fix: use correct ci branch context (#1521)

These options work the same as the curl command, but use a GitHub App so there's no need to provision and manage a Personal Access Token in order to trigger the Semantic Release action.

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

docs/recipes/github-actions.md

@@ -66,3 +66,8 @@ To trigger a release, call (with a [Personal Access Tokens](https://help.github.
 ```
 $ curl -v -H "Accept: application/vnd.github.everest-preview+json" -H "Authorization: token ${GITHUB_TOKEN}" https://api.github.com/repos/[org-name-or-username]/[repository]/dispatches -d '{ "event_type": "semantic-release" }'
 ```
+
+If you'd like to use a GitHub app to manage this instead of creating a personal access token, you could consider using a project like:
+
+* [Actions Panel](https://www.actionspanel.app/) - A declaratively configured way for triggering GitHub Actions
+* [Action Button](https://github-action-button.web.app/#details) - A simple badge based mechanism for triggering GitHub Actions

docs/recipes/gitlab-ci.md

@@ -14,7 +14,7 @@ GitLab CI supports [Pipelines](https://docs.gitlab.com/ee/ci/pipelines.html) all
 
 ### `.gitlab-ci.yml` configuration for Node projects
 
-This example is a minimal configuration for **semantic-release** with a build running Node 6 and 8. See [GitLab CI - Configuration of your jobs with .gitlab-ci.yml](https://docs.gitlab.com/ee/ci/yaml/README.html) for additional configuration options.
+This example is a minimal configuration for **semantic-release** with a build running Node 10 and 12. See [GitLab CI - Configuration of your jobs with .gitlab-ci.yml](https://docs.gitlab.com/ee/ci/yaml/README.html) for additional configuration options.
 
 **Note**: The`semantic-release` execution command varies depending if you are using a [local](../usage/installation.md#local-installation) or [global](../usage/installation.md#global-installation) **semantic-release** installation.
 
@@ -27,25 +27,60 @@ stages:
 before_script:
   - npm install
 
-node:6:
-  image: node:6
+node:10:
+  image: node:10
   stage: test
   script:
     - npm test
 
-node:8:
-  image: node:8
+node:12:
+  image: node:12
   stage: test
   script:
     - npm test
 
 publish:
-  image: node:8
+  image: node:12
   stage: release
   script:
     - npx semantic-release
 ```
 
+### `.gitlab-ci.yml` configuration for all projects
+
+This example is a minimal configuration for **semantic-release** with a build running Node 10 and 12. See [GitLab CI - Configuration of your jobs with .gitlab-ci.yml](https://docs.gitlab.com/ee/ci/yaml/README.html) for additional configuration options.
+
+**Note**: The`semantic-release` execution command varies depending if you are using a [local](../usage/installation.md#local-installation) or [global](../usage/installation.md#global-installation) **semantic-release** installation.
+
+
+```yaml
+# The release pipeline will run only on the master branch a commit is triggered 
+stages:
+  - release
+
+release:
+  image: node:10-buster-slim
+  stage: release
+  before_script:
+    - apt-get update && apt-get install -y --no-install-recommends git-core ca-certificates
+    - npm install -g semantic-release @semantic-release/gitlab
+  script:
+    - semantic-release
+  only:
+    - master
+
+release:
+  image: node:12-buster-slim
+  stage: release
+  before_script:
+    - apt-get update && apt-get install -y --no-install-recommends git-core ca-certificates
+    - npm install -g semantic-release @semantic-release/gitlab
+  script:
+    - semantic-release
+  only:
+    - master
+```
+
 ### `package.json` configuration
 
 A `package.json` is required only for [local](../usage/installation.md#local-installation) **semantic-release** installation.

docs/usage/ci-configuration.md

@@ -21,12 +21,13 @@ See [CI configuration recipes](../recipes/README.md#ci-configurations) for more
 
 **semantic-release** requires push access to the project Git repository in order to create [Git tags](https://git-scm.com/book/en/v2/Git-Basics-Tagging). The Git authentication can be set with one of the following environment variables:
 
-| Variable                        | Description                                                                                                                                                                                                                  |
-|---------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `GH_TOKEN` or `GITHUB_TOKEN`    | A GitHub [personal access token](https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line).                                                                                                    |
-| `GL_TOKEN` or `GITLAB_TOKEN`    | A GitLab [personal access token](https://docs.gitlab.com/ce/user/profile/personal_access_tokens.html).                                                                                                                       |
-| `BB_TOKEN` or `BITBUCKET_TOKEN` | A Bitbucket [personal access token](https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html).                                                                                                 |
-| `GIT_CREDENTIALS`               | [URL encoded](https://en.wikipedia.org/wiki/Percent-encoding) Git username and password in the format `<username>:<password>`. The username and password must each be individually URL encoded, not the `:` separating them. |
+| Variable                                              | Description                                                                                                                                                                                                                  |
+|-------------------------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `GH_TOKEN` or `GITHUB_TOKEN`                          | A GitHub [personal access token](https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line).                                                                                                    |
+| `GL_TOKEN` or `GITLAB_TOKEN`                          | A GitLab [personal access token](https://docs.gitlab.com/ce/user/profile/personal_access_tokens.html).                                                                                                                       |
+| `BB_TOKEN` or `BITBUCKET_TOKEN`                       | A Bitbucket [personal access token](https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html).                                                                                                 |
+| `BB_TOKEN_BASIC_AUTH` or `BITBUCKET_TOKEN_BASIC_AUTH` | A Bitbucket [personal access token](https://confluence.atlassian.com/bitbucketserver/personal-access-tokens-939515499.html) with basic auth support. For clearification `user:token` has to be the value of this env.        |
+| `GIT_CREDENTIALS`                                     | [URL encoded](https://en.wikipedia.org/wiki/Percent-encoding) Git username and password in the format `<username>:<password>`. The username and password must each be individually URL encoded, not the `:` separating them. |
 
 Alternatively the Git authentication can be set up via [SSH keys](../recipes/git-auth-ssh-keys.md).
 

docs/usage/getting-started.md

@@ -10,10 +10,8 @@ In order to use **semantic-release** you must follow these steps:
 Alternatively those steps can be easily done with the [**semantic-release** interactive CLI](https://github.com/semantic-release/cli):
 
 ```bash
-npm install -g semantic-release-cli
-
 cd your-module
-semantic-release-cli setup
+npx semantic-release-cli setup
 ```
 
 ![dialogue](../../media/semantic-release-cli.png)

docs/usage/workflow-configuration.md

@@ -140,7 +140,7 @@ A maintenance branch is characterized by a range which defines the versions that
 
 Maintenance branches are always considered lower than [release branches](#release-branches) and similarly to them, when a commit that would create a version conflict is pushed, **semantic-release** will not perform the release and will throw an `EINVALIDNEXTVERSION` error, listing the problematic commits and the valid branches on which to move them.
 
-**semantic-release** will automatically add releases to the corresponding distribution channel when code is [merged from a release or maintenance branch to another maintenance branch](#merging-into-a-maintenance-branch), however only version version within the branch `range` can be merged. Ia merged version is outside the maintenance branch `range` **semantic-release** will not add to the corresponding channel and will throw an `EINVALIDMAINTENANCEMERGE` error.
+**semantic-release** will automatically add releases to the corresponding distribution channel when code is [merged from a release or maintenance branch to another maintenance branch](#merging-into-a-maintenance-branch), however only versions within the branch `range` can be merged. If a merged version is outside the maintenance branch `range`, **semantic-release** will not add to the corresponding channel and will throw an `EINVALIDMAINTENANCEMERGE` error.
 
 See [publishing maintenance releases recipe](../recipes/maintenance-releases.md) for a detailed example.
 

index.js

@@ -26,7 +26,8 @@ marked.setOptions({renderer: new TerminalRenderer()});
 /* eslint complexity: off */
 async function run(context, plugins) {
   const {cwd, env, options, logger} = context;
-  const {isCi, branch: ciBranch, isPr} = context.envCi;
+  const {isCi, branch, prBranch, isPr} = context.envCi;
+  const ciBranch = isPr ? prBranch : branch;
 
   if (!isCi && !options.dryRun && !options.noCi) {
     logger.warn('This run was not triggered in a known CI environment, running in dry-run mode.');

lib/get-git-auth-url.js

@@ -25,6 +25,8 @@ module.exports = async ({cwd, env, branch, options: {repositoryUrl}}) => {
     GITLAB_TOKEN: 'gitlab-ci-token:',
     BB_TOKEN: 'x-token-auth:',
     BITBUCKET_TOKEN: 'x-token-auth:',
+    BB_TOKEN_BASIC_AUTH: '',
+    BITBUCKET_TOKEN_BASIC_AUTH: '',
   };
 
   const info = hostedGitInfo.fromUrl(repositoryUrl, {noGitPlus: true});

lib/hide-sensitive.js

@@ -2,9 +2,14 @@ const {escapeRegExp, size, isString} = require('lodash');
 const {SECRET_REPLACEMENT, SECRET_MIN_SIZE} = require('./definitions/constants');
 
 module.exports = (env) => {
-  const toReplace = Object.keys(env).filter(
-    (envVar) => /token|password|credential|secret|private/i.test(envVar) && size(env[envVar].trim()) >= SECRET_MIN_SIZE
-  );
+  const toReplace = Object.keys(env).filter((envVar) => {
+    // https://github.com/semantic-release/semantic-release/issues/1558
+    if (envVar === 'GOPRIVATE') {
+      return false;
+    }
+
+    return /token|password|credential|secret|private/i.test(envVar) && size(env[envVar].trim()) >= SECRET_MIN_SIZE;
+  });
 
   const regexp = new RegExp(toReplace.map((envVar) => escapeRegExp(env[envVar])).join('|'), 'g');
   return (output) =>

package.json

@@ -37,7 +37,7 @@
     "hook-std": "^2.0.0",
     "hosted-git-info": "^3.0.0",
     "lodash": "^4.17.15",
-    "marked": "^0.8.0",
+    "marked": "^1.0.0",
     "marked-terminal": "^4.0.0",
     "micromatch": "^4.0.2",
     "p-each-series": "^2.1.0",
@@ -57,7 +57,7 @@
     "dockerode": "^3.0.0",
     "file-url": "^3.0.0",
     "fs-extra": "^9.0.0",
-    "got": "^10.5.2",
+    "got": "^11.0.0",
     "js-yaml": "^3.10.0",
     "mockserver-client": "^5.1.1",
     "nock": "^12.0.0",

test/get-git-auth-url.test.js

@@ -299,6 +299,34 @@ test('Return the "https" formatted URL if "gitCredentials" is defined with "BITB
   );
 });
 
+test('Return the "https" formatted URL if "gitCredentials" is defined with "BB_TOKEN_BASIC_AUTH"', async (t) => {
+  const {cwd} = await gitRepo();
+
+  t.is(
+    await getAuthUrl({
+      cwd,
+      env: {...env, BB_TOKEN_BASIC_AUTH: 'username:token'},
+      branch: {name: 'master'},
+      options: {repositoryUrl: 'git@host.null:owner/repo.git'},
+    }),
+    'https://username:token@host.null/owner/repo.git'
+  );
+});
+
+test('Return the "https" formatted URL if "gitCredentials" is defined with "BITBUCKET_TOKEN_BASIC_AUTH"', async (t) => {
+  const {cwd} = await gitRepo();
+
+  t.is(
+    await getAuthUrl({
+      cwd,
+      env: {...env, BITBUCKET_TOKEN_BASIC_AUTH: 'username:token'},
+      branch: {name: 'master'},
+      options: {repositoryUrl: 'git@host.null:owner/repo.git'},
+    }),
+    'https://username:token@host.null/owner/repo.git'
+  );
+});
+
 test('Return the "https" formatted URL if "GITHUB_ACTION" is set', async (t) => {
   const {cwd} = await gitRepo();
 

test/hide-sensitive.test.js

@@ -19,6 +19,11 @@ test('Replace multiple occurences of sensitive environment variable values', (t)
   );
 });
 
+test('Replace sensitive environment variable matching specific regex for "private"', (t) => {
+  const env = {privateKey: 'secret', GOPRIVATE: 'host.com'};
+  t.is(hideSensitive(env)(`https://host.com?token=${env.privateKey}`), `https://host.com?token=${SECRET_REPLACEMENT}`);
+});
+
 test('Escape regexp special characters', (t) => {
   const env = {SOME_CREDENTIALS: 'p$^{.+}\\w[a-z]o.*rd'};
   t.is(
@@ -47,6 +52,11 @@ test('Exclude empty environment variables from the regexp if there is only empty
   t.is(hideSensitive({SOME_PASSWORD: '', SOME_TOKEN: ' \n '})(`https://host.com?token=`), 'https://host.com?token=');
 });
 
+test('Exclude nonsensitive GOPRIVATE environment variable for Golang projects from the regexp', (t) => {
+  const env = {GOPRIVATE: 'host.com'};
+  t.is(hideSensitive(env)(`https://host.com?token=`), 'https://host.com?token=');
+});
+
 test('Exclude environment variables with value shorter than SECRET_MIN_SIZE from the regexp', (t) => {
   const SHORT_TOKEN = repeat('a', SECRET_MIN_SIZE - 1);
   const LONG_TOKEN = repeat('b', SECRET_MIN_SIZE);

test/index.test.js

@@ -1258,7 +1258,7 @@ test('Allow local releases with "noCi" option', async (t) => {
 
   const semanticRelease = requireNoCache('..', {
     './lib/get-logger': () => t.context.logger,
-    'env-ci': () => ({isCi: false, branch: 'master', isPr: true}),
+    'env-ci': () => ({isCi: false, branch: 'master', isPr: false}),
   });
   t.truthy(
     await semanticRelease(options, {
@@ -1357,7 +1357,7 @@ test('Returns false if triggered by a PR', async (t) => {
 
   const semanticRelease = requireNoCache('..', {
     './lib/get-logger': () => t.context.logger,
-    'env-ci': () => ({isCi: true, branch: 'master', isPr: true}),
+    'env-ci': () => ({isCi: true, branch: 'master', prBranch: 'patch-1', isPr: true}),
   });
 
   t.false(