ethos-gemkit 0.2.0 → 0.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 248ba6ddb45bb0374b8d8fb4a59a987606ce2c2494a5b74d45b5f1c70911c84c
-  data.tar.gz: 0fd71c3766c11333163d12bf77399dc0b16748a0743aeed9b0cd5d09cc4c560e
+  metadata.gz: ea8ac801fd96cef32c35240e93271d04792235c4121c95f8261918f87795b2b1
+  data.tar.gz: 87a5464f90175cd5cf5f088f573ab2d47886ea2a702f5cb183f722081eb8bb47
 SHA512:
-  metadata.gz: 0c18eed79a4fdc2482c4d24addd491c2c663c2db3aa48f8188c02af3e0032b763c8568f651b7a0be9b72a2f84417fc982b72b3fec2f551fd9aedf66d7c870d05
-  data.tar.gz: 756aaa36df80a27b01f14e87093b4849f973ad690c6af486b38a948a7762e6028c5b9f9b2baf0034ccb8bda805525da7810912401398bf1e848dc35abfd1a8d5
+  metadata.gz: eb7aef3f0ccab2964c6a318649f72fbdc0f9fe9615814828c4161c386463794f10bcffc2383f001bfe9d7ba12bb46ff53a3e2280dc18481508df6b768ac1d62c
+  data.tar.gz: 74ba19f731bbbcfaa9a113e5d138929636fab47e2c35120ba410ed40019f04a797546d43911e18ef5b1bc5cac37f2953e6df277c974300f9554df1a5a64134c3

data/CHANGELOG.md

@@ -5,6 +5,26 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.1] - 2026-11-05
+
+
+### Documentation
+
+- clarify current setup
+
+- document checksums for frozen installs
+
+- distinguish source fixes from workflow retries
+
+
+
+
+### Fixed
+
+- preserve checksums during preparation
+
+
+
 ## [0.2.0] - 2026-11-04
 
 

data/README.md

@@ -7,14 +7,14 @@ belongs in the development/test Gemfile, never a consumer's runtime gemspec.
 Install the published gem in the development/test Gemfile:
 
 ```ruby
-gem "ethos-gemkit", "0.2.0", group: [:development, :test], require: false
+gem "ethos-gemkit", "0.2.1", group: [:development, :test], require: false
 ```
 
 Pin workflow callers to the full commit behind the installed Gemkit release tag.
 Resolve that commit with:
 
 ```sh
-git ls-remote https://github.com/ethos-link/ethos-gemkit.git 'refs/tags/v0.2.0^{}'
+git ls-remote https://github.com/ethos-link/ethos-gemkit.git 'refs/tags/v0.2.1^{}'
 ```
 
 Upgrade the gem version and workflow pins together. Consumer READMEs should cover
@@ -53,6 +53,21 @@ release tasks while a repository is adopting the toolkit.
 `bundle exec rake verify` runs lint, registered checks, a disposable native gem
 build, and git-cliff validation.
 
+## Private gem access
+
+To install private gems locally, use a GitHub personal access token (classic)
+with `read:packages` and access to the package. Configure Bundler once, replacing
+`USERNAME` and `TOKEN` with your credentials:
+
+```sh
+bundle config set --global https://rubygems.pkg.github.com/ethos-link USERNAME:TOKEN
+```
+
+Keep credentials out of Gemfiles. Each gem documents its scoped source block.
+Actions publishing uses `GITHUB_TOKEN`; installing another private repository's
+package requires that repository to grant the workflow access or an explicit
+token. See [GitHub's registry guide](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry).
+
 ## Releasing a gem
 
 **Run `release:prepare` from clean, up-to-date `main`.** It creates the conventional
@@ -62,6 +77,9 @@ Ordinary feature/fix PRs run verification; only a release PR starts publication.
 
 ### One-time prerequisites
 
+- Commit `Gemfile.lock`. Before its first commit, run
+  `bundle lock --add-checksums`; frozen CI installs reject empty registry
+  checksum entries, even when the gems are already installed locally.
 - Ignore `/.bundle/`, `/vendor/bundle/` and `/pkg/` in `.gitignore`. The shared
   workflows use Ruby setup's native `vendor/bundle` cache; generated files must
   leave the release checkout clean.
@@ -146,8 +164,8 @@ setup.
 The task prints each step and streams command output as it runs. It checks the
 working tree, canonical origin, current main, installed hooks and target tag.
 It creates `chore/release-vX.Y.Z`, updates the version and
-changelog, runs `bundle lock --local` and the full `rake verify`, then commits the
-three metadata files with hooks enabled, pushes the branch, and opens a
+changelog, runs `bundle lock --add-checksums` and the full `rake verify`, then
+commits the three metadata files with hooks enabled, pushes the branch, and opens a
 `chore(release): prepare vX.Y.Z` PR. Main stays unchanged. You can also start on
 that exact pre-created release branch if its HEAD still equals `origin/main`.
 When starting from main, a leftover local release branch is recreated only if
@@ -200,7 +218,14 @@ workflow run. This reuses its verified artifact and existing tag; do not run
 gh run rerun RUN_ID --repo OWNER/REPOSITORY --failed
 ```
 
-For CI failures, retry **failed jobs in the original run** within GitHub's 30-day
+If a failed build needs a source fix and no tag or upload exists, keep the
+prepared version and notes. Update its `chore/release-vX.Y.Z` branch from main,
+commit the fix, run verification and open a replacement release PR. Merge that
+PR to run the corrected source. The original run stays pinned to its original
+commit; rerunning it cannot pick up a source fix. Do not replace an existing tag
+or reuse a version that was already published.
+
+For transient CI failures, retry **failed jobs in the original run** within GitHub's 30-day
 retry window. Artifacts are retained for 90 days. A failed tag step can reuse an
 existing annotated tag only when it points to the same verified commit. A failed
 notes job reuses the original artifact without uploading again. Ambiguous uploads,

data/UPGRADE.md

@@ -1,5 +1,12 @@
 # Upgrading Gemkit
 
+## 0.2.1
+
+Release preparation now fetches registry checksums with Bundler instead of
+using local-only resolution. Network access to configured gem sources is
+required. Existing compatible dependency versions stay locked; complete
+checksums prevent frozen CI installs from rejecting local cache metadata.
+
 ## 0.2.0
 
 Update the gem version and pin each workflow caller to the commit behind the

data/lib/ethos/gemkit/release.rb

@@ -69,7 +69,7 @@ module Ethos
         File.write(file, text.sub(literal, %(VERSION = "#{target}")))
         run("git-cliff", "--config", "cliff.toml", "--unreleased", "--tag", "v#{target}", "--prepend", "CHANGELOG.md", live: true)
         progress "Updating Gemfile.lock"
-        run("bundle", "lock", "--local", live: true)
+        run("bundle", "lock", "--add-checksums", live: true)
         progress "Running verification (lint, tests, package, changelog)"
         run("bundle", "exec", "rake", "verify", live: true)
         files = [@config.data.fetch("version_file"), "CHANGELOG.md", "Gemfile.lock"]

data/lib/ethos/gemkit/version.rb

@@ -2,6 +2,6 @@
 
 module Ethos
   module Gemkit
-    VERSION = "0.2.0"
+    VERSION = "0.2.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ethos-gemkit
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.1
 platform: ruby
 authors:
 - Ethos Link