Repository: semantic-release/semantic-release (js)

Issue:
semantic-release --no-ci logs [secure]ecure][[secure]9[secu...
## Current behavior

```
$ ./node_modules/.bin/semantic-release --no-ci
[secure]ecure][[secure]9[secure]0[secure]m[secure][[secure]S[secure]e[secure]m[secure]a[secure]n[secure]t[secure]i[secure]c[secure] [secure]r[secure]e[secure]l[secure]e[secure]a[secure]s[secure]e[secure]][secure]:[secur....
```

## Expected behavior

should only mask sensitive tokens

## Environment

- **semantic-release** version: 13.1.3, 12.4.1
- Plugins used: none
- **semantic-release** configuration: 
  ```json
  "release": {
    "publish": [
      "@semantic-release/npm",
      {
        "path": "@semantic-release/github",
        "assets": [
          "dist/*"
        ]
      }
    ]
  }
  ```
- CI logs: does not apply

Pull request description:
fix: exclude empty env var value from replacement
Fix #646

Patch:
diff --git a/lib/hide-sensitive.js b/lib/hide-sensitive.js
index cd5709e..1fbd834 100644
--- a/lib/hide-sensitive.js
+++ b/lib/hide-sensitive.js
@@ -1,6 +1,9 @@
 const {escapeRegExp} = require('lodash');
 
-const toReplace = Object.keys(process.env).filter(envVar => /token|password|credential|secret|private/i.test(envVar));
+const toReplace = Object.keys(process.env).filter(
+  envVar => /token|password|credential|secret|private/i.test(envVar) && process.env[envVar].trim()
+);
+
 const regexp = new RegExp(toReplace.map(envVar => escapeRegExp(process.env[envVar])).join('|'), 'g');
 
 module.exports = output => {


Test patch:
diff --git a/test/hide-sensitive.test.js b/test/hide-sensitive.test.js
index 815f867..1109cb1 100644
--- a/test/hide-sensitive.test.js
+++ b/test/hide-sensitive.test.js
@@ -40,3 +40,18 @@ test.serial('Accept "undefined" input', t => {
 test.serial('Return same string if no environment variable has to be replaced', t => {
   t.is(require('../lib/hide-sensitive')('test'), 'test');
 });
+
+test.serial('Exclude empty environment variables from the regexp', t => {
+  process.env.SOME_PASSWORD = 'password';
+  process.env.SOME_TOKEN = '';
+  t.is(
+    require('../lib/hide-sensitive')(`https://user:${process.env.SOME_PASSWORD}@host.com?token=`),
+    'https://user:[secure]@host.com?token='
+  );
+});
+
+test.serial('Exclude empty environment variables from the regexp if there is only empty ones', t => {
+  process.env.SOME_PASSWORD = '';
+  process.env.SOME_TOKEN = ' \n ';
+  t.is(require('../lib/hide-sensitive')(`https://host.com?token=`), 'https://host.com?token=');
+});