feat: log git error message when authentication verification fails

.github/ISSUE_TEMPLATE.md

@@ -1,48 +0,0 @@
-<!--
-Please fill the informations requested or use one of the following url:
-  - Bug report: https://github.com/semantic-release/semantic-release/issues/new?template=bug-report.md
-  - Feature request: https://github.com/semantic-release/semantic-release/issues/new?template=feature-request.md
-  - New plugin request: https://github.com/semantic-release/semantic-release/issues/new?template=plugin-request.md
--->
-
-<!--------------------- FOR BUG REPORT ONLY --------------------->
-
-## Current behavior
-
-<!-- Describe how the issue manifests. -->
-
-## Expected behavior
-
-<!-- Describe what the desired behavior would be. -->
-
-## Environment
-
-- **semantic-release** version: <!-- Version set in package.json devDpendencies -->
-- CI environment: <!-- CI service name -->
-- Plugins used: <!-- List semantic-release plugin used if any -->
-- **semantic-release** configuration: <!-- link to your repository or relevant part of the semantic-release config -->
-- CI logs: <!-- link to your CI logs or semantic-release logs -->
-
-<!--------------------- FOR FEATURE REQUEST ONLY --------------------->
-
-## New feature motivation
-
-<!-- Describe the context, the use-case and the advantages of the feature request. -->
-
-## New feature description
-
-<!-- Describe the functional changes that would have to be made in semantic-release or its plugins. -->
-
-## New feature implementation
-
-<!-- Optionally describe the technical changes to be made in semantic-release or its plugins. -->
-
-<!--------------------- FOR NEW PLUGIN REQUEST ONLY --------------------->
-
-## New plugin motivation
-
-<!-- Describe the reasons to create a new plugin and why it's not covered by the existing ones. -->
-
-## Third-party documentation
-
-<!-- Provide explanation and documentation links for the platform to integrate with. -->

.github/ISSUE_TEMPLATE/01_bug_report.md

@@ -1,17 +1,21 @@
-# Bug report
-
-## Current behavior
-
-<!-- Describe how the issue manifests. -->
-
-## Expected behavior
-
-<!-- Describe what the desired behavior would be. -->
-
-## Environment
-
-- **semantic-release** version: <!-- Version set in package.json devDpendencies -->
-- CI environment: <!-- CI service name -->
-- Plugins used: <!-- List semantic-release plugin used if any -->
-- **semantic-release** configuration: <!-- link to your repository or relevant part of the semantic-release config -->
-- CI logs: <!-- link to your CI logs or semantic-release logs -->
+---
+name: Bug report
+about: Something not working as expected
+
+---
+
+## Current behavior
+
+<!-- Describe how the issue manifests. -->
+
+## Expected behavior
+
+<!-- Describe what the desired behavior would be. -->
+
+## Environment
+
+- **semantic-release** version: <!-- Version set in package.json devDpendencies -->
+- CI environment: <!-- CI service name -->
+- Plugins used: <!-- List semantic-release plugin used if any -->
+- **semantic-release** configuration: <!-- link to your repository or relevant part of the semantic-release config -->
+- CI logs: <!-- link to your CI logs or semantic-release logs -->

.github/ISSUE_TEMPLATE/02_feature_request.md

@@ -1,13 +1,17 @@
-# Feature request
-
-## New feature motivation
-
-<!-- Describe the context, the use-case and the advantages of the feature request. -->
-
-## New feature description
-
-<!-- Describe the functional changes that would have to be made in semantic-release or its plugins. -->
-
-## New feature implementation
-
-<!-- Optionally describe the technical changes to be made in semantic-release or its plugins. -->
+---
+name: Feature request
+about: Wouldn’t it be nice if semantic-release could ...
+
+---
+
+## New feature motivation
+
+<!-- Describe the context, the use-case and the advantages of the feature request. -->
+
+## New feature description
+
+<!-- Describe the functional changes that would have to be made in semantic-release or its plugins. -->
+
+## New feature implementation
+
+<!-- Optionally describe the technical changes to be made in semantic-release or its plugins. -->

.github/ISSUE_TEMPLATE/03_plugin_suggestion.md

@@ -1,9 +1,13 @@
-# New plugin request
-
-## New plugin motivation
-
-<!-- Describe the reasons to create a new plugin and why it's not covered by the existing ones. -->
-
-## Third-party documentation
-
-<!-- Provide explanation and documentation links for the platform to integrate with. -->
+---
+name: New plugin suggestion
+about: Integrate with a new platform, etc
+
+---
+
+## New plugin motivation
+
+<!-- Describe the reasons to create a new plugin and why it's not covered by the existing ones. -->
+
+## Third-party documentation
+
+<!-- Provide explanation and documentation links for the platform to integrate with. -->

docs/usage/ci-configuration.md

@@ -10,13 +10,14 @@ See [CI configuration recipes](../recipes/README.md#ci-configurations) for more
 
 **semantic-release** requires push access to the project Git repository in order to create [Git tags](https://git-scm.com/book/en/v2/Git-Basics-Tagging). The Git authentication can be set with one of the following environment variables:
 
-| Variable                     | Description                                                                                                                   |
-|------------------------------|-------------------------------------------------------------------------------------------------------------------------------|
-| `GH_TOKEN` or `GITHUB_TOKEN` | A GitHub [personal access token](https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line).     |
-| `GL_TOKEN` or `GITLAB_TOKEN` | A GitLab [personal access token](https://docs.gitlab.com/ce/user/profile/personal_access_tokens.html).                        |
-| `GIT_CREDENTIALS`            | [URL encoded basic HTTP Authentication](https://en.wikipedia.org/wiki/Basic_access_authentication#URL_encoding) credentials). |
+| Variable                        | Description                                                                                                                   |
+|---------------------------------|-------------------------------------------------------------------------------------------------------------------------------|
+| `GH_TOKEN` or `GITHUB_TOKEN`    | A GitHub [personal access token](https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line).     |
+| `GL_TOKEN` or `GITLAB_TOKEN`    | A GitLab [personal access token](https://docs.gitlab.com/ce/user/profile/personal_access_tokens.html).                        |
+| `BB_TOKEN` or `BITBUCKET_TOKEN` | A Bitbucket [personal access token](https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html).  |
+| `GIT_CREDENTIALS`               | [URL encoded basic HTTP Authentication](https://en.wikipedia.org/wiki/Basic_access_authentication#URL_encoding) credentials). |
 
-`GIT_CREDENTIALS` can be the Git username and password in the format `<username>:<password>` or a token for certain Git providers like [Bitbucket](https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html).
+`GIT_CREDENTIALS` must be the Git username and password in the format `<username>:<password>`.
 
 Alternatively the Git authentication can be set up via [SSH keys](../recipes/git-auth-ssh-keys.md).
 

index.js

@@ -13,7 +13,7 @@ const getLastRelease = require('./lib/get-last-release');
 const {extractErrors} = require('./lib/utils');
 const getGitAuthUrl = require('./lib/get-git-auth-url');
 const logger = require('./lib/logger');
-const {unshallow, verifyAuth, gitHead: getGitHead, tag, push} = require('./lib/git');
+const {unshallow, verifyAuth, isBranchUpToDate, gitHead: getGitHead, tag, push} = require('./lib/git');
 const getError = require('./lib/get-error');
 
 marked.setOptions({renderer: new TerminalRenderer()});
@@ -47,7 +47,19 @@ async function run(options, plugins) {
   await verify(options);
 
   options.repositoryUrl = await getGitAuthUrl(options);
-  if (!await verifyAuth(options.repositoryUrl, options.branch)) {
+
+  if (!await isBranchUpToDate(options.branch)) {
+    logger.log(
+      "The local branch %s is behind the remote one, therefore a new version won't be published.",
+      options.branch
+    );
+    return false;
+  }
+
+  try {
+    await verifyAuth(options.repositoryUrl, options.branch);
+  } catch (err) {
+    logger.error(`The command "${err.cmd}" failed with the error message %s.`, err.stderr);
     throw getError('EGITNOPERMISSION', {options});
   }
 

lib/get-git-auth-url.js

@@ -4,7 +4,15 @@ const gitUrlParse = require('git-url-parse');
 const hostedGitInfo = require('hosted-git-info');
 const {verifyAuth} = require('./git');
 
-const GIT_TOKENS = ['GIT_CREDENTIALS', 'GH_TOKEN', 'GITHUB_TOKEN', 'GL_TOKEN', 'GITLAB_TOKEN'];
+const GIT_TOKENS = {
+  GIT_CREDENTIALS: undefined,
+  GH_TOKEN: undefined,
+  GITHUB_TOKEN: undefined,
+  GL_TOKEN: 'gitlab-ci-token:',
+  GITLAB_TOKEN: 'gitlab-ci-token:',
+  BB_TOKEN: 'x-token-auth:',
+  BITBUCKET_TOKEN: 'x-token-auth:',
+};
 
 /**
  * Determine the the git repository URL to use to push, either:
@@ -35,16 +43,17 @@ module.exports = async ({repositoryUrl, branch}) => {
   }
 
   // Test if push is allowed without transforming the URL (e.g. is ssh keys are set up)
-  if (!await verifyAuth(repositoryUrl, branch)) {
-    const envVar = GIT_TOKENS.find(envVar => !isUndefined(process.env[envVar]));
-    const gitCredentials = ['GL_TOKEN', 'GITLAB_TOKEN'].includes(envVar)
-      ? `gitlab-ci-token:${process.env[envVar]}`
-      : process.env[envVar];
+  try {
+    await verifyAuth(repositoryUrl, branch);
+  } catch (err) {
+    const envVar = Object.keys(GIT_TOKENS).find(envVar => !isUndefined(process.env[envVar]));
+    const gitCredentials = `${GIT_TOKENS[envVar] || ''}${process.env[envVar] || ''}`;
     const {protocols, ...parsed} = gitUrlParse(repositoryUrl);
     const protocol = protocols.includes('https') ? 'https' : protocols.includes('http') ? 'http' : 'https';
 
     // If credentials are set via anvironment variables, convert the URL to http/https and add basic auth, otherwise return `repositoryUrl` as is
-    return gitCredentials ? {...parsed, ...{token: gitCredentials}}.toString(protocol) : repositoryUrl;
+    return gitCredentials ? {...parsed, protocols: [protocol], user: gitCredentials}.toString(protocol) : repositoryUrl;
   }
+
   return repositoryUrl;
 };

lib/git.js

@@ -45,7 +45,7 @@ async function isRefInHistory(ref) {
 /**
  * Unshallow the git repository (retriving every commits and tags).
  *
- * @param {String} repositoryUrl The remote repository URL with credentials.
+ * @param {String} repositoryUrl The remote repository URL.
  */
 async function unshallow(repositoryUrl) {
   await execa('git', ['fetch', '--unshallow', '--tags', repositoryUrl], {reject: false});
@@ -83,16 +83,17 @@ async function isGitRepo() {
 /**
  * Verify the write access authorization to remote repository with push dry-run.
  *
- * @param {String} origin The remote repository URL.
+ * @param {String} repositoryUrl The remote repository URL.
  * @param {String} branch The repositoru branch for which to verify write access.
  *
- * @return {Boolean} `true` is authorized to push, falsy otherwise.
+ * @throws {Error} if not authorized to push.
  */
-async function verifyAuth(origin, branch) {
+async function verifyAuth(repositoryUrl, branch) {
   try {
-    return (await execa('git', ['push', '--dry-run', origin, `HEAD:${branch}`])).code === 0;
+    await execa('git', ['push', '--dry-run', repositoryUrl, `HEAD:${branch}`]);
   } catch (err) {
     debug(err);
+    throw err;
   }
 }
 
@@ -109,12 +110,12 @@ async function tag(tagName) {
 /**
  * Push to the remote repository.
  *
- * @param {String} origin The remote repository URL.
+ * @param {String} repositoryUrl The remote repository URL.
  * @param {String} branch The branch to push.
  * @throws {Error} if the push failed.
  */
-async function push(origin, branch) {
-  await execa('git', ['push', '--tags', origin, `HEAD:${branch}`]);
+async function push(repositoryUrl, branch) {
+  await execa('git', ['push', '--tags', repositoryUrl, `HEAD:${branch}`]);
 }
 
 /**
@@ -131,6 +132,17 @@ async function verifyTagName(tagName) {
   }
 }
 
+/**
+ * Verify the local branch is up to date with the remote one.
+ *
+ * @param {String} branch The repository branch for which to verify status.
+ *
+ * @return {Boolean} `true` is the HEAD of the current local branch is the same as the HEAD of the remote branch, `false` otherwise.
+ */
+async function isBranchUpToDate(branch) {
+  return isRefInHistory(await execa.stdout('git', ['rev-parse', `${branch}@{u}`]));
+}
+
 module.exports = {
   gitTagHead,
   gitTags,
@@ -143,4 +155,5 @@ module.exports = {
   tag,
   push,
   verifyTagName,
+  isBranchUpToDate,
 };

package.json

@@ -54,7 +54,7 @@
     "delay": "^2.0.0",
     "dockerode": "^2.5.2",
     "file-url": "^2.0.2",
-    "fs-extra": "^5.0.0",
+    "fs-extra": "^6.0.0",
     "got": "^8.0.0",
     "js-yaml": "^3.10.0",
     "mockserver-client": "^5.1.1",

test/get-git-auth-url.test.js

@@ -13,6 +13,10 @@ test.beforeEach(() => {
   delete process.env.GITHUB_TOKEN;
   delete process.env.GL_TOKEN;
   delete process.env.GITLAB_TOKEN;
+  delete process.env.BB_TOKEN;
+  delete process.env.BITBUCKET_TOKEN;
+  process.env.GIT_ASKPASS = 'echo';
+  process.env.GIT_TERMINAL_PROMPT = 0;
 });
 
 test.afterEach.always(() => {
@@ -150,6 +154,22 @@ test.serial('Return the "https" formatted URL if "gitCredentials" is defined wit
   );
 });
 
+test.serial('Return the "https" formatted URL if "gitCredentials" is defined with "BB_TOKEN"', async t => {
+  process.env.BB_TOKEN = 'token';
+  t.is(
+    await getAuthUrl({repositoryUrl: 'git@host.null:owner/repo.git'}),
+    'https://x-token-auth:token@host.null/owner/repo.git'
+  );
+});
+
+test.serial('Return the "https" formatted URL if "gitCredentials" is defined with "BITBUCKET_TOKEN"', async t => {
+  process.env.BITBUCKET_TOKEN = 'token';
+  t.is(
+    await getAuthUrl({repositoryUrl: 'git@host.null:owner/repo.git'}),
+    'https://x-token-auth:token@host.null/owner/repo.git'
+  );
+});
+
 test.serial('Handle "https" URL with group and subgroup, with "GIT_CREDENTIALS"', async t => {
   process.env.GIT_CREDENTIALS = 'user:pass';
   t.is(

test/git.test.js

@@ -11,6 +11,7 @@ import {
   gitTags,
   isGitRepo,
   verifyTagName,
+  isBranchUpToDate,
 } from '../lib/git';
 import {
   gitRepo,
@@ -22,6 +23,8 @@ import {
   gitAddConfig,
   gitCommitTag,
   gitRemoteTagHead,
+  push as pushUtil,
+  reset,
 } from './helpers/git-utils';
 
 // Save the current working diretory
@@ -183,3 +186,33 @@ test.serial('Throws error if obtaining the tags fails', async t => {
 
   await t.throws(gitTags());
 });
+
+test.serial('Return "true" if repository is up to date', async t => {
+  await gitRepo(true);
+  await gitCommits(['First']);
+  await pushUtil();
+
+  t.true(await isBranchUpToDate('master'));
+});
+
+test.serial('Return falsy if repository is not up to date', async t => {
+  await gitRepo(true);
+  await gitCommits(['First']);
+  await gitCommits(['Second']);
+  await pushUtil();
+
+  t.true(await isBranchUpToDate('master'));
+
+  await reset();
+
+  t.falsy(await isBranchUpToDate('master'));
+});
+
+test.serial('Return "true" if local repository is ahead', async t => {
+  await gitRepo(true);
+  await gitCommits(['First']);
+  await pushUtil();
+  await gitCommits(['Second']);
+
+  t.true(await isBranchUpToDate('master'));
+});

test/helpers/git-utils.js

@@ -46,16 +46,16 @@ export async function gitRepo(withRemote, branch = 'master') {
  * - Create an initial commits
  * - Push to origin
  *
- * @param {String} origin The URL of the bare repository.
+ * @param {String} repositoryUrl The URL of the bare repository.
  * @param {String} [branch='master'] the branch to initialize.
  */
-export async function initBareRepo(origin, branch = 'master') {
+export async function initBareRepo(repositoryUrl, branch = 'master') {
   const clone = tempy.directory();
-  await execa('git', ['clone', '--no-hardlinks', origin, clone]);
+  await execa('git', ['clone', '--no-hardlinks', repositoryUrl, clone]);
   process.chdir(clone);
   await gitCheckout(branch);
   await gitCommits(['Initial commit']);
-  await execa('git', ['push', origin, branch]);
+  await execa('git', ['push', repositoryUrl, branch]);
 }
 
 /**
@@ -98,7 +98,7 @@ export async function gitGetCommits(from) {
  * Checkout a branch on the current git repository.
  *
  * @param {String} branch Branch name.
- * @param {boolean} create `true` to create the branche ans switch, `false` to only switch.
+ * @param {Boolean} create `true` to create the branche ans switch, `false` to only switch.
  */
 export async function gitCheckout(branch, create = true) {
   await execa('git', create ? ['checkout', '-b', branch] : ['checkout', branch]);
@@ -121,39 +121,36 @@ export async function gitTagVersion(tagName, sha) {
   await execa('git', sha ? ['tag', '-f', tagName, sha] : ['tag', tagName]);
 }
 
-export async function gitRemoteTagVersion(origin, tagName, sha = 'HEAD') {
-  await execa('git', ['push', origin, `${sha}:refs/tags/${tagName}`]);
-}
-
 /**
  * Create a shallow clone of a git repository and change the current working directory to the cloned repository root.
  * The shallow will contain a limited number of commit and no tags.
  *
- * @param {String} origin The path of the repository to clone.
+ * @param {String} repositoryUrl The path of the repository to clone.
+ * @param {String} [branch='master'] the branch to clone.
  * @param {Number} [depth=1] The number of commit to clone.
  * @return {String} The path of the cloned repository.
  */
-export async function gitShallowClone(origin, branch = 'master', depth = 1) {
+export async function gitShallowClone(repositoryUrl, branch = 'master', depth = 1) {
   const dir = tempy.directory();
 
   process.chdir(dir);
-  await execa('git', ['clone', '--no-hardlinks', '--no-tags', '-b', branch, '--depth', depth, origin, dir]);
+  await execa('git', ['clone', '--no-hardlinks', '--no-tags', '-b', branch, '--depth', depth, repositoryUrl, dir]);
   return dir;
 }
 
 /**
  * Create a git repo with a detached head from another git repository and change the current working directory to the new repository root.
  *
- * @param {String} origin The path of the repository to clone.
- * @param {Number} head A commit sha of the origin repo that will become the detached head of the new one.
+ * @param {String} repositoryUrl The path of the repository to clone.
+ * @param {Number} head A commit sha of the remote repo that will become the detached head of the new one.
  * @return {String} The path of the new repository.
  */
-export async function gitDetachedHead(origin, head) {
+export async function gitDetachedHead(repositoryUrl, head) {
   const dir = tempy.directory();
 
   process.chdir(dir);
   await execa('git', ['init']);
-  await execa('git', ['remote', 'add', 'origin', origin]);
+  await execa('git', ['remote', 'add', 'origin', repositoryUrl]);
   await execa('git', ['fetch']);
   await execa('git', ['checkout', head]);
   return dir;
@@ -183,12 +180,12 @@ export async function gitTagHead(tagName) {
 /**
  * Get the first commit sha referenced by the tag `tagName` in the remote repository.
  *
- * @param {String} origin The repository remote URL.
+ * @param {String} repositoryUrl The repository remote URL.
  * @param {String} tagName The tag name to seach for.
  * @return {String} The sha of the commit associated with `tagName` on the remote repository.
  */
-export async function gitRemoteTagHead(origin, tagName) {
-  return (await execa.stdout('git', ['ls-remote', '--tags', origin, tagName]))
+export async function gitRemoteTagHead(repositoryUrl, tagName) {
+  return (await execa.stdout('git', ['ls-remote', '--tags', repositoryUrl, tagName]))
     .split('\n')
     .filter(tag => Boolean(tag))
     .map(tag => tag.match(/^(\S+)/)[1])[0];
@@ -208,10 +205,19 @@ export async function gitCommitTag(gitHead) {
 /**
  * Push to the remote repository.
  *
- * @param {String} origin The remote repository URL.
+ * @param {String} repositoryUrl The remote repository URL.
  * @param {String} branch The branch to push.
  * @throws {Error} if the push failed.
  */
-export async function push(origin, branch) {
-  await execa('git', ['push', '--tags', origin, `HEAD:${branch}`]);
+export async function push(repositoryUrl = 'origin', branch = 'master') {
+  await execa('git', ['push', '--tags', repositoryUrl, `HEAD:${branch}`]);
+}
+
+/**
+ * Reset repository to a commit.
+ *
+ * @param {String} [commit='HEAD~1'] Commit reference to reset the repo to.
+ */
+export async function reset(commit = 'HEAD~1') {
+  await execa('git', ['reset', commit]);
 }

test/index.test.js

@@ -14,6 +14,7 @@ import {
   gitRemoteTagHead,
   push,
   gitShallowClone,
+  reset,
 } from './helpers/git-utils';
 
 // Save the current process.env
@@ -57,6 +58,7 @@ test.serial('Plugins are called with expected values', async t => {
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   commits = (await gitCommits(['Second'])).concat(commits);
+  await push();
 
   const lastRelease = {version: '1.0.0', gitHead: commits[commits.length - 1].hash, gitTag: 'v1.0.0'};
   const nextRelease = {type: 'major', version: '2.0.0', gitHead: await getGitHead(), gitTag: 'v2.0.0'};
@@ -162,6 +164,7 @@ test.serial('Use custom tag format', async t => {
   await gitCommits(['First']);
   await gitTagVersion('test-1.0.0');
   await gitCommits(['Second']);
+  await push();
 
   const nextRelease = {type: 'major', version: '2.0.0', gitHead: await getGitHead(), gitTag: 'test-2.0.0'};
   const notes = 'Release notes';
@@ -198,6 +201,7 @@ test.serial('Use new gitHead, and recreate release notes if a prepare plugin cre
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   commits = (await gitCommits(['Second'])).concat(commits);
+  await push();
 
   const nextRelease = {type: 'major', version: '2.0.0', gitHead: await getGitHead(), gitTag: 'v2.0.0'};
   const notes = 'Release notes';
@@ -257,6 +261,7 @@ test.serial('Call all "success" plugins even if one errors out', async t => {
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   await gitCommits(['Second']);
+  await push();
 
   const nextRelease = {type: 'major', version: '2.0.0', gitHead: await getGitHead(), gitTag: 'v2.0.0'};
   const notes = 'Release notes';
@@ -304,6 +309,7 @@ test.serial('Log all "verifyConditions" errors', async t => {
   const repositoryUrl = await gitRepo(true);
   // Add commits to the master branch
   await gitCommits(['First']);
+  await push();
 
   const error1 = new Error('error 1');
   const error2 = new SemanticReleaseError('error 2', 'ERR2');
@@ -346,6 +352,7 @@ test.serial('Log all "verifyRelease" errors', async t => {
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   await gitCommits(['Second']);
+  await push();
 
   const error1 = new SemanticReleaseError('error 1', 'ERR1');
   const error2 = new SemanticReleaseError('error 2', 'ERR2');
@@ -382,6 +389,7 @@ test.serial('Dry-run skips publish and success', async t => {
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   await gitCommits(['Second']);
+  await push();
 
   const nextRelease = {type: 'major', version: '2.0.0', gitHead: await getGitHead(), gitTag: 'v2.0.0'};
   const notes = 'Release notes';
@@ -430,6 +438,7 @@ test.serial('Dry-run skips fail', async t => {
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   await gitCommits(['Second']);
+  await push();
 
   const error1 = new SemanticReleaseError('error 1', 'ERR1');
   const error2 = new SemanticReleaseError('error 2', 'ERR2');
@@ -464,6 +473,7 @@ test.serial('Force a dry-run if not on a CI and "noCi" is not explicitly set', a
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   await gitCommits(['Second']);
+  await push();
 
   const nextRelease = {type: 'major', version: '2.0.0', gitHead: await getGitHead(), gitTag: 'v2.0.0'};
   const notes = 'Release notes';
@@ -513,6 +523,7 @@ test.serial('Allow local releases with "noCi" option', async t => {
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   await gitCommits(['Second']);
+  await push();
 
   const nextRelease = {type: 'major', version: '2.0.0', gitHead: await getGitHead(), gitTag: 'v2.0.0'};
   const notes = 'Release notes';
@@ -566,6 +577,7 @@ test.serial('Accept "undefined" value returned by the "generateNotes" plugins',
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   commits = (await gitCommits(['Second'])).concat(commits);
+  await push();
 
   const lastRelease = {version: '1.0.0', gitHead: commits[commits.length - 1].hash, gitTag: 'v1.0.0'};
   const nextRelease = {type: 'major', version: '2.0.0', gitHead: await getGitHead(), gitTag: 'v2.0.0'};
@@ -623,6 +635,27 @@ test.serial('Returns falsy value if triggered by a PR', async t => {
   );
 });
 
+test.serial('Returns falsy value if triggered on an outdated clone', async t => {
+  // Create a git repository, set the current working directory at the root of the repo
+  const repositoryUrl = await gitRepo(true);
+  // Add commits to the master branch
+  await gitCommits(['First']);
+  await gitCommits(['Second']);
+  await push();
+  await reset();
+
+  const semanticRelease = proxyquire('..', {
+    './lib/logger': t.context.logger,
+    'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
+  });
+
+  t.falsy(await semanticRelease({repositoryUrl}));
+  t.deepEqual(t.context.log.args[t.context.log.args.length - 1], [
+    "The local branch %s is behind the remote one, therefore a new version won't be published.",
+    'master',
+  ]);
+});
+
 test.serial('Returns falsy value if not running from the configured branch', async t => {
   // Create a git repository, set the current working directory at the root of the repo
   const repositoryUrl = await gitRepo(true);
@@ -656,6 +689,7 @@ test.serial('Returns falsy value if there is no relevant changes', async t => {
   const repositoryUrl = await gitRepo(true);
   // Add commits to the master branch
   await gitCommits(['First']);
+  await push();
 
   const analyzeCommits = stub().resolves();
   const verifyRelease = stub().resolves();
@@ -685,7 +719,10 @@ test.serial('Returns falsy value if there is no relevant changes', async t => {
   t.is(verifyRelease.callCount, 0);
   t.is(generateNotes.callCount, 0);
   t.is(publish.callCount, 0);
-  t.is(t.context.log.args[7][0], 'There are no relevant changes, so no new version is released.');
+  t.is(
+    t.context.log.args[t.context.log.args.length - 1][0],
+    'There are no relevant changes, so no new version is released.'
+  );
 });
 
 test.serial('Exclude commits with [skip release] or [release skip] from analysis', async t => {
@@ -702,6 +739,7 @@ test.serial('Exclude commits with [skip release] or [release skip] from analysis
     'Test commit\n\n commit body\n[skip release]',
     'Test commit\n\n commit body\n[release skip]',
   ]);
+  await push();
   const analyzeCommits = stub().resolves();
   const config = {branch: 'master', repositoryUrl, globalOpt: 'global'};
   const options = {
@@ -826,6 +864,7 @@ test.serial('Throw an Error if plugin returns an unexpected value', async t => {
   await gitTagVersion('v1.0.0');
   // Add new commits to the master branch
   await gitCommits(['Second']);
+  await push();
 
   const verifyConditions = stub().resolves();
   const analyzeCommits = stub().resolves('string');