fix: hide sensitive data in relesae notes and fail/success plugin params

This way plugins can pipe a stream to `stdout` and `stderr` in integration tests.

docs/extending/plugins-list.md

@@ -53,3 +53,7 @@
   - [verifyConditions](https://github.com/GabrielDuarteM/semantic-release-chrome#verifyconditions) Verify the presence of the authentication (set via environment variables).
   - [prepare](https://github.com/GabrielDuarteM/semantic-release-chrome#prepare) Write the correct version to the manifest.json and creates a zip file of the whole dist folder.
   - [publish](https://github.com/GabrielDuarteM/semantic-release-chrome#publish) Uploads the generated zip file to the webstore, and publish the item.
+- [semantic-release-firefox](https://github.com/felixfbecker/semantic-release-firefox) Set of semantic-release plugins for publishing a Firefox extension release.
+  - [verifyConditions](https://github.com/felixfbecker/semantic-release-firefox#verifyconditions) Verify the presence of the authentication (set via environment variables).
+  - [prepare](https://github.com/felixfbecker/semantic-release-firefox#prepare) Write the correct version to the manifest.json,   creates a xpi file of the dist folder and a zip of the sources.
+  - [publish](https://github.com/felixfbecker/semantic-release-firefox#publish) Submit the generated archives to the webstore for review, and publish the item including release notes.

lib/definitions/plugins.js

@@ -1,5 +1,7 @@
 const {isString, isPlainObject} = require('lodash');
 const {gitHead} = require('../git');
+const hideSensitive = require('../hide-sensitive');
+const {hideSensitiveValues} = require('../utils');
 const {RELEASE_TYPE, RELEASE_NOTES_SEPARATOR} = require('./constants');
 
 module.exports = {
@@ -40,7 +42,7 @@ module.exports = {
         },
       }),
     }),
-    postprocess: results => results.filter(Boolean).join(RELEASE_NOTES_SEPARATOR),
+    postprocess: (results, {env}) => hideSensitive(env)(results.filter(Boolean).join(RELEASE_NOTES_SEPARATOR)),
   },
   prepare: {
     default: ['@semantic-release/npm'],
@@ -80,11 +82,13 @@ module.exports = {
     multiple: true,
     required: false,
     pipelineConfig: () => ({settleAll: true}),
+    preprocess: ({releases, env, ...inputs}) => ({...inputs, env, releases: hideSensitiveValues(env, releases)}),
   },
   fail: {
     default: ['@semantic-release/github'],
     multiple: true,
     required: false,
     pipelineConfig: () => ({settleAll: true}),
+    preprocess: ({errors, env, ...inputs}) => ({...inputs, env, errors: hideSensitiveValues(env, errors)}),
   },
 };

lib/hide-sensitive.js

@@ -1,4 +1,4 @@
-const {escapeRegExp, size} = require('lodash');
+const {escapeRegExp, size, isString} = require('lodash');
 const {SECRET_REPLACEMENT, SECRET_MIN_SIZE} = require('./definitions/constants');
 
 module.exports = env => {
@@ -7,5 +7,6 @@ module.exports = env => {
   );
 
   const regexp = new RegExp(toReplace.map(envVar => escapeRegExp(env[envVar])).join('|'), 'g');
-  return output => (output && toReplace.length > 0 ? output.toString().replace(regexp, SECRET_REPLACEMENT) : output);
+  return output =>
+    output && isString(output) && toReplace.length > 0 ? output.toString().replace(regexp, SECRET_REPLACEMENT) : output;
 };

lib/plugins/index.js

@@ -36,7 +36,10 @@ module.exports = (context, pluginsPath) => {
       );
 
       plugins[type] = async input =>
-        postprocess(await pipeline(steps, pipelineConfig && pipelineConfig(plugins, logger))(await preprocess(input)));
+        postprocess(
+          await pipeline(steps, pipelineConfig && pipelineConfig(plugins, logger))(await preprocess(input)),
+          input
+        );
 
       return plugins;
     },

lib/utils.js

@@ -1,7 +1,20 @@
 const {isFunction} = require('lodash');
+const hideSensitive = require('./hide-sensitive');
 
 function extractErrors(err) {
   return err && isFunction(err[Symbol.iterator]) ? [...err] : [err];
 }
 
-module.exports = {extractErrors};
+function hideSensitiveValues(env, objs) {
+  const hideFunction = hideSensitive(env);
+  return objs.map(obj => {
+    Object.getOwnPropertyNames(obj).forEach(prop => {
+      if (obj[prop]) {
+        obj[prop] = hideFunction(obj[prop]);
+      }
+    });
+    return obj;
+  });
+}
+
+module.exports = {extractErrors, hideSensitiveValues};

package.json

@@ -28,16 +28,16 @@
     "cosmiconfig": "^5.0.1",
     "debug": "^3.1.0",
     "env-ci": "^2.0.0",
-    "execa": "^0.10.0",
+    "execa": "^1.0.0",
     "figures": "^2.0.0",
     "find-versions": "^2.0.0",
-    "get-stream": "^3.0.0",
+    "get-stream": "^4.0.0",
     "git-log-parser": "^1.2.0",
     "git-url-parse": "^10.0.1",
     "hook-std": "^1.1.0",
     "hosted-git-info": "^2.7.1",
     "lodash": "^4.17.4",
-    "marked": "^0.4.0",
+    "marked": "^0.5.0",
     "marked-terminal": "^3.0.0",
     "p-locate": "^3.0.0",
     "p-reduce": "^1.0.0",
@@ -65,8 +65,9 @@
     "p-retry": "^2.0.0",
     "proxyquire": "^2.0.0",
     "sinon": "^6.0.0",
+    "stream-buffers": "^3.0.2",
     "tempy": "^0.2.1",
-    "xo": "^0.21.0"
+    "xo": "^0.22.0"
   },
   "engines": {
     "node": ">=8.3"

test/definitions/plugins.test.js

@@ -1,6 +1,6 @@
 import test from 'ava';
 import plugins from '../../lib/definitions/plugins';
-import {RELEASE_NOTES_SEPARATOR} from '../../lib/definitions/constants';
+import {RELEASE_NOTES_SEPARATOR, SECRET_REPLACEMENT} from '../../lib/definitions/constants';
 
 test('The "analyzeCommits" plugin output must be either undefined or a valid semver release type', t => {
   t.false(plugins.analyzeCommits.outputValidator('invalid'));
@@ -32,10 +32,22 @@ test('The "publish" plugin output, if defined, must be an object', t => {
   t.true(plugins.publish.outputValidator(''));
 });
 
-test('The "generateNotes" plugins output are concatenated with separator', t => {
-  t.is(plugins.generateNotes.postprocess(['note 1', 'note 2']), `note 1${RELEASE_NOTES_SEPARATOR}note 2`);
-  t.is(plugins.generateNotes.postprocess(['', 'note']), 'note');
-  t.is(plugins.generateNotes.postprocess([undefined, 'note']), 'note');
-  t.is(plugins.generateNotes.postprocess(['note 1', '', 'note 2']), `note 1${RELEASE_NOTES_SEPARATOR}note 2`);
-  t.is(plugins.generateNotes.postprocess(['note 1', undefined, 'note 2']), `note 1${RELEASE_NOTES_SEPARATOR}note 2`);
+test('The "generateNotes" plugins output are concatenated with separator and sensitive data is hidden', t => {
+  const env = {MY_TOKEN: 'secret token'};
+  t.is(plugins.generateNotes.postprocess(['note 1', 'note 2'], {env}), `note 1${RELEASE_NOTES_SEPARATOR}note 2`);
+  t.is(plugins.generateNotes.postprocess(['', 'note'], {env}), 'note');
+  t.is(plugins.generateNotes.postprocess([undefined, 'note'], {env}), 'note');
+  t.is(plugins.generateNotes.postprocess(['note 1', '', 'note 2'], {env}), `note 1${RELEASE_NOTES_SEPARATOR}note 2`);
+  t.is(
+    plugins.generateNotes.postprocess(['note 1', undefined, 'note 2'], {env}),
+    `note 1${RELEASE_NOTES_SEPARATOR}note 2`
+  );
+
+  t.is(
+    plugins.generateNotes.postprocess(
+      [`Note 1: Exposing token ${env.MY_TOKEN}`, `Note 2: Exposing token ${SECRET_REPLACEMENT}`],
+      {env}
+    ),
+    `Note 1: Exposing token ${SECRET_REPLACEMENT}${RELEASE_NOTES_SEPARATOR}Note 2: Exposing token ${SECRET_REPLACEMENT}`
+  );
 });

test/fixtures/index.js

@@ -1,2 +1 @@
 module.exports = () => {};
-

test/fixtures/plugin-error-inherited.js

@@ -1,7 +1,7 @@
 const SemanticReleaseError = require('@semantic-release/error');
 
 class InheritedError extends SemanticReleaseError {
-  constructor(message, code, newProperty) {
+  constructor(message, code) {
     super(message);
     Error.captureStackTrace(this, this.constructor);
     this.name = this.constructor.name;

test/index.test.js

@@ -1,9 +1,11 @@
 import test from 'ava';
+import {escapeRegExp, isString} from 'lodash';
 import proxyquire from 'proxyquire';
 import {spy, stub} from 'sinon';
+import {WritableStreamBuffer} from 'stream-buffers';
 import AggregateError from 'aggregate-error';
 import SemanticReleaseError from '@semantic-release/error';
-import {COMMIT_NAME, COMMIT_EMAIL} from '../lib/definitions/constants';
+import {COMMIT_NAME, COMMIT_EMAIL, SECRET_REPLACEMENT} from '../lib/definitions/constants';
 import {
   gitHead as getGitHead,
   gitTagHead,
@@ -78,8 +80,8 @@ test('Plugins are called with expected values', async t => {
   const result = await semanticRelease(options, {
     cwd,
     env,
-    stdout: {write: () => {}},
-    stderr: {write: () => {}},
+    stdout: new WritableStreamBuffer(),
+    stderr: new WritableStreamBuffer(),
   });
 
   t.is(verifyConditions1.callCount, 1);
@@ -215,7 +217,14 @@ test('Use custom tag format', async t => {
     './lib/get-logger': () => t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  t.truthy(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.truthy(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
 
   // Verify the tag has been created on the local and remote repo and reference the gitHead
   t.is(await gitTagHead(nextRelease.gitTag, {cwd}), nextRelease.gitHead);
@@ -260,7 +269,14 @@ test('Use new gitHead, and recreate release notes if a prepare plugin create a c
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
 
-  t.truthy(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.truthy(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
 
   t.is(generateNotes.callCount, 2);
   t.deepEqual(generateNotes.args[0][1].nextRelease, nextRelease);
@@ -318,7 +334,9 @@ test('Call all "success" plugins even if one errors out', async t => {
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
 
-  await t.throws(semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  await t.throws(
+    semanticRelease(options, {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()})
+  );
 
   t.is(success1.callCount, 1);
   t.deepEqual(success1.args[0][1].releases, [{...release, ...nextRelease, notes, pluginName: '[Function: proxy]'}]);
@@ -350,7 +368,9 @@ test('Log all "verifyConditions" errors', async t => {
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
   const errors = [
-    ...(await t.throws(semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}))),
+    ...(await t.throws(
+      semanticRelease(options, {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()})
+    )),
   ];
 
   t.deepEqual(errors, [error1, error2, error3]);
@@ -396,7 +416,9 @@ test('Log all "verifyRelease" errors', async t => {
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
   const errors = [
-    ...(await t.throws(semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}))),
+    ...(await t.throws(
+      semanticRelease(options, {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()})
+    )),
   ];
 
   t.deepEqual(errors, [error1, error2]);
@@ -445,7 +467,14 @@ test('Dry-run skips publish and success', async t => {
     './lib/get-logger': () => t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  t.truthy(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.truthy(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
 
   t.not(t.context.log.args[0][0], 'This run was not triggered in a known CI environment, running in dry-run mode.');
   t.is(verifyConditions.callCount, 1);
@@ -484,7 +513,9 @@ test('Dry-run skips fail', async t => {
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
   const errors = [
-    ...(await t.throws(semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}))),
+    ...(await t.throws(
+      semanticRelease(options, {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()})
+    )),
   ];
 
   t.deepEqual(errors, [error1, error2]);
@@ -532,7 +563,14 @@ test('Force a dry-run if not on a CI and "noCi" is not explicitly set', async t
     './lib/get-logger': () => t.context.logger,
     'env-ci': () => ({isCi: false, branch: 'master'}),
   });
-  t.truthy(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.truthy(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
 
   t.is(t.context.log.args[1][0], 'This run was not triggered in a known CI environment, running in dry-run mode.');
   t.is(verifyConditions.callCount, 1);
@@ -575,7 +613,14 @@ test('Dry-run does not print changelog if "generateNotes" return "undefined"', a
     './lib/get-logger': () => t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  t.truthy(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.truthy(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
 
   t.deepEqual(t.context.log.args[t.context.log.args.length - 1], ['Release note for version 2.0.0:']);
 });
@@ -619,7 +664,14 @@ test('Allow local releases with "noCi" option', async t => {
     './lib/get-logger': () => t.context.logger,
     'env-ci': () => ({isCi: false, branch: 'master', isPr: true}),
   });
-  t.truthy(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.truthy(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
 
   t.not(t.context.log.args[0][0], 'This run was not triggered in a known CI environment, running in dry-run mode.');
   t.not(
@@ -671,7 +723,14 @@ test('Accept "undefined" value returned by the "generateNotes" plugins', async t
     './lib/get-logger': () => t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  t.truthy(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.truthy(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
 
   t.is(analyzeCommits.callCount, 1);
   t.deepEqual(analyzeCommits.args[0][1].lastRelease, lastRelease);
@@ -700,7 +759,10 @@ test('Returns false if triggered by a PR', async t => {
   });
 
   t.false(
-    await semanticRelease({cwd, repositoryUrl}, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}})
+    await semanticRelease(
+      {cwd, repositoryUrl},
+      {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()}
+    )
   );
   t.is(
     t.context.log.args[t.context.log.args.length - 1][0],
@@ -728,7 +790,7 @@ test('Returns false if triggered on an outdated clone', async t => {
   t.false(
     await semanticRelease(
       {repositoryUrl},
-      {cwd: repoDir, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}
+      {cwd: repoDir, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()}
     )
   );
   t.deepEqual(t.context.log.args[t.context.log.args.length - 1], [
@@ -757,7 +819,14 @@ test('Returns false if not running from the configured branch', async t => {
     'env-ci': () => ({isCi: true, branch: 'other-branch', isPr: false}),
   });
 
-  t.false(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.false(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
   t.is(
     t.context.log.args[1][0],
     'This test run was triggered on the branch other-branch, while semantic-release is configured to only publish from master, therefore a new version won’t be published.'
@@ -794,7 +863,14 @@ test('Returns false if there is no relevant changes', async t => {
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
 
-  t.false(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.false(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
   t.is(analyzeCommits.callCount, 1);
   t.is(verifyRelease.callCount, 0);
   t.is(generateNotes.callCount, 0);
@@ -841,7 +917,12 @@ test('Exclude commits with [skip release] or [release skip] from analysis', asyn
     './lib/get-logger': () => t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}});
+  await semanticRelease(options, {
+    cwd,
+    env: {},
+    stdout: new WritableStreamBuffer(),
+    stderr: new WritableStreamBuffer(),
+  });
 
   t.is(analyzeCommits.callCount, 1);
   t.is(analyzeCommits.args[0][1].commits.length, 2);
@@ -865,7 +946,9 @@ test('Log both plugins errors and errors thrown by "fail" plugin', async t => {
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
 
-  await t.throws(semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  await t.throws(
+    semanticRelease(options, {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()})
+  );
 
   t.is(t.context.error.args[t.context.error.args.length - 1][0], 'ERR Plugin error');
   t.is(t.context.error.args[t.context.error.args.length - 3][1], failError1);
@@ -888,7 +971,9 @@ test('Call "fail" only if a plugin returns a SemanticReleaseError', async t => {
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
 
-  await t.throws(semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  await t.throws(
+    semanticRelease(options, {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()})
+  );
 
   t.true(fail.notCalled);
   t.is(t.context.error.args[t.context.error.args.length - 1][1], pluginError);
@@ -903,7 +988,9 @@ test('Throw SemanticReleaseError if repositoryUrl is not set and cannot be found
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
   const errors = [
-    ...(await t.throws(semanticRelease({}, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}))),
+    ...(await t.throws(
+      semanticRelease({}, {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()})
+    )),
   ];
 
   // Verify error code and type
@@ -939,12 +1026,93 @@ test('Throw an Error if plugin returns an unexpected value', async t => {
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
   const error = await t.throws(
-    semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}),
+    semanticRelease(options, {cwd, env: {}, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()}),
     Error
   );
   t.regex(error.details, /string/);
 });
 
+test('Hide sensitive information passed to "fail" plugin', async t => {
+  const {cwd, repositoryUrl} = await gitRepo(true);
+
+  const fail = stub().resolves();
+  const env = {MY_TOKEN: 'secret token'};
+  const options = {
+    branch: 'master',
+    repositoryUrl,
+    verifyConditions: stub().throws(
+      new SemanticReleaseError(
+        `Message: Exposing token ${env.MY_TOKEN}`,
+        'ERR',
+        `Details: Exposing token ${env.MY_TOKEN}`
+      )
+    ),
+    success: stub().resolves(),
+    fail,
+  };
+
+  const semanticRelease = requireNoCache('..', {
+    './lib/get-logger': () => t.context.logger,
+    'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
+  });
+  await t.throws(
+    semanticRelease(options, {cwd, env, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()}),
+    Error
+  );
+
+  const error = fail.args[0][1].errors[0];
+
+  t.is(error.message, `Message: Exposing token ${SECRET_REPLACEMENT}`);
+  t.is(error.details, `Details: Exposing token ${SECRET_REPLACEMENT}`);
+
+  Object.getOwnPropertyNames(error).forEach(prop => {
+    if (isString(error[prop])) {
+      t.notRegex(error[prop], new RegExp(escapeRegExp(env.MY_TOKEN)));
+    }
+  });
+});
+
+test('Hide sensitive information passed to "success" plugin', async t => {
+  const {cwd, repositoryUrl} = await gitRepo(true);
+  await gitCommits(['feat: initial release'], {cwd});
+  await gitTagVersion('v1.0.0', undefined, {cwd});
+  await gitCommits(['feat: new feature'], {cwd});
+  await gitPush(repositoryUrl, 'master', {cwd});
+
+  const success = stub().resolves();
+  const env = {MY_TOKEN: 'secret token'};
+  const options = {
+    branch: 'master',
+    repositoryUrl,
+    verifyConditions: false,
+    verifyRelease: false,
+    prepare: false,
+    publish: stub().resolves({
+      name: `Name: Exposing token ${env.MY_TOKEN}`,
+      url: `URL: Exposing token ${env.MY_TOKEN}`,
+    }),
+    success,
+    fail: stub().resolves(),
+  };
+
+  const semanticRelease = requireNoCache('..', {
+    './lib/get-logger': () => t.context.logger,
+    'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
+  });
+  await semanticRelease(options, {cwd, env, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()});
+
+  const release = success.args[0][1].releases[0];
+
+  t.is(release.name, `Name: Exposing token ${SECRET_REPLACEMENT}`);
+  t.is(release.url, `URL: Exposing token ${SECRET_REPLACEMENT}`);
+
+  Object.getOwnPropertyNames(release).forEach(prop => {
+    if (isString(release[prop])) {
+      t.notRegex(release[prop], new RegExp(escapeRegExp(env.MY_TOKEN)));
+    }
+  });
+});
+
 test('Get all commits including the ones not in the shallow clone', async t => {
   let {cwd, repositoryUrl} = await gitRepo(true);
   await gitTagVersion('v1.0.0', undefined, {cwd});
@@ -974,7 +1142,14 @@ test('Get all commits including the ones not in the shallow clone', async t => {
     './lib/get-logger': () => t.context.logger,
     'env-ci': () => ({isCi: true, branch: 'master', isPr: false}),
   });
-  t.truthy(await semanticRelease(options, {cwd, env: {}, stdout: {write: () => {}}, stderr: {write: () => {}}}));
+  t.truthy(
+    await semanticRelease(options, {
+      cwd,
+      env: {},
+      stdout: new WritableStreamBuffer(),
+      stderr: new WritableStreamBuffer(),
+    })
+  );
 
   t.is(analyzeCommits.args[0][1].commits.length, 3);
 });

test/integration.test.js

@@ -4,6 +4,7 @@ import test from 'ava';
 import {escapeRegExp} from 'lodash';
 import {writeJson, readJson} from 'fs-extra';
 import execa from 'execa';
+import {WritableStreamBuffer} from 'stream-buffers';
 import {SECRET_REPLACEMENT} from '../lib/definitions/constants';
 import {gitHead as getGitHead, gitTagHead, gitRepo, gitCommits, gitRemoteTagHead, gitPush} from './helpers/git-utils';
 import gitbox from './helpers/gitbox';
@@ -490,7 +491,7 @@ test('Run via JS API', async t => {
   t.log('Commit a feature');
   await gitCommits(['feat: Initial commit'], {cwd});
   t.log('$ Call semantic-release via API');
-  await semanticRelease(undefined, {cwd, env, stdout: {write: () => {}}, stderr: {write: () => {}}});
+  await semanticRelease(undefined, {cwd, env, stdout: new WritableStreamBuffer(), stderr: new WritableStreamBuffer()});
 
   // Verify package.json and has been updated
   t.is((await readJson(path.resolve(cwd, 'package.json'))).version, version);