inquirex-tools 0.8.0 → 0.9.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2027915b1b69d07af80a30a63207731809243ae607da736ea2d558c2748c6c1f
-  data.tar.gz: 6c35d199ad702ffd061d90bf5fa5ebe17da1fc8b1f0d7722e3f8bf37676b3e4b
+  metadata.gz: a86b68b3b9abc13c3046754f8b5f43a69f84360e3b581e5760ab9145049da76a
+  data.tar.gz: 5001830e113f7c7b63547f9f49ca10cb290b946c90a0916313e83dee0e1f479a
 SHA512:
-  metadata.gz: a97efe3bc05fc24445e9b40920ec073055305e26c92764a7977cea0152cd33a25c28ccca97cf3e129ced24150b5957f0a137c57bc10172c1054cea7a5300ddfb
-  data.tar.gz: 0a975ec1e72ad597bf19827d9fe5f5afe68523bfea5809729a23ae184ab61a380b7aeff9128df1e984042c307a9de6c4ea464c660bf668474e731aa78779664e
+  metadata.gz: ab2d90315649ab9d2465156964f6436b96a79a5fb0a32c4489ef2910d8a991166da17bcd1731bae08d830097bb2249b91ca9c7ad339e171d48004b812363c8f7
+  data.tar.gz: f7258bdb64b70a46a21b09ccb0f58111077e326b290fdaa3fc72e5cfea1c661abe546e005bce892ec69662fed81c938cbf1645a9cad4eb8e61f0061b56ff721f

data/.env.encrypted

@@ -0,0 +1,11 @@
+#ENC[AES256_GCM,data:4mpgKeRs3A2HXmt/FjaIn561sybb9L9oX7gVygSpct//wHWjT5I+lT3Vf5UlMGTv42RKAAL5CgF+SRr4bni33A6CeU3ODQ3vYAo=,iv:oP7xJ9m3C0ezlTznZ1NkqCvu52MLHpDnTkmc7Q0lhhY=,tag:7SoYBTYtcIex2jgqECrAuA==,type:comment]
+#ENC[AES256_GCM,data:89N9zu88zeviY33xeiZOFaLTDxv51jf8SmuZ07NVzAOUDdQAPkKuYkqvOOZpYXjYTDJVY16yYLMYGSmVq8f5rbmWDYC/gJn31m0=,iv:01XkrGj3H6uf6tIdHZxSEpJ/a8LVpo/TidFgRHTJUXo=,tag:lTMSW/QgGaWub1pZrre9TA==,type:comment]
+#ENC[AES256_GCM,data:nYuulT9DlDl+zOPlhK0IqJSahj1KiunqenUbfzPllxxEvJNqMUKU/kVaK73YbaDSUPdAeRXbFH3trz8CQ4uBR5yjQCnv12DD9VVjXw==,iv:7hWr2ajKbKA7lPqtBsmvUycJTF69PVcHUk1kA0T6kXo=,tag:2fnWYnft/u2hVkadn5dsdw==,type:comment]
+#ENC[AES256_GCM,data:kDDhc1ZMB8McDQ2dcEnvT24UWRUq/WNKJ/QuhFpO54K6P0IXFUbmBoqIK2X408HPcJLz9etlw7NAZt1AaQ==,iv:+BRUu6mSooyQt+bazHq/dgXVISTjEfiIJTyUR0N9XgI=,tag:pU6kCwETMJ4neWSHLDBX9g==,type:comment]
+OP_ACCOUNT=ENC[AES256_GCM,data:QLsZSJQqdNSFAIqVDBVHh4kO9TrP9Hm4CZA=,iv:qlqTEsjHfV5AowWnsgWYjU2udMgFmXsYF3GK1PIjzsw=,tag:PUivzRC+pPufSY5P+HG9Rg==,type:str]
+sops_age__list_0__map_enc=-----BEGIN AGE ENCRYPTED FILE-----\nYWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IHBpdi1wMjU2IER3YUVVQSBBMHphcXd3\nNmtHWjkxVDdwZDZON213c3hmeEpGbW9GSmszM2ZWUGxxRWoyQwpReTZ3bzZFeEJM\nWlF0VVFTNGVnaFlmMVRSUmtoVEZKOCtVRlU1VjYya25FCi0tLSBJTEtJcTducjM4\nSndWNmZub1hiMCsxMTFwbkpSTXVtZnNKemt6UGpzS1BRCptxoolSJ98Ngajq1/pI\nWo0FMY9hEPh5m1m0lBcWBRqbnr23APyywtt89b0UOKhRHhf9KMw6zTfk+KQC3wj0\nNug=\n-----END AGE ENCRYPTED FILE-----\n
+sops_age__list_0__map_recipient=age1se1qd8tpc9v42uuqz974uxx84mdz0aejujrzssmyjl6fvmwgx3gm62wjjxjyws
+sops_lastmodified=2026-08-06T01:38:07Z
+sops_mac=ENC[AES256_GCM,data:4J6BN+p3cXmbGMOfmjXtkPDvRI1jlflrEObvC30TwwrbBXhBW+WLSUOiGM8aVC+pSCzCNykpjkKw47ElMA8jD927xMg1BaglWTtbFPaqVgCVXXnM0c1XL6+oWa80QULZGXViG4W7c4JTYxzqsvhGEpKx0CUFO43GKibx/BaUgAo=,iv:+F76/yNF/kctS0844U7IS9RUyMIg4fkltqlbS+l9mrQ=,tag:rwtNHQpXnEuDLl77qMesZw==,type:str]
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.13.2

data/.env.example

@@ -0,0 +1,5 @@
+# Example environment variables for this project.
+# Copy this file to `.env`, fill in real values, then encrypt with sopsy.
+# `.env` itself is gitignored and must never be committed in plaintext.
+DATABASE_URL=postgres://localhost:5432/myapp
+API_KEY=replace-me

data/.envrc

@@ -0,0 +1 @@
+PATH_add bin

data/.relaxed_rubocop.yml

@@ -0,0 +1,153 @@
+# Relaxed.Ruby.Style
+## Version 2.5
+
+Style/Alias:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylealias
+
+Style/AsciiComments:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleasciicomments
+
+Style/BeginBlock:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylebeginblock
+
+Style/BlockDelimiters:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleblockdelimiters
+
+Style/CommentAnnotation:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylecommentannotation
+
+Style/Documentation:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styledocumentation
+
+Layout/DotPosition:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#layoutdotposition
+
+Style/DoubleNegation:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styledoublenegation
+
+Style/EndBlock:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleendblock
+
+Style/FormatString:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleformatstring
+
+Style/IfUnlessModifier:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleifunlessmodifier
+
+Style/Lambda:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylelambda
+
+Style/ModuleFunction:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylemodulefunction
+
+Style/MultilineBlockChain:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylemultilineblockchain
+
+Style/NegatedIf:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylenegatedif
+
+Style/NegatedWhile:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylenegatedwhile
+
+Style/NumericPredicate:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylenumericpredicate
+
+Style/ParallelAssignment:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleparallelassignment
+
+Style/PercentLiteralDelimiters:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylepercentliteraldelimiters
+
+Style/PerlBackrefs:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styleperlbackrefs
+
+Style/Semicolon:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylesemicolon
+
+Style/SignalException:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylesignalexception
+
+Style/SingleLineBlockParams:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylesinglelineblockparams
+
+Style/SingleLineMethods:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylesinglelinemethods
+
+Layout/SpaceBeforeBlockBraces:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#layoutspacebeforeblockbraces
+
+Layout/SpaceInsideParens:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#layoutspaceinsideparens
+
+Style/SpecialGlobalVars:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylespecialglobalvars
+
+Style/StringLiterals:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylestringliterals
+
+Style/TrailingCommaInArguments:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainarguments
+
+Style/TrailingCommaInArrayLiteral:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainarrayliteral
+
+Style/TrailingCommaInHashLiteral:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#styletrailingcommainhashliteral
+
+Style/SymbolArray:
+  Enabled: false
+  StyleGuide: http://relaxed.ruby.style/#stylesymbolarray
+
+Style/WhileUntilModifier:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylewhileuntilmodifier
+
+Style/WordArray:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#stylewordarray
+
+Lint/AmbiguousRegexpLiteral:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#lintambiguousregexpliteral
+
+Lint/AssignmentInCondition:
+  Enabled: false
+  StyleGuide: https://relaxed.ruby.style/#lintassignmentincondition
+
+Layout/LineLength:
+  Enabled: false
+
+Metrics:
+  Enabled: false
+

data/.sops.yaml

@@ -0,0 +1,6 @@
+# Managed by sopsy. Maps encrypted files to their age recipients.
+creation_rules:
+  - path_regex: '\.env\.encrypted$'
+    age: 'age1se1qd8tpc9v42uuqz974uxx84mdz0aejujrzssmyjl6fvmwgx3gm62wjjxjyws'
+  - path_regex: '\.encrypted$'
+    age: 'age1se1qd8tpc9v42uuqz974uxx84mdz0aejujrzssmyjl6fvmwgx3gm62wjjxjyws'

data/.sopsy.sha

@@ -0,0 +1 @@
+b95fff7b1445f7690843e41678e2676916ec792390828e5755e7ec554812aece

data/.sopsy.yml

@@ -0,0 +1,11 @@
+recipients:
+- name: admin
+  public_key: age1se1qd8tpc9v42uuqz974uxx84mdz0aejujrzssmyjl6fvmwgx3gm62wjjxjyws
+  username: kig
+  break_glass: false
+encrypted_globs:
+- '*.encrypted'
+- .env.encrypted
+- config/*.encrypted.yaml
+sops_version: 3.13.2
+join_request_ttl: 72h

data/exe/inquirex

@@ -5,8 +5,9 @@
 # binary; this gem owns the bare name so cross-family tooling has one entry
 # point and no two gems install a binary called `inquirex`.
 #
-#   inquirex versions             # lockstep parity across the family
-#   inquirex versions --set 0.8.0
+#   inquirex versions-check              # lockstep parity across the family
+#   inquirex versions-check --preflight  # parity plus git release readiness
+#   inquirex versions-bump 0.8.0         # move every lockstep package
 #   inquirex changelogs
 #
 # Inside a checkout, prefer the repo's own Gemfile over whatever rubygems has

data/exe/inquirexor

@@ -0,0 +1 @@
+inquirex

data/justfile

@@ -0,0 +1,158 @@
+# Tell 'just' to run bash, source our setup script, then execute the recipe
+set shell := ["bash", "-c"]
+
+version := `grep VERSION lib/inquirex/tools/version.rb | awk '{print $3}' | tr -d '"' | tr -d '\n'`
+rbenv   := 'eval "$(rbenv init - bash)"; bundle exec '
+repo    := 'git@github.com:inquirex/inquirex-tools.git'
+
+# 1Password secret reference for the RubyGems TOTP, and the full path to `op`
+# because a recipe does not inherit an interactive shell's PATH.
+# The account is NOT named here: it is a private 1Password address and this
+# file is public. `op` reads it from OP_ACCOUNT, exported by the ecosystem
+# root's .envrc, which lives outside every repo. Two accounts are
+# registered and only one holds the open-source-repos vault, so without
+# OP_ACCOUNT the read can resolve against the wrong one, return nothing,
+# and publish silently falls back to prompting mid-release.
+op      := '/opt/homebrew/bin/op'
+otp_ref := 'op://open-source-repos/ruby-gems/one-time password?attribute=otp'
+
+gem_name := 'inquirex-tools'
+gem_file := 'pkg/' + gem_name + '-' + version + '.gem'
+gem_url  := 'https://rubygems.org/gems/' + gem_name
+
+[no-exit-message]
+recipes:
+    just --choose
+
+# Sync all dependencies
+install:
+    bin/setup
+
+build: install
+
+# Lint and reformat files
+lint:
+    {{ rbenv }} rubocop
+
+# Lint and reformat files (-a) — pass -A as an argument
+format *args:
+    {{ rbenv }} rubocop -a {{ args }}
+    /usr/bin/find . -name '*.md' -exec mdformat --wrap no {} \; -print
+
+# Run all the tests
+test *args: 
+    export ENVIRONMENT=test; {{ rbenv }} rspec {{args}}
+
+# Run tests with coverage
+test-coverage *args:
+    export ENVIRONMENT=test; export COVERAGE=true; {{ rbenv }} rspec {{ args }}
+
+ci: lint test-coverage 
+
+alias check-all := ci
+
+clean:
+    #!/usr/bin/env bash
+    @find . -name .DS_Store -delete -print || true
+    @rm -rf tmp/*
+
+# Run all lefthook pre-commit hooks
+lefthook:
+    {{ rbenv }} lefthook run pre-commit --all-files
+
+# Print current gem version
+version:
+    @echo "{{ version }}"
+
+# Clobber
+clobber: 
+    {{ rbenv }} rake clobber
+
+# Generate documentation
+doc: 
+    #!/usr/bin/env bash
+    {{ rbenv }} rake doc
+
+# `gem push` rather than `rake release`: release also guards the tree, tags and
+# pushes git — which `just release` does deliberately and separately — and it
+# gives no way to pass a 2FA code, so it always stopped to prompt.
+#
+# The code comes from 1Password unless one is passed in:
+#
+#   just publish            # read the code from 1Password
+#   just publish 123456     # use this code
+#
+# `just publish-all` in inquirex-tools passes one, because a TOTP is single-use:
+# four gems reading the same 30-second window would have the second push
+# rejected as a replay.
+#
+# Build the .gem and push it to RubyGems, non-interactively
+publish otp="": build
+    #!/usr/bin/env bash
+    set -euo pipefail
+    eval "$(rbenv init - bash 2>/dev/null || true)"
+
+    mkdir -p pkg
+    gem build {{ gem_name }}.gemspec --output "{{ gem_file }}"
+
+    # `|| true` is load-bearing: under `set -e` a failed `op read` — not signed
+    # in to 1Password, item renamed, op not installed — would abort the recipe
+    # before the prompting fallback below could run.
+    otp="{{ otp }}"
+    [[ -n "${otp}" ]] || otp=$({{ op }} read "{{ otp_ref }}" 2>/dev/null || true)
+
+    if [[ -n "${otp}" ]]; then
+      gem push "{{ gem_file }}" --otp "${otp}"
+    else
+      echo "rubygems: no OTP available — gem push will prompt if 2FA is required."
+      gem push "{{ gem_file }}"
+    fi
+
+    # Only reachable when the push succeeded: `set -e` aborts the recipe on a
+    # non-zero `gem push`, so the page never opens for a release that failed.
+    echo "published {{ gem_name }} {{ version }} → {{ gem_url }}"
+    open "{{ gem_url }}" 2>/dev/null || xdg-open "{{ gem_url }}" 2>/dev/null || true
+
+# Publish every package in the family, gems and npm packages alike.
+#
+# A thin wrapper: the ordering, the per-gem 2FA code and the stop-on-failure
+# rule all live in Inquirex::Tools::Publisher, where they are unit-tested. This
+# recipe only supplies the environment — OP_ACCOUNT, decrypted from
+# .env.encrypted — that the Ruby side cannot obtain for itself.
+#
+# Only this repo carries the sopsy setup. Each package's `just publish` runs as
+# a grandchild process and inherits the exported value, so the other five repos
+# stay free of an encrypted env and a Touch ID prompt they do not need.
+#
+#   just publish-all              # publish for real
+#   just publish-all --dry-run    # print the commands, run nothing
+#
+# Publish every package in the family (--dry-run to preview)
+publish-all *args:
+    #!/usr/bin/env bash
+    set -euo pipefail
+    eval "$(rbenv init - bash 2>/dev/null || true)"
+
+    # `|| true`: a missing key, a locked Secure Enclave or no sopsy at all must
+    # not abort a release. Without OP_ACCOUNT the run still works — `op` falls
+    # back to the default account, and failing that, prompts.
+    if [[ -f .env.encrypted ]]; then
+      if secrets=$(sopsy decrypt .env.encrypted 2>/dev/null); then
+        set -a
+        eval "$(printf '%s\n' "${secrets}" | sed -E '/^#/d; /^$/d')"
+        set +a
+        echo "sopsy: OP_ACCOUNT=${OP_ACCOUNT:-<unset>}"
+      else
+        echo "sopsy: could not decrypt .env.encrypted — continuing without OP_ACCOUNT" >&2
+      fi
+    fi
+
+    bundle exec exe/inquirex publish {{ args }}
+
+# Tag v{{ version }}, publish the GH release, & refresh the Homebrew tap.
+release:
+    git fetch --tags
+    git tag -f "v{{ version }}"
+    git push -f --tags
+    gh release delete -y "v{{ version }}" --repo {{ repo }} 2>/dev/null || true
+    gh release create "v{{ version }}" --generate-notes --repo {{ repo }}

data/lib/inquirex/tools/commands/changelogs.rb

@@ -7,12 +7,14 @@ module Inquirex
       class Changelogs < Dry::CLI::Command
         desc "Regenerate CHANGELOG.md from merged PRs"
 
-        argument :repos, type: :array, required: false,
-                         desc: "Repositories to regenerate (default: all configured)"
+        argument :repos,
+          type:     :array,
+          required: false,
+          desc:     "Repositories to regenerate (default: all configured)"
 
         example [
           "                    # every repo with a .github_changelog_generator",
-          "inquirex-js         # just one"
+          "inquirex-widget     # just one"
         ]
 
         # The GitHub token comes from `gh auth token`, so no secret is stored

data/lib/inquirex/tools/commands/publish.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Inquirex
+  module Tools
+    module Commands
+      # `inquirex publish` — publishes every package in the family.
+      #
+      # The orchestrator runs each package's own `just publish` in that
+      # package's directory, so how a package reaches its registry stays that
+      # package's business. What this adds is the order, a fresh 2FA code per
+      # gem, and stopping at the first failure.
+      class Publish < Dry::CLI::Command
+        desc "Publish every package in the family to RubyGems and npm"
+
+        option :dry_run,
+          type:    :boolean,
+          default: false,
+          desc:    "Print the commands that would run; publish nothing"
+
+        example [
+          "                # publish the whole family",
+          "--dry-run       # print what would happen, touch no registry"
+        ]
+
+        # @param options [Hash] parsed CLI options
+        # @return [void]
+        def call(**options)
+          exit(1) unless Inquirex::Tools::Publisher.new.call(dry_run: options.fetch(:dry_run, false))
+        rescue Inquirex::Tools::Error => e
+          warn "ERROR: #{e.message}"
+          exit 1
+        end
+      end
+    end
+  end
+end

data/lib/inquirex/tools/commands/versions_bump.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+module Inquirex
+  module Tools
+    module Commands
+      # `inquirex versions-bump` — moves every lockstep package to one version.
+      #
+      # The write counterpart of `inquirex versions-check`. Separate commands
+      # rather than one command with a `--set` flag, so nothing that writes can
+      # be reached by accident from a command meant to report.
+      class VersionsBump < Dry::CLI::Command
+        desc "Set every lockstep package to one version"
+
+        argument :version,
+          type:     :string,
+          required: true,
+          desc:     "Target version, MAJOR.MINOR.PATCH — must not go backwards"
+
+        example [
+          "0.9.0           # move every lockstep package to 0.9.0"
+        ]
+
+        # @param version [String, nil] target version
+        # @return [void]
+        def call(version: nil, **)
+          exit(1) unless Inquirex::Tools::VersionBumper.new.call(version)
+        rescue Inquirex::Tools::Error => e
+          warn "ERROR: #{e.message}"
+          exit 1
+        end
+      end
+    end
+  end
+end

data/lib/inquirex/tools/commands/versions_check.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Inquirex
+  module Tools
+    module Commands
+      # `inquirex versions-check` — reports the family's lockstep version.
+      #
+      # Plural on purpose: `inquirex version` prints this tool's own version,
+      # `inquirex versions-check` reports the family's. Read-only; the write
+      # counterpart is `inquirex versions-bump`.
+      class VersionsCheck < Dry::CLI::Command
+        desc "Report lockstep version parity across the family"
+
+        option :preflight,
+          type:    :boolean,
+          default: false,
+          desc:    "Also check clean trees, main branch, and tags"
+
+        example [
+          "                      # report parity, exit 1 on drift",
+          "--preflight           # release readiness"
+        ]
+
+        # @param preflight [Boolean] also report git release readiness
+        # @return [void]
+        def call(preflight: false, **)
+          checker = Inquirex::Tools::VersionChecker.new
+          exit(1) unless preflight ? checker.preflight : checker.call
+        rescue Inquirex::Tools::Error => e
+          warn "ERROR: #{e.message}"
+          exit 1
+        end
+      end
+    end
+  end
+end

data/lib/inquirex/tools/commands.rb

@@ -3,7 +3,9 @@
 require "dry/cli"
 
 require_relative "commands/version"
-require_relative "commands/versions"
+require_relative "commands/versions_bump"
+require_relative "commands/versions_check"
+require_relative "commands/publish"
 require_relative "commands/changelogs"
 
 module Inquirex
@@ -16,9 +18,11 @@ module Inquirex
     module Commands
       extend Dry::CLI::Registry
 
-      register "versions",   Versions
+      register "versions-check", VersionsCheck
+      register "versions-bump", VersionsBump
+      register "publish", Publish
       register "changelogs", Changelogs
-      register "version",    Version
+      register "version", Version
     end
   end
 end