[Mearman]

resolveBuildIdentity and predictNextVersion took the last release from package.json's version and then looked for its tag. That only works while every release also commits a version bump. A repository that releases with just a tag and a GitHub Release (no @semantic-release/git or @semantic-release/npm commit) keeps an old package.json version, so after its next release the prediction keeps analysing commits since the stale tag and resolveBuildIdentity never reports kind: 'release'.

Releases are now read from tags alone, and nothing reads package.json.

resolveBuildIdentity reports kind: 'release' when any release tag points at HEAD (git tag --points-at HEAD), with the version read out of the tag; with several, the highest wins, and a lower one on HEAD (a backport tagged after a newer release) still counts. It looks at HEAD only, so it works in a shallow clone, and a clone made without tags reports kind: 'commit' rather than throwing.

findLastRelease is the highest major.minor.patch tag in the tag template among the tags git tag --merged HEAD lists, which is how semantic-release's own core picks the last release. Prerelease tags, tags in another format and tags on commits HEAD does not contain are ignored. It throws, saying what to fetch (fetch-depth: 0), in any shallow clone, since a higher tag could sit beyond the cut, and when no release tag is reachable. predictNextVersion analyses the commits since that tag and inherits both errors. There is no first-release fallback: a clone made without its tags looks exactly like a repository that never released, and predicting 1.0.0 there names a version that may already exist.

This is a breaking change and should release as a major. The tagName function option becomes tagTemplate, a string with {version} exactly once, because a tag has to be read back into a version and a function cannot be inverted; the CLI's --tag-name already took this template, so the CLI is unchanged. readPackageVersion is removed; a caller that used it for "the last released version" gets that from findLastRelease(root).version, which needs the full history and tags wherever it runs.

Every git call the library makes now drops GIT_DIR, GIT_WORK_TREE and GIT_INDEX_FILE from its environment. A git hook exports them for its own repository and git then ignores repoRoot; this repository's pre-push hook runs the test suite, so the fixtures were exposed to it too.

Since the first push: the release check moved from "the highest reachable release is on HEAD" to "any release tag is on HEAD"; findLastRelease throws instead of returning undefined, and the 1.0.0 first-release prediction is gone, because a shallow or tagless clone of a repository at v4.2.0 predicted 1.0.0; the hook environment fix; the log range names refs/tags/ in full; version comparison parses typed parts instead of defaulting missing fields; and tests for shallow and tagless clones, annotated tags, a merged side-branch tag, a higher tag on an unmerged branch, a tag on an unreachable commit, vNext, the backport case and the hook environment. Each new test was checked by breaking the code it covers and watching it fail.

Verified with the repository's own pnpm typecheck, pnpm lint, pnpm test (including the CLI e2e suite against a fresh build), pnpm build and attw --pack, on every commit.

Known consumers, all private repositories, found by code search across the owning organisations and by reading each one's package.json, call sites and workflow checkouts. None passes the tagName option. Two call only resolveBuildIdentity, predictNextVersion and loadCommitAnalyzer with the default template and need nothing beyond the version bump; every job of theirs that predicts checks out with fetch-depth: 0, and their shallow jobs only resolve the identity, which still works there. One imports readPackageVersion for an API document's version; its bump replaces that call with findLastRelease(root).version, and the jobs that build it already check out with fetch-depth: 0. Its exact pin means the major does not reach it until it is bumped on purpose.

[chatgpt-codex-connector]

This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins.

[github-actions]

🎉 This PR is included in version 3.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀