hook
BREAKING CHANGE: Committing or creating files in the `publish` plugin hook is not supported anymore and now must be done in the `prepare` hook

Plugins with a `publish` hook that makes a commit or create a file that can be committed must use the `prepare` hook.
2018-02-19 00:28:50 -05:00
Pierre Vanduynslager 687435b9a2 feat: add debug logs for git commands 2018-02-08 16:43:17 -05:00
Pierre Vanduynslager 39536fa34e feat: add tagFormat option to customize Git tag name 2018-01-29 00:55:32 -05:00
Pierre Vanduynslager d0b304e240 feat: get last release with git tags
- Remove the `getLastRelease` plugin type
- Retrieve the last release based on Git tags
- Create the next release Git tag before calling the `publish` plugins

BREAKING CHANGE: Remove the `getLastRelease` plugin type

The `getLastRelease` plugins will not be called anymore.

BREAKING CHANGE: Git repository authentication is now mandatory

The Git authentication is now mandatory and must be set via `GH_TOKEN`, `GITHUB_TOKEN`,  `GL_TOKEN`, `GITLAB_TOKEN` or `GIT_CREDENTIALS` as described in [CI configuration](https://github.com/semantic-release/semantic-release/blob/caribou/docs/usage/ci-configuration.md#authentication).
2018-01-27 16:50:29 -05:00
Pierre Vanduynslager 754b420fd6 feat: support sharable configuration
Adds the options `extends`, which can be defined via configuration file or CLI arguments to a single path or an array of paths of shareable configuration.
A shareable configuration is a file or a module that can be loaded with `require`.
Options is defined by merging in the following order of priority:
- CLI/API
- Configuration file
- Shareable configuration (from right to left)

Options set in a shareable configuration can be unset by setting it to `null` or `undefined` in the main configuration file. If a default value applies to this property it will be used.
2017-12-22 14:22:30 -05:00
Pierre Vanduynslager 8942093c18 test: limit information stored in context
Store only objects set in `beforeEach` used in `test`.
Avoid logging useless info on test failure.
2017-12-14 11:44:24 -05:00
Pierre Vanduynslager 8371a03da0 test: Verify Error instance type and SemanticReleaseError name 2017-11-29 18:06:14 -05:00
Pierre Vanduynslager 0c67ba517f feat: Make semantic-release language agnostic
- Do not rely on `package.json` anymore
- Use `cosmiconfig` to load the configation. `semantic-release` can be configured:
  - via CLI options (including plugin names but not plugin options)
  - in the `release` property of `package.json` (as before)
  - in a `.releaserc.yml` or `.releaserc.js` or `.releaserc.js` or `release.config.js` file
  - in a `.releaserc` file containing `json`, `yaml` or `javascript` module
- Add the `repositoryUrl` options (used across `semantic-release` and plugins). The value is determined from CLi option, or option configuration, or package.json or the git remote url
- Verifies that `semantic-release` runs from a git repository
- `pkg` and `env` are not passed to plugin anymore
- `semantic-release` can be run both locally and globally. If ran globally with non default plugins, the plugins can be installed both globally or locally.

BREAKING CHANGE: `pkg` and `env` are not passed to plugin anymore.
Plugins relying on a `package.json` must verify the presence of a valid `package.json` and load it.
Plugins can use `process.env` instead of `env`.
2017-11-24 21:56:15 -05:00
Pierre Vanduynslager facdadaddb ci: Lint with XO 2017-11-21 20:55:47 -05:00
Pierre Vanduynslager d548edcf37 feat: Extract npm and github publish to plugins
- Add a new plugin type: `publish`
- Add support for multi-plugin. A plugin module can now return an object with a property for each plugin type
- Uses by default [npm](https://github.com/semantic-release/npm) and [github](https://github.com/semantic-release/github) in addition of Travis for the verify condition plugin
- Uses by default [npm](https://github.com/semantic-release/npm) and [github](https://github.com/semantic-release/github) for the publish plugin
- `gitTag` if one can be found is passed to `generateNotes` for both `lastRelease` and `nextRelease`
- `semantic-release` now verifies the plugin configuration (in the `release` property of `package.json`) and throws an error if it's invalid
- `semantic-release` now verifies each plugin output and will throw an error if a plugin returns an unexpected value.

BREAKING CHANGE: `githubToken`, `githubUrl` and `githubApiPathPrefix` have to be set at the [github](https://github.com/semantic-release/github) plugin level. They can be set via `GH_TOKEN`, `GH_URL` and `GH_PREFIX` environment variables.

BREAKING CHANGE: the `npm` parameter is not passed to any plugin anymore. Each plugin have to read `.npmrc` if they needs to (with https://github.com/kevva/npm-conf for example).
2017-11-21 16:41:04 -05:00