@cycjimmy/semantic-release-action 6.0.0 → 7.1.1

package/README.md

@@ -18,16 +18,16 @@ GitHub Action for [Semantic Release][semantic-url].
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 ```
 
 **IMPORTANT**: `GITHUB_TOKEN` does not have the required permissions to operate on protected branches.
-If you are using this action for protected branches, replace `GITHUB_TOKEN` with [Personal Access Token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line). If using the `@semantic-release/git` plugin for protected branches, avoid persisting credentials as part of `actions/checkout@v5` by setting the parameter `persist-credentials: false`. This credential does not have the required permission to operate on protected branches.
+If you are using this action for protected branches, replace `GITHUB_TOKEN` with [Personal Access Token](https://help.github.com/en/github/authenticating-to-github/creating-a-personal-access-token-for-the-command-line). If using the `@semantic-release/git` plugin for protected branches, avoid persisting credentials as part of `actions/checkout@v7` by setting the parameter `persist-credentials: false`. This credential does not have the required permission to operate on protected branches.
 
 #### Private Packages
 
@@ -45,27 +45,27 @@ then make sure that you configure this in your `package.json` file:
 ### Inputs
 |  Input Parameter  | Required | Description                                                                                                              |
 |:-----------------:|:--------:|--------------------------------------------------------------------------------------------------------------------------|
-| semantic_version  |  false   | Specify version range for semantic-release. [[Details](#semantic_version)]                                               |
-|     branches      |  false   | The branches on which releases should happen.[[Details](#branches)]<br>Support for **semantic-release above v16**.       |
-|      branch       |  false   | The branch on which releases should happen.[[Details](#branch)]<br>Only support for **semantic-release older than v16**. |
+| semantic_version  |  false   | Specify version range for semantic-release (v16 or above required). [[Details](#semantic_version)]                       |
+|     branches      |  false   | The branches on which releases should happen.[[Details](#branches)]<br>Requires **semantic-release v16 or above**.       |
 |   extra_plugins   |  false   | Extra plugins for pre-install. [[Details](#extra_plugins)]                                                               |
 |      dry_run      |  false   | Whether to run semantic release in `dry-run` mode. [[Details](#dry_run)]                                                 |
-|        ci         |  false   | Whether to run semantic release with CI support. [[Details](#ci)]<br>Support for **semantic-release above v16**.         |
+|        ci         |  false   | Whether to run semantic release with CI support. [[Details](#ci)]                                                        |
 |   unset_gha_env   |  false   | Whether to unset the GITHUB_ACTIONS environment variable.                                                                |
 |      extends      |  false   | Use a sharable configuration [[Details](#extends)]                                                                       |
 | working_directory |  false   | Use another working directory for semantic release [[Details](#working_directory)]                                       |
 |    tag_format     |  false   | Specify format of tag (useful for monorepos)                                                                             |
 |  repository_url   |  false   | The Git repository url. If no repository url specified, current repository will be used by default.                      |
+| skip_npm_plugin   |  false   | Whether to skip the @semantic-release/npm default plugin. [[Details](#skip_npm_plugin)]<br>Useful for non-Node.js projects. |
 
 #### semantic_version
-> {Optional Input Parameter} Specify version range for semantic-release.
+> {Optional Input Parameter} Specify version range for semantic-release.<br>The minimum supported semantic-release version is **v16**; older versions fail with an error.
 
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       semantic_version: 19.0.5  # It is recommended to specify a version range
                                 # for semantic-release when using
@@ -75,20 +75,20 @@ steps:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 ```
 
-If no version range is specified with `cycjimmy/semantic-release-action@v6` then [semantic-release](https://github.com/semantic-release/semantic-release/) version [24.2.7](https://github.com/semantic-release/semantic-release/releases/tag/v25.0.2) is used.
+If no version range is specified with `cycjimmy/semantic-release-action@v7` then [semantic-release@latest](https://github.com/semantic-release/semantic-release/releases) is used.
 
 #### branches
-> {Optional Input Parameter} The branches on which releases should happen.<br>`branches` supports for **semantic-release above v16**.
+> {Optional Input Parameter} The branches on which releases should happen.<br>`branches` requires **semantic-release v16 or above**.
 
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       semantic_version: 16
-      # you can set branches for semantic-release above v16.
+      # you can set branches for semantic-release v16 or above.
       branches: |
         [
           '+([0-9])?(.{+([0-9]),x}).x',
@@ -123,25 +123,7 @@ steps:
 
 See [configuration#branches](https://semantic-release.gitbook.io/semantic-release/usage/configuration#branches) for more information.
 
-#### branch
-> {Optional Input Parameter} Similar to parameter `branches`. The branch on which releases should happen.<br>`branch` only supports for **semantic-release older than v16**.
-
-```yaml
-steps:
-  - name: Checkout
-    uses: actions/checkout@v5
-  - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
-    with:
-      semantic_version: 15.13.28
-      # you can set branch for semantic-release older than v16.
-      branch: your-branch
-    env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-```
-
-It will override the `branch` attribute in your configuration file. If the attribute is not configured on both sides, the default is `master`.
+**NOTE**: The `branches` input is evaluated as a JavaScript expression to support the array/object configuration above. Only pass content you trust — anyone able to edit the workflow file can already run arbitrary commands in your CI.
 
 #### extra_plugins
 > {Optional Input Parameter} Extra plugins for pre-install.
@@ -154,9 +136,9 @@ Github Action Workflow:
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       # You can specify specifying version range for the extra plugins if you prefer.
       extra_plugins: |
@@ -169,6 +151,8 @@ steps:
 
 Similar to parameter `semantic_version`. *It is recommended to manually specify a version of semantic-release plugins to prevent errors caused.*
 
+**NOTE**: `extra_plugins` accepts npm package specs (e.g. `@semantic-release/git@10.0.0` or `@semantic-release/git@>=10.0.0`) separated by whitespace or newlines. Each spec is passed to `npm install` as a single argument without a shell; tokens starting with `-` or containing quotes or similar unsafe characters are ignored and reported as a warning. Because whitespace separates specs, version ranges containing spaces (e.g. `>=1.0.0 <2.0.0`) are not supported. The same rules apply to the `extends` input.
+
 Release Config:
 ```diff
   plugins: [
@@ -184,9 +168,9 @@ Release Config:
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       dry_run: true
     env:
@@ -194,15 +178,17 @@ steps:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 ```
 
+**NOTE**: `dry-run` mode still requires write access to the repository. At startup, semantic-release verifies push permission by running `git push --dry-run` ([`verifyAuth`](https://github.com/semantic-release/semantic-release/blob/master/lib/git.js)), and GitHub enforces write access for dry-run pushes as well — nothing is actually pushed. If the credentials cannot push — for example, the default `GITHUB_TOKEN` when the job does not grant `permissions: contents: write` — the action fails with `EGITNOPERMISSION: Cannot push to the Git repository.` even in `dry-run` mode. To fix it, grant write permission to the job, e.g. `permissions: contents: write` (or use a token with write access).
+
 #### ci
-> {Optional Input Parameter} Whether to run semantic release with CI support (default true).<br>`ci` supports for **semantic-release above v16**.
+> {Optional Input Parameter} Whether to run semantic release with CI support (default true).
 
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       ci: false
     env:
@@ -218,9 +204,9 @@ The action can be used with `extends` option to extend an existing [sharable con
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       # You can extend an existing shareable configuration.
       # And you can specify version range for the shareable configuration if you prefer.
@@ -238,9 +224,9 @@ This action run semantic release in the github provided workspace by default. Yo
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       # You can select another working directory like a subdirectory for example.
       working_directory: ./code
@@ -255,9 +241,9 @@ The default tag format on semantic-release is `v{version}`. You can override tha
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       tag_format: custom-v${version}
     env:
@@ -271,7 +257,7 @@ Setting this to true will unset the `GITHUB_ACTIONS` environment variable. This
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Temporarily merge PR branch
     if: ${{ github.event_name == 'pull_request' }}
     run: |
@@ -279,7 +265,7 @@ steps:
       git config --global user.email github-actions@github.com
       git merge --no-ff origin/${{ github.event.pull_request.head.ref }} --message "${{ github.event.pull_request.title }}"
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     with:
       unset_gha_env: ${{ github.event_name == 'pull_request' }}
       ci: ${{ github.event_name == 'pull_request' && false || '' }}
@@ -288,6 +274,31 @@ steps:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 ```
 
+#### skip_npm_plugin
+> {Optional Input Parameter} Whether to skip the `@semantic-release/npm` default plugin.<br>Useful for running the action in a project that is not a Node.js project (i.e. without a `package.json` file).
+
+```yaml
+steps:
+  - name: Checkout
+    uses: actions/checkout@v7
+  - name: Semantic Release
+    uses: cycjimmy/semantic-release-action@v7
+    with:
+      skip_npm_plugin: true
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+The `@semantic-release/npm` default plugin requires a `package.json` file in the working directory. Without one, semantic-release fails with `SemanticReleaseError: Missing package.json file.` (ENOPKG) — even in `dry-run` mode. Set `skip_npm_plugin: true` to remove the npm plugin from the default plugins. The default plugins are then replaced with the following list (the [default plugins](https://semantic-release.gitbook.io/semantic-release/usage/plugins#default-plugins) of semantic-release without `@semantic-release/npm`):
+
+- `@semantic-release/commit-analyzer`
+- `@semantic-release/release-notes-generator`
+- `@semantic-release/github`
+
+Similar to the other options, it will override the `plugins` attribute in your configuration file. If you already maintain your own `plugins` array in your release configuration, you don't need this input — just omit `@semantic-release/npm` from your array.
+
+**NOTE**: `NPM_TOKEN` is not required when the npm plugin is skipped. Also note that configuring `npmPublish: false` or `private: true` on the npm plugin does **not** avoid the ENOPKG error, as the plugin checks for a `package.json` file before taking those settings into account. The only way to release a project without a `package.json` file is to not use the npm plugin at all.
+
 ### Outputs
 |     Output Parameter      | Description                                                                                                                       |
 |:-------------------------:|-----------------------------------------------------------------------------------------------------------------------------------|
@@ -308,9 +319,9 @@ steps:
 ```yaml
 steps:
   - name: Checkout
-    uses: actions/checkout@v5
+    uses: actions/checkout@v7
   - name: Semantic Release
-    uses: cycjimmy/semantic-release-action@v6
+    uses: cycjimmy/semantic-release-action@v7
     id: semantic   # Need an `id` for output variables
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -325,6 +336,24 @@ steps:
       echo ${{ steps.semantic.outputs.new_release_patch_version }}
 ```
 
+## Migration Notes
+
+### The `branch` input has been removed
+The `branch` input is no longer supported. Use the `branches` input instead:
+
+```diff
+  - name: Semantic Release
+    uses: cycjimmy/semantic-release-action@v7
+    with:
+-     branch: your-branch
++     branches: your-branch
+```
+
+If the `branch` input is still passed, the action prints a deprecation warning and ignores it.
+
+### semantic-release below v16 is no longer supported
+This action now requires **semantic-release v16 or above**. If the installed semantic-release version is older (for example via `semantic_version: 15`), the action fails with an error. Update the `semantic_version` input to v16 or above, or remove it to use the latest version.
+
 ## Changelog
 See [CHANGELOG][changelog-url].
 

package/action.yml

@@ -7,13 +7,10 @@ branding:
 inputs:
   semantic_version:
     required: false
-    description: 'Specify specifying version range for semantic-release. If no version range is specified, latest version will be used by default'
+    description: 'Specify specifying version range for semantic-release (v16 or above required). If no version range is specified, latest version will be used by default'
   branches:
     required: false
-    description: 'The branches on which releases should happen. It will override the branches attribute in your configuration file. Support for semantic-release above v16. See https://semantic-release.gitbook.io/semantic-release/usage/configuration#branches for more information.'
-  branch:
-    required: false
-    description: 'The branch on which releases should happen. It will override the branch attribute in your configuration file. If the attribute is not configured on both sides, the default is master. Support for semantic-release older than v16.'
+    description: 'The branches on which releases should happen. It will override the branches attribute in your configuration file. Requires semantic-release v16 or above. See https://semantic-release.gitbook.io/semantic-release/usage/configuration#branches for more information.'
   extra_plugins:
     required: false
     description: 'Extra plugins for pre-install. You can also specify specifying version range for the extra plugins if you prefer.'
@@ -38,6 +35,9 @@ inputs:
   repository_url:
     required: false
     description: 'The Git repository url. If no repository url specified, current repository will be used by default.'
+  skip_npm_plugin:
+    required: false
+    description: 'Whether to skip the @semantic-release/npm default plugin. Useful for non-Node.js projects without a package.json file. When true, the default plugins are replaced with @semantic-release/commit-analyzer, @semantic-release/release-notes-generator and @semantic-release/github. It will override the plugins attribute in your configuration file.'
 outputs:
   new_release_published:
     description: 'Whether a new release was published'

package/docs/CHANGELOG.md

@@ -1,3 +1,41 @@
+## [7.1.1](https://github.com/cycjimmy/semantic-release-action/compare/v7.1.0...v7.1.1) (2026-10-10)
+
+
+### Bug Fixes
+
+* **ci:** improve error handling for push permission failures ([895d556](https://github.com/cycjimmy/semantic-release-action/commit/895d556be9f4f2e382d2713f135c582cfd36d619)), closes [#312](https://github.com/cycjimmy/semantic-release-action/issues/312)
+
+# [7.1.0](https://github.com/cycjimmy/semantic-release-action/compare/v7.0.0...v7.1.0) (2026-10-09)
+
+
+### Features
+
+* **core:** add option to skip npm plugin for non-Node.js projects ([d1038bc](https://github.com/cycjimmy/semantic-release-action/commit/d1038bc60313f92bfcba1be105b18a41e4501b18)), closes [#313](https://github.com/cycjimmy/semantic-release-action/issues/313)
+
+# [7.0.0](https://github.com/cycjimmy/semantic-release-action/compare/v6.0.0...v7.0.0) (2026-10-09)
+
+
+### Bug Fixes
+
+* **ci:** improve error handling and npm package installation ([b7ca30e](https://github.com/cycjimmy/semantic-release-action/commit/b7ca30e8f5630203651f721e521e114ee905bace))
+* **release:** update GitHub Actions workflow for enhanced permissions and Node.js setup ([45d484c](https://github.com/cycjimmy/semantic-release-action/commit/45d484c29bc15ed2b7cb63b79fab2024d8f5e228))
+
+
+### Features
+
+* upgrade deps ([3341766](https://github.com/cycjimmy/semantic-release-action/commit/3341766fa2b64a1ede0f9e0fba9d8a63d57f26f2)), closes [#302](https://github.com/cycjimmy/semantic-release-action/issues/302)
+
+
+### Performance Improvements
+
+* require semantic-release v16 or above and remove branch input ([3d0cb78](https://github.com/cycjimmy/semantic-release-action/commit/3d0cb78a35a8c728aaf92f57448f7a366a501728))
+
+
+### BREAKING CHANGES
+
+* require semantic-release v16 or above and remove branch input
+* upgrade deps and use module type
+
 # [6.0.0](https://github.com/cycjimmy/semantic-release-action/compare/v5.0.2...v6.0.0) (2025-11-17)
 
 

package/index.js

@@ -1,5 +1,9 @@
-const exec = require('./src/_exec');
-const path = require('path');
+import exec from './src/_exec.js';
+import path, {dirname} from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
 
 const run = async () => {
   // Install Dependencies
@@ -13,7 +17,13 @@ const run = async () => {
     }
   }
 
-  require('./src/index')();
+  const mod = await import('./src/index.js');
+  await mod.default();
 };
 
-run().catch(console.error);
+run().catch((error) => {
+  console.error(error instanceof Error ? error.stack : error);
+
+  // Exit with a non-zero code so the workflow step is marked as failed
+  process.exitCode = 1;
+});

package/package.json

@@ -1,8 +1,9 @@
 {
   "name": "@cycjimmy/semantic-release-action",
-  "version": "6.0.0",
+  "version": "7.1.1",
   "description": "GitHub Action for Semantic Release",
   "main": "index.js",
+  "type": "module",
   "scripts": {
     "test": "echo \"Error: no test specified\" && exit 1"
   },
@@ -21,11 +22,10 @@
   },
   "homepage": "https://github.com/cycjimmy/semantic-release-action#readme",
   "dependencies": {
-    "@actions/core": "^1.11.1",
-    "@actions/io": "^2.0.0",
-    "@cycjimmy/awesome-js-funcs": "^4.0.9",
-    "@semantic-release/changelog": "^6.0.3",
-    "@semantic-release/git": "^10.0.1",
-    "semantic-release": "^25.0.2"
+    "@actions/core": "^3.0.1",
+    "@actions/io": "^3.0.2",
+    "@semantic-release/changelog": "^7.0.0",
+    "@semantic-release/git": "^11.0.1",
+    "semantic-release": "^25.0.9"
   }
 }

package/src/_exec.js

@@ -1,2 +1,4 @@
-const util = require('util');
-module.exports = util.promisify(require('child_process').exec);
+import { promisify } from 'util';
+import { exec } from 'child_process';
+
+export default promisify(exec);

package/src/assertSemanticReleaseVersion.task.js

@@ -0,0 +1,22 @@
+import * as core from '@actions/core';
+
+const MINIMUM_MAJOR_VERSION = 16;
+
+/**
+ * Assert the installed semantic-release version is supported (v16 or above)
+ * @returns {Promise<void>}
+ * @throws {Error} when the installed semantic-release major version is below the minimum
+ */
+export default async () => {
+  const { default: { version } } = await import('semantic-release/package.json', { with: { type: 'json' } });
+  const majorVersion = Number(version.replace(/\..+/g, ''));
+  core.debug(`semantic-release version: ${version}`);
+
+  if (Number.isNaN(majorVersion) || majorVersion < MINIMUM_MAJOR_VERSION) {
+    throw new Error(
+      `Unsupported semantic-release version: ${version}. ` +
+      `This action requires semantic-release v${MINIMUM_MAJOR_VERSION} or above. ` +
+      `Update the 'semantic_version' input to v${MINIMUM_MAJOR_VERSION} or above, or remove it to use the latest version.`
+    );
+  }
+};

package/src/cleanupNpmrc.task.js

@@ -1,9 +1,9 @@
-const io = require('@actions/io');
+import * as io from '@actions/io';
 
 /**
  * Clean up `.npmrc` file in the repo after releasing
  * @returns {Promise<never>}
  */
-module.exports = async () => {
+export default async () => {
   await io.rmRF('.npmrc');
 };

package/src/handleError.js

@@ -0,0 +1,32 @@
+import * as core from '@actions/core';
+
+const EGITNOPERMISSION_HINT =
+  `Push permission check failed (EGITNOPERMISSION). If you use the default GITHUB_TOKEN, ` +
+  `grant write access to the job, e.g. "permissions: contents: write". ` +
+  `This is also required in dry-run mode: semantic-release verifies push permission with "git push --dry-run". ` +
+  `See https://github.com/cycjimmy/semantic-release-action#dry_run`;
+
+/**
+ * Check whether an error, or any aggregated sub-error, has the given code.
+ * @param {Error|String} error
+ * @param {String} code
+ * @returns {Boolean}
+ */
+const hasErrorCode = (error, code) =>
+  error?.code === code ||
+  (Array.isArray(error?.errors) && error.errors.some((subError) => hasErrorCode(subError, code)));
+
+/**
+ * Report a failed release to GitHub Actions, adding extra hints for known semantic-release error codes.
+ * @param {Error|String} error
+ * @returns {void}
+ */
+const handleError = (error) => {
+  if (hasErrorCode(error, 'EGITNOPERMISSION')) {
+    core.warning(EGITNOPERMISSION_HINT);
+  }
+
+  core.setFailed(error);
+};
+
+export default handleError;

package/src/handleOptions.js

@@ -1,51 +1,69 @@
-const core = require('@actions/core');
-const stringToJson = require('@cycjimmy/awesome-js-funcs/cjs/typeConversion/stringToJson.cjs').default;
-const inputs = require('./inputs.json');
+import * as core from '@actions/core';
+import fs from 'fs';
+import stringToJson from './stringToJson.js';
+import inputs from './inputs.json' with { type: 'json' };
 
 /**
  * Handle Branches Option
- * @returns {{}|{branch: string}}
+ * @returns {{}|{branches: string|Array}}
  */
-exports.handleBranchesOption = () => {
+export const handleBranchesOption = () => {
   const branchesOption = {};
   const branches = core.getInput(inputs.branches);
-  const branch = core.getInput(inputs.branch);
-
   core.debug(`branches input: ${branches}`);
-  core.debug(`branch input: ${branch}`);
 
-  const semanticVersion = require('semantic-release/package.json').version;
-  const semanticMajorVersion = Number(semanticVersion.replace(/\..+/g, ''));
-  core.debug(`semanticMajorVersion: ${semanticMajorVersion}`);
+  if (!branches) {
+    return branchesOption;
+  }
 
-  // older than v16
-  if (semanticMajorVersion < 16) {
-    if (!branch) {
-      return branchesOption;
-    }
+  const jsonOrStr = stringToJson('' + branches);
+  core.debug(`Converted branches attribute: ${JSON.stringify(jsonOrStr)}`);
+  branchesOption.branches = jsonOrStr;
+  return branchesOption;
+};
 
-    branchesOption.branch = branch;
-    return branchesOption;
+/**
+ * Warn about removed legacy inputs. The `branch` input is no longer declared
+ * in action.yml; the runner still exports it as INPUT_BRANCH when users pass it.
+ */
+export const warnDeprecatedInputs = () => {
+  // hardcoded: 'branch' was removed from inputs.json
+  const branch = core.getInput('branch');
+
+  if (branch) {
+    core.warning(
+      `The 'branch' input is no longer supported and will be ignored. ` +
+      `Use the 'branches' input instead (requires semantic-release v16 or above). ` +
+      `See https://semantic-release.gitbook.io/semantic-release/usage/configuration#branches`
+    );
   }
+};
 
-  // above v16
-  const strNeedConvertToJson = branches || branch || '';
+/**
+ * Warn when the working directory has no package.json and the npm default
+ * plugin is not skipped: @semantic-release/npm fails with ENOPKG in that case.
+ */
+export const warnIfNoPackageJson = () => {
+  const skipNpmPlugin = core.getInput(inputs.skip_npm_plugin) === 'true';
 
-  if (!strNeedConvertToJson) {
-    return branchesOption;
+  if (skipNpmPlugin || fs.existsSync('package.json')) {
+    return;
   }
 
-  const jsonOrStr = stringToJson('' + strNeedConvertToJson);
-  core.debug(`Converted branches attribute: ${JSON.stringify(jsonOrStr)}`);
-  branchesOption.branches = jsonOrStr;
-  return branchesOption;
+  core.warning(
+    `No package.json file found in ${process.cwd()}. ` +
+    `The default @semantic-release/npm plugin requires one and will fail with ` +
+    `"Missing package.json file." (ENOPKG). ` +
+    `If this is not a Node.js project, set the 'skip_npm_plugin' input to true, ` +
+    `or define a custom 'plugins' array without @semantic-release/npm in your release configuration.`
+  );
 };
 
 /**
  * Handle DryRun Option
  * @returns {{}|{dryRun: boolean}}
  */
-exports.handleDryRunOption = () => {
+export const handleDryRunOption = () => {
   const dryRun = core.getInput(inputs.dry_run);
   core.debug(`dryRun input: ${dryRun}`);
 
@@ -65,7 +83,7 @@ exports.handleDryRunOption = () => {
  * Handle Ci Option
  * @returns {{}|{ci: boolean}}
  */
-exports.handleCiOption = () => {
+export const handleCiOption = () => {
   const ci = core.getInput(inputs.ci);
   core.debug(`ci input: ${ci}`);
 
@@ -85,7 +103,7 @@ exports.handleCiOption = () => {
  * Handle Extends Option
  * @returns {{}|{extends: Array}|{extends: String}}
  */
-exports.handleExtends = () => {
+export const handleExtends = () => {
   const extend = core.getInput(inputs.extends);
   core.debug(`extend input: ${extend}`);
 
@@ -104,9 +122,9 @@ exports.handleExtends = () => {
  * Handle TagFormat Option
  * @returns {{}|{tagFormat: String}}
  */
-exports.handleTagFormat = () => {
+export const handleTagFormat = () => {
   const tagFormat = core.getInput(inputs.tag_format);
-  core.debug(`citagFormat input: ${tagFormat}`);
+  core.debug(`tagFormat input: ${tagFormat}`);
 
   if (tagFormat) {
     return {
@@ -119,15 +137,39 @@ exports.handleTagFormat = () => {
 
 /**
  * Handle repository-url Option
- * @returns {{}|{r: String}}
+ * @returns {{}|{repositoryUrl: String}}
  */
-exports.handleRepositoryUrlOption = () => {
+export const handleRepositoryUrlOption = () => {
   const repositoryUrl = core.getInput(inputs.repository_url);
   core.debug(`repository_url input: ${repositoryUrl}`);
 
   if (repositoryUrl) {
-    return { r: repositoryUrl };
+    return { repositoryUrl };
   } else {
     return {};
   }
 };
+
+/**
+ * Handle SkipNpmPlugin Option
+ * @returns {{}|{plugins: string[]}}
+ */
+export const handleSkipNpmPluginOption = () => {
+  const skipNpmPlugin = core.getInput(inputs.skip_npm_plugin);
+  core.debug(`skip_npm_plugin input: ${skipNpmPlugin}`);
+
+  switch (skipNpmPlugin) {
+    case 'true':
+      return {
+        plugins: [
+          '@semantic-release/commit-analyzer',
+          '@semantic-release/release-notes-generator',
+          '@semantic-release/github'
+        ]
+      };
+
+    case 'false':
+    default:
+      return {};
+  }
+};

package/src/index.js

@@ -1,18 +1,23 @@
-const core = require('@actions/core');
-const {
+import * as core from '@actions/core';
+import {
+  warnDeprecatedInputs,
+  warnIfNoPackageJson,
   handleBranchesOption,
   handleDryRunOption,
   handleCiOption,
   handleExtends,
   handleTagFormat,
   handleRepositoryUrlOption,
-} = require('./handleOptions');
-const setUpJob = require('./setUpJob.task');
-const installSpecifyingVersionSemantic = require('./installSpecifyingVersionSemantic.task');
-const preInstall = require('./preInstall.task');
-const cleanupNpmrc = require('./cleanupNpmrc.task');
-const windUpJob = require('./windUpJob.task');
-const inputs = require('./inputs.json');
+  handleSkipNpmPluginOption,
+} from './handleOptions.js';
+import handleError from './handleError.js';
+import setUpJob from './setUpJob.task.js';
+import installSpecifyingVersionSemantic from './installSpecifyingVersionSemantic.task.js';
+import assertSemanticReleaseVersion from './assertSemanticReleaseVersion.task.js';
+import preInstall from './preInstall.task.js';
+import cleanupNpmrc from './cleanupNpmrc.task.js';
+import windUpJob from './windUpJob.task.js';
+import inputs from './inputs.json' with { type: 'json' };
 
 /**
  * Release main task
@@ -23,7 +28,10 @@ const release = async () => {
     process.chdir(core.getInput(inputs.working_directory));
   }
   await setUpJob();
+  warnDeprecatedInputs();
+  warnIfNoPackageJson();
   await installSpecifyingVersionSemantic();
+  await assertSemanticReleaseVersion();
   await preInstall(core.getInput(inputs.extra_plugins));
   await preInstall(core.getInput(inputs.extends));
 
@@ -33,20 +41,22 @@ const release = async () => {
   }
 
   const semanticRelease = await import('semantic-release');
+  const branchesOption = handleBranchesOption();
   const result = await semanticRelease.default({
-    ...handleBranchesOption(),
+    ...branchesOption,
     ...handleDryRunOption(),
     ...handleCiOption(),
     ...handleExtends(),
     ...handleTagFormat(),
-    ...handleRepositoryUrlOption()
+    ...handleRepositoryUrlOption(),
+    ...handleSkipNpmPluginOption()
   });
 
   await cleanupNpmrc();
   await windUpJob(result);
 };
 
-module.exports = () => {
+export default async () => {
   core.debug('Initialization successful');
-  release().catch(core.setFailed);
+  release().catch(handleError);
 };

package/src/inputs.json

@@ -1,7 +1,6 @@
 {
   "semantic_version": "semantic_version",
   "branches": "branches",
-  "branch": "branch",
   "extra_plugins": "extra_plugins",
   "dry_run": "dry_run",
   "ci": "ci",
@@ -9,5 +8,6 @@
   "extends": "extends",
   "working_directory": "working_directory",
   "tag_format": "tag_format",
-  "repository_url": "repository_url"
+  "repository_url": "repository_url",
+  "skip_npm_plugin": "skip_npm_plugin"
 }

package/src/installSpecifyingVersionSemantic.task.js

@@ -1,21 +1,36 @@
-const path = require('path');
-const core = require('@actions/core');
-const exec = require('./_exec');
-const inputs = require('./inputs.json');
+import * as core from '@actions/core';
+import runNpm from './runNpm.js';
+import isNpmSpec from './isNpmSpec.js';
+import inputs from './inputs.json' with { type: 'json' };
+import path, {dirname} from 'path';
+import { fileURLToPath } from 'url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
 
 /**
  * Install Specifying Version semantic-release
  * @returns {Promise<void>}
  */
-module.exports = async () => {
+export default async () => {
   const semantic_version = core.getInput(inputs.semantic_version);
+
+  // Reject implausible version specs early (also prevents silently falling
+  // back to "latest"); the spec is passed to npm without a shell
+  if (semantic_version && !isNpmSpec(semantic_version)) {
+    throw new Error(`Invalid semantic_version input: ${semantic_version}`);
+  }
+
   const versionSuffix = semantic_version
     ? `@${semantic_version}`
     : '';
 
-  const {stdout, stderr} = await exec(`npm install semantic-release${versionSuffix} --no-audit --silent`, {
-    cwd: path.resolve(__dirname, '..')
-  });
+  const {stdout, stderr} = await runNpm(
+    ['install', `semantic-release${versionSuffix}`, '--no-audit', '--silent'],
+    {
+      cwd: path.resolve(__dirname, '..')
+    }
+  );
   core.debug(stdout);
   core.error(stderr);
 };

package/src/isNpmSpec.js

@@ -0,0 +1,8 @@
+// isNpmSpec.js
+// A plausible npm package/version spec: any characters except whitespace,
+// quotes and other shell-like punctuation (kept as defense in depth even
+// though the install commands run without a shell). A token starting with
+// `-` is rejected so it can never be read as an npm option/flag.
+const NPM_SPEC_PATTERN = /^[^\s'"`$;&(){}]+$/;
+
+export default (spec) => !spec.startsWith('-') && NPM_SPEC_PATTERN.test(spec);

package/src/preInstall.task.js

@@ -1,20 +1,48 @@
-const path = require('path');
-const core = require('@actions/core');
-const exec = require('./_exec');
+import path, {dirname} from 'path';
+import { fileURLToPath } from 'url';
+import * as core from '@actions/core';
+import runNpm from './runNpm.js';
+import isNpmSpec from './isNpmSpec.js';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
 
 /**
  * Pre-install extra dependecies
  * @returns {Promise<void>}
  */
-module.exports = async extras => {
+export default async extras => {
   if (!extras) {
     return Promise.resolve();
   }
 
-  const _extras = extras.replace(/['"]/g, '').replace(/[\n\r]/g, ' ');
+  // Split into tokens and keep only plausible npm package specs: specs are
+  // passed to npm without a shell, and tokens starting with `-` are dropped
+  // so they can never be read as npm options
+  const extrasList = extras
+    .replace(/['"]/g, '')
+    .split(/\s+/)
+    .filter(Boolean);
+  const validSpecs = extrasList.filter((spec) => isNpmSpec(spec));
+  const invalidTokens = extrasList.filter((spec) => !isNpmSpec(spec));
+
+  if (invalidTokens.length) {
+    core.warning(`Ignored invalid package specs: ${invalidTokens.join(', ')}`);
+  }
+
+  if (!validSpecs.length) {
+    return Promise.resolve();
+  }
+
+  core.debug(`Installing extra packages: ${validSpecs.join(', ')}`);
+
   const silentFlag = process.env.RUNNER_DEBUG === '1' ? '' : '--silent';
+  const args = ['install', ...validSpecs, '--no-audit'];
+  if (silentFlag) {
+    args.push(silentFlag);
+  }
 
-  const { stdout, stderr } = await exec(`npm install ${_extras} --no-audit ${silentFlag}`, {
+  const { stdout, stderr } = await runNpm(args, {
     cwd: path.resolve(__dirname, '..')
   });
   core.debug(stdout);

package/src/runNpm.js

@@ -0,0 +1,50 @@
+import fs from 'fs';
+import path from 'path';
+import { promisify } from 'util';
+import { execFile } from 'child_process';
+
+const execFileAsync = promisify(execFile);
+
+// npm's cli entry bundled with the running Node distribution. Running npm
+// through the current Node executable keeps the invocation shell-free on
+// every platform (spawning `npm.cmd` on Windows would require a shell).
+const resolveNpmCliPath = () => {
+  const nodeDir = path.dirname(process.execPath);
+
+  // Layout of the official Node distributions:
+  // - Windows: <node-dir>/node_modules/npm/bin/npm-cli.js
+  // - POSIX:   <node-dir>/../lib/node_modules/npm/bin/npm-cli.js
+  const npmCliPath = process.platform === 'win32'
+    ? path.join(nodeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js')
+    : path.join(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js');
+
+  return fs.existsSync(npmCliPath) ? npmCliPath : '';
+};
+
+/**
+ * Run npm with the given argument list without a shell.
+ * Every argument is passed as a single argv element, so user-provided
+ * package specs can never be interpreted as shell commands.
+ * @param {string[]} args
+ * @param {Object} [options] child_process options (e.g. cwd)
+ * @returns {Promise<{stdout: string, stderr: string}>}
+ */
+export default async (args, options = {}) => {
+  const npmCliPath = resolveNpmCliPath();
+
+  if (npmCliPath) {
+    return execFileAsync(process.execPath, [npmCliPath, ...args], options);
+  }
+
+  if (process.platform === 'win32') {
+    // `npm` on Windows is npm.cmd, which cannot be spawned without a shell.
+    // Fail with a clear message instead of an opaque ENOENT.
+    throw new Error(
+      'Unable to locate npm-cli.js for the current Node installation on Windows. ' +
+      'semantic-release-action requires Node to be installed with npm bundled.'
+    );
+  }
+
+  // Non-Windows fallback: plain `npm` executable from PATH
+  return execFileAsync('npm', args, options);
+};

package/src/setUpJob.task.js

@@ -1,17 +1,22 @@
-const path = require('path');
-const core = require('@actions/core');
-const outputs = require('./outputs.json');
+import path, { dirname } from 'path';
+import { fileURLToPath } from 'url';
+import * as core from '@actions/core';
+import outputs from './outputs.json' with { type: 'json' };
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = dirname(__filename);
 
 /**
  * setUpJob
  * @returns {Promise<void>}
  */
-module.exports = async () => {
-  // set outputs default
+export default async () => {
+  // set defaults for all outputs so they always exist
+  Object.values(outputs).forEach((output) => {
+    core.setOutput(output, '');
+  });
   core.setOutput(outputs.new_release_published, 'false');
 
   core.debug('action_workspace: ' + path.resolve(__dirname, '..'));
   core.debug('process.cwd: ' + process.cwd());
-
-  return Promise.resolve();
 };

package/src/stringToJson.js

@@ -0,0 +1,15 @@
+// stringToJson.js
+// NOTE: The input string is evaluated as a JavaScript expression. This is
+// required for backward compatibility with documented `branches` configs
+// which use JS syntax (single-quoted strings, unquoted object keys), so it
+// must only be fed with trusted input from the workflow file.
+const strToJsonFunc = (str) => (new Function(`return ${str}`))();
+const strToJson = (str) => {
+  try {
+    return strToJsonFunc(str);
+  } catch (e) {
+    return str;
+  }
+};
+
+export default (str) => strToJson(str);

package/src/windUpJob.task.js

@@ -1,14 +1,13 @@
-const core = require('@actions/core');
-const outputs = require('./outputs.json');
+import * as core from '@actions/core';
+import outputs from './outputs.json' with { type: 'json' };
 
 /**
  * windUpJob
  * @param result
  * @returns {Promise<void>}
  */
-module.exports = async (result) => {
-  const resolved = await result;
-  if (!resolved) {
+export default async (result) => {
+  if (!result) {
     core.debug('No release published.');
     return;
   }
@@ -18,7 +17,7 @@ module.exports = async (result) => {
     commits = [],
     nextRelease = {},
     releases = [],
-  } = resolved;
+  } = result;
 
   if (lastRelease?.version) {
     core.debug(`The last release was "${lastRelease.version}".`);
@@ -48,7 +47,7 @@ module.exports = async (result) => {
   core.setOutput(outputs.new_release_minor_version, minor);
   core.setOutput(outputs.new_release_patch_version, patch);
   core.setOutput(outputs.new_release_channel, channel);
-  core.setOutput(outputs.new_release_notes, notes);  
+  core.setOutput(outputs.new_release_notes, notes);
   core.setOutput(outputs.new_release_git_head, gitHead);
   core.setOutput(outputs.new_release_git_tag, gitTag);
 };