bake-gem 0.13.1 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1921512c8e66685c7ced03e581fa8ecafea58e93720540dc80dd6ee84ebafaf9
-  data.tar.gz: 9ffa14838c160f994189bf54499420a891c6364d7629834c88b9babafdf30237
+  metadata.gz: 847773b347cc41d5b64aa246a96fc3770e932f15fe53121538156327a8e67a9f
+  data.tar.gz: e0396526fe9584882269a7326e99614885cc4e6f4c755d064e8cbf1f8af2e054
 SHA512:
-  metadata.gz: 76ef768494dcf189e0aaf4651a7c3c03bc0d5f4bcd0e87ccb5fd5c890f8d20b49ffb2149e523ae912d752a15ad2614f8dd2a1aaf6d0b5091890d749d9fac105e
-  data.tar.gz: 27740a73d10724a9b88d5bf880621a4c80e644ad5a6accd714b4014b67ba055e1548a0d9a8c83accd08ecddafb892bf7c64ce269ca55a05d8e876739e606635e
+  metadata.gz: 4b18cd961a2cfd4fc06bec5ed0389c6b3d1b8eb65ace189ae393c7bf6ab9838711322f82dad8e17cb62a69937d35e4f3a2ad15a9c4c19d0053182d6dc2d02abf
+  data.tar.gz: 51874bafe6a43e93c62f464502e074974df47a5d03ec7e7c204c7e0cfa730f0bcaaedf27c9e63e4bd375f81b84732404426a0dc95d94f914d06d80eeffa9d2fd

data/bake/gem/release/branch.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 # Released under the MIT License.
-# Copyright, 2021-2025, by Samuel Williams.
+# Copyright, 2021-2026, by Samuel Williams.
 
 # Increment the patch number of the current version.
 def patch
@@ -25,21 +25,15 @@ end
 def commit(bump, message: "Bump version.")
 	release = context.lookup("gem:release")
 	helper = release.instance.helper
-	gemspec = helper.gemspec
-	
-	# helper.guard_clean
-	
-	version_path = context.lookup("gem:release:version:increment").call(bump, message: message)
-	
-	if version_path
-		branch_name = helper.create_release_branch(version_path, message: message)
-	else
-		raise "Could not find version number!"
-	end
-	
-	return {
-		version: gemspec.version,
-		version_path: version_path,
-		branch: branch_name,
-	}
+	helper.guard_clean
+	helper.guard_last_commit_not_version_bump
+	path = helper.version_path or raise "Could not find version file!"
+	line = File.read(File.expand_path(path, helper.root))
+	version = nil
+	Bake::Gem::Version.update_version(line){|current| version = current.increment(bump)}
+	raise "Could not find version number!" unless version
+	branch_name = helper.create_release_branch(version: version.join)
+	result = context.lookup("gem:release:version:increment").call(bump, message: message)
+	helper.commit_version_changes(message: message)
+	return result.merge(branch: branch_name)
 end

data/bake/gem/release/version.rb

@@ -27,7 +27,7 @@ def increment(bump, message: "Bump version.")
 	helper = release.instance.helper
 	gemspec = helper.gemspec
 	
-	helper.update_version(bump) do |version|
+	version_path = helper.update_version(bump) do |version|
 		Console.info(self, "Updated version:", version: version)
 		
 		# Ensure that any subsequent tasks use the correct version!
@@ -35,10 +35,12 @@ def increment(bump, message: "Bump version.")
 		
 		after_increment(version)
 	end
+	raise "Could not find version number!" unless version_path
+	helper.guard_release_changes
 	
 	return {
 		version: gemspec.version,
-		version_path: helper.version_path,
+		version_path: version_path,
 	}
 end
 
@@ -52,18 +54,9 @@ def commit(bump, message: "Bump version.")
 	
 	helper.guard_clean
 	
-	version_path = increment(bump, message: message)
-	
-	if version_path
-		helper.commit_version_changes(message: message)
-	else
-		raise "Could not find version number!"
-	end
-	
-	return {
-		version: helper.gemspec.version,
-		version_path: version_path,
-	}
+	result = increment(bump, message: message)
+	helper.commit_version_changes(message: message)
+	return result
 end
 
 protected

data/bake/gem/release.rb

@@ -35,3 +35,13 @@ def major(tag: true)
 	release_task = context.lookup("gem:release")
 	release_task.call(tag: tag)
 end
+
+# Regenerate release content from the base commit and compare it with the candidate.
+# @parameter base [String] The current target commit (first parent when publishing).
+# @parameter candidate [String] The proposed or merged release commit.
+# @parameter optional [Boolean] Accept ordinary PRs with no version change.
+def validate(base:, candidate: "HEAD", optional: false)
+	require_relative "../../lib/bake/gem/helper"
+	require_relative "../../lib/bake/gem/release"
+	Bake::Gem::Release.new(context.root).validate(base: base, candidate: candidate, optional: optional)
+end

data/bake/gem.rb

@@ -21,18 +21,36 @@ def files
 	@helper.gemspec.files
 end
 
+# Inspect the gem name, version, and version file in the current checkout.
+def metadata
+	gemspec = @helper.gemspec
+	raise "No gemspec found." unless gemspec
+	
+	return {name: gemspec.name, version: gemspec.version.to_s, version_path: @helper.version_path}
+end
+
 # Build the gem into the pkg directory.
 # @parameter root [String] The root directory to build the gem into. Defaults to `pkg`.
-# @parameter signing_key [Boolean] Whether to use a signing key.
+# @parameter signing_key [String | Nil] A signing key path, "true" to require signing, or "false" to disable signing.
 def build(root: "pkg", signing_key: nil)
+	# Accept boolean command line options while preserving signing key paths:
+	signing_key = true if signing_key == "true"
+	signing_key = false if signing_key == "false"
+	
 	@helper.build_gem(root: root, signing_key: signing_key)
 end
 
 # Build and install the gem into system gems.
 # @parameter local [Boolean] only use locally available caches.
 def install(local: false)
-	# For installing the gem, don't bother with signinng it:
-	path = @helper.build_gem(signing_key: false)
+	changes = @helper.uncommitted_changes
+	
+	if changes.any?
+		Console.warn(self, "Installing from clean git worktree; uncommitted changes are not included in the installed gem.", changes: changes.map(&:chomp))
+	end
+	
+	# For installing the gem, don't bother with signing it:
+	path = @helper.build_gem_in_worktree(signing_key: false)
 	
 	arguments = []
 	arguments << "--local" if local
@@ -64,7 +82,7 @@ def release(tag: true)
 		raise
 	end
 	
-	@helper.push_release(current_branch: current_branch)
+	@helper.push_release(current_branch: current_branch, tag: tag_name)
 	context["after_gem_release"]&.call(name: @helper.gemspec.name, version: version, tag: tag_name, path: path)
 	
 	return {

data/context/getting-started.md

@@ -20,6 +20,8 @@ end
 
 ## Usage
 
+Run Bake tasks from the gem project's root directory. When using `Bake::Gem::Helper` directly, construct and use it with that directory as the process's working directory. Gemspec evaluation and packaging resolve relative paths there; the helper does not change the working directory.
+
 Before using `bake-gem`, ensure you have:
 
 1. A properly configured `gemspec` file in your project root
@@ -73,7 +75,7 @@ $ bake gem:release
 
 ### Automated CI/CD Pipeline
 
-For releasing gems via automated pipelines, use a two-step process:
+Use `bake-gem-github` for GitHub pull requests, native approval rules, Trusted Publishing and attestations. The provider-independent preparation tasks below work identically locally and in CI.
 
 #### Step 1: Create Release Branch (Locally)
 
@@ -83,22 +85,25 @@ $ bake gem:release:branch:patch  # or minor/major
 ```
 
 This will:
-- Create a new branch named `releases/v[new-version]`
+- Require a clean checkout on a branch
+- Create a new branch named `releases/v[new-version]` before modifying files
 - Bump the gem version
-- Commit the version change
-- Push the branch to origin
+- Run `after_gem_release_version_increment` and commit all changes, including added and deleted documentation
+
+This task does not push, open a PR, create tags or publish. Select a current base before running it; the GitHub companion additionally fetches and checks the default branch. Failed hooks leave changes available for inspection.
 
 #### Step 2: Release from CI (After Merge)
 
-Once the release branch is merged into main:
+The GitHub companion handles publishing the exact merged commit. To independently validate release content, supply the current target commit and proposed commit:
 
 ``` bash
-$ export RUBYGEMS_HOST=https://rubygems.org
-$ export GEM_HOST_API_KEY=your_api_key
-
-$ bake gem:release
+$ bundle exec bake gem:release:validate base=origin/main candidate=HEAD
 ```
 
+Validation creates a temporary checkout of the base, applies the proposed patch/minor/major bump, runs the same hooks, and compares the complete generated tree with the candidate. It never bumps the candidate again or modifies your checkout. Stale notes and unexpected file additions/deletions fail with a diff. A rebase passes when the generated content still matches. Hooks must be repeatable for the same source and version.
+
+For an ordinary PR check, add `optional=true` to accept candidates without a version change. After merge, use the merged commit's first parent as `base` and the merged commit as `candidate`; later changes on `main` do not affect that release boundary.
+
 ### Individual Commands
 
 You can also run individual steps:
@@ -113,6 +118,9 @@ $ bake gem:install
 # List files that will be included in the gem
 $ bake gem:files
 
+# Inspect the gem name, version, and version file as JSON
+$ bake gem:metadata output format=json
+
 # Build without signing
 $ bake gem:build signing_key=false
 ```
@@ -127,6 +135,8 @@ The tool automatically prevents consecutive version bumps by checking the last c
 ### Clean Worktree Building
 Gems are built in isolated git worktrees to ensure the build environment exactly matches your committed code, preventing issues with uncommitted changes affecting the build.
 
+Worktree builds and release validation run Bake tasks in fresh Ruby processes launched with the checkout as their working directory, so version constants and hook state come from each checkout. The parent process's working directory is unchanged.
+
 ### Repository Cleanliness Check
 Before any release operation, the tool ensures your repository has no uncommitted changes.
 
@@ -141,6 +151,12 @@ spec.signing_key = "path/to/private_key.pem"
 spec.cert_chain = ["path/to/certificate.pem"]
 ```
 
+To supply a signing key when building:
+
+``` bash
+$ bake gem:build signing_key=/path/to/private_key.pem
+```
+
 Or disable signing explicitly:
 
 ``` bash
@@ -186,11 +202,9 @@ $ bake gem:release:patch
 # Create release branch
 $ bake gem:release:branch:minor
 # Creates branch: releases/v1.3.0
-# Commits version bump
-# Pushes branch
+# Commits the version bump and release-hook output
+# Leaves the branch local for inspection
 
-# After code review and merge:
-$ git checkout main
-$ git pull
-$ bake gem:release
+# Validate before pushing or opening a PR:
+$ bake gem:release:validate base=main
 ```

data/context/index.yaml

@@ -3,6 +3,8 @@
 ---
 description: Release management for Ruby gems.
 metadata:
+  bug_tracker_uri: https://github.com/ioquatix/bake-gem/issues
+  changelog_uri: https://github.com/ioquatix/bake-gem/blob/main/releases.md
   documentation_uri: https://ioquatix.github.io/bake-gem/
   funding_uri: https://github.com/sponsors/ioquatix/
   source_code_uri: https://github.com/ioquatix/bake-gem.git

data/lib/bake/gem/helper.rb

@@ -82,11 +82,13 @@ module Bake
 		end
 		
 		# Helper class for performing gem-related operations like building, installing, and publishing gems.
+		# The process must already be in the gem project's root directory when constructing and using a helper.
+		# Gemspec evaluation and packaging resolve relative paths against that working directory; the helper does not change it.
 		class Helper
 			include Shell
 			
 			# Initialize a new helper with the specified root directory and optional gemspec.
-			# @parameter root [String] The root directory of the gem project.
+			# @parameter root [String] The root directory of the gem project, which must also be the process's working directory.
 			# @parameter gemspec [Gem::Specification | Nil] The gemspec to use, or nil to find it automatically.
 			def initialize(root = Dir.pwd, gemspec: nil)
 				@root = root
@@ -127,7 +129,8 @@ module Bake
 				# Guard against consecutive version bumps
 				guard_last_commit_not_version_bump
 				
-				lines = File.readlines(version_path)
+				path = File.expand_path(version_path, @root)
+				lines = File.readlines(path)
 				new_version = nil
 				
 				lines.each do |line|
@@ -137,7 +140,7 @@ module Bake
 				end
 				
 				if new_version
-					File.write(version_path, lines.join)
+					File.write(path, lines.join)
 					
 					if block_given?
 						yield new_version
@@ -151,7 +154,7 @@ module Bake
 			# @returns [Boolean] True if the repository is clean.
 			# @raises [RuntimeError] If there are uncommitted changes in the repository.
 			def guard_clean
-				lines = readlines("git", "status", "--porcelain", chdir: @root)
+				lines = uncommitted_changes
 				
 				if lines.any?
 					raise "Repository has uncommited changes!\n#{lines.join('')}"
@@ -160,6 +163,12 @@ module Bake
 				return true
 			end
 			
+			# Get the list of uncommitted changes in the repository.
+			# @returns [Array(String)] The porcelain status lines for uncommitted changes.
+			def uncommitted_changes
+				readlines("git", "status", "--porcelain", chdir: @root)
+			end
+			
 			# Verify that the last commit was not a version bump.
 			# @returns [Boolean] True if the last commit was not a version bump.
 			# @raises [RuntimeError] If the last commit was a version bump.
@@ -188,6 +197,7 @@ module Bake
 			# @returns [String] The path to the built gem package.
 			def build_gem(root: "pkg", signing_key: nil)
 				# Ensure the output directory exists:
+				root = File.expand_path(root, @root)
 				FileUtils.mkdir_p(root)
 				
 				output_path = File.join(root, @gemspec.file_name)
@@ -222,7 +232,7 @@ module Bake
 			# @parameter signing_key [String | Nil] The signing key to use for signing the package.
 			# @returns [String] The path to the built gem package.
 			def build_gem_in_worktree(root: "pkg", signing_key: nil)
-				original_pkg_path = File.join(@root, root)
+				original_pkg_path = File.expand_path(root, @root)
 				
 				# Create a unique temporary path for the worktree
 				timestamp = Time.now.strftime("%Y%m%d-%H%M%S-%N")
@@ -230,15 +240,13 @@ module Bake
 				
 				begin
 					# Create worktree from current HEAD
-					unless system("git", "worktree", "add", worktree_path, "HEAD", chdir: @root)
+					unless system("git", "worktree", "add", "--detach", worktree_path, "HEAD", chdir: @root)
 						raise "Failed to create git worktree. Make sure you have at least one commit in the repository."
 					end
 					
-					# Create helper for the worktree
-					worktree_helper = self.class.new(worktree_path)
-					
-					# Build gem directly into the target pkg directory
-					output_path = worktree_helper.build_gem(root: original_pkg_path, signing_key: signing_key)
+					# Build using the worktree's gemspec in a fresh interpreter:
+					require_relative "release"
+					output_path = Release.new(@root).bake(worktree_path, "gem:build", root: original_pkg_path, signing_key: signing_key)
 					
 					output_path
 				ensure
@@ -247,16 +255,16 @@ module Bake
 				end
 			end
 			
-			# Create a release branch, add the version file, and commit the changes.
-			# @parameter version_path [String] The path to the version file that was updated.
-			# @parameter message [String] The commit message to use.
+			# Create a release branch before generating release changes.
+			# @parameter version [String] The proposed release version.
 			# @returns [String] The name of the created branch.
-			def create_release_branch(version_path, message: "Bump version.")
-				branch_name = "release-v#{@gemspec.version}"
+			def create_release_branch(version:)
+				guard_clean
+				raise "Release preparation requires a branch checkout." unless current_branch
+				branch_name = "releases/v#{version}"
+				raise "Release tag v#{version} already exists." unless readlines("git", "tag", "--list", "v#{version}", chdir: @root).empty?
 				
 				system("git", "checkout", "-b", branch_name, chdir: @root)
-				system("git", "add", version_path, chdir: @root)
-				system("git", "commit", "-m", message, chdir: @root)
 				
 				return branch_name
 			end
@@ -264,10 +272,25 @@ module Bake
 			# Commit version changes to the current branch.
 			# @parameter message [String] The commit message to use.
 			def commit_version_changes(message: "Bump version.")
+				guard_release_changes
 				system("git", "add", "--all", chdir: @root)
 				system("git", "commit", "-m", message, chdir: @root)
 			end
 			
+			# Reject generated package output and private keys before staging release changes.
+			def guard_release_changes
+				paths = readlines("git", "diff", "--name-only", "--diff-filter=ACM", "-z", "HEAD", chdir: @root).join.split("\0")
+				paths.concat(readlines("git", "ls-files", "--others", "--exclude-standard", "-z", chdir: @root).join.split("\0"))
+				paths.uniq.each do |path|
+					raise "Release changes include build output: #{path}" if path.start_with?("pkg/") || path.end_with?(".gem")
+					absolute = File.expand_path(path, @root)
+					next unless File.file?(absolute) && !File.symlink?(absolute)
+					if File.binread(absolute).match?(/^-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----/)
+						raise "Release changes include a private key: #{path}"
+					end
+				end
+			end
+			
 			# Fetch remote tags and create a release tag for the specified version.
 			# @parameter tag [Boolean] Whether to tag the release.
 			# @parameter version [String] The version to tag.
@@ -292,13 +315,13 @@ module Bake
 			
 			# Push changes and tags to the remote repository.
 			# @parameter current_branch [String | Nil] The current branch name, or nil if not on a branch.
-			def push_release(current_branch: nil)
+			def push_release(current_branch: nil, tag: nil)
 				# If we are on a branch, push, otherwise just push the tags (assuming shallow checkout):
 				if current_branch
 					system("git", "push", chdir: @root)
 				end
 				
-				system("git", "push", "--tags", chdir: @root)
+				system("git", "push", "origin", "refs/tags/#{tag}", chdir: @root) if tag
 			end
 			
 			# Figure out if there is a current branch, if not, return `nil`.

data/lib/bake/gem/release.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+# Released under the MIT License.
+# Copyright, 2026, by Samuel Williams.
+
+require_relative "helper"
+require "json"
+require "tmpdir"
+
+module Bake
+	module Gem
+		# Regenerates release content from its base without modifying the checkout.
+		class Release
+			include Shell
+			
+			# Supported stable version increments.
+			BUMPS = {"patch" => [nil, nil, 1], "minor" => [nil, 1, 0], "major" => [1, 0, 0]}.freeze
+			
+			# @parameter root [String] The repository containing the commits to compare.
+			def initialize(root)
+				@root = File.expand_path(root)
+			end
+			
+			# Resolve a commit before passing it to other Git commands.
+			def resolve(reference)
+				git("rev-parse", "--verify", "--end-of-options", "#{reference}^{commit}").strip
+			end
+			
+			# Yield a temporary detached worktree and remove it even on failure.
+			def worktree(reference)
+				commit = resolve(reference)
+				Dir.mktmpdir("bake-gem-release-") do |directory|
+					path = File.join(directory, "source")
+					system("git", "worktree", "add", "--detach", path, commit, chdir: @root, out: File::NULL)
+					begin
+						yield path
+					ensure
+						system("git", "worktree", "remove", "--force", path, chdir: @root, out: File::NULL)
+					end
+				end
+			end
+			
+			# Run Bake tasks in a fresh interpreter, avoiding cached version constants.
+			# @parameter path [String] The checkout in which to run the tasks.
+			# @parameter arguments [Array(String)] Task names and command line arguments.
+			# @parameter options [Hash] Task options; nil values use the task defaults.
+			def bake(path, *arguments, **options)
+				Dir.mktmpdir("bake-gem-result-") do |directory|
+					result = File.join(directory, "result.json")
+					options.each{|key, value| arguments << "#{key}=#{value}" unless value.nil?}
+					system("bake", *arguments, "output", "file=#{result}", "format=json", chdir: path)
+					JSON.parse(File.read(result), symbolize_names: true)
+				end
+			end
+			
+			# Inspect a committed gem in isolation.
+			def metadata(reference)
+				worktree(reference) {|path| bake(path, "gem:metadata")}
+			end
+			
+			# Validate an ordinary patch, minor, or major transition.
+			def bump(previous, target)
+				unless previous.match?(/\A\d+\.\d+\.\d+\z/) && target.match?(/\A\d+\.\d+\.\d+\z/)
+					raise "Release validation supports stable three-part versions only."
+				end
+				BUMPS.each do |name, increment|
+					version = Version.new(previous.split(".").map(&:to_i), nil).increment(increment)
+					return name if version.join == target
+				end
+				raise "Unsupported release transition: #{previous} -> #{target}."
+			end
+			
+			# Compare an independently generated release tree to the candidate, including added and deleted files.
+			# @parameter base [String] Current target commit, or the merged commit's first parent when publishing.
+			# @parameter candidate [String] Proposed or merged release commit.
+			# @parameter optional [Boolean] Allow ordinary PRs which do not change the version.
+			def validate(base:, candidate: "HEAD", optional: false)
+				base = resolve(base)
+				candidate = resolve(candidate)
+				proposed = metadata(candidate)
+				worktree(base) do |path|
+					previous = bake(path, "gem:metadata")
+					raise "Release changes the gem name." unless proposed[:name] == previous[:name]
+					return nil if optional && proposed[:version] == previous[:version]
+					increment = bump(previous[:version], proposed[:version])
+					generated = bake(path, "gem:release:version:increment", BUMPS.fetch(increment).join(","))
+					raise "Generated version does not match proposal." unless generated[:version] == proposed[:version]
+					system("git", "add", "--all", chdir: path)
+					expected = readlines("git", "write-tree", chdir: path).join.strip
+					diff = git("diff", "--no-ext-diff", "--no-textconv", candidate, expected, "--")
+					raise "Release content is stale or contains unrelated changes. Expected changes:\n#{diff}" unless diff.empty?
+					return proposed.merge(base: base, commit: candidate, bump: increment)
+				end
+			end
+			
+			private
+			
+			def git(*arguments)
+				readlines("git", *arguments, chdir: @root).join
+			end
+		end
+	end
+end

data/lib/bake/gem/shell.rb

@@ -11,6 +11,9 @@ module Bake
 	module Gem
 		# Exception raised when a command execution fails.
 		class CommandExecutionError < RuntimeError
+			# Initialize the exception with the specified message and process status.
+			# @parameter message [String] The error message.
+			# @parameter status [Process::Status] The status object of the failed command.
 			def initialize(message, status)
 				super(message)
 				@status = status

data/lib/bake/gem/version.rb

@@ -5,6 +5,6 @@
 
 module Bake
 	module Gem
-		VERSION = "0.13.1"
+		VERSION = "0.15.0"
 	end
 end

data/readme.md

@@ -14,6 +14,13 @@ Please see the [project documentation](https://ioquatix.github.io/bake-gem/) for
 
 Please see the [project releases](https://ioquatix.github.io/bake-gem/releases/index) for all releases.
 
+### v0.15.0
+
+  - Prepare release branches with `gem:release:branch:patch/minor/major`, committing the version bump and all release-hook changes before review.
+  - Add `gem:release:validate` to detect stale generated release content and unrelated changes.
+  - Build committed source in a fresh Ruby process and accept an explicit signing key path with `gem:build`.
+  - Push only the intended release tag when publishing locally.
+
 ### v0.13.1
 
   - Better `version.rb` detection in `version_path` method.
@@ -52,26 +59,26 @@ Please see the [project releases](https://ioquatix.github.io/bake-gem/releases/i
 
 We welcome contributions to this project.
 
-1.  Fork it.
+1.  Fork the repository.
 2.  Create your feature branch (`git checkout -b my-new-feature`).
-3.  Commit your changes (`git commit -am 'Add some feature'`).
+3.  Commit your changes (`git commit -am 'Add some feature.'`).
 4.  Push to the branch (`git push origin my-new-feature`).
-5.  Create new Pull Request.
+5.  Create a new pull request.
 
 ### Running Tests
 
 To run the test suite:
 
-``` shell
-bundle exec sus
+``` bash
+$ bundle exec sus
 ```
 
 ### Making Releases
 
 To make a new release:
 
-``` shell
-bundle exec bake gem:release:patch # or minor or major
+``` bash
+$ bundle exec bake gem:release:patch # or minor or major
 ```
 
 ### Developer Certificate of Origin

data/releases.md

@@ -1,5 +1,12 @@
 # Releases
 
+## v0.15.0
+
+  - Prepare release branches with `gem:release:branch:patch/minor/major`, committing the version bump and all release-hook changes before review.
+  - Add `gem:release:validate` to detect stale generated release content and unrelated changes.
+  - Build committed source in a fresh Ruby process and accept an explicit signing key path with `gem:build`.
+  - Push only the intended release tag when publishing locally.
+
 ## v0.13.1
 
   - Better `version.rb` detection in `version_path` method.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bake-gem
 version: !ruby/object:Gem::Version
-  version: 0.13.1
+  version: 0.15.0
 platform: ruby
 authors:
 - Samuel Williams
@@ -66,6 +66,7 @@ files:
 - context/index.yaml
 - lib/bake/gem.rb
 - lib/bake/gem/helper.rb
+- lib/bake/gem/release.rb
 - lib/bake/gem/shell.rb
 - lib/bake/gem/version.rb
 - license.md
@@ -75,6 +76,8 @@ homepage: https://github.com/ioquatix/bake-gem
 licenses:
 - MIT
 metadata:
+  bug_tracker_uri: https://github.com/ioquatix/bake-gem/issues
+  changelog_uri: https://github.com/ioquatix/bake-gem/blob/main/releases.md
   documentation_uri: https://ioquatix.github.io/bake-gem/
   funding_uri: https://github.com/sponsors/ioquatix/
   source_code_uri: https://github.com/ioquatix/bake-gem.git
@@ -92,7 +95,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.6
+rubygems_version: 4.0.16
 specification_version: 4
 summary: Release management for Ruby gems.
 test_files: []