feat: hide sensitive info in stdout/sdtin

The `noCi` is no properly set based on the `--no-ci` CLI arg and it is overwritten by the `noCi` option

.travis.yml

@@ -1,13 +1,11 @@
 language: node_js
+
 services:
   - docker
-notifications:
-  email: false
+
 node_js:
   - 9
   - 8
-os:
-  - linux
 
 # Trigger a push build on caribou and greenkeeper branches + PRs build on every branches
 # Avoid double build on PRs (See https://github.com/travis-ci/travis-ci/issues/1147)
@@ -25,5 +23,10 @@ script:
 
 after_success:
   - npm run codecov
-  - npm install -g travis-deploy-once@4
-  - travis-deploy-once "npm run semantic-release"
+
+jobs:
+  include:
+    - stage: release
+      node_js: lts/*
+      script:
+        - npm run semantic-release

README.md

@@ -49,7 +49,7 @@ This removes the immediate connection between human emotions and version numbers
 
 **semantic-release** uses the commit messages to determine the type of changes in the codebase. Following formalized conventions for commit messages, **semantic-release** automatically determines the next [semantic version](https://semver.org) number, generates a changelog and publish the release.
 
-By default **semantic-release** uses [Angular Commit Message Conventions](https://github.com/angular/angular.js/blob/master/DEVELOPERS.md#-git-commit-guidelines). The commit message format that can changed with the [`preset` or `config` options](docs/usage/configuration.md#options) of the [@semantic-release/commit-analyzer](https://github.com/semantic-release/commit-analyzer#options) and [@semantic-release/release-notes-generator](https://github.com/semantic-release/release-notes-generator#options) plugins.
+By default **semantic-release** uses [Angular Commit Message Conventions](https://github.com/angular/angular.js/blob/master/DEVELOPERS.md#-git-commit-guidelines). The commit message format can be changed with the [`preset` or `config` options](docs/usage/configuration.md#options) of the [@semantic-release/commit-analyzer](https://github.com/semantic-release/commit-analyzer#options) and [@semantic-release/release-notes-generator](https://github.com/semantic-release/release-notes-generator#options) plugins.
 
 Tools such as [commitizen](https://github.com/commitizen/cz-cli), [commitlint](https://github.com/marionebl/commitlint) or [semantic-git-commit-cli](https://github.com/JPeer264/node-semantic-git-commit-cli) can be used to help contributor and enforce valid commits message.
 

cli.js

@@ -1,6 +1,5 @@
 const program = require('commander');
 const {pickBy, isUndefined} = require('lodash');
-const logger = require('./lib/logger');
 
 function list(values) {
   return values.split(',').map(value => value.trim());
@@ -48,15 +47,13 @@ module.exports = async () => {
       program.outputHelp();
       process.exitCode = 1;
     } else {
+      const opts = program.opts();
+      // Set the `noCi` options as commander.js sets the `ci` options instead (becasue args starts with `--no`)
+      opts.noCi = opts.ci === false ? true : undefined;
       // Remove option with undefined values, as commander.js sets non defined options as `undefined`
-      await require('.')(pickBy(program.opts(), value => !isUndefined(value)));
+      await require('.')(pickBy(opts, value => !isUndefined(value)));
     }
   } catch (err) {
     process.exitCode = 1;
-    if (err.semanticRelease) {
-      logger.log(`%s ${err.message}`, err.code);
-    } else {
-      logger.error('An error occurred while running semantic-release: %O', err);
-    }
   }
 };

docs/recipes/travis.md

@@ -16,7 +16,9 @@ For projects that require to be tested only with a single [Node version](https:/
 
 This example is a minimal configuration for semantic-release with a build running Node 8 on Linux. See [Travis - Customizing the Build](https://docs.travis-ci.com/user/customizing-the-build) for additional configuration options.
 
-It's recommended to run the `semantic-release` command in the [Travis `script` step](https://docs.travis-ci.com/user/customizing-the-build/#The-Build-Lifecycle) so if an error happen the build will fail and Travis will send a notification.
+It's recommended to run the `semantic-release` command in the [Travis `deploy` step](https://docs.travis-ci.com/user/customizing-the-build/#The-Build-Lifecycle) so if an error occurs the build will fail and Travis will send a notification.
+
+**Note**: It's not recommended to run the `semantic-release` command in the Travis `script` step as each script in this step will be executed regardless of the outcome of the previous one. See [travis-ci/travis-ci#1066](https://github.com/travis-ci/travis-ci/issues/1066).
 
 **Note**: The`semantic-release` execution command varies depending if you are using a [local](../usage/installation.md#local-installation) or [global](../usage/installation.md#global-installation) semantic-release installation.
 
@@ -29,12 +31,14 @@ script:
   # Run tests
   - npm run test
 
-  # Only for a local semantic-release installation
-  - npm run semantic-release
-
-  # Only for a global semantic-release installation
-  - npm install -g semantic-release
-  - semantic-release
+deploy:
+  provider: script
+  skip_cleanup: true
+  script:
+    # Only for a local semantic-release installation
+    - npm run semantic-release
+    # Only for a global semantic-release installation
+    - npm install -g semantic-release && semantic-release
 ```
 
 ### `package.json` configuration for single Node job
@@ -56,7 +60,7 @@ A `package.json` is required only for [local](../usage/installation.md#local-ins
 
 For projects that require to be tested with multiple [Node versions](https://docs.travis-ci.com/user/languages/javascript-with-nodejs/#Specifying-Node.js-versions) and/or on multiple [Operating Systems](https://docs.travis-ci.com/user/multi-os).
 
-**Note**: At least one job must run a [Node >= 8 version](../support/FAQ.md#why-does-semantic-release-require-node-version--8).
+**Note**: At least one job must run a [Node >= 8 version](../support/FAQ.md#why-does-semantic-release-require-node-version--83).
 
 ### `.travis.yml` configuration for multiple Node jobs
 
@@ -64,7 +68,9 @@ This example is a minimal configuration for **semantic-release** with a build ru
 
 This example uses [`travis-deploy-once`](https://github.com/semantic-release/travis-deploy-once) in order to command [Run `semantic-release` only after all tests succeeded](../usage/ci-configuration.md#run-semantic-release-only-after-all-tests-succeeded). Alternatively you can use [Travis CI Build Stages recipe](travis-build-stages.md).
 
-It's recommended to run the `semantic-release` command in the [Travis `script` step](https://docs.travis-ci.com/user/customizing-the-build/#The-Build-Lifecycle) so if an error happen the build will fail and Travis will send a notification.
+It's recommended to run the `semantic-release` command in the [Travis `deploy` step](https://docs.travis-ci.com/user/customizing-the-build/#The-Build-Lifecycle) so if an error occurs the build will fail and Travis will send a notification.
+
+**Note**: It's not recommended to run the `semantic-release` command in the Travis `script` step as each script in this step will be executed regardless of the outcome of the previous one. See [travis-ci/travis-ci#1066](https://github.com/travis-ci/travis-ci/issues/1066).
 
 **Note**: The`semantic-release` execution command varies depending if you are using a [local](../usage/installation.md#local-installation) or [global](../usage/installation.md#global-installation) **semantic-release** installation.
 
@@ -84,12 +90,14 @@ script:
   # Run tests
   - npm run test
 
-  # Only for a local semantic-release installation
-  - npm run travis-deploy-once "npm run semantic-release"
-
-  # Only for a global semantic-release installation
-  - npm install -g travis-deploy-once semantic-release
-  - travis-deploy-once "semantic-release"
+deploy:
+  provider: script
+  skip_cleanup: true
+  script:
+    # Only for a local semantic-release installation
+    - npm run travis-deploy-once "npm run semantic-release"
+    # Only for a global semantic-release installation
+    - npm install -g travis-deploy-once semantic-release && travis-deploy-once "semantic-release"
 ```
 
 **Note**: See the `travis-deploy-once` [`pro`](https://github.com/semantic-release/travis-deploy-once#-p---pro) and [`travis-url`](https://github.com/semantic-release/travis-deploy-once#-u---travis-url) options for using with [Travis Pro](https://docs.travis-ci.com/user/travis-pro) and [Travis Enterprise](https://enterprise.travis-ci.com).
@@ -123,7 +131,9 @@ This example is a minimal configuration for semantic-release with a build runnin
 
 This example uses [`travis-deploy-once`](https://github.com/semantic-release/travis-deploy-once) in order to [run `semantic-release` only after all tests succeeded](../usage/ci-configuration.md#run-semantic-release-only-after-all-tests-succeeded). Alternatively you can use [Travis CI Build Stages recipe](travis-build-stages.md).
 
-It's recommended to run the `semantic-release` command in the [Travis `script` step](https://docs.travis-ci.com/user/customizing-the-build/#The-Build-Lifecycle) so if an error happen the build will fail and Travis will send a notification.
+It's recommended to run the `semantic-release` command in the [Travis `deploy` step](https://docs.travis-ci.com/user/customizing-the-build/#The-Build-Lifecycle) so if an error occurs the build will fail and Travis will send a notification.
+
+**Note**: It's not recommended to run the `semantic-release` command in the Travis `script` step as each script in this step will be executed regardless of the outcome of the previous one. See [travis-ci/travis-ci#1066](https://github.com/travis-ci/travis-ci/issues/1066).
 
 ```yaml
 language: go
@@ -140,12 +150,16 @@ script:
   # Run tests
   - go test -v ./...
 
-  # Use nvm to install and use the Node LTS version (nvm is installed on Travis images)
-  - nvm install lts/*
-  # Install travis-deploy-once and semantic-release
-  - npm install -g travis-deploy-once semantic-release
-  # Run semantic-release only on job, after all other are successful
-  - travis-deploy-once "semantic-release"
+deploy:
+  provider: script
+  skip_cleanup: true
+  script:
+    # Use nvm to install and use the Node LTS version (nvm is installed on all Travis images)
+    - nvm install lts/*
+    # Install travis-deploy-once and semantic-release
+    - npm install -g travis-deploy-once semantic-release
+    # Run semantic-release only on job, after all other are successful
+    - travis-deploy-once "semantic-release"
 ```
 
 **Note**: See the `travis-deploy-once` [`pro`](https://github.com/semantic-release/travis-deploy-once#-p---pro) and [`travis-url`](https://github.com/semantic-release/travis-deploy-once#-u---travis-url) options for using with [Travis Pro](https://docs.travis-ci.com/user/travis-pro) and [Travis Enterprise](https://enterprise.travis-ci.com).

index.js

@@ -1,21 +1,25 @@
 const marked = require('marked');
 const TerminalRenderer = require('marked-terminal');
 const envCi = require('env-ci');
+const hookStd = require('hook-std');
+const hideSensitive = require('./lib/hide-sensitive');
 const getConfig = require('./lib/get-config');
 const getNextVersion = require('./lib/get-next-version');
 const getCommits = require('./lib/get-commits');
 const logger = require('./lib/logger');
 const {gitHead: getGitHead, isGitRepo} = require('./lib/git');
 
-module.exports = async opts => {
+async function run(opts) {
   const {isCi, branch, isPr} = envCi();
+  const config = await getConfig(opts, logger);
+  const {plugins, options} = config;
 
-  if (!isCi && !opts.dryRun && !opts.noCi) {
+  if (!isCi && !options.dryRun && !options.noCi) {
     logger.log('This run was not triggered in a known CI environment, running in dry-run mode.');
-    opts.dryRun = true;
+    options.dryRun = true;
   }
 
-  if (isCi && isPr && !opts.noCi) {
+  if (isCi && isPr && !options.noCi) {
     logger.log("This run was triggered by a pull request and therefore a new version won't be published.");
     return;
   }
@@ -25,9 +29,6 @@ module.exports = async opts => {
     return;
   }
 
-  const config = await getConfig(opts, logger);
-  const {plugins, options} = config;
-
   if (branch !== options.branch) {
     logger.log(
       `This test run was triggered on the branch ${branch}, while semantic-release is configured to only publish from ${
@@ -40,7 +41,7 @@ module.exports = async opts => {
   logger.log('Run automated release from branch %s', options.branch);
 
   logger.log('Call plugin %s', 'verify-conditions');
-  await plugins.verifyConditions({options, logger});
+  await plugins.verifyConditions({options, logger}, true);
 
   logger.log('Call plugin %s', 'get-last-release');
   const {commits, lastRelease} = await getCommits(
@@ -64,7 +65,7 @@ module.exports = async opts => {
   const nextRelease = {type, version, gitHead: await getGitHead(), gitTag: `v${version}`};
 
   logger.log('Call plugin %s', 'verify-release');
-  await plugins.verifyRelease({options, logger, lastRelease, commits, nextRelease});
+  await plugins.verifyRelease({options, logger, lastRelease, commits, nextRelease}, true);
 
   const generateNotesParam = {options, logger, lastRelease, commits, nextRelease};
 
@@ -79,7 +80,7 @@ module.exports = async opts => {
     nextRelease.notes = await plugins.generateNotes(generateNotesParam);
 
     logger.log('Call plugin %s', 'publish');
-    await plugins.publish({options, logger, lastRelease, commits, nextRelease}, async prevInput => {
+    await plugins.publish({options, logger, lastRelease, commits, nextRelease}, false, async prevInput => {
       const newGitHead = await getGitHead();
       // If previous publish plugin has created a commit (gitHead changed)
       if (prevInput.nextRelease.gitHead !== newGitHead) {
@@ -94,4 +95,24 @@ module.exports = async opts => {
     logger.log('Published release: %s', nextRelease.version);
   }
   return true;
+}
+
+module.exports = async opts => {
+  const unhook = hookStd({silent: false}, hideSensitive);
+  try {
+    const result = await run(opts);
+    unhook();
+    return result;
+  } catch (err) {
+    const errors = err.name === 'AggregateError' ? Array.from(err).sort(error => !error.semanticRelease) : [err];
+    for (const error of errors) {
+      if (error.semanticRelease) {
+        logger.log(`%s ${error.message}`, error.code);
+      } else {
+        logger.error('An error occurred while running semantic-release: %O', error);
+      }
+    }
+    unhook();
+    throw err;
+  }
 };

lib/hide-sensitive.js

@@ -0,0 +1,11 @@
+const {escapeRegExp} = require('lodash');
+
+const regexp = new RegExp(
+  Object.keys(process.env)
+    .filter(envVar => /token|password|credential|secret|private/i.test(envVar))
+    .map(envVar => escapeRegExp(process.env[envVar]))
+    .join('|'),
+  'g'
+);
+
+module.exports = output => output.replace(regexp, '[secure]');

lib/plugins/pipeline.js

@@ -1,19 +1,33 @@
 const {identity} = require('lodash');
+const pReflect = require('p-reflect');
 const pReduce = require('p-reduce');
+const AggregateError = require('aggregate-error');
 
-module.exports = steps => async (input, getNextInput = identity) => {
+module.exports = steps => async (input, settleAll = false, getNextInput = identity) => {
   const results = [];
+  const errors = [];
   await pReduce(
     steps,
     async (prevResult, nextStep) => {
-      // Call the next step with the input computed at the end of the previous iteration
-      const result = await nextStep(prevResult);
-      // Save intermediary result
-      results.push(result);
+      let result;
+
+      // Call the next step with the input computed at the end of the previous iteration and save intermediary result
+      if (settleAll) {
+        const {isFulfilled, value, reason} = await pReflect(nextStep(prevResult));
+        result = isFulfilled ? value : reason;
+        (isFulfilled ? results : errors).push(result);
+      } else {
+        result = await nextStep(prevResult);
+        results.push(result);
+      }
+
       // Prepare input for next step, passing the result of the previous iteration and the current one
       return getNextInput(prevResult, result);
     },
     input
   );
+  if (errors.length > 0) {
+    throw new AggregateError(errors);
+  }
   return results;
 };

package.json

@@ -24,24 +24,28 @@
     "@semantic-release/github": "^3.0.1",
     "@semantic-release/npm": "^2.0.0",
     "@semantic-release/release-notes-generator": "^6.0.0",
+    "aggregate-error": "^1.0.0",
     "chalk": "^2.3.0",
     "commander": "^2.11.0",
-    "cosmiconfig": "^3.1.0",
+    "cosmiconfig": "^4.0.0",
     "debug": "^3.1.0",
     "env-ci": "^1.0.0",
     "execa": "^0.9.0",
     "get-stream": "^3.0.0",
     "git-log-parser": "^1.2.0",
-    "lodash": "^4.0.0",
+    "hook-std": "^0.4.0",
+    "lodash": "^4.17.4",
     "marked": "^0.3.9",
     "marked-terminal": "^2.0.0",
     "p-reduce": "^1.0.0",
+    "p-reflect": "^1.0.0",
     "read-pkg-up": "^3.0.0",
     "resolve-from": "^4.0.0",
     "semver": "^5.4.1"
   },
   "devDependencies": {
-    "ava": "^0.24.0",
+    "ava": "^0.25.0",
+    "clear-module": "^2.1.0",
     "codecov": "^3.0.0",
     "commitizen": "^2.9.6",
     "cz-conventional-changelog": "^2.0.0",

test/hide-sensitive.test.js

@@ -0,0 +1,34 @@
+import test from 'ava';
+import clearModule from 'clear-module';
+
+test.beforeEach(() => {
+  process.env = {};
+  clearModule('../lib/hide-sensitive');
+});
+
+test.serial('Replace multiple sensitive environment variable values', t => {
+  process.env.SOME_PASSWORD = 'password';
+  process.env.SOME_TOKEN = 'secret';
+  t.is(
+    require('../lib/hide-sensitive')(
+      `https://user:${process.env.SOME_PASSWORD}@host.com?token=${process.env.SOME_TOKEN}`
+    ),
+    'https://user:[secure]@host.com?token=[secure]'
+  );
+});
+
+test.serial('Replace multiple occurences of sensitive environment variable values', t => {
+  process.env.secretKey = 'secret';
+  t.is(
+    require('../lib/hide-sensitive')(`https://user:${process.env.secretKey}@host.com?token=${process.env.secretKey}`),
+    'https://user:[secure]@host.com?token=[secure]'
+  );
+});
+
+test.serial('Escape regexp special characters', t => {
+  process.env.SOME_CREDENTIALS = 'p$^{.+}\\w[a-z]o.*rd';
+  t.is(
+    require('../lib/hide-sensitive')(`https://user:${process.env.SOME_CREDENTIALS}@host.com`),
+    'https://user:[secure]@host.com'
+  );
+});

test/index.test.js

@@ -2,6 +2,8 @@ import test from 'ava';
 import proxyquire from 'proxyquire';
 import {stub} from 'sinon';
 import tempy from 'tempy';
+import clearModule from 'clear-module';
+import SemanticReleaseError from '@semantic-release/error';
 import DEFINITIONS from '../lib/plugins/definitions';
 import {gitHead as getGitHead} from '../lib/git';
 import {gitRepo, gitCommits, gitTagVersion} from './helpers/git-utils';
@@ -11,21 +13,25 @@ const envBackup = Object.assign({}, process.env);
 // Save the current working diretory
 const cwd = process.cwd();
 
-stub(process.stdout, 'write');
-stub(process.stderr, 'write');
-
 test.beforeEach(t => {
+  clearModule('../lib/hide-sensitive');
+
   // Stub the logger functions
   t.context.log = stub();
   t.context.error = stub();
   t.context.logger = {log: t.context.log, error: t.context.error};
+  t.context.stdout = stub(process.stdout, 'write');
+  t.context.stderr = stub(process.stderr, 'write');
 });
 
-test.afterEach.always(() => {
+test.afterEach.always(t => {
   // Restore process.env
   process.env = envBackup;
   // Restore the current working directory
   process.chdir(cwd);
+
+  t.context.stdout.restore();
+  t.context.stderr.restore();
 });
 
 test.serial('Plugins are called with expected values', async t => {
@@ -161,6 +167,70 @@ test.serial('Use new gitHead, and recreate release notes if a publish plugin cre
   t.deepEqual(publish2.args[0][1].nextRelease, Object.assign({}, nextRelease, {notes}));
 });
 
+test.serial('Log all "verifyConditions" errors', async t => {
+  // Create a git repository, set the current working directory at the root of the repo
+  await gitRepo();
+  // Add commits to the master branch
+  await gitCommits(['First']);
+
+  const error1 = new Error('error 1');
+  const error2 = new SemanticReleaseError('error 2', 'ERR2');
+  const error3 = new SemanticReleaseError('error 3', 'ERR3');
+  const options = {
+    branch: 'master',
+    repositoryUrl: 'git@hostname.com:owner/module.git',
+    verifyConditions: [stub().rejects(error1), stub().rejects(error2), stub().rejects(error3)],
+  };
+
+  const semanticRelease = proxyquire('..', {
+    './lib/logger': t.context.logger,
+    'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
+  });
+  const errors = await t.throws(semanticRelease(options));
+
+  t.deepEqual(Array.from(errors), [error1, error2, error3]);
+  t.deepEqual(t.context.log.args[t.context.log.args.length - 2], ['%s error 2', 'ERR2']);
+  t.deepEqual(t.context.log.args[t.context.log.args.length - 1], ['%s error 3', 'ERR3']);
+  t.deepEqual(t.context.error.args[t.context.error.args.length - 1], [
+    'An error occurred while running semantic-release: %O',
+    error1,
+  ]);
+  t.true(t.context.error.calledAfter(t.context.log));
+});
+
+test.serial('Log all "verifyRelease" errors', async t => {
+  // Create a git repository, set the current working directory at the root of the repo
+  await gitRepo();
+  // Add commits to the master branch
+  let commits = await gitCommits(['First']);
+  // Create the tag corresponding to version 1.0.0
+  await gitTagVersion('v1.0.0');
+  // Add new commits to the master branch
+  commits = (await gitCommits(['Second'])).concat(commits);
+
+  const error1 = new SemanticReleaseError('error 1', 'ERR1');
+  const error2 = new SemanticReleaseError('error 2', 'ERR2');
+  const lastRelease = {version: '1.0.0', gitHead: commits[commits.length - 1].hash, gitTag: 'v1.0.0'};
+  const options = {
+    branch: 'master',
+    repositoryUrl: 'git@hostname.com:owner/module.git',
+    verifyConditions: stub().resolves(),
+    getLastRelease: stub().resolves(lastRelease),
+    analyzeCommits: stub().resolves('major'),
+    verifyRelease: [stub().rejects(error1), stub().rejects(error2)],
+  };
+
+  const semanticRelease = proxyquire('..', {
+    './lib/logger': t.context.logger,
+    'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
+  });
+  const errors = await t.throws(semanticRelease(options));
+
+  t.deepEqual(Array.from(errors), [error1, error2]);
+  t.deepEqual(t.context.log.args[t.context.log.args.length - 2], ['%s error 1', 'ERR1']);
+  t.deepEqual(t.context.log.args[t.context.log.args.length - 1], ['%s error 2', 'ERR2']);
+});
+
 test.serial('Dry-run skips publish', async t => {
   // Create a git repository, set the current working directory at the root of the repo
   await gitRepo();
@@ -209,7 +279,7 @@ test.serial('Dry-run skips publish', async t => {
   t.is(publish.callCount, 0);
 });
 
-test.serial('Force a dry-run if not on a CI and ignore "noCi" is not explicitly set', async t => {
+test.serial('Force a dry-run if not on a CI and "noCi" is not explicitly set', async t => {
   // Create a git repository, set the current working directory at the root of the repo
   await gitRepo();
   // Add commits to the master branch
@@ -369,7 +439,7 @@ test.serial('Returns falsy value if not running from a git repository', async t
     './lib/logger': t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  t.falsy(await semanticRelease());
+  t.falsy(await semanticRelease({repositoryUrl: 'git@hostname.com:owner/module.git'}));
   t.is(t.context.error.args[0][0], 'Semantic-release must run from a git repository.');
 });
 
@@ -384,7 +454,7 @@ test.serial('Returns falsy value if triggered by a PR', async t => {
 
   t.falsy(await semanticRelease({repositoryUrl: 'git@hostname.com:owner/module.git'}));
   t.is(
-    t.context.log.args[0][0],
+    t.context.log.args[7][0],
     "This run was triggered by a pull request and therefore a new version won't be published."
   );
 });
@@ -506,6 +576,31 @@ test.serial('Exclude commits with [skip release] or [release skip] from analysis
   t.deepEqual(analyzeCommits.args[0][1].commits[0].message, commits[commits.length - 1].message);
 });
 
+test.serial('Hide sensitive environment variable values from the logs', async t => {
+  process.env.MY_TOKEN = 'secret token';
+  await gitRepo();
+
+  const options = {
+    branch: 'master',
+    repositoryUrl: 'git@hostname.com:owner/module.git',
+    verifyConditions: async (pluginConfig, {logger}) => {
+      console.log(`Console: The token ${process.env.MY_TOKEN} is invalid`);
+      logger.log(`Log: The token ${process.env.MY_TOKEN} is invalid`);
+      logger.error(`Error: The token ${process.env.MY_TOKEN} is invalid`);
+      throw new Error(`Invalid token ${process.env.MY_TOKEN}`);
+    },
+  };
+  const semanticRelease = proxyquire('..', {
+    'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
+  });
+
+  await t.throws(semanticRelease(options));
+  t.regex(t.context.stdout.args[7][0], /Console: The token \[secure\] is invalid/);
+  t.regex(t.context.stdout.args[8][0], /Log: The token \[secure\] is invalid/);
+  t.regex(t.context.stderr.args[0][0], /Error: The token \[secure\] is invalid/);
+  t.regex(t.context.stderr.args[1][0], /Invalid token \[secure\]/);
+});
+
 test.serial('Throw SemanticReleaseError if repositoryUrl is not set and cannot be found from repo config', async t => {
   // Create a git repository, set the current working directory at the root of the repo
   await gitRepo();

test/integration.test.js

@@ -61,7 +61,7 @@ test.beforeEach(() => {
 
   // Delete all `npm_config` environment variable set by CI as they take precedence over the `.npmrc` because the process that runs the tests is started before the `.npmrc` is created
   for (let i = 0, keys = Object.keys(process.env); i < keys.length; i++) {
-    if (keys[i].startsWith('npm_config')) {
+    if (keys[i].startsWith('npm_')) {
       delete process.env[keys[i]];
     }
   }
@@ -656,6 +656,77 @@ test.serial('Dry-run', async t => {
   await mockServer.verify(verifyMock);
 });
 
+test.serial('Allow local releases with "noCi" option', async t => {
+  delete process.env.TRAVIS;
+  delete process.env.CI;
+  const packageName = 'test-no-ci';
+  const owner = 'test-repo';
+  // Create a git repository, set the current working directory at the root of the repo
+  t.log('Create git repository and package.json');
+  await gitRepo();
+  // Create package.json in repository root
+  await writeJson('./package.json', {
+    name: packageName,
+    version: '0.0.0-dev',
+    repository: {url: `git+https://github.com/${owner}/${packageName}`},
+    publishConfig: {registry: npmRegistry.url},
+  });
+
+  /* Initial release */
+  const version = '1.0.0';
+  const verifyMock = await mockServer.mock(
+    `/repos/${owner}/${packageName}`,
+    {headers: [{name: 'Authorization', values: [`token ${env.GH_TOKEN}`]}]},
+    {body: {permissions: {push: true}}, method: 'GET'}
+  );
+  const getRefMock = await mockServer.mock(
+    `/repos/${owner}/${packageName}/git/refs/tags/v${version}`,
+    {},
+    {body: {}, statusCode: 404, method: 'GET'}
+  );
+  const createRefMock = await mockServer.mock(
+    `/repos/${owner}/${packageName}/git/refs`,
+    {
+      body: {ref: `refs/tags/v${version}`},
+      headers: [{name: 'Authorization', values: [`token ${env.GH_TOKEN}`]}],
+    },
+    {body: {ref: `refs/tags/${version}`}}
+  );
+  const createReleaseMock = await mockServer.mock(
+    `/repos/${owner}/${packageName}/releases`,
+    {
+      body: {tag_name: `v${version}`, target_commitish: 'master', name: `v${version}`},
+      headers: [{name: 'Authorization', values: [`token ${env.GH_TOKEN}`]}],
+    },
+    {body: {html_url: `release-url/${version}`}}
+  );
+
+  t.log('Commit a feature');
+  await gitCommits(['feat: Initial commit']);
+  t.log('$ semantic-release --no-ci');
+  const {stdout, code} = await execa(cli, ['--no-ci'], {env});
+  console.log(stdout);
+  t.regex(stdout, new RegExp(`Published GitHub release: release-url/${version}`));
+  t.regex(stdout, new RegExp(`Publishing version ${version} to npm registry`));
+  t.is(code, 0);
+
+  // Verify package.json and has been updated
+  t.is((await readJson('./package.json')).version, version);
+
+  // Retrieve the published package from the registry and check version and gitHead
+  const [, releasedVersion, releasedGitHead] = /^version = '(.+)'\s+gitHead = '(.+)'$/.exec(
+    (await execa('npm', ['show', packageName, 'version', 'gitHead'], {env: testEnv})).stdout
+  );
+  t.is(releasedVersion, version);
+  t.is(releasedGitHead, await gitHead());
+  t.log(`+ released ${releasedVersion} with gitHead ${releasedGitHead}`);
+
+  await mockServer.verify(verifyMock);
+  await mockServer.verify(getRefMock);
+  await mockServer.verify(createRefMock);
+  await mockServer.verify(createReleaseMock);
+});
+
 test.serial('Pass options via CLI arguments', async t => {
   const packageName = 'test-cli';
   const owner = 'test-repo';

test/plugins/pipeline.test.js

@@ -12,24 +12,50 @@ test('Execute each function in series passing the same input', async t => {
   t.true(step1.calledWith(0));
   t.true(step2.calledWith(0));
   t.true(step3.calledWith(0));
+
+  t.true(step1.calledBefore(step2));
+  t.true(step2.calledBefore(step3));
 });
 
 test('Execute each function in series passing a transformed input', async t => {
   const step1 = stub().resolves(1);
   const step2 = stub().resolves(2);
   const step3 = stub().resolves(3);
+  const step4 = stub().resolves(4);
 
-  const result = await pipeline([step1, step2, step3])(0, (prevResult, result) => prevResult + result);
+  const result = await pipeline([step1, step2, step3, step4])(0, false, (prevResult, result) => prevResult + result);
 
-  t.deepEqual(result, [1, 2, 3]);
+  t.deepEqual(result, [1, 2, 3, 4]);
+  t.true(step1.calledWith(0));
+  t.true(step2.calledWith(0 + 1));
+  t.true(step3.calledWith(0 + 1 + 2));
+  t.true(step4.calledWith(0 + 1 + 2 + 3));
+  t.true(step1.calledBefore(step2));
+  t.true(step2.calledBefore(step3));
+  t.true(step3.calledBefore(step4));
+});
+
+test('Execute each function in series passing the result of the previous one', async t => {
+  const step1 = stub().resolves(1);
+  const step2 = stub().resolves(2);
+  const step3 = stub().resolves(3);
+  const step4 = stub().resolves(4);
+
+  const result = await pipeline([step1, step2, step3, step4])(0, false, (prevResult, result) => result);
+
+  t.deepEqual(result, [1, 2, 3, 4]);
   t.true(step1.calledWith(0));
   t.true(step2.calledWith(1));
-  t.true(step3.calledWith(3));
+  t.true(step3.calledWith(2));
+  t.true(step4.calledWith(3));
+  t.true(step1.calledBefore(step2));
+  t.true(step2.calledBefore(step3));
+  t.true(step3.calledBefore(step4));
 });
 
 test('Stop execution and throw error is a step rejects', async t => {
   const step1 = stub().resolves(1);
-  const step2 = stub().throws(new Error('test error'));
+  const step2 = stub().rejects(new Error('test error'));
   const step3 = stub().resolves(3);
 
   const error = await t.throws(pipeline([step1, step2, step3])(0), Error);
@@ -38,3 +64,37 @@ test('Stop execution and throw error is a step rejects', async t => {
   t.true(step2.calledWith(0));
   t.true(step3.notCalled);
 });
+
+test('Execute all even if a Promise rejects', async t => {
+  const error1 = new Error('test error 1');
+  const error2 = new Error('test error 2');
+  const step1 = stub().resolves(1);
+  const step2 = stub().rejects(error1);
+  const step3 = stub().rejects(error2);
+
+  const errors = await t.throws(pipeline([step1, step2, step3])(0, true));
+
+  t.deepEqual(Array.from(errors), [error1, error2]);
+  t.true(step1.calledWith(0));
+  t.true(step2.calledWith(0));
+  t.true(step3.calledWith(0));
+});
+
+test('Execute each function in series passing a transformed input even if a Promise rejects', async t => {
+  const error2 = new Error('test error 2');
+  const error3 = new Error('test error 3');
+  const step1 = stub().resolves(1);
+  const step2 = stub().rejects(error2);
+  const step3 = stub().rejects(error3);
+  const step4 = stub().resolves(4);
+
+  const errors = await t.throws(
+    pipeline([step1, step2, step3, step4])(0, true, (prevResult, result) => prevResult + result)
+  );
+
+  t.deepEqual(Array.from(errors), [error2, error3]);
+  t.true(step1.calledWith(0));
+  t.true(step2.calledWith(0 + 1));
+  t.true(step3.calledWith(0 + 1 + error2));
+  t.true(step4.calledWith(0 + 1 + error2 + error3));
+});