feat: init `@semantic-release/core` by babblebey · Pull Request #1 · semantic-release/core

babblebey · 2026-06-03T14:48:00Z

Phase 1: Repository and Package Scaffolding

Objective: Introduce package boundaries with minimal behavior change.

Checklist:

Create packages/core (or equivalent) with package metadata for @semantic-release/core.
Move/copy core files (index.js, lib/, type definitions) into core package structure.
Set module exports/types fields correctly for ESM consumers.
Add package-level tests/lint config wiring for core.

Deliverables:

Buildable/installable @semantic-release/core package in repository.
CI can run tests against both wrapper and core packages. (Core package side scaffolding complete; wrapper CI wiring remains for Phase 3/4 integration.)

Phase 2: Core Decoupling and Default Behavior Ownership

Objective: Make core fully composable and remove default plugin assumptions from core.

Checklist:

Change core config defaults so plugins is empty in core package.
Add explicit validation and actionable error when required steps are missing (e.g., analyzeCommits).
Isolate or inject terminal rendering formatter to avoid hard dependency on CLI-oriented renderer.
Ensure core does not depend on wrapper-only dependencies (yargs, CLI-only renderer packages).
Keep plugin loading behavior and plugin step contracts unchanged.

Deliverables:

Core runs with user-provided plugin lists.
Core fails fast with clear messages when mandatory lifecycle setup is missing.

Phase 3: Wrapper Package Compatibility Layer (`semantic-release`)

Objective: Preserve existing user behavior by making semantic-release a thin adapter.

Checklist:

Update wrapper index.js to delegate execution to @semantic-release/core.
Preserve exported API shape currently expected by programmatic users.
Keep CLI in wrapper package and maintain current option parsing/flags.
Inject current default plugin list from wrapper to emulate existing behavior.
Verify wrapper still masks sensitive output and preserves current logging style.

Deliverables:

Existing semantic-release commands work with no user config changes.
Wrapper package owns defaults and CLI while core remains neutral.

Reference: https://github.com/semantic-release/semantic-release/tree/feat/core-integration

Phase 4: Test Strategy and Regression Hardening

Objective: Prove no regressions in wrapper and expected behavior in core.

Checklist:

Add/adjust unit tests for core defaults and validation errors.
Add wrapper tests proving default plugin behavior parity with pre-split behavior.
Add integration tests for custom plugin stacks using @semantic-release/core.
Validate dry-run behavior, branch constraints, and fail/success hooks across both packages.
Ensure snapshot/log-output tests account for formatter abstraction changes.

Deliverables:

Green focused test matrix covering core standalone usage and wrapper compatibility.
Clear evidence of behavior parity for existing users.

Phase 4.5: Cracking `core` 😤

Objective: Make core composable and IMPERATIVELY 100% backward compactible to semantic-release

Checklist:

Deliverables

semantic-release/core installable in semantic-release with zero breaking

Phase 5: Documentation and Migration Guidance

Objective: Make adoption and upgrade path clear.

Checklist:

Add @semantic-release/core usage docs with minimal and advanced examples.
Update semantic-release docs to explain default behavior remains and where customization lives.
Publish migration guidance for users who want custom CLIs/plugin stacks.
Document dependency ownership (what is bundled in wrapper vs expected in core consumers).
Update TypeScript examples for both packages.

Deliverables:

Updated docs website (target https://semantic-release.org/developer-guide/js-api) and README sections for both package audiences.
Migration notes suitable for release announcement/changelog.

Phase 6: Release and Rollout

Objective: Ship safely with clear communication and rollback options.

Checklist:

Publish @semantic-release/core initial version with release notes.
Publish updated semantic-release wrapper release with explicit compatibility notes.
Monitor issue tracker for integration and plugin-resolution regressions.
Prepare patch follow-up path for wrapper compatibility issues.
Collect user feedback on core composability and CLI extension experience.

Deliverables:

Stable release of both packages.
Post-release triage checklist executed.

Related Issue

Proposal: Extract @semantic-release/core package to enable composable release pipelines semantic-release#4072

…figuration

…ripts and configuration

- Add `get-last-release.js` to determine the last tagged release. - Introduce `get-logger.js` for logging purposes. - Create `get-next-version.js` to calculate the next version based on the last release. - Implement `get-release-to-add.js` to find releases merged from higher branches. - Add `git.js` for Git operations including fetching tags and commits. - Introduce `hide-sensitive.js` to mask sensitive environment variables. - Create `plugins/index.js` to manage plugin loading and configuration. - Implement `plugins/normalize.js` for normalizing plugin options. - Add `plugins/pipeline.js` to execute plugins in a pipeline. - Create `plugins/utils.js` for utility functions related to plugins. - Implement `utils.js` for various utility functions including version handling. - Add `verify.js` to validate the configuration and environment. - Update `package.json` to reflect new structure and dependencies.

…ove linting scripts - Added "types" field to specify TypeScript definitions file. - Updated "exports" to include types alongside the default entry point. - Included "index.d.ts" in the "files" array for distribution. - Added "lint:core" script to run core linting. - Updated "test" script to include a "test:core" alias for consistency.

…pport

- Changed the test command to use AVA with verbose output. - Added AVA configuration for test files, node arguments, and timeout. - Updated devDependencies to include AVA version 8.0.1.

…d git helper methods

socket-security · 2026-06-03T14:48:25Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@semantic-release/error@4.0.0
	resolve-from@5.0.0
	p-each-series@3.0.0
	p-reduce@3.0.0
	signale@1.4.0
	lodash-es@4.18.1
	git-log-parser@1.2.1
	aggregate-error@5.0.0
	import-from-esm@2.0.0
	figures@6.1.0
	read-package-up@12.0.0
	hook-std@4.0.0
	get-stream@6.0.1
	tempy@3.2.0
	execa@9.6.1
	debug@4.4.3
	@semantic-release/commit-analyzer@13.0.1
	micromatch@4.0.8
	env-ci@11.2.0
	testdouble@3.20.2
	fs-extra@11.3.5
	ava@8.0.1
	cosmiconfig@9.0.1
	sinon@22.0.0
	prettier@3.8.3
	hosted-git-info@9.0.3
	semver@7.8.1

View full report

- Introduced a noop plugin for testing purposes. - Added a result configuration plugin to return pluginConfig and context. - Enhanced get-config tests to validate plugin options and context handling. - Created git utility functions for tagging and adding notes. - Implemented extensive tests for plugin normalization, including various input formats and error handling. - Developed pipeline tests to ensure sequential execution of plugin functions with error handling. - Added utility tests for plugin validation and loading mechanisms. - Ensured compatibility with shareable config modules and proper error reporting for invalid plugin configurations.

…ve data, utility functions, and verification logic - Implemented tests for various git operations including fetching, tagging, and branch management in `git.test.js`. - Added tests for hiding sensitive environment variables in `hide-sensitive.test.js`. - Created utility function tests in `utils.test.js` covering version extraction and comparison. - Developed verification tests in `verify.test.js` to ensure proper error handling and validation of branch and tag formats.

socket-security · 2026-06-06T18:56:28Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `@pnpm/network.ca-file` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@semantic-release/commit-analyzer@13.0.1` → `npm/@pnpm/network.ca-file@1.0.2` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/@pnpm/network.ca-file@1.0.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `execa` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/execa@9.6.1` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/execa@9.6.1`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `highlight.js` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@semantic-release/commit-analyzer@13.0.1` → `npm/highlight.js@10.7.3` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/highlight.js@10.7.3`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `js-yaml` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/cosmiconfig@9.0.1` → `npm/js-yaml@4.2.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/js-yaml@4.2.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `npm` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@semantic-release/commit-analyzer@13.0.1` → `npm/npm@11.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@11.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `npm` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → `npm/@semantic-release/commit-analyzer@13.0.1` → `npm/npm@11.16.0` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/npm@11.16.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

…-lock.json

…dation

…re execution

…ests

…mit-analyzer` as default packed plugin

… injection logic

… `getConfig`

…dge default plugin from core

…mmits

…yntax

…on links

…ction and warning behavior

…ase base configuration

…w test cases for configuration handling

…te related tests

…ck.json

…onfig and related functions

…on settings

…ult` entry point

…`default`, `resolveConfig`, `getLogger`, and `resolveEnvCi` functions

… signature, inputs, and return value

…ulation

…n README

gr2m · 2026-06-10T17:14:53Z

Phase 6: Release and Rollout

Objective: Ship safely with clear communication and rollback options.

Checklist:

Publish @semantic-release/core initial version with release notes.

Publish updated semantic-release wrapper release with explicit compatibility notes.

Monitor issue tracker for integration and plugin-resolution regressions.

Prepare patch follow-up path for wrapper compatibility issues.

Collect user feedback on core composability and CLI extension experience.

Deliverables:

Stable release of both packages.

Post-release triage checklist executed.

I would add a follow up issue with the above checklist as deliverable

babblebey added 9 commits June 2, 2026 08:50

feat: initialize core project with main functionality and package con…

983c710

…figuration

feat: add package-lock.json and enhance package.json with prettier sc…

591496b

…ripts and configuration

feat: add TypeScript definitions for semantic-release core module

cb84ae8

feat: add test for core package default function export

bf783ed

feat: enhance context handling by adding defaultPlugins and onInit su…

c87ef86

…pport

chore: update testing framework to AVA and configure test settings

ad3f08c

- Changed the test command to use AVA with verbose output. - Added AVA configuration for test files, node arguments, and timeout. - Updated devDependencies to include AVA version 8.0.1.

feat: add integration and unit tests for core plugin functionality an…

ca43899

…d git helper methods

babblebey added 9 commits June 4, 2026 18:43

feat: add publishConfig for public access and provenance

d99bff8

feat: update semantic-release API for legacy support

9ce09fb

feat: add getConfig, getLogger, and resolveEnvCi exports to core module

1bc2985

feat: pack commit-analyzer as default plugin

f822c17

feat: improve dryRun logging to include release notes

2a93f2e

feat: enhance release logging to indicate dry-run status

236d14e

feat: add .project to .gitignore

6797984

babblebey changed the base branch from main to beta June 6, 2026 19:10

babblebey added 9 commits June 6, 2026 20:11

Merge branch 'beta' into start

487df8a

feat: remove js-yaml from devDependencies in package.json and package…

e4bb494

…-lock.json

feat: add plugin pipeline steps and utility functions for plugin vali…

2d734a3

…dation

feat: integrate plugin normalization and enhance error handling in co…

8447522

…re execution

feat: enhance getConfig to support conditional plugin pipeline execution

8054d68

feat: add validation for plugins input in core execution and update t…

2a1b67f

…ests

feat: inject fallback for analyzeCommits using `@semantic-release/com…

56c71c5

…mit-analyzer` as default packed plugin

feat(test): add tests for analyzeCommits fallback behavior and plugin…

cfbd0fa

… injection logic

feat: replace hardcoded plugin with DEFAULT_ANALYZE_COMMITS_PLUGIN in…

cbfe988

… `getConfig`

babblebey added 19 commits June 7, 2026 18:12

fix: correct import path for DEFAULT_ANALYZE_COMMITS_PLUGIN in index.js

cef1ef3

fix(errors): modify notice for missing analyzeCommits plugin aknownle…

7608881

…dge default plugin from core

fix(logger): add warning for unavailable fallback plugin in analyzeCo…

bc2c9ac

…mmits

chore: add @semantic-release/commit-analyzer dependency

dca0865

fix(errors): update import method for package.json to use ES module s…

61fede1

…yntax

fix(errors): update error messages and details to use new documentati…

c9c436f

…on links

fix(tests): update analyzeCommits fallback test to ensure proper inje…

0c6c1e1

…ction and warning behavior

feat(config): rename getConfig to resolveConfig and add support for b…

19c6a7a

…ase base configuration

feat(tests): update integration tests to use resolveConfig and add ne…

bf6679e

…w test cases for configuration handling

fix(config): change default buildPlugins option to false and upda…

c06e9ab

…te related tests

fix(package): add "peer" field to multiple dependencies in package-lo…

1717a77

…ck.json

refactor(config): rename cliOptions to runtimeOptions in resolveC…

42fc88c

…onfig and related functions

doc: add README to document core package

2f76cb1

fix(docs): update runtimeOptions in README to reflect new configurati…

89c2149

…on settings

fix(docs): correct README formatting and enhance description of `defa…

1a612e2

…ult` entry point

fix(docs): correct formatting in README and expand documentation for …

be4c446

…`default`, `resolveConfig`, `getLogger`, and `resolveEnvCi` functions

fix(docs): expand documentation for resolveConfig function, including…

d13bb16

… signature, inputs, and return value

fix(docs): update logger usage instructions in README for context pop…

9854feb

…ulation

fix(docs): streamline purpose descriptions for public API functions i…

a52dc5b

…n README

babblebey marked this pull request as ready for review June 9, 2026 21:50

babblebey mentioned this pull request Jun 10, 2026

Release and Rollout #3

Open

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: init `@semantic-release/core`#1

feat: init `@semantic-release/core`#1
babblebey wants to merge 46 commits into
betafrom
start

babblebey commented Jun 3, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 6, 2026 •

edited

Loading

Uh oh!

gr2m commented Jun 10, 2026

Phase 6: Release and Rollout

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

babblebey commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Phase 1: Repository and Package Scaffolding

Phase 2: Core Decoupling and Default Behavior Ownership

Phase 3: Wrapper Package Compatibility Layer (semantic-release)

Phase 4: Test Strategy and Regression Hardening

Phase 4.5: Cracking core 😤

Phase 5: Documentation and Migration Guidance

Phase 6: Release and Rollout

Related Issue

Uh oh!

socket-security Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jun 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gr2m commented Jun 10, 2026

Phase 6: Release and Rollout

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

babblebey commented Jun 3, 2026 •

edited

Loading

Phase 3: Wrapper Package Compatibility Layer (`semantic-release`)

Phase 4.5: Cracking `core` 😤

socket-security Bot commented Jun 3, 2026 •

edited

Loading

socket-security Bot commented Jun 6, 2026 •

edited

Loading