# Testing signals — semantic-release/semantic-release

> Canonical page: https://codevetter.com/unpack/semantic-release/testing-signals

# Testing signals — semantic-release/semantic-release

Scanned commit e8c2436e5704a6d1fa5b4aa69238f50edbe586bf (2026-09-21). Generated by codevetter codevetter 1.15.0 on 2026-10-02.

Source inspection; upstream code and tests were not executed.

Tests and CI definitions were inspected, not executed; their existence is not a passing result. AVA suites cover core helpers, Git behavior, lifecycle integration, and container-backed publishing scenarios. Inspection sampled test implementations and declarations, so it does not establish exhaustive coverage or live provider compatibility.
- AVA's default file selection includes test/**/*.test.js except integration and E2E; separate scripts run those suites, and c8 instruments lib JavaScript, index.js, and cli.js with all enabled. — [package.json#L7-L17](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/package.json#L7-L17) [package.json#L110-L122](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/package.json#L110-L122) [package.json#L156-L158](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/package.json#L156-L158)
- Inspected integration tests create real local Git histories and stub lifecycle hooks with Sinon, replacing env-ci and logging through testdouble to assert plugin context. — [test/integration.test.js#L1-L26](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/integration.test.js#L1-L26) [test/integration.test.js#L47-L97](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/integration.test.js#L47-L97) [test/integration.test.js#L158-L175](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/integration.test.js#L158-L175)
- Integration assertions cover channel promotion across fast-forward, merge, and rebase histories; dry-run hook suppression; pull-request skipping; stale clones; and no relevant commits. — [test/integration.test.js#L859-L880](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/integration.test.js#L859-L880) [test/integration.test.js#L1088-L1111](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/integration.test.js#L1088-L1111) [test/integration.test.js#L1406-L1424](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/integration.test.js#L1406-L1424) [test/integration.test.js#L1603-L1710](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/integration.test.js#L1603-L1710)
- E2E tests invoke the executable against Gitbox and Verdaccio, mock GitHub API requests, and assert package/shrinkwrap versions, registry dist-tags, and local/remote tag heads. — [test/e2e.test.js#L43-L66](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/e2e.test.js#L43-L66) [test/e2e.test.js#L70-L146](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/e2e.test.js#L70-L146)
- E2E infrastructure uses Testcontainers with pinned image digests from e2e.compose.yml, mapped service ports, readiness probes, a copied Verdaccio configuration, and teardown of started containers. — [test/helpers/e2e-environment.js#L11-L16](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/helpers/e2e-environment.js#L11-L16) [test/helpers/e2e-environment.js#L137-L161](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/helpers/e2e-environment.js#L137-L161) [test/helpers/e2e-environment.js#L181-L191](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/helpers/e2e-environment.js#L181-L191) [e2e.compose.yml#L1-L19](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/e2e.compose.yml#L1-L19)
- Security regressions include dash-prefixed repository URL rejection, Git upload/receive-pack argument-injection checks, encoded credential masking, and masking in a failing Git command's captured logs. — [test/verify.test.js#L128-L138](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/verify.test.js#L128-L138) [test/git.test.js#L429-L454](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/git.test.js#L429-L454) [test/hide-sensitive.test.js#L87-L143](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/hide-sensitive.test.js#L87-L143) [test/integration.test.js#L1958-L1993](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/integration.test.js#L1958-L1993)
- The inspected test workflow runs npm test on Ubuntu for Node 22.14.0, 24.10.0, 24, and .nvmrc; jobs also clean-install dependencies and audit signatures, but this brief reports no execution or coverage result. — [.github/workflows/test.yml#L23-L66](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/.github/workflows/test.yml#L23-L66) [package.json#L155-L158](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/package.json#L155-L158) [.nvmrc#L1-L1](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/.nvmrc#L1-L1)
- The sampled E2E path verifies mocked GitHub responses rather than live GitHub behavior, and the inspected CI jobs use Ubuntu; CONTRIBUTING asks for 100% unit coverage, while the inspected c8 config specifies reports without a threshold. — [test/e2e.test.js#L54-L55](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/e2e.test.js#L54-L55) [test/e2e.test.js#L107-L118](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/test/e2e.test.js#L107-L118) [.github/workflows/test.yml#L32-L33](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/.github/workflows/test.yml#L32-L33) [CONTRIBUTING.md#L292-L297](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/CONTRIBUTING.md#L292-L297) [package.json#L110-L122](https://github.com/semantic-release/semantic-release/blob/e8c2436e5704a6d1fa5b4aa69238f50edbe586bf/package.json#L110-L122)

Every claim links to its cited files at the pinned commit. Citations identify source evidence; they do not establish runtime correctness. Independent CodeVetter scan — not reviewed by upstream maintainers.

## Public product links

- [CodeVetter](https://codevetter.com/)
- [Download](https://codevetter.com/download)
- [Documentation](https://codevetter.com/docs/)
- [Source](https://github.com/Codevetter/codevetter)