gem_kit-release 0.2.2 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7c57bae0a6fbc182e752ab68d4e5eaa6f1441354e9f906d9ee6d336c8c51c9e4
-  data.tar.gz: 73cc9921720bad183c573a5cd7bdb077bd118ed6f3eb2d1a0f417f0c9a1bf9de
+  metadata.gz: dbdaca4c93bb73c92daa2e585aa8f6dbcef18a7717a6f9c3549f943272b13947
+  data.tar.gz: 8d41aaa5cd762b8c6660d6cffbb669d1d17ce5a604ea578d1673681eb6c39809
 SHA512:
-  metadata.gz: 507b97ad08897e529ba1d471b696beeeb8af74fdd782e7067de2ac0f6ffa51f20010d782de808727083781b4e4b766fa7327cf122b300b284e88441e2d2899ef
-  data.tar.gz: 1fc2b130909d685e609f30e54a59faa8ad8e047ec057be23a5cfbea5648d1919a4b28fbf2bf2076239a7af4a3523ccd9b49cdc899333b0d1cd7d1e8bab113080
+  metadata.gz: e431cf45975cc92e084d02988ed88a68053bf538f386bf734a167a9e0a6914de609a8d22555ba4e238c41ff6ae932bbfa44e5933fd665f19b0c4468336d60e8b
+  data.tar.gz: 852b384995fbbd1ee34b28200cdcd472eddb6c3460e99101b70df56da4435b45be91fc6805959f21eb942bfc7287f883000e70e1566f684e518102727a29f1d1

data/README.md

@@ -65,7 +65,7 @@ gem kit changelog --write     # have an AI CLI write the entry
 gem kit changelog             # lint it
 gem kit deprecations          # what is still outstanding
 gem kit release --dry-run     # run the gates
-gem kit tag --push            # tag it
+gem kit release               # ...then build, push and tag
 ```
 
 | Command | What it does |

data/lib/gem_kit/release/cli.rb

@@ -105,21 +105,28 @@ module GemKit
         Commands::Deprecations.new(options).call(version)
       end
 
-      desc "release", "Gate, build and push this gem"
+      desc "release", "Gate, build, push and tag this gem"
       long_desc <<~TXT
-        Two gates, both before `gem build` runs:
+        Three gates, all before `gem build` runs:
 
         the changelog must have a non-empty, correctly formatted section for this
-        version, sitting at the top of the released list; and nothing promised to
-        disappear in this version may still be in the tree.
+        version, sitting at the top of the released list; nothing promised to
+        disappear in this version may still be in the tree; and the working tree
+        must be committed, because a gem built from uncommitted files is a gem
+        whose source exists nowhere.
+
+        Then builds the gemspec, pushes it, and tags the release — after the push,
+        so a tag never names a version that failed to publish. Requires RubyGems
+        push credentials.
 
-        Then builds the gemspec and pushes it. Requires RubyGems push credentials.
         --dry-run runs the gates and stops, which is what belongs in CI.
       TXT
       method_option :dry_run, type: :boolean, default: false, aliases: "-n",
                               desc: "Run the gates and stop"
-      method_option :tag, type: :boolean, default: false, aliases: "-t",
-                          desc: "Tag the release after pushing"
+      method_option :tag, type: :boolean, default: true,
+                          desc: "Tag the release and push the tag (--no-tag to skip)"
+      method_option :allow_dirty, type: :boolean, default: false,
+                                  desc: "Release even with uncommitted changes"
       def release
         Commands::Release.new(options).call
       end

data/lib/gem_kit/release/commands/bump.rb

@@ -35,6 +35,8 @@ module GemKit
           version_file.write(target)
           say("#{current} -> #{target}")
 
+          relock(target)
+
           upcoming = gate.upcoming_deprecations(target)
           unless upcoming.empty?
             say("#{upcoming.size} deprecation(s) still outstanding (none due in #{target}).")
@@ -45,6 +47,35 @@ module GemKit
           say
           say("#{RED}now run: gem kit changelog --write#{RESET}")
         end
+
+        private
+
+          # A Gemfile that says `gemspec` or `path: "."` records this gem's own
+          # version in Gemfile.lock, so a bump that only rewrites the version
+          # file leaves the two disagreeing — and bundler refuses outright
+          # under frozen mode, which is what bundlerEnv sets. Relock, so the
+          # bump is one coherent change rather than a trap for the next
+          # command anyone runs.
+          #
+          # `bundle lock` rather than `bundle install`: nothing needs
+          # installing, only the lockfile needs to agree.
+          def relock(target)
+            return unless project.self_locked?
+
+            say("Relocking #{File.basename(project.lockfile_path)}…")
+
+            ok = Dir.chdir(project.root) do
+              # BUNDLE_FROZEN is exactly what stops this, and inheriting it
+              # from an ambient devshell would defeat the point.
+              system({"BUNDLE_FROZEN" => "false", "BUNDLE_GEMFILE" => nil},
+                     "bundle", "lock", out: File::NULL, err: File::NULL)
+            end
+
+            return if ok
+
+            say("#{RED}could not relock — run `bundle lock` before committing " \
+                "#{target}#{RESET}")
+          end
       end
     end
   end
@@ -95,6 +126,44 @@ describe "gem_kit/release/commands/bump" do
     end
   end
 
+  # The version lives in two files when a gem is in its own bundle, and a bump
+  # that moves one of them leaves bundler refusing to do anything.
+  it "relocks a lockfile that records this gem's own version" do
+    with_gem do |dir|
+      File.write(File.join(dir, "Gemfile"), %(source "https://rubygems.org"\ngemspec\n))
+      File.write(File.join(dir, "Gemfile.lock"), <<~LOCK)
+        PATH
+          remote: .
+          specs:
+            demo (1.2.3)
+
+        GEM
+          remote: https://rubygems.org/
+
+        PLATFORMS
+          ruby
+
+        DEPENDENCIES
+          demo!
+
+        BUNDLED WITH
+           2.7.2
+      LOCK
+
+      _status, out, _err = invoke(["bump", "minor"], dir)
+
+      out.should.match(/Relocking Gemfile\.lock/)
+      File.read(File.join(dir, "Gemfile.lock")).should.match(/demo \(1\.3\.0\)/)
+    end
+  end
+
+  it "says nothing about a lockfile that does not record this gem" do
+    with_gem do |dir|
+      _status, out, _err = invoke(["bump", "minor"], dir)
+      out.should.not.match(/Relocking/)
+    end
+  end
+
   it "mentions deprecations outstanding but not yet due" do
     with_gem do |dir|
       _status, out, _err = invoke(["bump", "minor"], dir, deprecations: [["Old", "New", "9.0"]])

data/lib/gem_kit/release/commands/release.rb

@@ -5,15 +5,15 @@ require_relative "command"
 module GemKit
   module Release
     module Commands
-      # Gate, build, push. The gates run before anything is built, because a
-      # half-done release is worse than a refused one.
+      # Gate, build, push, tag. The gates run before anything is built, because
+      # a half-done release is worse than a refused one.
       class Release < Command
 
 
 
         def call
           version  = project.version.to_s
-          problems = gate.release_problems(version)
+          problems = gate.release_problems(version, allow_dirty: options[:allow_dirty])
 
           refuse("Refusing to release #{project.name} #{version}:", problems) unless problems.empty?
 
@@ -35,7 +35,11 @@ module GemKit
 
           say("Released #{project.name} #{version}")
 
-          Tag.new(options).call if options[:tag]
+          # Tagging is part of releasing, not a flag someone remembers. It runs
+          # after the push rather than before, so a tag never points at a
+          # version that failed to publish — and it pushes, because the gem is
+          # public by now and a tag only this machine has is half a release.
+          Tag.new(options.merge(push: true)).call unless options[:tag] == false
         end
       end
     end
@@ -56,6 +60,39 @@ describe "gem_kit/release/commands/release" do
     end
   end
 
+  # A gem built from an uncommitted tree matches nothing in git.
+  it "refuses while the working tree is dirty, before building anything" do
+    with_gem do |dir|
+      system("git init -q #{dir}")
+
+      status, _out, err = invoke(["release"], dir)
+
+      status.should == 1
+      err.should.match(/uncommitted change/)
+      err.should.match(/--allow-dirty/)
+      Dir[File.join(dir, "*.gem")].should.be.empty
+    end
+  end
+
+  it "--allow-dirty releases anyway" do
+    with_gem do |dir|
+      system("git init -q #{dir}")
+
+      # --dry-run stops before the push, which is as far as a spec should go.
+      invoke(["release", "--dry-run", "--allow-dirty"], dir).first.should == 0
+    end
+  end
+
+  it "is satisfied once the tree is committed" do
+    with_gem do |dir|
+      system("git init -q #{dir}")
+      system("git -C #{dir} add -A")
+      system("git -C #{dir} -c user.name=t -c user.email=t@t commit -q -m x")
+
+      invoke(["release", "--dry-run"], dir).first.should == 0
+    end
+  end
+
   it "refuses without a changelog entry, before building anything" do
     with_gem(changelog: :none) do |dir|
       status, _out, err = invoke(["release"], dir)

data/lib/gem_kit/release/gate.rb

@@ -47,14 +47,39 @@ module GemKit
         version ? changelog.release_problems(version) : changelog.problems
       end
 
+      # What is in the working tree but not in git. A gem built from an
+      # uncommitted tree is a gem whose source exists nowhere — and `bump` and
+      # `changelog --write` leave exactly two such files behind, which is
+      # precisely the moment someone reaches for `release`.
+      #
+      # A directory that is not a git repository is not a problem: this gate
+      # has nothing to say about it.
+      def working_tree_problems
+        return [] unless git?
+
+        dirty = Dir.chdir(project.root) { `git status --porcelain`.lines.map(&:strip) }
+        return [] if dirty.empty?
+
+        ["#{dirty.size} uncommitted change(s) — the gem would match nothing in git:",
+         *dirty.first(10).map { |line| "  #{line}" },
+         *(dirty.size > 10 ? ["  … and #{dirty.size - 10} more"] : []),
+         "",
+         "The bump and the changelog belong in one commit. Or pass --allow-dirty."]
+      end
+
+      def git?
+        Dir.chdir(project.root) { system("git rev-parse --git-dir >/dev/null 2>&1") }
+      end
+
       # Everything standing between the project and releasing `version`.
-      def release_problems(version = project.version)
+      def release_problems(version = project.version, allow_dirty: false)
         problems = []
 
         changelog_problems(version).each { |problem| problems << problem }
         deprecation_problems(version).each do |problem|
           problems << "deprecation due in #{version}: #{problem}"
         end
+        working_tree_problems.each { |problem| problems << problem } unless allow_dirty
 
         problems
       end
@@ -76,10 +101,10 @@ describe "gem_kit/release/gate" do
 
   # A Project stub: the Gate only asks it for a changelog path and a version,
   # and to load the library (a no-op here — the specs drive the registry).
-  stub_project = lambda do |changelog_path, version: "1.0.0"|
-    Struct.new(:changelog_path, :version) do
+  stub_project = lambda do |changelog_path, version: "1.0.0", root: nil|
+    Struct.new(:changelog_path, :version, :root) do
       def load! = true
-    end.new(changelog_path, Gem::Version.new(version))
+    end.new(changelog_path, Gem::Version.new(version), root || File.dirname(changelog_path))
   end
 
   clean_changelog = <<~MD
@@ -155,6 +180,36 @@ describe "gem_kit/release/gate" do
     end
   end
 
+  # The gate that catches what `bump` and `changelog --write` leave behind.
+  it "reports an uncommitted working tree, and clears once it is committed" do
+    Dir.mktmpdir do |dir|
+      File.write(File.join(dir, "CHANGELOG.md"), clean_changelog)
+      system("git init -q #{dir}")
+
+      isolated.call do
+        gate = GemKit::Release::Gate.new(stub_project.call(File.join(dir, "CHANGELOG.md"), root: dir))
+
+        gate.release_problems("1.0.0").first.should.match(/uncommitted change/)
+        gate.release_problems("1.0.0", allow_dirty: true).should == []
+
+        system("git -C #{dir} add -A")
+        system("git -C #{dir} -c user.name=t -c user.email=t@t commit -q -m x")
+        gate.release_problems("1.0.0").should == []
+      end
+    end
+  end
+
+  it "says nothing about a directory that is not a git repository" do
+    Dir.mktmpdir do |dir|
+      File.write(File.join(dir, "CHANGELOG.md"), clean_changelog)
+
+      isolated.call do
+        GemKit::Release::Gate.new(stub_project.call(File.join(dir, "CHANGELOG.md"), root: dir))
+          .working_tree_problems.should == []
+      end
+    end
+  end
+
   it "checks changelog format alone when given no version" do
     Dir.mktmpdir do |dir|
       path = File.join(dir, "CHANGELOG.md")

data/lib/gem_kit/release/project.rb

@@ -105,6 +105,21 @@ module GemKit
         multi_gem? ? "CHANGELOG-#{name}.md" : "CHANGELOG.md"
       end
 
+      def lockfile_path
+        File.join(root, "Gemfile.lock")
+      end
+
+      # A Gemfile that says `gemspec` or `path: "."` puts this gem in its own
+      # bundle, and the lockfile then records this gem's version. Bumping
+      # without relocking leaves the two disagreeing — which bundler reports as
+      # "the gemspecs for path gems changed", and refuses outright under
+      # frozen mode, as bundlerEnv sets.
+      def self_locked?
+        return false unless File.exist?(lockfile_path)
+
+        File.read(lockfile_path).match?(/^\s{4}#{Regexp.escape(name)} \(\d/)
+      end
+
       # `v1.2.3` says which version but not which gem, which is fine until a
       # repository holds two of them at the same version.
       def tag_prefix
@@ -252,6 +267,38 @@ describe "gem_kit/release/project" do
     end
   end
 
+  # A gem whose own Gemfile pulls it in has its version written in the lockfile
+  # as well as the version file, and both have to move together.
+  it "knows whether the lockfile records this gem's own version" do
+    with_project.call do |dir|
+      GemKit::Release::Project.detect(dir).self_locked?.should.be.false
+
+      File.write(File.join(dir, "Gemfile.lock"), <<~LOCK)
+        PATH
+          remote: .
+          specs:
+            demo (1.2.3)
+
+        GEM
+          remote: https://rubygems.org/
+      LOCK
+      GemKit::Release::Project.detect(dir).self_locked?.should.be.true
+    end
+  end
+
+  it "does not mistake another gem's line in the lockfile for its own" do
+    with_project.call do |dir|
+      File.write(File.join(dir, "Gemfile.lock"), <<~LOCK)
+        GEM
+          remote: https://rubygems.org/
+          specs:
+            other-demo (1.0.0)
+            demo-helper (2.0.0)
+      LOCK
+      GemKit::Release::Project.detect(dir).self_locked?.should.be.false
+    end
+  end
+
   it "finds an ERB version template when the project generates its version file" do
     with_project.call do |dir|
       GemKit::Release::Project.detect(dir).version_template.should.be.nil

data/lib/gem_kit/release/templates/RELEASE.md.erb

@@ -8,8 +8,7 @@ The whole process, in order:
 <%= step("gem kit changelog#{gem_flag} --write") %># 3. write the entry
 <%= step("gem kit changelog#{gem_flag} <VERSION>") %># 4. check it
 <%= step(%(git commit -am "Release ..."))  %># 5. commit the bump + changelog
-<%= step("gem kit release#{gem_flag}")     %># 6. build and push
-<%= step("gem kit tag#{gem_flag} --push")  %># 7. tag it
+<%= step("gem kit release#{gem_flag}")     %># 6. gate, build, push, tag
 ```
 
 Steps 2 and 6 are gates: they refuse to proceed when something is missing.
@@ -119,27 +118,30 @@ unwritten in git is the failure this process exists to prevent.
 ## 6. Release
 
 ```sh
-gem kit release<%= gem_flag %>           # or: gem kit release<%= gem_flag %> --dry-run, which is the CI check
+gem kit release<%= gem_flag %>             # or --dry-run, which is the CI check
 ```
 
-Two gates, both before `gem build` runs:
+Three gates, all before `gem build` runs:
 
 1. **Changelog** — this version needs its own non-empty, correctly formatted
    section, sitting at the top of the released list.
 2. **Deprecations** — nothing promised to disappear in this version may still
    be in the tree.
+3. **The working tree** — everything committed. A gem built from uncommitted
+   files is a gem whose source exists nowhere, and step 2 and step 3 above
+   leave exactly two such files behind. `--allow-dirty` overrides it.
 
-Then `gem build` and `gem push`. Requires RubyGems push credentials.
+Then `gem build`, `gem push`, and the tag — `<%= tag_prefix %><%= version %>`,
+created and pushed *after* the gem, so a tag never names a version that failed
+to publish. `--no-tag` skips it.
 
-## 7. Tag
+Requires RubyGems push credentials.
 
-```sh
-gem kit tag<%= gem_flag %> --push
-```
+The tag matters beyond bookkeeping: it is what the next
+`gem kit changelog<%= gem_flag %> --write` uses to find the commit range, so a
+missing one makes the following release's changelog harder to write.
 
-Creates `<%= tag_prefix %><%= version %>`, refusing if it already exists. The tag is also what
-the next `gem kit changelog<%= gem_flag %> --write` uses to find the commit range, so a missing
-one makes the following release's changelog harder to write.
+`gem kit tag<%= gem_flag %>` still exists for tagging on its own.
 
 ## When something goes wrong
 

data/lib/gem_kit/release/version.rb

@@ -2,6 +2,6 @@
 
 module GemKit
   module Release
-    VERSION = "0.2.2"
+    VERSION = "0.3.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: gem_kit-release
 version: !ruby/object:Gem::Version
-  version: 0.2.2
+  version: 0.3.1
 platform: ruby
 authors:
 - Nathan Kidd