fix: exclude empty env var value from replacement

Even the user set Git credentials via environment variable, use the configured URL (with authentication) if it works.
This allow users to push tags and commits via ssh while still using the GitHub/GitLab API.

cli.js

@@ -20,7 +20,7 @@ Usage:
     .option('r', {alias: 'repository-url', describe: 'Git repository URL', type: 'string', group: 'Options'})
     .option('t', {alias: 'tag-format', describe: 'Git tag format', type: 'string', group: 'Options'})
     .option('e', {alias: 'extends', describe: 'Shareable configurations', ...stringList, group: 'Options'})
-    .option('ci', {describe: 'Toggle CI verifications', default: true, type: 'boolean', group: 'Options'})
+    .option('ci', {describe: 'Toggle CI verifications', default: undefined, type: 'boolean', group: 'Options'})
     .option('verify-conditions', {...stringList, group: 'Plugins'})
     .option('analyze-commits', {type: 'string', group: 'Plugins'})
     .option('verify-release', {...stringList, group: 'Plugins'})
@@ -28,15 +28,17 @@ Usage:
     .option('publish', {...stringList, group: 'Plugins'})
     .option('success', {...stringList, group: 'Plugins'})
     .option('fail', {...stringList, group: 'Plugins'})
-    .option('debug', {describe: 'Output debugging information', default: false, type: 'boolean', group: 'Options'})
-    .option('d', {alias: 'dry-run', describe: 'Skip publishing', default: false, type: 'boolean', group: 'Options'})
-    .option('h', {alias: 'help', group: 'Options'})
-    .option('v', {alias: 'version', group: 'Options'})
+    .option('debug', {describe: 'Output debugging information', default: undefined, type: 'boolean', group: 'Options'})
+    .option('d', {alias: 'dry-run', describe: 'Skip publishing', default: undefined, type: 'boolean', group: 'Options'})
+    .option('h', {alias: 'help', default: undefined, group: 'Options'})
+    .option('v', {alias: 'version', default: undefined, group: 'Options'})
     .strict(false)
     .exitProcess(false);
 
   try {
-    const {help, version, ...opts} = cli.argv;
+    // Remove option with undefined values, as yargs sets non defined options as `undefined`
+    const {help, version, ...opts} = pickBy(cli.argv, value => !isUndefined(value));
+
     if (Boolean(help) || Boolean(version)) {
       process.exitCode = 0;
       return;
@@ -52,8 +54,7 @@ Usage:
       require('debug').enable('semantic-release:*');
     }
 
-    // Remove option with undefined values, as yargs sets non defined options as `undefined`
-    await require('.')(pickBy(opts, value => !isUndefined(value)));
+    await require('.')(opts);
     process.exitCode = 0;
   } catch (err) {
     if (err.name !== 'YError') {

index.js

@@ -29,10 +29,17 @@ async function run(options, plugins) {
     return;
   }
 
-  if (!await verify(options, branch, logger)) {
-    return;
+  if (branch !== options.branch) {
+    logger.log(
+      `This test run was triggered on the branch ${branch}, while semantic-release is configured to only publish from ${
+        options.branch
+      }, therefore a new version won’t be published.`
+    );
+    return false;
   }
 
+  await verify(options);
+
   logger.log('Run automated release from branch %s', options.branch);
 
   logger.log('Call plugin %s', 'verify-conditions');

lib/get-config.js

@@ -3,7 +3,7 @@ const readPkgUp = require('read-pkg-up');
 const cosmiconfig = require('cosmiconfig');
 const resolveFrom = require('resolve-from');
 const debug = require('debug')('semantic-release:config');
-const {repoUrl} = require('./git');
+const {repoUrl, verifyAuth} = require('./git');
 const PLUGINS_DEFINITIONS = require('./definitions/plugins');
 const plugins = require('./plugins');
 const getGitAuthUrl = require('./get-git-auth-url');
@@ -51,7 +51,9 @@ module.exports = async (opts, logger) => {
     ...pickBy(options, option => !isUndefined(option) && !isNull(option)),
   };
 
-  options.repositoryUrl = options.repositoryUrl ? getGitAuthUrl(options.repositoryUrl) : options.repositoryUrl;
+  if (!await verifyAuth(options.repositoryUrl, options.branch)) {
+    options.repositoryUrl = options.repositoryUrl ? getGitAuthUrl(options.repositoryUrl) : options.repositoryUrl;
+  }
 
   debug('options values: %O', options);
 

lib/hide-sensitive.js

@@ -1,6 +1,9 @@
 const {escapeRegExp} = require('lodash');
 
-const toReplace = Object.keys(process.env).filter(envVar => /token|password|credential|secret|private/i.test(envVar));
+const toReplace = Object.keys(process.env).filter(
+  envVar => /token|password|credential|secret|private/i.test(envVar) && process.env[envVar].trim()
+);
+
 const regexp = new RegExp(toReplace.map(envVar => escapeRegExp(process.env[envVar])).join('|'), 'g');
 
 module.exports = output => {

lib/verify.js

@@ -3,7 +3,7 @@ const AggregateError = require('aggregate-error');
 const {isGitRepo, verifyAuth, verifyTagName} = require('./git');
 const getError = require('./get-error');
 
-module.exports = async (options, branch, logger) => {
+module.exports = async options => {
   const errors = [];
 
   if (!await isGitRepo()) {
@@ -29,15 +29,4 @@ module.exports = async (options, branch, logger) => {
   if (errors.length > 0) {
     throw new AggregateError(errors);
   }
-
-  if (branch !== options.branch) {
-    logger.log(
-      `This test run was triggered on the branch ${branch}, while semantic-release is configured to only publish from ${
-        options.branch
-      }, therefore a new version won’t be published.`
-    );
-    return false;
-  }
-
-  return true;
 };

package.json

@@ -53,8 +53,6 @@
     "cz-conventional-changelog": "^2.0.0",
     "delay": "^2.0.0",
     "dockerode": "^2.5.2",
-    "eslint-config-prettier": "^2.5.0",
-    "eslint-plugin-prettier": "^2.3.0",
     "file-url": "^2.0.2",
     "fs-extra": "^5.0.0",
     "got": "^8.0.0",
@@ -63,11 +61,10 @@
     "nock": "^9.0.2",
     "nyc": "^11.2.1",
     "p-retry": "^1.0.0",
-    "prettier": "~1.10.0",
     "proxyquire": "^1.8.0",
     "sinon": "^4.0.0",
     "tempy": "^0.2.1",
-    "xo": "^0.18.2"
+    "xo": "^0.20.0"
   },
   "engines": {
     "node": ">=8.3"
@@ -107,10 +104,7 @@
     "all": true
   },
   "prettier": {
-    "printWidth": 120,
-    "singleQuote": true,
-    "bracketSpacing": false,
-    "trailingComma": "es5"
+    "printWidth": 120
   },
   "publishConfig": {
     "tag": "next"
@@ -131,14 +125,7 @@
     "test": "nyc ava -v"
   },
   "xo": {
-    "extends": [
-      "prettier"
-    ],
-    "plugins": [
-      "prettier"
-    ],
-    "rules": {
-      "prettier/prettier": 2
-    }
+    "prettier": true,
+    "space": true
   }
 }

test/cli.test.js

@@ -153,6 +153,22 @@ test.serial('Pass empty Array to semantic-release API for list option set to "fa
   t.is(process.exitCode, 0);
 });
 
+test.serial('Do not set properties in option for which arg is not in command line', async t => {
+  const run = stub().resolves(true);
+  const cli = proxyquire('../cli', {'.': run});
+
+  process.argv = ['', '', '-b', 'master'];
+
+  await cli();
+
+  t.false(Object.prototype.hasOwnProperty.call(run.args[0][0], 'ci'));
+  t.false(Object.prototype.hasOwnProperty.call(run.args[0][0], 'd'));
+  t.false(Object.prototype.hasOwnProperty.call(run.args[0][0], 'dry-run'));
+  t.false(Object.prototype.hasOwnProperty.call(run.args[0][0], 'debug'));
+  t.false(Object.prototype.hasOwnProperty.call(run.args[0][0], 'r'));
+  t.false(Object.prototype.hasOwnProperty.call(run.args[0][0], 't'));
+});
+
 test.serial('Set "noCi" options to "true" with "--no-ci"', async t => {
   const run = stub().resolves(true);
   const cli = proxyquire('../cli', {'.': run});

test/get-config.test.js

@@ -80,6 +80,19 @@ test.serial('Default values, reading repositoryUrl (http url) from package.json
   t.is(options.tagFormat, `v\${version}`);
 });
 
+test.serial('Do not add git credential to repositoryUrl if push is allowed', async t => {
+  process.env.GIT_CREDENTIALS = 'user:pass';
+  // Create a git repository, set the current working directory at the root of the repo
+  const repositoryUrl = await gitRepo(true);
+  const pkg = {repository: repositoryUrl};
+  // Create package.json in repository root
+  await outputJson('./package.json', pkg);
+
+  const {options} = await t.context.getConfig();
+
+  t.is(options.repositoryUrl, repositoryUrl);
+});
+
 test.serial('Read options from package.json', async t => {
   const release = {
     analyzeCommits: {path: 'analyzeCommits', param: 'analyzeCommits_param'},

test/hide-sensitive.test.js

@@ -40,3 +40,18 @@ test.serial('Accept "undefined" input', t => {
 test.serial('Return same string if no environment variable has to be replaced', t => {
   t.is(require('../lib/hide-sensitive')('test'), 'test');
 });
+
+test.serial('Exclude empty environment variables from the regexp', t => {
+  process.env.SOME_PASSWORD = 'password';
+  process.env.SOME_TOKEN = '';
+  t.is(
+    require('../lib/hide-sensitive')(`https://user:${process.env.SOME_PASSWORD}@host.com?token=`),
+    'https://user:[secure]@host.com?token='
+  );
+});
+
+test.serial('Exclude empty environment variables from the regexp if there is only empty ones', t => {
+  process.env.SOME_PASSWORD = '';
+  process.env.SOME_TOKEN = ' \n ';
+  t.is(require('../lib/hide-sensitive')(`https://host.com?token=`), 'https://host.com?token=');
+});

test/index.test.js

@@ -302,9 +302,9 @@ test.serial('Log all "verifyConditions" errors', async t => {
     './lib/logger': t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  const errors = await t.throws(semanticRelease(options));
+  const errors = [...(await t.throws(semanticRelease(options)))];
 
-  t.deepEqual(Array.from(errors), [error1, error2, error3]);
+  t.deepEqual(errors, [error1, error2, error3]);
   t.deepEqual(t.context.log.args[t.context.log.args.length - 2], ['%s error 2', 'ERR2']);
   t.deepEqual(t.context.log.args[t.context.log.args.length - 1], ['%s error 3', 'ERR3']);
   t.deepEqual(t.context.error.args[t.context.error.args.length - 1], [
@@ -345,9 +345,9 @@ test.serial('Log all "verifyRelease" errors', async t => {
     './lib/logger': t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  const errors = await t.throws(semanticRelease(options));
+  const errors = [...(await t.throws(semanticRelease(options)))];
 
-  t.deepEqual(Array.from(errors), [error1, error2]);
+  t.deepEqual(errors, [error1, error2]);
   t.deepEqual(t.context.log.args[t.context.log.args.length - 2], ['%s error 1', 'ERR1']);
   t.deepEqual(t.context.log.args[t.context.log.args.length - 1], ['%s error 2', 'ERR2']);
   t.is(fail.callCount, 1);
@@ -428,9 +428,9 @@ test.serial('Dry-run skips fail', async t => {
     './lib/logger': t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  const errors = await t.throws(semanticRelease(options));
+  const errors = [...(await t.throws(semanticRelease(options)))];
 
-  t.deepEqual(Array.from(errors), [error1, error2]);
+  t.deepEqual(errors, [error1, error2]);
   t.deepEqual(t.context.log.args[t.context.log.args.length - 2], ['%s error 1', 'ERR1']);
   t.deepEqual(t.context.log.args[t.context.log.args.length - 1], ['%s error 2', 'ERR2']);
   t.is(fail.callCount, 0);
@@ -785,7 +785,7 @@ test.serial('Throw SemanticReleaseError if repositoryUrl is not set and cannot b
     './lib/logger': t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  const errors = Array.from(await t.throws(semanticRelease()));
+  const errors = [...(await t.throws(semanticRelease()))];
 
   // Verify error code and type
   t.is(errors[0].code, 'ENOREPOURL');

test/integration.test.js

@@ -603,11 +603,11 @@ test.serial('Exit with 1 if missing permission to push to the remote repository'
 
   // Create a git repository, set the current working directory at the root of the repo
   t.log('Create git repository');
-  const {repositoryUrl} = await gitbox.createRepo(packageName);
+  await gitbox.createRepo(packageName);
   await writeJson('./package.json', {
     name: packageName,
     version: '0.0.0-dev',
-    repository: {url: repositoryUrl},
+    repository: {url: 'http://user:wrong_pass@localhost:2080/git/unauthorized.git'},
   });
 
   /* Initial release */

test/plugins/pipeline.test.js

@@ -118,7 +118,7 @@ test('Throw all errors from the first step throwing an AggregateError', async t
 
   const errors = await t.throws(pipeline([step1, step2, step3])(0));
 
-  t.deepEqual(Array.from(errors), [error1, error2]);
+  t.deepEqual([...errors], [error1, error2]);
   t.true(step1.calledWith(0));
   t.true(step2.calledWith(0));
   t.true(step3.notCalled);
@@ -133,7 +133,7 @@ test('Execute all even if a Promise rejects', async t => {
 
   const errors = await t.throws(pipeline([step1, step2, step3])(0, {settleAll: true}));
 
-  t.deepEqual(Array.from(errors), [error1, error2]);
+  t.deepEqual([...errors], [error1, error2]);
   t.true(step1.calledWith(0));
   t.true(step2.calledWith(0));
   t.true(step3.calledWith(0));
@@ -149,7 +149,7 @@ test('Throw all errors from all steps throwing an AggregateError', async t => {
 
   const errors = await t.throws(pipeline([step1, step2])(0, {settleAll: true}));
 
-  t.deepEqual(Array.from(errors), [error1, error2, error3, error4]);
+  t.deepEqual([...errors], [error1, error2, error3, error4]);
   t.true(step1.calledWith(0));
   t.true(step2.calledWith(0));
 });
@@ -165,7 +165,7 @@ test('Execute each function in series passing a transformed input even if a step
 
   const errors = await t.throws(pipeline([step1, step2, step3, step4])(0, {settleAll: true, getNextInput}));
 
-  t.deepEqual(Array.from(errors), [error2, error3]);
+  t.deepEqual([...errors], [error2, error3]);
   t.true(step1.calledWith(0));
   t.true(step2.calledWith(0 + 1));
   t.true(step3.calledWith(0 + 1 + error2));

test/plugins/plugins.test.js

@@ -136,16 +136,16 @@ test('Merge global options with plugin options', async t => {
 });
 
 test('Throw an error if plugins configuration are missing a path for plugin pipeline', t => {
-  const errors = Array.from(t.throws(() => getPlugins({verifyConditions: {}}, {}, t.context.logger)));
+  const errors = [...t.throws(() => getPlugins({verifyConditions: {}}, {}, t.context.logger))];
 
   t.is(errors[0].name, 'SemanticReleaseError');
   t.is(errors[0].code, 'EPLUGINCONF');
 });
 
 test('Throw an error if an array of plugin configuration is missing a path for plugin pipeline', t => {
-  const errors = Array.from(
-    t.throws(() => getPlugins({verifyConditions: [{path: '@semantic-release/npm'}, {}]}, {}, t.context.logger))
-  );
+  const errors = [
+    ...t.throws(() => getPlugins({verifyConditions: [{path: '@semantic-release/npm'}, {}]}, {}, t.context.logger)),
+  ];
 
   t.is(errors[0].name, 'SemanticReleaseError');
   t.is(errors[0].code, 'EPLUGINCONF');

test/verify.test.js

@@ -1,5 +1,4 @@
 import test from 'ava';
-import {stub} from 'sinon';
 import tempy from 'tempy';
 import verify from '../lib/verify';
 import {gitRepo} from './helpers/git-utils';
@@ -9,17 +8,13 @@ const envBackup = Object.assign({}, process.env);
 // Save the current working diretory
 const cwd = process.cwd();
 
-test.beforeEach(t => {
+test.beforeEach(() => {
   // Delete environment variables that could have been set on the machine running the tests
   delete process.env.GIT_CREDENTIALS;
   delete process.env.GH_TOKEN;
   delete process.env.GITHUB_TOKEN;
   delete process.env.GL_TOKEN;
   delete process.env.GITLAB_TOKEN;
-  // Stub the logger functions
-  t.context.log = stub();
-  t.context.error = stub();
-  t.context.logger = {log: t.context.log, error: t.context.error};
 });
 
 test.afterEach.always(() => {
@@ -32,7 +27,7 @@ test.afterEach.always(() => {
 test.serial('Throw a AggregateError', async t => {
   await gitRepo();
 
-  const errors = Array.from(await t.throws(verify({}, 'master', t.context.logger)));
+  const errors = [...(await t.throws(verify({})))];
 
   t.is(errors[0].name, 'SemanticReleaseError');
   t.is(errors[0].code, 'ENOREPOURL');
@@ -46,7 +41,7 @@ test.serial('Throw a SemanticReleaseError if does not run on a git repository',
   const dir = tempy.directory();
   process.chdir(dir);
 
-  const errors = Array.from(await t.throws(verify({}, 'master', t.context.logger)));
+  const errors = [...(await t.throws(verify({})))];
 
   t.is(errors[0].name, 'SemanticReleaseError');
   t.is(errors[0].code, 'ENOGITREPO');
@@ -56,7 +51,7 @@ test.serial('Throw a SemanticReleaseError if the "tagFormat" is not valid', asyn
   const repositoryUrl = await gitRepo(true);
   const options = {repositoryUrl, tagFormat: `?\${version}`};
 
-  const errors = Array.from(await t.throws(verify(options, 'master', t.context.logger)));
+  const errors = [...(await t.throws(verify(options, 'master', t.context.logger)))];
 
   t.is(errors[0].name, 'SemanticReleaseError');
   t.is(errors[0].code, 'EINVALIDTAGFORMAT');
@@ -66,7 +61,7 @@ test.serial('Throw a SemanticReleaseError if the "tagFormat" does not contains t
   const repositoryUrl = await gitRepo(true);
   const options = {repositoryUrl, tagFormat: 'test'};
 
-  const errors = Array.from(await t.throws(verify(options, 'master', t.context.logger)));
+  const errors = [...(await t.throws(verify(options, 'master', t.context.logger)))];
 
   t.is(errors[0].name, 'SemanticReleaseError');
   t.is(errors[0].code, 'ETAGNOVERSION');
@@ -76,22 +71,15 @@ test.serial('Throw a SemanticReleaseError if the "tagFormat" contains multiple "
   const repositoryUrl = await gitRepo(true);
   const options = {repositoryUrl, tagFormat: `\${version}v\${version}`};
 
-  const errors = Array.from(await t.throws(verify(options, 'master', t.context.logger)));
+  const errors = [...(await t.throws(verify(options)))];
 
   t.is(errors[0].name, 'SemanticReleaseError');
   t.is(errors[0].code, 'ETAGNOVERSION');
 });
 
-test.serial('Return "false" if the current branch is not the once configured', async t => {
-  const repositoryUrl = await gitRepo(true);
-  const options = {repositoryUrl, tagFormat: `v\${version}`, branch: 'master'};
-
-  t.false(await verify(options, 'other', t.context.logger));
-});
-
 test.serial('Return "true" if all verification pass', async t => {
   const repositoryUrl = await gitRepo(true);
   const options = {repositoryUrl, tagFormat: `v\${version}`, branch: 'master'};
 
-  t.true(await verify(options, 'master', t.context.logger));
+  await t.notThrows(verify(options));
 });