@semantic-release/github MIT 51 versions

@semantic-release/github

npm Repository Homepage

semantic-release plugin to publish a GitHub release and comment on released Pull Requests/Issues

51

Versions

MIT

License

No

Install Scripts

Verified

Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

pvdlgsemantic-release-botgr2mtravi

Keywords

gitgithubissuenotificationspublishpull-requestreleasesemantic-releaseversion

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
provenance	publisher-changed	AI (provenance): semantic-release/github migrated from semantic-release-bot to GitHub Actions publishing with SLSA provenance. This is a legitimate, security-improving workflow change consistent with the org's CI/CD practices.	ai	2026/04/23
publish-pattern	new-deps-added	AI (publish-pattern): undici is the official Node.js HTTP client maintained by the Node.js core team; its addition to a GitHub API plugin is entirely reasonable and not a supply chain risk.	ai	2026/04/23

Versions (showing 51 of 166)

View all versions

Version	Deps	Published
12.0.8	17 / 13	2026-05-08
12.0.7	17 / 13	2026-05-08
12.0.6	17 / 13	2026-02-12
12.0.5	17 / 13	2026-02-07
12.0.4	17 / 13	2026-02-06
12.0.3	17 / 13	2026-01-30
12.0.2	17 / 13	2025-11-08
12.0.1	16 / 13	2025-10-31
12.0.0	16 / 13	2025-10-15
11.0.6	16 / 13	2025-09-11
11.0.5	16 / 13	2025-08-29
11.0.4	16 / 13	2025-08-10
11.0.3	16 / 13	2025-05-25
11.0.2	16 / 13	2025-04-25
11.0.1	16 / 13	2024-11-06
11.0.0	16 / 13	2024-09-24
10.3.5	16 / 13	2024-09-20
10.3.4	16 / 13	2024-09-15
10.3.3	16 / 13	2024-09-05
10.3.2	16 / 13	2024-09-04
10.3.1	16 / 13	2024-09-03
10.3.0	16 / 13	2024-09-02
10.2.0	16 / 13	2024-09-02
10.1.7	16 / 13	2024-08-20
10.1.6	16 / 13	2024-08-15
10.1.5	16 / 13	2024-08-14
10.1.4	16 / 13	2024-08-09
10.1.3	16 / 13	2024-07-26
10.1.2	16 / 13	2024-07-25
10.1.1	16 / 13	2024-07-19
10.1.0	16 / 13	2024-07-08
10.0.7	16 / 13	2024-07-01
10.0.6	16 / 13	2024-06-05
10.0.5	16 / 13	2024-05-22
10.0.4	16 / 13	2024-05-15
10.0.3	16 / 13	2024-04-06
10.0.2	16 / 13	2024-03-15
10.0.1	16 / 13	2024-03-14
10.0.0	16 / 13	2024-03-14
9.2.6	16 / 13	2023-12-22
9.2.5	16 / 13	2023-12-07
9.2.4	16 / 13	2023-11-29
9.2.3	16 / 13	2023-11-09
9.2.2	16 / 13	2023-11-08
9.2.1	16 / 8	2023-09-27
9.2.0	16 / 8	2023-09-26
9.1.0	16 / 8	2023-09-25
9.0.7	16 / 8	2023-09-23
9.0.6	16 / 8	2023-09-14
9.0.5	16 / 8	2023-09-09
9.0.4	16 / 8	2023-07-16

v12.0.8

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.7

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.3

2 findings

HIGH Publisher changed: semantic-release-bot → GitHub Actions (on 2026-01-30) provenance

This version was published by a different npm account than previous versions on 2026-01-30. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.2

2 findings

HIGH Publisher changed: semantic-release-bot → GitHub Actions (on 2025-11-08) provenance

This version was published by a different npm account than previous versions on 2025-11-08. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.1

2 findings

HIGH Publisher changed: semantic-release-bot → GitHub Actions (on 2025-10-31) provenance

This version was published by a different npm account than previous versions on 2025-10-31. This could indicate a legitimate maintainer transition or an account compromise.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v12.0.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v11.0.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.3.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.2.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.7

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.3

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.2

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.1

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.1.0

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.0.7

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.0.6

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.0.5

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v10.0.4

1 finding

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.