CodeVetter · Repo Unpack · Contributor handoff
semantic-release/semantic-release
Begin with the orchestrator and lifecycle definitions, then follow the affected branch, Git, or configuration helper. Tests and CI were inspected, not executed, and this brief is bounded evidence rather than an exhaustive audit. Future implementation work should preserve publishing order, dry-run eligibility, configuration precedence, and credential masking while validating only within the authorized environment.
- Read index.js and lib/definitions/plugins.js together before lifecycle changes: core call order and per-stage dry-run/preprocess/postprocess behavior jointly determine observable execution.
- Use npm and the tracked lockfile; packageManager pins npm 12.0.2, Node engines define runtime compatibility, and .nvmrc selects Node 24 for development.
- For authorized validation, start with the affected AVA file, then use test:unit, test:integration, or test:e2e as appropriate; npm test combines lint scripts with test suites, including container-backed E2E.
- Tests and CI were inspected, not executed: coverage configuration, assertions, and workflow commands establish intended checks only; no passing suite or measured coverage is asserted here.
- Preserve configuration precedence and shareable-config plugin resolution when editing get-config; explicit CLI/API values override discovered configuration and imported defaults.
- Before changing branch policy, inspect normalization, last-release selection, and promotion together; branch order controls ranges and higher-channel eligibility, while Git notes carry channel history.
- Security edits should retain dash-prefixed URL rejection, Git argument separators, and raw/encoded masking; focused regression files include verify, git, hide-sensitive, and integration tests.
- Contract trap: runtime can return only {releases} after channel promotion when analysis produces no new release, but Result declares a release object requiring lastRelease, commits, and nextRelease.