[@semantic-release/github] step fails with 404 error when trying to access non-existent PR # 1

[iamkun]

Current behavior

success step fails with 404 error when trying to access non-existent PR # 1

Bug Report

semantic-release version: 24.2.7
@semantic-release/github version: (latest installed via npm install -g)
Node version: 22.18.0
npm version: (from GitHub Actions)
Platform: GitHub Actions (ubuntu-latest)

Description

The semantic-release process completes successfully (npm package is published, GitHub release is created), but fails at the final success step when @semantic-release/github tries to access a non-existent Pull Request # 1.

Steps to Reproduce

1. Run semantic-release on a repository with the following configuration:

   • Default semantic-release setup with @semantic-release/changelog, @semantic-release/git, and @semantic-release/github plugins
   • Repository: https://github.com/iamkun/dayjs
   • Triggered by push to master branch

2. The release process works fine until the success step

Actual Behavior

The success step fails with a 404 error when trying to access /repos/iamkun/dayjs/pulls/1/commits, even though the commits being analyzed reference PR semantic-release/semantic-release#2920 (iamkun/dayjs#2920), not PR semantic-release/semantic-release#1.

Commit Analysis Context

The semantic-release found 8 commits since the last release, including:

• Merge pull request semantic-release/semantic-release#2920 from iamkun/dev
• Several other commits with fix/chore/test prefixes

None of the analyzed commits reference PR semantic-release/semantic-release#1, yet the plugin attempts to access it.

Questions/Concerns

1. Why is the plugin trying to access PR # 1? The commits being analyzed reference PR # 2920 (d2m iamkun/dayjs#2920), not PR # 1. How does the plugin determine which PRs to process?

2. Is there a configuration to prevent this? Can we configure the plugin to skip PR processing or handle missing PRs more gracefully?

Github Action

https://github.com/iamkun/dayjs/blob/dev/.github/workflows/release.yml

Logs

https://github.com/iamkun/dayjs/actions/runs/17285905464/job/49063050009

Expected behavior

The success step should complete without errors, or gracefully handle non-existent PRs.

semantic-release version

24.2.7

CI environment

Github Action

Plugins used

@semantic-release/changelog
@semantic-release/git

semantic-release configuration

https://github.com/iamkun/dayjs/blob/dev/.releaserc

{
"branches": ["master"],
"prepare": [
{
"path": "@semantic-release/changelog"
},
[
"@semantic-release/git",
{
"assets": [
"CHANGELOG.md"
]
}
]
]
}

CI logs

Run npm install -g @semantic-release/changelog @semantic-release/git semantic-release
  npm install -g @semantic-release/changelog @semantic-release/git semantic-release
  semantic-release
  shell: /usr/bin/bash -e {0}
  env:
    GITHUB_TOKEN: ***
    NPM_TOKEN: ***

added 322 packages in 7s

103 packages are looking for funding
  run `npm fund` for details
[4:37:59 AM] [semantic-release] › ℹ  Running semantic-release version 24.2.7
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/npm"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "verifyConditions" from "@semantic-release/github"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "analyzeCommits" from "@semantic-release/commit-analyzer"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "generateNotes" from "@semantic-release/release-notes-generator"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/changelog"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "prepare" from "@semantic-release/git"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/npm"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "publish" from "@semantic-release/github"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "addChannel" from "@semantic-release/npm"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "addChannel" from "@semantic-release/github"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "success" from "@semantic-release/github"
[4:38:00 AM] [semantic-release] › ✔  Loaded plugin "fail" from "@semantic-release/github"
[4:38:01 AM] [semantic-release] › ✔  Run automated release from branch master on repository https://github.com/iamkun/dayjs.git
[4:38:01 AM] [semantic-release] › ✔  Allowed to push to the Git repository
[4:38:01 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/npm"
[4:38:01 AM] [semantic-release] [@semantic-release/npm] › ℹ  Verify authentication for registry https://registry.npmjs.org/
[4:38:01 AM] [semantic-release] [@semantic-release/npm] › ℹ  Wrote NPM_TOKEN to /tmp/e424f65a0adda158bec1ed4d8e1b24/.npmrc
iamkun
[4:38:01 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/npm"
[4:38:01 AM] [semantic-release] › ℹ  Start step "verifyConditions" of plugin "@semantic-release/github"
[4:38:01 AM] [semantic-release] [@semantic-release/github] › ℹ  Verify GitHub authentication (https://api.github.com)
[4:38:01 AM] [semantic-release] › ✔  Completed step "verifyConditions" of plugin "@semantic-release/github"
[4:38:01 AM] [semantic-release] › ℹ  Found git tag v1.11.14 associated with version 1.11.14 on branch master
[4:38:01 AM] [semantic-release] › ℹ  Found 8 commits since last release
[4:38:01 AM] [semantic-release] › ℹ  Start step "analyzeCommits" of plugin "@semantic-release/commit-analyzer"
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: Merge pull request semantic-release/semantic-release#2920 from iamkun/dev

d2m
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The commit should not trigger a release
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: fix: Fix misspellings in Irish or Irish Gaelic [ga] (#2861)

For authoritative forms see e.g. 
https://www.tearma.ie/q/October/

[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The release type for the commit is patch
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: chore: update workflows
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The commit should not trigger a release
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: chore: update workflows
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The commit should not trigger a release
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: chore: update workflows
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The commit should not trigger a release
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: test: update test case (#2917)
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The commit should not trigger a release
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: test: update test case (#2916)

* test: update test case

* test: update test case
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The commit should not trigger a release
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analyzing commit: chore: update workflows (#2915)

* chore: update workflows

* chore: update workflows

* chore: update workflows

* chore: update workflows

* chore: update workflows

* chore: update workflows

* chore: update workflows

* chore: update workflows

* chore: update workflows

* chore: update workflows
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  The commit should not trigger a release
[4:38:01 AM] [semantic-release] [@semantic-release/commit-analyzer] › ℹ  Analysis of 8 commits complete: patch release
[4:38:01 AM] [semantic-release] › ✔  Completed step "analyzeCommits" of plugin "@semantic-release/commit-analyzer"
[4:38:01 AM] [semantic-release] › ℹ  The next release version is 1.11.15
[4:38:01 AM] [semantic-release] › ℹ  Start step "generateNotes" of plugin "@semantic-release/release-notes-generator"
[4:38:01 AM] [semantic-release] › ✔  Completed step "generateNotes" of plugin "@semantic-release/release-notes-generator"
[4:38:01 AM] [semantic-release] › ℹ  Start step "prepare" of plugin "@semantic-release/changelog"
[4:38:01 AM] [semantic-release] [@semantic-release/changelog] › ℹ  Update /home/runner/work/dayjs/dayjs/CHANGELOG.md
[4:38:01 AM] [semantic-release] › ✔  Completed step "prepare" of plugin "@semantic-release/changelog"
[4:38:02 AM] [semantic-release] › ℹ  Start step "prepare" of plugin "@semantic-release/git"
[4:38:02 AM] [semantic-release] [@semantic-release/git] › ℹ  Found 1 file(s) to commit
[4:38:05 AM] [semantic-release] [@semantic-release/git] › ℹ  Prepared Git release: v1.11.15
[4:38:05 AM] [semantic-release] › ✔  Completed step "prepare" of plugin "@semantic-release/git"
[4:38:05 AM] [semantic-release] › ℹ  Start step "generateNotes" of plugin "@semantic-release/release-notes-generator"
[4:38:05 AM] [semantic-release] › ✔  Completed step "generateNotes" of plugin "@semantic-release/release-notes-generator"
[4:38:06 AM] [semantic-release] › ✔  Created tag v1.11.15
[4:38:06 AM] [semantic-release] › ℹ  Start step "publish" of plugin "@semantic-release/npm"
[4:38:06 AM] [semantic-release] [@semantic-release/npm] › ℹ  Write version 1.11.15 to package.json in /home/runner/work/dayjs/dayjs
v1.11.15
[4:38:06 AM] [semantic-release] [@semantic-release/npm] › ℹ  Publishing version 1.11.15 to npm registry on dist-tag latest
npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish scripts entry "lint" was fixed to remove node_modules/.bin reference
npm warn publish "repository.url" was normalized to "git+https://github.com/iamkun/dayjs.git"
npm notice
npm notice 📦  dayjs@1.11.15
npm notice Publishing to https://registry.npmjs.org/ with tag latest and default access
+ dayjs@1.11.15
[4:38:10 AM] [semantic-release] [@semantic-release/npm] › ℹ  Published dayjs@1.11.15 to dist-tag @latest on https://registry.npmjs.org/
[4:38:10 AM] [semantic-release] › ✔  Completed step "publish" of plugin "@semantic-release/npm"
[4:38:10 AM] [semantic-release] › ℹ  Start step "publish" of plugin "@semantic-release/github"
[4:38:10 AM] [semantic-release] [@semantic-release/github] › ℹ  Published GitHub release: https://github.com/iamkun/dayjs/releases/tag/v1.11.15
[4:38:10 AM] [semantic-release] › ✔  Completed step "publish" of plugin "@semantic-release/github"
[4:38:10 AM] [semantic-release] › ℹ  Start step "success" of plugin "@semantic-release/github"
[4:38:26 AM] [semantic-release] › ✘  Failed step "success" of plugin "@semantic-release/github"
[4:38:26 AM] [semantic-release] › ✘  An error occurred while running semantic-release: RequestError [HttpError]: Not Found - https://docs.github.com/rest/pulls/pulls#list-commits-on-a-pull-request
    at fetchWrapper (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/@octokit/request/dist-bundle/index.js:122:11)
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async requestWithGraphqlErrorHandling (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/@octokit/plugin-retry/dist-bundle/index.js:36:20)
    at async Job.doExecute (/opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/bottleneck/light.js:405:18) {
  status: 404,
  request: {
    method: 'GET',
    url: 'https://api.github.com/repos/iamkun/dayjs/pulls/1/commits',
    headers: {
      accept: 'application/vnd.github.v3+json',
      'user-agent': '@semantic-release/github v11.0.4 octokit-core.js/7.0.3 Node.js/22',
      authorization: 'token [REDACTED]'
    },
    request: {
      agent: undefined,
      hook: [Function: bound bound register],
      retryCount: 3,
      retries: 3,
      retryAfter: 16
    }
  },
  response: {
    url: 'https://api.github.com/repos/iamkun/dayjs/pulls/1/commits',
    status: 404,
    headers: {
      'access-control-allow-origin': '*',
      'access-control-expose-headers': 'ETag, Link, Location, Retry-After, X-GitHub-OTP, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Used, X-RateLimit-Resource, X-RateLimit-Reset, X-OAuth-Scopes, X-Accepted-OAuth-Scopes, X-Poll-Interval, X-GitHub-Media-Type, X-GitHub-SSO, X-GitHub-Request-Id, Deprecation, Sunset',
      'content-encoding': 'gzip',
      'content-security-policy': "default-src 'none'",
      'content-type': 'application/json; charset=utf-8',
      date: 'Thu, 28 Aug 2025 04:38:26 GMT',
      'referrer-policy': 'origin-when-cross-origin, strict-origin-when-cross-origin',
      server: 'github.com',
      'strict-transport-security': 'max-age=31536000; includeSubdomains; preload',
      'transfer-encoding': 'chunked',
      vary: 'Accept-Encoding, Accept, X-Requested-With',
      'x-accepted-github-permissions': 'pull_requests=read',
      'x-content-type-options': 'nosniff',
      'x-frame-options': 'deny',
      'x-github-api-version-selected': '2022-11-28',
      'x-github-media-type': 'github.v3; format=json',
      'x-github-request-id': '6C20:23E6D2:4753F2:10245B7:68AFDD42',
      'x-ratelimit-limit': '5000',
      'x-ratelimit-remaining': '4970',
      'x-ratelimit-reset': '1756358327',
      'x-ratelimit-resource': 'core',
      'x-ratelimit-used': '30',
      'x-xss-protection': '0'
    },
    data: {
      message: 'Not Found',
      documentation_url: 'https://docs.github.com/rest/pulls/pulls#list-commits-on-a-pull-request',
      status: '404'
    }
  },
  pluginName: '@semantic-release/github'
}
AggregateError: 
    HttpError: Not Found - https://docs.github.com/rest/pulls/pulls#list-commits-on-a-pull-request
        at fetchWrapper (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/@octokit/request/dist-bundle/index.js:122:11)
        at async requestWithGraphqlErrorHandling (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/@octokit/plugin-retry/dist-bundle/index.js:36:20)
        at async Job.doExecute (/opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/bottleneck/light.js:405:18)
    at file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/lib/plugins/pipeline.js:55:13
    at async pluginsConfigAccumulator.<computed> [as success] (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/lib/plugins/index.js:87:11)
    at async run (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/index.js:218:3)
    at async Module.default (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/index.js:278:22)
    at async default (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/cli.js:55:5) {
  errors: [
    RequestError [HttpError]: Not Found - https://docs.github.com/rest/pulls/pulls#list-commits-on-a-pull-request
        at fetchWrapper (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/@octokit/request/dist-bundle/index.js:122:11)
        at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
        at async requestWithGraphqlErrorHandling (file:///opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/@octokit/plugin-retry/dist-bundle/index.js:36:20)
        at async Job.doExecute (/opt/hostedtoolcache/node/22.18.0/x64/lib/node_modules/semantic-release/node_modules/bottleneck/light.js:405:18) {
      status: 404,
      request: [Object],
      response: [Object],
      pluginName: '@semantic-release/github'
    }
  ]
}
Error: Process completed with exit code 1.

[iamkun]

I did some further investigation using the GitHub GraphQL API with same code in @semantic-release/github and found the following:

When querying the commit for associated pull requests, the associatedPullRequests field returns two PR nodes with chunk id 'b37431d84403689d7eb86b854925e21509dc78bc' , owner 'iamkun', repo 'dayjs':

[
  {
    "__typename": "PullRequest",
    "id": "MDExOlB1bGxSZXF1ZXN0NjM3NDAxMjE5",
    "title": "Merge original repo",
    "number": 1,
    "url": "https://github.com/A973C/dayjs/pull/1",
    "state": "OPEN",
    "author": { "login": "A973C", "url": "https://github.com/A973C" },
    "mergeable": "MERGEABLE",
    "changedFiles": 378,
    "commits": { "totalCount": 954 }
  },
  {
    "__typename": "PullRequest",
    "id": "PR_kwDOB675s86mBUDu",
    "title": "d2m",
    "number": 2921,
    "url": "https://github.com/iamkun/dayjs/pull/2921",
    "state": "MERGED",
    "author": { "login": "iamkun", "url": "https://github.com/iamkun" },
    "mergeable": "UNKNOWN",
    "changedFiles": 5,
    "commits": { "totalCount": 3 }
  }
]

The PR number 2921 is the correct one that triggered the semantic-release CI workflow. However, the query also returns PR number 1, which is from a forked repository and unrelated. Since PR semantic-release/semantic-release#1 does not exist in the main repository, attempting to access it causes the 404 error observed in the success step.

Suggestion: It would be helpful if the plugin logic included a check to filter out PRs from forks or verify that a PR exists in the repository before attempting to fetch commits. This would prevent 404 errors and allow the success step to complete gracefully.

[iamkun]

Additionally, you can directly check the GitHub REST API endpoint for this commit:

https://api.github.com/repos/iamkun/dayjs/commits/b37431d84403689d7eb86b854925e21509dc78bc/pulls

It clearly shows two associated pull requests, matching what I observed with the GraphQL query:

1. PR fix(cli): npm install abbrev semantic-release#1 — from a forked repository, unrelated to the release.
2. PR chore(deps): update dependency p-retry to v6 semantic-release#2921 — the correct PR that triggered the semantic-release workflow.