ethos-gemkit 0.2.0 → 0.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 248ba6ddb45bb0374b8d8fb4a59a987606ce2c2494a5b74d45b5f1c70911c84c
-  data.tar.gz: 0fd71c3766c11333163d12bf77399dc0b16748a0743aeed9b0cd5d09cc4c560e
+  metadata.gz: b4df86371c7d4ec7fff974c09607c9c9913619c43a346fbeb942b15e1f2cd459
+  data.tar.gz: 6714316c9084400d143c62eac48fc8396f8bc12341cf456a3b13926782d4dfae
 SHA512:
-  metadata.gz: 0c18eed79a4fdc2482c4d24addd491c2c663c2db3aa48f8188c02af3e0032b763c8568f651b7a0be9b72a2f84417fc982b72b3fec2f551fd9aedf66d7c870d05
-  data.tar.gz: 756aaa36df80a27b01f14e87093b4849f973ad690c6af486b38a948a7762e6028c5b9f9b2baf0034ccb8bda805525da7810912401398bf1e848dc35abfd1a8d5
+  metadata.gz: ba5baf95b85294435d3cc4b833ca5a9279411a4678a39596b26208c397db544ff76e674fd90e9d2999908d602f90d41e919574818d101cd45b56830aa9658c0e
+  data.tar.gz: 035744fbe210f66bc5b02d4f1eceb10b0470afd8d18b1fdda6505fdefdd176242f00155ae36fd5b1c042bfb4c912e5fc1d1f82df179e59e622065fcd117a2a7c

data/CHANGELOG.md

@@ -5,145 +5,68 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
-## [0.2.0] - 2026-11-04
-
-
-### Added
-
-- support native private publishing and project setup
+## [0.3.0] - 2026-11-05
 
+### Changed
 
+- remove unused package and changelog entries
+- provision consumer dependencies before checks
 
+## [0.2.1] - 2026-11-05
 
 ### Documentation
 
-- document the published Gemkit release
-
-- clarify per-gem publishers and safe retries
-
-
-
+- clarify current setup
+- document checksums for frozen installs
+- distinguish source fixes from workflow retries
 
 ### Fixed
 
-- show preparation progress and live command output
-
-
-
-## [0.1.0] - 2026-11-04
+- preserve checksums during preparation
 
+## [0.2.0] - 2026-11-04
 
 ### Added
 
-- bootstrap shared gem development contracts
-
-- enforce the shared commit message policy
-
-- centralize verified gem release orchestration
-
-- prepare release PRs and publish after merging
-
-
-
-
-### Changed
-
-- exercise standalone core operations
-
-- expose shared commit message validation
-
-- replace release orchestration with native workflows
-
-- remove the redundant bootstrap fixture
-
+- support native private publishing and project setup
 
+### Documentation
 
+- document the published Gemkit release
+- clarify per-gem publishers and safe retries
 
 ### Fixed
 
-- lock toolkit development to patched Active Support
-
-- disable inherited publishing tasks
-
-- complete checksums for frozen hosted installs
-
-- declare and isolate framework fixture dependencies
-
-- bind package files to the verified tag tree
-
-- expose scoped bundle executables to subprocesses
-
-- retain confirmed publication evidence for recovery
-
-- scope source fetch authentication to GitHub
-
-- select the current artifact run explicitly
-
-- prevent implicit pushes of unrelated tags
-
-- bootstrap Bundler for plain rake commands
-
-- keep Bundler's CI cache out of release source
-
-- recycle fully merged local release branches
-
-
+- show preparation progress and live command output
 
 ## [0.1.0] - 2026-11-04
 
-
 ### Added
 
 - bootstrap shared gem development contracts
-
 - enforce the shared commit message policy
-
 - centralize verified gem release orchestration
-
 - prepare release PRs and publish after merging
 
-
-
-
 ### Changed
 
 - exercise standalone core operations
-
 - expose shared commit message validation
-
 - replace release orchestration with native workflows
-
 - remove the redundant bootstrap fixture
 
-
-
-
 ### Fixed
 
 - lock toolkit development to patched Active Support
-
 - disable inherited publishing tasks
-
 - complete checksums for frozen hosted installs
-
 - declare and isolate framework fixture dependencies
-
 - bind package files to the verified tag tree
-
 - expose scoped bundle executables to subprocesses
-
 - retain confirmed publication evidence for recovery
-
 - scope source fetch authentication to GitHub
-
 - select the current artifact run explicitly
-
 - prevent implicit pushes of unrelated tags
-
 - bootstrap Bundler for plain rake commands
-
-
-
-# Changelog
-
-Changes are generated from Conventional Commits when preparing a release.
+- keep Bundler's CI cache out of release source
+- recycle fully merged local release branches

data/README.md

@@ -7,14 +7,14 @@ belongs in the development/test Gemfile, never a consumer's runtime gemspec.
 Install the published gem in the development/test Gemfile:
 
 ```ruby
-gem "ethos-gemkit", "0.2.0", group: [:development, :test], require: false
+gem "ethos-gemkit", "0.2.1", group: [:development, :test], require: false
 ```
 
 Pin workflow callers to the full commit behind the installed Gemkit release tag.
 Resolve that commit with:
 
 ```sh
-git ls-remote https://github.com/ethos-link/ethos-gemkit.git 'refs/tags/v0.2.0^{}'
+git ls-remote https://github.com/ethos-link/ethos-gemkit.git 'refs/tags/v0.2.1^{}'
 ```
 
 Upgrade the gem version and workflow pins together. Consumer READMEs should cover
@@ -53,6 +53,26 @@ release tasks while a repository is adopting the toolkit.
 `bundle exec rake verify` runs lint, registered checks, a disposable native gem
 build, and git-cliff validation.
 
+Ordinary pull requests call `.github/workflows/consumer.yml`. Its optional
+`build-setup` input provisions system dependencies before verification, such as
+browser packages or a disposable database. Keep the caller's permissions at
+`contents: read`; this workflow does not need publishing credentials.
+
+## Private gem access
+
+To install private gems locally, use a GitHub personal access token (classic)
+with `read:packages` and access to the package. Configure Bundler once, replacing
+`USERNAME` and `TOKEN` with your credentials:
+
+```sh
+bundle config set --global https://rubygems.pkg.github.com/ethos-link USERNAME:TOKEN
+```
+
+Keep credentials out of Gemfiles. Each gem documents its scoped source block.
+Actions publishing uses `GITHUB_TOKEN`; installing another private repository's
+package requires that repository to grant the workflow access or an explicit
+token. See [GitHub's registry guide](https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-rubygems-registry).
+
 ## Releasing a gem
 
 **Run `release:prepare` from clean, up-to-date `main`.** It creates the conventional
@@ -62,6 +82,9 @@ Ordinary feature/fix PRs run verification; only a release PR starts publication.
 
 ### One-time prerequisites
 
+- Commit `Gemfile.lock`. Before its first commit, run
+  `bundle lock --add-checksums`; frozen CI installs reject empty registry
+  checksum entries, even when the gems are already installed locally.
 - Ignore `/.bundle/`, `/vendor/bundle/` and `/pkg/` in `.gitignore`. The shared
   workflows use Ruby setup's native `vendor/bundle` cache; generated files must
   leave the release checkout clean.
@@ -146,8 +169,8 @@ setup.
 The task prints each step and streams command output as it runs. It checks the
 working tree, canonical origin, current main, installed hooks and target tag.
 It creates `chore/release-vX.Y.Z`, updates the version and
-changelog, runs `bundle lock --local` and the full `rake verify`, then commits the
-three metadata files with hooks enabled, pushes the branch, and opens a
+changelog, runs `bundle lock --add-checksums` and the full `rake verify`, then
+commits the three metadata files with hooks enabled, pushes the branch, and opens a
 `chore(release): prepare vX.Y.Z` PR. Main stays unchanged. You can also start on
 that exact pre-created release branch if its HEAD still equals `origin/main`.
 When starting from main, a leftover local release branch is recreated only if
@@ -200,7 +223,14 @@ workflow run. This reuses its verified artifact and existing tag; do not run
 gh run rerun RUN_ID --repo OWNER/REPOSITORY --failed
 ```
 
-For CI failures, retry **failed jobs in the original run** within GitHub's 30-day
+If a failed build needs a source fix and no tag or upload exists, keep the
+prepared version and notes. Update its `chore/release-vX.Y.Z` branch from main,
+commit the fix, run verification and open a replacement release PR. Merge that
+PR to run the corrected source. The original run stays pinned to its original
+commit; rerunning it cannot pick up a source fix. Do not replace an existing tag
+or reuse a version that was already published.
+
+For transient CI failures, retry **failed jobs in the original run** within GitHub's 30-day
 retry window. Artifacts are retained for 90 days. A failed tag step can reuse an
 existing annotated tag only when it points to the same verified commit. A failed
 notes job reuses the original artifact without uploading again. Ambiguous uploads,

data/UPGRADE.md

@@ -1,5 +1,12 @@
 # Upgrading Gemkit
 
+## 0.2.1
+
+Release preparation now fetches registry checksums with Bundler instead of
+using local-only resolution. Network access to configured gem sources is
+required. Existing compatible dependency versions stay locked; complete
+checksums prevent frozen CI installs from rejecting local cache metadata.
+
 ## 0.2.0
 
 Update the gem version and pin each workflow caller to the commit behind the

data/lib/ethos/gemkit/release.rb

@@ -69,7 +69,7 @@ module Ethos
         File.write(file, text.sub(literal, %(VERSION = "#{target}")))
         run("git-cliff", "--config", "cliff.toml", "--unreleased", "--tag", "v#{target}", "--prepend", "CHANGELOG.md", live: true)
         progress "Updating Gemfile.lock"
-        run("bundle", "lock", "--local", live: true)
+        run("bundle", "lock", "--add-checksums", live: true)
         progress "Running verification (lint, tests, package, changelog)"
         run("bundle", "exec", "rake", "verify", live: true)
         files = [@config.data.fetch("version_file"), "CHANGELOG.md", "Gemfile.lock"]

data/lib/ethos/gemkit/version.rb

@@ -2,6 +2,6 @@
 
 module Ethos
   module Gemkit
-    VERSION = "0.2.0"
+    VERSION = "0.3.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ethos-gemkit
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.3.0
 platform: ruby
 authors:
 - Ethos Link