kettle-dev 1.0.10 → 1.0.12

data/lib/kettle/dev/git_adapter.rb

@@ -1,13 +1,17 @@
 # frozen_string_literal: true
 
+require "open3"
+
 module Kettle
   module Dev
     # Minimal Git adapter used by kettle-dev to avoid invoking live shell commands
-    # directly from the library code. In tests, mock this adapter's methods to
-    # prevent any real network or repository mutations.
+    # directly from the higher-level library code. In tests, mock this adapter's
+    # methods to prevent any real network or repository mutations.
     #
-    # This adapter requires the 'git' gem at runtime and does not shell out to
-    # the system git. Specs should stub the git gem API to avoid real pushes.
+    # Behavior:
+    # - Prefer the 'git' gem when available.
+    # - If the 'git' gem is not present (LoadError), fall back to shelling out to
+    #   the system `git` executable for the small set of operations we need.
     #
     # Public API is intentionally small and only includes what we need right now.
     class GitAdapter
@@ -15,10 +19,21 @@ module Kettle
       # @return [void]
       def initialize
         begin
-          require "git"
-          @git = ::Git.open(Dir.pwd)
+          # Allow users/CI to opt out of using the 'git' gem even when available.
+          # Set KETTLE_DEV_DISABLE_GIT_GEM to a truthy value ("1", "true", "yes") to force CLI backend.
+          env_val = ENV["KETTLE_DEV_DISABLE_GIT_GEM"]
+          # Ruby 2.3 compatibility: String#match? was added in 2.4; use Regexp#=== / =~ instead
+          disable_gem = env_val && !!(/\A(1|true|yes)\z/i =~ env_val)
+          if disable_gem
+            @backend = :cli
+          else
+            Kernel.require "git"
+            @backend = :gem
+            @git = ::Git.open(Dir.pwd)
+          end
         rescue LoadError
-          raise Kettle::Dev::Error, "The 'git' gem is required at runtime. Please add it as a dependency."
+          # Optional dependency: fall back to CLI
+          @backend = :cli
         rescue StandardError => e
           raise Kettle::Dev::Error, "Failed to open git repository: #{e.message}"
         end
@@ -30,42 +45,73 @@ module Kettle
       # @param force [Boolean] whether to force push
       # @return [Boolean] true when the push is reported successful
       def push(remote, branch, force: false)
-        # git gem supports force: true option on push
-        begin
+        if @backend == :gem
+          begin
+            if remote
+              @git.push(remote, branch, force: force)
+            else
+              # Default remote according to repo config
+              @git.push(nil, branch, force: force)
+            end
+            true
+          rescue StandardError
+            false
+          end
+        else
+          args = ["git", "push"]
+          args << "--force" if force
           if remote
-            @git.push(remote, branch, force: force)
-          else
-            # Default remote according to repo config
-            @git.push(nil, branch, force: force)
+            args << remote.to_s << branch.to_s
           end
-          true
-        rescue StandardError
-          false
+          system(*args)
         end
       end
 
       # @return [String, nil] current branch name, or nil on error
       def current_branch
-        @git.current_branch
+        if @backend == :gem
+          @git.current_branch
+        else
+          out, status = Open3.capture2("git", "rev-parse", "--abbrev-ref", "HEAD")
+          status.success? ? out.strip : nil
+        end
       rescue StandardError
         nil
       end
 
       # @return [Array<String>] list of remote names
       def remotes
-        @git.remotes.map(&:name)
+        if @backend == :gem
+          @git.remotes.map(&:name)
+        else
+          out, status = Open3.capture2("git", "remote")
+          status.success? ? out.split(/\r?\n/).map(&:strip).reject(&:empty?) : []
+        end
       rescue StandardError
         []
       end
 
       # @return [Hash{String=>String}] remote name => fetch URL
       def remotes_with_urls
-        @git.remotes.each_with_object({}) do |r, h|
-          begin
-            h[r.name] = r.url
-          rescue StandardError
-            # ignore
+        if @backend == :gem
+          @git.remotes.each_with_object({}) do |r, h|
+            begin
+              h[r.name] = r.url
+            rescue StandardError
+              # ignore
+            end
+          end
+        else
+          out, status = Open3.capture2("git", "remote", "-v")
+          return {} unless status.success?
+          urls = {}
+          out.each_line do |line|
+            # Example: origin https://github.com/me/repo.git (fetch)
+            if line =~ /^(\S+)\s+(\S+)\s+\(fetch\)/
+              urls[Regexp.last_match(1)] = Regexp.last_match(2)
+            end
           end
+          urls
         end
       rescue StandardError
         {}
@@ -74,8 +120,13 @@ module Kettle
       # @param name [String]
       # @return [String, nil]
       def remote_url(name)
-        r = @git.remotes.find { |x| x.name == name }
-        r&.url
+        if @backend == :gem
+          r = @git.remotes.find { |x| x.name == name }
+          r&.url
+        else
+          out, status = Open3.capture2("git", "config", "--get", "remote.#{name}.url")
+          status.success? ? out.strip : nil
+        end
       rescue StandardError
         nil
       end
@@ -84,8 +135,12 @@ module Kettle
       # @param branch [String]
       # @return [Boolean]
       def checkout(branch)
-        @git.checkout(branch)
-        true
+        if @backend == :gem
+          @git.checkout(branch)
+          true
+        else
+          system("git", "checkout", branch.to_s)
+        end
       rescue StandardError
         false
       end
@@ -95,8 +150,12 @@ module Kettle
       # @param branch [String]
       # @return [Boolean]
       def pull(remote, branch)
-        @git.pull(remote, branch)
-        true
+        if @backend == :gem
+          @git.pull(remote, branch)
+          true
+        else
+          system("git", "pull", remote.to_s, branch.to_s)
+        end
       rescue StandardError
         false
       end
@@ -106,12 +165,18 @@ module Kettle
       # @param ref [String, nil]
       # @return [Boolean]
       def fetch(remote, ref = nil)
-        if ref
-          @git.fetch(remote, ref)
+        if @backend == :gem
+          if ref
+            @git.fetch(remote, ref)
+          else
+            @git.fetch(remote)
+          end
+          true
+        elsif ref
+          system("git", "fetch", remote.to_s, ref.to_s)
         else
-          @git.fetch(remote)
+          system("git", "fetch", remote.to_s)
         end
-        true
       rescue StandardError
         false
       end

data/lib/kettle/dev/git_commit_footer.rb

@@ -77,7 +77,7 @@ module Kettle
 
           if footer_append && goalie_allows_footer?(subject_line)
             if commit_msg.include?(sentinel)
-              exit(0)
+              Kettle::Dev::ExitAdapter.exit(0)
             else
               footer_binding = GitCommitFooter.new
               File.open(argv[0], "w") do |file|

data/lib/kettle/dev/input_adapter.rb

@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+module Kettle
+  module Dev
+    # Input indirection layer to make interactive prompts safe in tests.
+    #
+    # Production/default behavior delegates to $stdin.gets (or Kernel#gets)
+    # so application code does not read from STDIN directly. In specs, mock
+    # this adapter's methods to return deterministic answers without touching
+    # global IO.
+    #
+    # Example (RSpec):
+    #   allow(Kettle::Dev::InputAdapter).to receive(:gets).and_return("y\n")
+    #
+    # This mirrors the "mockable adapter" approach used for GitAdapter and ExitAdapter.
+    module InputAdapter
+      module_function
+
+      # Read one line from the standard input, including the trailing newline if
+      # present. Returns nil on EOF, consistent with IO#gets.
+      #
+      # @param args [Array] any args are forwarded to $stdin.gets for compatibility
+      # @return [String, nil]
+      def gets(*args)
+        $stdin.gets(*args)
+      end
+
+      def tty?
+        $stdin.tty?
+      end
+
+      # Read one line from standard input, raising EOFError on end-of-file.
+      # Provided for convenience symmetry with IO#readline when needed.
+      #
+      # @param args [Array]
+      # @return [String]
+      def readline(*args)
+        line = gets(*args)
+        raise EOFError, "end of file reached" if line.nil?
+        line
+      end
+    end
+  end
+end

data/lib/kettle/dev/release_cli.rb

@@ -16,6 +16,8 @@ require "ruby-progressbar"
 # Internal
 require "kettle/dev/git_adapter"
 require "kettle/dev/exit_adapter"
+require "kettle/dev/input_adapter"
+require "kettle/dev/versioning"
 
 module Kettle
   module Dev
@@ -28,114 +30,177 @@ module Kettle
 
       public
 
-      def initialize
+      def initialize(start_step: 1)
         @root = Kettle::Dev::CIHelpers.project_root
         @git = Kettle::Dev::GitAdapter.new
+        @start_step = (start_step || 1).to_i
+        @start_step = 1 if @start_step < 1
       end
 
       def run
-        puts "== kettle-release =="
-
+        # 1. Ensure Bundler version ✓
         ensure_bundler_2_7_plus!
 
-        version = detect_version
-        puts "Detected version: #{version.inspect}"
-
-        latest_overall = nil
-        latest_for_series = nil
-        begin
-          gem_name = detect_gem_name
-          latest_overall, latest_for_series = latest_released_versions(gem_name, version)
-        rescue StandardError => e
-          warn("Warning: failed to check RubyGems for latest version (#{e.class}: #{e.message}). Proceeding.")
-        end
-
-        if latest_overall
-          msg = "Latest released: #{latest_overall}"
-          if latest_for_series && latest_for_series != latest_overall
-            msg += " | Latest for series #{Gem::Version.new(version).segments[0, 2].join(".")}.x: #{latest_for_series}"
-          elsif latest_for_series
-            msg += " (matches current series)"
+        version = nil
+        committed = nil
+        trunk = nil
+        feature = nil
+
+        # 2. Version detection and sanity checks + prompt
+        if @start_step <= 2
+          version = detect_version
+          puts "Detected version: #{version.inspect}"
+
+          latest_overall = nil
+          latest_for_series = nil
+          begin
+            gem_name = detect_gem_name
+            latest_overall, latest_for_series = latest_released_versions(gem_name, version)
+          rescue StandardError => e
+            warn("Warning: failed to check RubyGems for latest version (#{e.class}: #{e.message}). Proceeding.")
           end
-          puts msg
-
-          cur = Gem::Version.new(version)
-          overall = Gem::Version.new(latest_overall)
-          cur_series = cur.segments[0, 2]
-          overall_series = overall.segments[0, 2]
-          target = if (cur_series <=> overall_series) == -1
-            latest_for_series
+
+          if latest_overall
+            msg = "Latest released: #{latest_overall}"
+            if latest_for_series && latest_for_series != latest_overall
+              msg += " | Latest for series #{Gem::Version.new(version).segments[0, 2].join(".")}.x: #{latest_for_series}"
+            elsif latest_for_series
+              msg += " (matches current series)"
+            end
+            puts msg
+
+            cur = Gem::Version.new(version)
+            overall = Gem::Version.new(latest_overall)
+            cur_series = cur.segments[0, 2]
+            overall_series = overall.segments[0, 2]
+            target = if (cur_series <=> overall_series) == -1
+              latest_for_series
+            else
+              latest_overall
+            end
+            if target
+              bump = Kettle::Dev::Versioning.classify_bump(target, version)
+              case bump
+              when :same
+                series = cur_series.join(".")
+                warn("version.rb (#{version}) matches the latest released version for series #{series} (#{target}).")
+                abort("Aborting: version bump required. Bump PATCH/MINOR/MAJOR/EPIC.")
+              when :downgrade
+                series = cur_series.join(".")
+                warn("version.rb (#{version}) is lower than the latest released version for series #{series} (#{target}).")
+                abort("Aborting: version must be bumped above #{target}.")
+              else
+                label = {epic: "EPIC", major: "MAJOR", minor: "MINOR", patch: "PATCH"}[bump] || bump.to_s.upcase
+                puts "Proposed bump type: #{label} (from #{target} -> #{version})"
+              end
+            else
+              puts "Could not determine latest released version from RubyGems (offline?). Proceeding without sanity check."
+            end
           else
-            latest_overall
-          end
-          if target && Gem::Version.new(version) <= Gem::Version.new(target)
-            series = cur_series.join(".")
-            warn("version.rb (#{version}) must be greater than the latest released version for series #{series}. Latest for series: #{target}.")
-            warn("Tip: bump PATCH for a stable branch release, or bump MINOR/MAJOR when on trunk.")
-            abort("Aborting: version bump required.")
+            puts "Could not determine latest released version from RubyGems (offline?). Proceeding without sanity check."
           end
-        else
-          puts "Could not determine latest released version from RubyGems (offline?). Proceeding without sanity check."
-        end
 
-        puts "Have you updated lib/**/version.rb and CHANGELOG.md for v#{version}? [y/N]"
-        print("> ")
-        ans = $stdin.gets&.strip
-        abort("Aborted: please update version.rb and CHANGELOG.md, then re-run.") unless ans&.downcase&.start_with?("y")
+          puts "Have you updated lib/**/version.rb and CHANGELOG.md for v#{version}? [y/N]"
+          print("> ")
+          ans = Kettle::Dev::InputAdapter.gets&.strip
+          abort("Aborted: please update version.rb and CHANGELOG.md, then re-run.") unless ans&.downcase&.start_with?("y")
+        end
 
-        run_cmd!("bin/setup")
-        run_cmd!("bin/rake")
+        # 3. bin/setup
+        run_cmd!("bin/setup") if @start_step <= 3
+        # 4. bin/rake
+        run_cmd!("bin/rake") if @start_step <= 4
+
+        # 5. appraisal:update (optional)
+        if @start_step <= 5
+          appraisals_path = File.join(@root, "Appraisals")
+          if File.file?(appraisals_path)
+            puts "Appraisals detected at #{appraisals_path}. Running: bin/rake appraisal:update"
+            run_cmd!("bin/rake appraisal:update")
+          else
+            puts "No Appraisals file found; skipping appraisal:update"
+          end
+        end
 
-        appraisals_path = File.join(@root, "Appraisals")
-        if File.file?(appraisals_path)
-          puts "Appraisals detected at #{appraisals_path}. Running: bin/rake appraisal:update"
-          run_cmd!("bin/rake appraisal:update")
-        else
-          puts "No Appraisals file found; skipping appraisal:update"
+        # 6. git user + commit release prep
+        if @start_step <= 6
+          ensure_git_user!
+          version ||= detect_version
+          committed = commit_release_prep!(version)
         end
 
-        ensure_git_user!
-        committed = commit_release_prep!(version)
+        # 7. optional local CI via act
+        maybe_run_local_ci_before_push!(committed) if @start_step <= 7
 
-        maybe_run_local_ci_before_push!(committed)
+        # 8. ensure trunk synced
+        if @start_step <= 8
+          trunk = detect_trunk_branch
+          feature = current_branch
+          puts "Trunk branch detected: #{trunk}"
+          ensure_trunk_synced_before_push!(trunk, feature)
+        end
 
-        trunk = detect_trunk_branch
-        feature = current_branch
-        puts "Trunk branch detected: #{trunk}"
-        ensure_trunk_synced_before_push!(trunk, feature)
+        # 9. push branches
+        push! if @start_step <= 9
 
-        push!
+        # 10. monitor CI after push
+        monitor_workflows_after_push! if @start_step <= 10
 
-        monitor_workflows_after_push!
+        # 11. merge feature into trunk and push
+        if @start_step <= 11
+          trunk ||= detect_trunk_branch
+          feature ||= current_branch
+          merge_feature_into_trunk_and_push!(trunk, feature)
+        end
 
-        merge_feature_into_trunk_and_push!(trunk, feature)
+        # 12. checkout trunk and pull
+        if @start_step <= 12
+          trunk ||= detect_trunk_branch
+          checkout!(trunk)
+          pull!(trunk)
+        end
 
-        checkout!(trunk)
-        pull!(trunk)
-
-        # Strong reminder for local runs: skip signing when testing a release flow
-        if ENV["SKIP_GEM_SIGNING"].to_s.strip == ""
-          puts "TIP: For local dry-runs or testing the release workflow, set SKIP_GEM_SIGNING=true to avoid PEM password prompts."
-          # Prompt on CI to allow an explicit abort when signing would otherwise hang
-          if ENV.fetch("CI", "false").casecmp("true").zero?
-            print("Proceed with signing enabled? This may hang waiting for a PEM password. [y/N]: ")
-            ans = $stdin.gets&.strip
-            unless ans&.downcase&.start_with?("y")
-              abort("Aborted. Re-run with SKIP_GEM_SIGNING=true bundle exec kettle-release (or set it in your environment).")
+        # 13. signing guidance and checks
+        if @start_step <= 13
+          if ENV.fetch("SKIP_GEM_SIGNING", "false").casecmp("false").zero?
+            puts "TIP: For local dry-runs or testing the release workflow, set SKIP_GEM_SIGNING=true to avoid PEM password prompts."
+            if Kettle::Dev::InputAdapter.tty?
+              # In CI, avoid interactive prompts when no TTY is present (e.g., act or GitHub Actions "CI validation").
+              # Non-interactive CI runs should not abort here; later signing checks are either stubbed in tests
+              # or will be handled explicitly by ensure_signing_setup_or_skip!.
+              print("Proceed with signing enabled? This may hang waiting for a PEM password. [y/N]: ")
+              ans = Kettle::Dev::InputAdapter.gets&.strip
+              unless ans&.downcase&.start_with?("y")
+                abort("Aborted. Re-run with SKIP_GEM_SIGNING=true bundle exec kettle-release (or set it in your environment).")
+              end
+            else
+              warn("Non-interactive shell detected (non-TTY); skipping interactive signing confirmation.")
             end
           end
+
+          ensure_signing_setup_or_skip!
         end
 
-        ensure_signing_setup_or_skip!
-        puts "Running build (you may be prompted for the signing key password)..."
-        run_cmd!("bundle exec rake build")
+        # 14. build
+        if @start_step <= 14
+          puts "Running build (you may be prompted for the signing key password)..."
+          run_cmd!("bundle exec rake build")
+        end
 
-        run_cmd!("bin/gem_checksums")
-        validate_checksums!(version, stage: "after build + gem_checksums")
+        # 15. checksums validate
+        if @start_step <= 15
+          run_cmd!("bin/gem_checksums")
+          version ||= detect_version
+          validate_checksums!(version, stage: "after build + gem_checksums")
+        end
 
-        puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
-        run_cmd!("bundle exec rake release")
-        validate_checksums!(version, stage: "after release")
+        # 16. release and validate
+        if @start_step <= 16
+          puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
+          run_cmd!("bundle exec rake release")
+          version ||= detect_version
+          validate_checksums!(version, stage: "after release")
+        end
 
         puts "\nRelease complete. Don't forget to push the checksums commit if needed."
       end
@@ -143,87 +208,9 @@ module Kettle
       private
 
       def monitor_workflows_after_push!
-        root = Kettle::Dev::CIHelpers.project_root
-        workflows = Kettle::Dev::CIHelpers.workflows_list(root)
-        gitlab_ci = File.exist?(File.join(root, ".gitlab-ci.yml"))
-
-        branch = Kettle::Dev::CIHelpers.current_branch
-        abort("Could not determine current branch for CI checks.") unless branch
-
-        gh_remote = preferred_github_remote
-        gh_owner = nil
-        gh_repo = nil
-        if gh_remote && !workflows.empty?
-          url = remote_url(gh_remote)
-          gh_owner, gh_repo = parse_github_owner_repo(url)
-        end
-
-        checks_any = false
-
-        if gh_owner && gh_repo && !workflows.empty?
-          checks_any = true
-          total = workflows.size
-          abort("No GitHub workflows found under .github/workflows; aborting.") if total.zero?
-
-          passed = {}
-          idx = 0
-          puts "Ensuring GitHub Actions workflows pass on #{branch} (#{gh_owner}/#{gh_repo}) via remote '#{gh_remote}'"
-          pbar = if defined?(ProgressBar)
-            ProgressBar.create(title: "CI", total: total, format: "%t %b %c/%C", length: 30)
-          end
-
-          loop do
-            wf = workflows[idx]
-            run = Kettle::Dev::CIHelpers.latest_run(owner: gh_owner, repo: gh_repo, workflow_file: wf, branch: branch)
-            if run
-              if Kettle::Dev::CIHelpers.success?(run)
-                unless passed[wf]
-                  passed[wf] = true
-                  pbar&.increment
-                end
-              elsif Kettle::Dev::CIHelpers.failed?(run)
-                puts
-                url = run["html_url"] || "https://github.com/#{gh_owner}/#{gh_repo}/actions/workflows/#{wf}"
-                abort("Workflow failed: #{wf} -> #{url}")
-              end
-            end
-            break if passed.size == total
-            idx = (idx + 1) % total
-            sleep(1)
-          end
-          pbar&.finish unless pbar&.finished?
-          puts "\nAll GitHub workflows passing (#{passed.size}/#{total})."
-        end
-
-        gl_remote = gitlab_remote_candidates.first
-        if gitlab_ci && gl_remote
-          owner, repo = Kettle::Dev::CIHelpers.repo_info_gitlab
-          if owner && repo
-            checks_any = true
-            puts "Ensuring GitLab pipeline passes on #{branch} (#{owner}/#{repo}) via remote '#{gl_remote}'"
-            pbar = if defined?(ProgressBar)
-              ProgressBar.create(title: "CI", total: 1, format: "%t %b %c/%C", length: 30)
-            end
-            loop do
-              pipe = Kettle::Dev::CIHelpers.gitlab_latest_pipeline(owner: owner, repo: repo, branch: branch)
-              if pipe
-                if Kettle::Dev::CIHelpers.gitlab_success?(pipe)
-                  pbar&.increment unless pbar&.finished?
-                  break
-                elsif Kettle::Dev::CIHelpers.gitlab_failed?(pipe)
-                  puts
-                  url = pipe["web_url"] || "https://gitlab.com/#{owner}/#{repo}/-/pipelines"
-                  abort("Pipeline failed: #{url}")
-                end
-              end
-              sleep(1)
-            end
-            pbar&.finish unless pbar&.finished?
-            puts "\nGitLab pipeline passing."
-          end
-        end
-
-        abort("CI configuration not detected (GitHub or GitLab). Ensure CI is configured and remotes point to the correct hosts.") unless checks_any
+        # Delegate to shared CI monitor to keep logic DRY across release flow and rake tasks
+        require "kettle/dev/ci_monitor"
+        Kettle::Dev::CIMonitor.monitor_all!(restart_hint: "bundle exec kettle-release start_step=10")
       end
 
       def run_cmd!(cmd)
@@ -269,7 +256,7 @@ module Kettle
         when "true", "1", "yes", "y" then true
         when "ask"
           print("Run local CI with 'act' before pushing? [Y/n] ")
-          ans = $stdin.gets&.strip
+          ans = Kettle::Dev::InputAdapter.gets&.strip
           ans.nil? || ans.empty? || ans =~ /\Ay(es)?\z/i
         else
           false
@@ -329,17 +316,7 @@ module Kettle
       end
 
       def detect_version
-        candidates = Dir[File.join(@root, "lib", "**", "version.rb")]
-        abort("Could not find version.rb under lib/**.") if candidates.empty?
-        versions = candidates.map do |path|
-          content = File.read(path)
-          m = content.match(/VERSION\s*=\s*(["'])([^"']+)\1/)
-          next unless m
-          m[2]
-        end.compact
-        abort("VERSION constant not found in #{@root}/lib/**/version.rb") if versions.none?
-        abort("Multiple VERSION constants found to be out of sync (#{versions.inspect}) in #{@root}/lib/**/version.rb") unless versions.uniq.length == 1
-        versions.first
+        Kettle::Dev::Versioning.detect_version(@root)
       end
 
       def detect_gem_name
@@ -571,7 +548,7 @@ module Kettle
             puts "  [m] Merge --no-ff #{gh_remote}/#{trunk} into #{trunk} (push to origin and #{gh_remote})"
             puts "  [a] Abort"
             print("> ")
-            choice = $stdin.gets&.strip&.downcase
+            choice = Kettle::Dev::InputAdapter.gets&.strip&.downcase
             case choice
             when "r"
               run_cmd!("git rebase #{Shellwords.escape("#{gh_remote}/#{trunk}")}")
@@ -606,8 +583,8 @@ module Kettle
       end
 
       def ensure_signing_setup_or_skip!
-        # Treat any non-empty value as an explicit skip signal (more robust across Ruby versions and ENV adapters)
-        return if ENV["SKIP_GEM_SIGNING"].to_s.strip != ""
+        # Treat any non-/true/i value as an explicit skip signal
+        return if ENV.fetch("SKIP_GEM_SIGNING", "").casecmp("true").zero?
 
         user = ENV.fetch("GEM_CERT_USER", ENV["USER"])
         cert_path = File.join(@root, "certs", "#{user}.pem")