kettle-dev 2.2.25 → 2.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5e5b1b17ea5254ca2a656ec1a10a984b5f8170359507c9a7c56c46b42ab3ca0b
-  data.tar.gz: cc447fb1871394c8473e2464fe8dd56d8b554274b1e08bdb2ae5461b92030b77
+  metadata.gz: 9af988c7e6584e30cd1ee4c7a799dbe13a7322e166c95a439fb131d627bb5145
+  data.tar.gz: 7579a10cf684681b1ae88cb9d9c2f0c0a73a1acd3a7f22f74a35277a03882e2f
 SHA512:
-  metadata.gz: 0a0ae789338feaaae14007e02ebdb520da4d819d14783f82cf27b2d3e400f6818eefb4be5d5d485fee5cea9cd086b7387b50c0fb8d7f63e64a37214b238f6437
-  data.tar.gz: 7a6dc01a712098bcc218652f83c219bc9e0551be7d492bec5bcd1fc0f82dbcf7b196f0fafa324a7c934c410136df41108ce22ecf449fa1d475299e3bd9a866ed
+  metadata.gz: 77ca7f3d5b0135b37e2f817c173cc111561d37c805103d1f34fada9b3f4cc42f8c4e47b9e45e2327436221f67918b25ff80e8f6b86b8fca2e2364318bbec059f
+  data.tar.gz: 82e064b7576902016b5443f2b30db1b6a2203259d51b865ea3c0eeaec2e3612b00dabcaee453ae74b7f0015066eedc47bcb2803856ba56b95f16b16ae837cfc0

data/CHANGELOG.md

@@ -30,6 +30,52 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.3.1] - 2026-07-10
+
+- TAG: [v2.3.1][2.3.1t]
+- COVERAGE: 91.69% -- 4271/4658 lines in 36 files
+- BRANCH COVERAGE: 73.08% -- 1683/2303 branches in 36 files
+- 57.30% documented
+
+### Added
+
+- `kettle-pre-release` now skips volatile star-history image URLs by default
+  during Markdown image validation, and accepts additional
+  `.kettle-family.yml` or `KETTLE_FAMILY_CONFIG` patterns under
+  `pre_release.image_url_skip_patterns`.
+
+- `kettle-release --skip-bundle-audit` and `KETTLE_DEV_SKIP_BUNDLE_AUDIT=true`
+  now disable the release-flow `bundle:audit` and `bundle:audit:update` rake
+  defaults so a known advisory can be handled outside the automated release.
+
+### Changed
+
+- `require "kettle/dev"` no longer loads `version_gem` by default; require
+  `kettle/dev/version_gem` for the optional `VersionGem::Basic` extension.
+
+### Fixed
+
+- Legacy-engine CI workflows now install Bundler gems under
+  `${RUNNER_TEMP}/bundle` instead of `vendor/bundle`, and RuboCop now excludes
+  nested `vendor/` trees such as `gemfiles/vendor`.
+
+- `kettle-release --skip-bundle-audit` now also prefixes release `bin/rake`
+  commands with `KETTLE_DEV_SKIP_BUNDLE_AUDIT=true`, ensuring the skip reaches
+  the rake process during release checks.
+
+## [2.3.0] - 2026-07-02
+
+- TAG: [v2.3.0][2.3.0t]
+- COVERAGE: 91.95% -- 4216/4585 lines in 35 files
+- BRANCH COVERAGE: 73.19% -- 1660/2268 branches in 35 files
+- 58.02% documented
+
+### Added
+
+- `Kettle::Dev::VersionBump` now exposes the reusable engine behind
+  `kettle-bump`, so other tools can share version detection, target resolution,
+  Prism edits, and write behavior without shelling out or duplicating logic.
+
 ## [2.2.25] - 2026-07-01
 
 - TAG: [v2.2.25][2.2.25t]
@@ -2396,7 +2442,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.2.25...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.1...HEAD
+[2.3.1]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.0...v2.3.1
+[2.3.1t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.1
+[2.3.0]: https://github.com/kettle-dev/kettle-dev/compare/v2.2.25...v2.3.0
+[2.3.0t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.0
 [2.2.25]: https://github.com/kettle-dev/kettle-dev/compare/v2.2.24...v2.2.25
 [2.2.25t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.2.25
 [2.2.24]: https://github.com/kettle-dev/kettle-dev/compare/v2.2.23...v2.2.24

data/README.md

@@ -496,6 +496,14 @@ What it does:
     - 1) Validate GitHub Actions workflow action refs with `kettle-gha-sha-pins --check`; if pins are stale, it prints an outdated-actions summary, exits non-zero, and recommends `kettle-gha-sha-pins --write --upgrade patch`.
     - 2) Normalize Markdown image URLs.
     - 3) Validate that all image URLs referenced by Markdown files resolve (HTTP HEAD).
+- Image URL skips:
+    - Star-history image API URLs are skipped by default because they are volatile.
+    - Add project-specific shell-style URL patterns in `.kettle-family.yml` or a config path pointed to by `KETTLE_FAMILY_CONFIG`:
+        ```yaml
+        pre_release:
+          image_url_skip_patterns:
+            - https://assets.example.com/generated/*
+        ```
 
 ### Commit message helper (git hook)
 
@@ -874,7 +882,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.567-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.658-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-release

@@ -43,7 +43,7 @@ end
 # Do not guard with __FILE__ == $PROGRAM_NAME because binstubs use Kernel.load.
 if ARGV.include?("-h") || ARGV.include?("--help")
   puts <<~USAGE
-    Usage: kettle-release [--version VERSION] [--local-ci] [--appraisal-update] [--skip-steps STEPS] [start_step=<0-19>]
+    Usage: kettle-release [--version VERSION] [--local-ci] [--appraisal-update] [--skip-bundle-audit] [--skip-steps STEPS] [start_step=<0-19>]
 
     Automates the release flow for a Ruby gem in the host project.
 
@@ -80,6 +80,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       --skip-steps NUMBERS        # Alias for skip_steps=NUMBERS (e.g., --skip-steps 10 or --skip-steps 10,18)
       --version VERSION           # Use this version instead of detecting VERSION from lib/**/version.rb
       --appraisal-update          # Use slower appraisal:update instead of default appraisal:generate
+      --skip-bundle-audit         # Skip bundle:audit/update during release rake checks
       --local-ci                  # Sensitive release mode: run act locally, publish before any git push,
                                   # create the git tag locally, then push commits and tags after publish
 
@@ -90,6 +91,8 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       K_RELEASE_LOCAL_CI_WORKFLOW # Name of workflow (without .yml) for local CI; defaults to locked_deps or first
       KETTLE_RELEASE_APPRAISAL_TASK=appraisal:update
                                   # Use slower appraisal:update instead of default appraisal:generate
+      KETTLE_DEV_SKIP_BUNDLE_AUDIT=true
+                                  # Skip bundle:audit/update during release rake checks
       GITHUB_TOKEN / GH_TOKEN     # Optional; enables GitHub release creation and API queries
       GITLAB_TOKEN / GL_TOKEN     # Optional; enables GitLab API queries when applicable
       DEBUG=true                  # Print backtraces on errors
@@ -144,13 +147,14 @@ end
 
 local_ci = ARGV.include?("--local-ci")
 appraisal_task = ARGV.delete("--appraisal-update") ? "appraisal:update" : nil
+skip_bundle_audit = !!ARGV.delete("--skip-bundle-audit")
 start_step_arg = ARGV.find { |a| a.start_with?("start_step=") }
 start_step = start_step_arg ? start_step_arg.split("=", 2)[1].to_i : 0
 version_override = extract_version_arg!(ARGV)
 skip_steps = extract_skip_steps_arg!(ARGV)
 
 begin
-  Kettle::Dev::ReleaseCLI.new(start_step: start_step, local_ci: local_ci, version: version_override, appraisal_task: appraisal_task, skip_steps: skip_steps).run
+  Kettle::Dev::ReleaseCLI.new(start_step: start_step, local_ci: local_ci, version: version_override, appraisal_task: appraisal_task, skip_steps: skip_steps, skip_bundle_audit: skip_bundle_audit).run
 rescue LoadError => e
   warn("#{script_basename}: could not load dependency: #{e.class}: #{e.message}")
   warn(Array(e.backtrace).join("\n")) if ENV["DEBUG"]

data/lib/kettle/dev/bump_cli.rb

@@ -6,8 +6,6 @@ module Kettle
   module Dev
     # CLI for bumping the current project's gem version before changelog prep.
     class BumpCLI
-      BUMP_TYPES = %w[major minor patch pre].freeze
-
       def initialize(argv = [], out: $stdout, err: $stderr, root: Kettle::Dev::CIHelpers.project_root)
         @argv = argv.dup
         @out = out
@@ -19,16 +17,15 @@ module Kettle
         options = parse_options
         return 0 if options.fetch(:help)
 
-        current_version = Kettle::Dev::Versioning.detect_version(root)
-        target_version = resolve_target_version(options.fetch(:target), current_version)
-        edits = collect_edits(
-          current_version: current_version,
-          target_version: target_version,
+        bump = Kettle::Dev::VersionBump.new(
+          root: root,
+          target_version: options.fetch(:target),
           from_version: options[:from]
         )
-        write_edits(edits) if options.fetch(:mode) == :execute
+        edits = bump.edits
+        Kettle::Dev::VersionBump.write_edits(edits) if options.fetch(:mode) == :execute
 
-        out.puts(summary(edits: edits, current_version: current_version, target_version: target_version, mode: options.fetch(:mode)))
+        out.puts(summary(edits: edits, current_version: bump.current_version, target_version: bump.target_version, mode: options.fetch(:mode)))
         (options.fetch(:mode) == :check && edits.any?) ? 1 : 0
       end
 
@@ -59,168 +56,8 @@ module Kettle
         raise Kettle::Dev::Error, error.message
       end
 
-      def resolve_target_version(target, current_version)
-        if BUMP_TYPES.include?(target)
-          bumped_version(target, current_version)
-        else
-          validate_version(target)
-        end
-      end
-
-      def bumped_version(type, current_version)
-        return bumped_prerelease_version(current_version) if type == "pre"
-
-        version = Gem::Version.new(current_version)
-        segments = version.segments
-        unless segments.all? { |segment| segment.is_a?(Integer) }
-          raise Kettle::Dev::Error, "cannot #{type}-bump non-numeric version #{current_version.inspect}"
-        end
-
-        major, minor, patch = (segments + [0, 0, 0])[0, 3]
-        case type
-        when "major"
-          "#{major + 1}.0.0"
-        when "minor"
-          "#{major}.#{minor + 1}.0"
-        when "patch"
-          "#{major}.#{minor}.#{patch + 1}"
-        end
-      end
-
-      def bumped_prerelease_version(current_version)
-        version = Gem::Version.new(current_version)
-        segments = version.segments
-        prerelease_index = segments.index { |segment| !segment.is_a?(Integer) }
-        unless prerelease_index
-          raise Kettle::Dev::Error, "cannot pre-bump version without prerelease segment #{current_version.inspect}"
-        end
-
-        release_core = segments[0...prerelease_index].join(".")
-        prerelease_suffix = prerelease_suffix_for(current_version, release_core)
-        "#{release_core}.#{prerelease_suffix.next}"
-      end
-
-      def prerelease_suffix_for(current_version, release_core)
-        prefix = "#{release_core}."
-        return string_tail(current_version, prefix.length) if current_version.start_with?(prefix)
-
-        canonical_version = Gem::Version.new(current_version).to_s
-        return string_tail(canonical_version, prefix.length) if canonical_version.start_with?(prefix)
-
-        raise Kettle::Dev::Error, "cannot find prerelease segment in version #{current_version.inspect}"
-      end
-
-      def string_tail(value, offset)
-        value[offset, value.length - offset]
-      end
-
       def validate_version(version)
-        Gem::Version.new(version).to_s
-      rescue ArgumentError => error
-        raise Kettle::Dev::Error, "invalid version #{version.inspect}: #{error.message}"
-      end
-
-      def collect_edits(current_version:, target_version:, from_version:)
-        if from_version && current_version != from_version
-          raise Kettle::Dev::Error, "current version is #{current_version}, not --from #{from_version}"
-        end
-
-        version_file_edits(target_version) + gemspec_version_edits(current_version, target_version)
-      end
-
-      def version_file_edits(target_version)
-        Kettle::Dev::Versioning.version_file_candidates(root).filter_map do |path|
-          source = File.read(path)
-          node = version_string_node(source, path)
-          current = node.unescaped
-          next if current == target_version
-
-          replacement = quote_like(node.location.slice, target_version)
-          file_edit(path, source, node.location.start_offset, node.location.end_offset, replacement)
-        end
-      end
-
-      def gemspec_version_edits(current_version, target_version)
-        gemspec_path = gemspec_path_for_bump
-        return [] unless gemspec_path
-
-        source = File.read(gemspec_path)
-        parse_result = parse_source(source, gemspec_path)
-        each_node(parse_result.value).filter_map do |node|
-          next unless node.is_a?(Prism::CallNode) && node.name == :version=
-
-          version_node = node.arguments&.arguments&.first
-          next unless version_node.is_a?(Prism::StringNode)
-          next unless version_node.unescaped == current_version
-          next if version_node.unescaped == target_version
-
-          replacement = quote_like(version_node.location.slice, target_version)
-          file_edit(gemspec_path, source, version_node.location.start_offset, version_node.location.end_offset, replacement)
-        end
-      end
-
-      def gemspec_path_for_bump
-        paths = Dir.glob(File.join(root, "*.gemspec")).sort
-        return nil if paths.empty?
-        raise Kettle::Dev::Error, "multiple gemspecs found; kettle-bump supports single gems only" if paths.length > 1
-
-        paths.first
-      end
-
-      def version_string_node(source, path)
-        parse_result = parse_source(source, path)
-        constant = each_node(parse_result.value).find do |node|
-          node.is_a?(Prism::ConstantWriteNode) && node.name == :VERSION && node.value.is_a?(Prism::StringNode)
-        end
-        raise Kettle::Dev::Error, "could not find string VERSION constant in #{path}" unless constant
-
-        constant.value
-      end
-
-      def parse_source(source, path)
-        require_prism
-        parse_result = Prism.parse(source)
-        raise Kettle::Dev::Error, "could not parse #{path}" unless parse_result.success?
-
-        parse_result
-      end
-
-      def require_prism
-        return if defined?(Prism)
-
-        require "prism"
-      rescue LoadError => error
-        raise Kettle::Dev::Error, "kettle-bump requires Prism; install the prism gem or run on Ruby 3.3+ (#{error.message})"
-      end
-
-      def each_node(root)
-        return enum_for(__method__, root) unless block_given?
-
-        queue = [root]
-        until queue.empty?
-          node = queue.shift
-          yield node
-          queue.concat(node.child_nodes.compact) if node.respond_to?(:child_nodes)
-        end
-      end
-
-      def file_edit(path, source, start_offset, end_offset, replacement)
-        {path: path, source: source, start_offset: start_offset, end_offset: end_offset, replacement: replacement}
-      end
-
-      def quote_like(original, value)
-        quote = original.start_with?("'") ? "'" : '"'
-        "#{quote}#{value}#{quote}"
-      end
-
-      def write_edits(edits)
-        edits.group_by { |edit| edit.fetch(:path) }.each_value do |file_edits|
-          source = file_edits.first.fetch(:source)
-          file_edits.sort_by { |edit| -edit.fetch(:start_offset) }.each do |edit|
-            source[edit.fetch(:start_offset)...edit.fetch(:end_offset)] = edit.fetch(:replacement)
-          end
-          File.write(file_edits.first.fetch(:path), source)
-        end
+        Kettle::Dev::VersionBump.validate_version(version)
       end
 
       def summary(edits:, current_version:, target_version:, mode:)

data/lib/kettle/dev/cache_progress.rb

@@ -8,15 +8,17 @@ module Kettle
       FORMAT = "%t %b %c/%C"
       LENGTH = 30
 
-      def initialize(total:, cached_title:, live_title:, output:, enabled: true)
+      def initialize(total:, cached_title:, live_title:, output:, enabled: true, skipped_title: nil)
         @total = total.to_i
         @cached_count = 0
         @live_count = 0
+        @skipped_count = 0
         @cached_bar = progress_bar(cached_title, output, enabled)
         @live_bar = progress_bar(live_title, output, enabled)
+        @skipped_bar = skipped_title ? progress_bar(skipped_title, output, enabled) : nil
       end
 
-      attr_reader :cached_count, :live_count
+      attr_reader :cached_count, :live_count, :skipped_count
 
       def cached
         @cached_count += 1
@@ -28,6 +30,11 @@ module Kettle
         @live_bar&.increment
       end
 
+      def skipped
+        @skipped_count += 1
+        @skipped_bar&.increment
+      end
+
       private
 
       def progress_bar(title, output, enabled)

data/lib/kettle/dev/pre_release_cli.rb

@@ -4,6 +4,7 @@ require "optparse"
 require "English"
 require "json"
 require "fileutils"
+require "yaml"
 require "uri"
 require "net/http"
 require "openssl"
@@ -26,6 +27,10 @@ module Kettle
     # Usage: Kettle::Dev::PreReleaseCLI.new(check_num: 1).run
     class PreReleaseCLI
       IMAGE_URL_CACHE_TTL_SECONDS = 7 * 24 * 60 * 60
+      DEFAULT_IMAGE_URL_SKIP_PATTERNS = [
+        "https://api.star-history.com/svg*"
+      ].freeze
+      FAMILY_CONFIG_PATHS = [".kettle-family.yml", ".structuredmerge/kettle-family.yml"].freeze
 
       # Simple HTTP helpers for link validation
       module HTTP
@@ -271,6 +276,7 @@ module Kettle
         @check_num = 1 if @check_num < 1
         @image_url_cache_path = configured_image_url_cache_path
         @refresh_image_url_cache = env_truthy?(ENV["KETTLE_IMAGE_URL_CACHE_REFRESH"])
+        @image_url_skip_patterns = configured_image_url_skip_patterns
       end
 
       # Execute configured checks starting from @check_num.
@@ -359,15 +365,23 @@ module Kettle
         puts "[kettle-pre-release] Check 3: Validate Markdown image links (cached HTTP HEAD, with GET fallback)"
         urls = Markdown.extract_image_urls_from_files
         puts "[kettle-pre-release] Found #{urls.size} unique image URL(s)."
+        skipped = []
         cache = image_url_cache
         progress = CacheProgress.new(
           total: urls.size,
           cached_title: "Images cached",
           live_title: "Images live",
+          skipped_title: "Images skipped",
           output: $stdout
         )
         failures = []
         urls.each do |url|
+          if image_url_skipped?(url)
+            skipped << url
+            progress.skipped
+            next
+          end
+
           if cache && !@refresh_image_url_cache && cache.fresh_success?(url)
             progress.cached
             next
@@ -382,6 +396,7 @@ module Kettle
           end
         end
         puts "[kettle-pre-release] Image URL checks: #{progress.cached_count} cached, #{progress.live_count} live."
+        puts "[kettle-pre-release] Skipped #{progress.skipped_count} image URL check(s)." if skipped.any?
         if failures.any?
           warn("[kettle-pre-release] #{failures.size} image URL(s) failed validation:")
           failures.each { |u| warn("  - #{u}") }
@@ -411,6 +426,51 @@ module Kettle
       def env_truthy?(value)
         !!value.to_s.strip.match?(/\A(true|y|yes|1|on)\z/i)
       end
+
+      def configured_image_url_skip_patterns
+        DEFAULT_IMAGE_URL_SKIP_PATTERNS + family_configured_image_url_skip_patterns
+      end
+
+      def family_configured_image_url_skip_patterns
+        data = family_config_data
+        patterns = data.dig("pre_release", "image_url_skip_patterns")
+        Array(patterns).map(&:to_s).reject(&:empty?)
+      end
+
+      def family_config_data
+        config_path = configured_family_config_path
+        return {} unless config_path
+
+        data = stringify_keys(YAML.load_file(config_path) || {})
+        data.is_a?(Hash) ? data : {}
+      rescue Psych::SyntaxError, Errno::EACCES => e
+        warn("[kettle-pre-release] Could not read #{config_path}: #{e.class}: #{e.message}")
+        {}
+      end
+
+      def configured_family_config_path
+        env_path = ENV.fetch("KETTLE_FAMILY_CONFIG", nil)
+        return File.expand_path(env_path) if env_path && File.file?(File.expand_path(env_path))
+
+        FAMILY_CONFIG_PATHS.find { |path| File.file?(path) }
+      end
+
+      def image_url_skipped?(url)
+        @image_url_skip_patterns.any? do |pattern|
+          File.fnmatch?(pattern, url, File::FNM_CASEFOLD)
+        end
+      end
+
+      def stringify_keys(value)
+        case value
+        when Hash
+          value.to_h { |key, item| [key.to_s, stringify_keys(item)] }
+        when Array
+          value.map { |item| stringify_keys(item) }
+        else
+          value
+        end
+      end
     end
   end
 end

data/lib/kettle/dev/rakelib/bundle_audit.rake

@@ -1,20 +1,36 @@
 # frozen_string_literal: true
 
-# Setup Bundle Audit
-begin
-  require "bundler/audit/task"
+skip_bundle_audit = %w[1 true yes on].include?(ENV.fetch("KETTLE_DEV_SKIP_BUNDLE_AUDIT", "").downcase)
 
-  Bundler::Audit::Task.new
-  Kettle::Dev.register_default("bundle:audit:update")
-  Kettle::Dev.register_default("bundle:audit")
-rescue LoadError
-  warn("[kettle-dev][bundle_audit.rake] failed to load bundle/audit/task") if Kettle::Dev::DEBUGGING
-  desc("(stub) bundle:audit is unavailable")
+define_bundle_audit_stub_tasks = lambda do |description_prefix, warning|
+  desc("#{description_prefix} bundle:audit")
   task("bundle:audit") do
-    warn("NOTE: bundler-audit isn't installed, or is disabled for #{RUBY_VERSION} in the current environment")
+    warn(warning.call("bundle:audit"))
   end
-  desc("(stub) bundle:audit:update is unavailable")
+  desc("#{description_prefix} bundle:audit:update")
   task("bundle:audit:update") do
-    warn("NOTE: bundler-audit isn't installed, or is disabled for #{RUBY_VERSION} in the current environment")
+    warn(warning.call("bundle:audit:update"))
+  end
+end
+
+if skip_bundle_audit
+  define_bundle_audit_stub_tasks.call(
+    "(skipped)",
+    ->(task_name) { "NOTE: #{task_name} skipped because KETTLE_DEV_SKIP_BUNDLE_AUDIT is enabled" }
+  )
+else
+  # Setup Bundle Audit
+  begin
+    require "bundler/audit/task"
+
+    Bundler::Audit::Task.new
+    Kettle::Dev.register_default("bundle:audit:update")
+    Kettle::Dev.register_default("bundle:audit")
+  rescue LoadError
+    warn("[kettle-dev][bundle_audit.rake] failed to load bundle/audit/task") if Kettle::Dev::DEBUGGING
+    define_bundle_audit_stub_tasks.call(
+      "(stub)",
+      ->(_task_name) { "NOTE: bundler-audit isn't installed, or is disabled for #{RUBY_VERSION} in the current environment" }
+    )
   end
 end

data/lib/kettle/dev/rakelib/spec_test.rake

@@ -36,7 +36,12 @@ setup_spec_task = ->(default:) {
   unless Rake::Task.task_defined?(:spec)
     desc("Run RSpec code examples")
     task(:spec) do
-      sh("bundle", "exec", "kettle-test")
+      begin
+        skip_bundle_audit = ENV.delete("KETTLE_DEV_SKIP_BUNDLE_AUDIT")
+        sh("bundle", "exec", "kettle-test")
+      ensure
+        ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"] = skip_bundle_audit if skip_bundle_audit
+      end
     end
   end
 

data/lib/kettle/dev/release_cli.rb

@@ -108,18 +108,25 @@ module Kettle
 
       public
 
-      def initialize(start_step: 0, local_ci: false, version: nil, appraisal_task: nil, skip_steps: nil)
+      def initialize(start_step: 0, local_ci: false, version: nil, appraisal_task: nil, skip_steps: nil, skip_bundle_audit: nil)
         @root = Kettle::Dev::CIHelpers.project_root
         @git = Kettle::Dev::GitAdapter.new
         @start_step = (start_step || 0).to_i
         @start_step = 0 if @start_step < 0
         @skip_steps = normalize_skip_steps(skip_steps)
         @local_ci = !!local_ci
+        @skip_bundle_audit = truthy_value?(skip_bundle_audit) || truthy_value?(ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"])
         @version_override = Kettle::Dev::Versioning.normalize_explicit_version(version)
         @appraisal_task = normalize_appraisal_task(appraisal_task || ENV["KETTLE_RELEASE_APPRAISAL_TASK"])
       end
 
       def run
+        with_bundle_audit_skip_env do
+          run_with_release_environment
+        end
+      end
+
+      def run_with_release_environment
         run_pre_release_checks! if run_step?(0)
 
         # 1. Ensure Bundler version ✓
@@ -404,6 +411,16 @@ module Kettle
         @local_ci
       end
 
+      def skip_bundle_audit?
+        @skip_bundle_audit
+      end
+
+      def truthy_value?(value)
+        return true if value == true
+
+        DEBUG_TRUE_VALUES.include?(value.to_s.downcase)
+      end
+
       def run_step?(step)
         @start_step <= step && !@skip_steps.include?(step)
       end
@@ -701,7 +718,30 @@ module Kettle
       end
 
       def run_cmd!(cmd)
-        self.class.run_cmd!(cmd)
+        cmd = bundle_audit_skip_command(cmd)
+        with_bundle_audit_skip_env do
+          self.class.run_cmd!(cmd)
+        end
+      end
+
+      def bundle_audit_skip_command(cmd)
+        return cmd unless skip_bundle_audit?
+        return cmd unless cmd.start_with?("bin/rake")
+        return cmd if cmd.start_with?("KETTLE_DEV_SKIP_BUNDLE_AUDIT=")
+
+        "KETTLE_DEV_SKIP_BUNDLE_AUDIT=true #{cmd}"
+      end
+
+      def with_bundle_audit_skip_env
+        return yield unless skip_bundle_audit?
+
+        previous = ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"]
+        ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"] = "true"
+        yield
+      ensure
+        if skip_bundle_audit?
+          previous.nil? ? ENV.delete("KETTLE_DEV_SKIP_BUNDLE_AUDIT") : ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"] = previous
+        end
       end
 
       def git_output(args)

data/lib/kettle/dev/version.rb

@@ -3,7 +3,7 @@
 module Kettle
   module Dev
     module Version
-      VERSION = "2.2.25"
+      VERSION = "2.3.1"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

data/lib/kettle/dev/version_bump.rb

@@ -0,0 +1,195 @@
+# frozen_string_literal: true
+
+module Kettle
+  module Dev
+    # Reusable engine behind kettle-bump.
+    class VersionBump
+      BUMP_TYPES = %w[major minor patch pre].freeze
+
+      class << self
+        def resolve_target_version(target, current_version)
+          target = target.to_s
+          if BUMP_TYPES.include?(target)
+            bumped_version(target, current_version)
+          else
+            validate_version(target)
+          end
+        end
+
+        def validate_version(version)
+          Gem::Version.new(version).to_s
+        rescue ArgumentError => error
+          raise Kettle::Dev::Error, "invalid version #{version.inspect}: #{error.message}"
+        end
+
+        def bumped_version(type, current_version)
+          return bumped_prerelease_version(current_version) if type == "pre"
+
+          version = Gem::Version.new(current_version)
+          segments = version.segments
+          unless segments.all? { |segment| segment.is_a?(Integer) }
+            raise Kettle::Dev::Error, "cannot #{type}-bump non-numeric version #{current_version.inspect}"
+          end
+
+          major, minor, patch = (segments + [0, 0, 0])[0, 3]
+          case type
+          when "major"
+            "#{major + 1}.0.0"
+          when "minor"
+            "#{major}.#{minor + 1}.0"
+          when "patch"
+            "#{major}.#{minor}.#{patch + 1}"
+          end
+        end
+
+        def bumped_prerelease_version(current_version)
+          version = Gem::Version.new(current_version)
+          segments = version.segments
+          prerelease_index = segments.index { |segment| !segment.is_a?(Integer) }
+          unless prerelease_index
+            raise Kettle::Dev::Error, "cannot pre-bump version without prerelease segment #{current_version.inspect}"
+          end
+
+          release_core = segments[0...prerelease_index].join(".")
+          prerelease_suffix = prerelease_suffix_for(current_version, release_core)
+          "#{release_core}.#{prerelease_suffix.next}"
+        end
+
+        def prerelease_suffix_for(current_version, release_core)
+          prefix = "#{release_core}."
+          return string_tail(current_version, prefix.length) if current_version.start_with?(prefix)
+
+          canonical_version = Gem::Version.new(current_version).to_s
+          return string_tail(canonical_version, prefix.length) if canonical_version.start_with?(prefix)
+
+          raise Kettle::Dev::Error, "cannot find prerelease segment in version #{current_version.inspect}"
+        end
+
+        def string_tail(value, offset)
+          value[offset, value.length - offset]
+        end
+
+        def version_string_node(source, path)
+          parse_result = parse_source(source, path)
+          constant = each_node(parse_result.value).find do |node|
+            node.is_a?(Prism::ConstantWriteNode) && node.name == :VERSION && node.value.is_a?(Prism::StringNode)
+          end
+          raise Kettle::Dev::Error, "could not find string VERSION constant in #{path}" unless constant
+
+          constant.value
+        end
+
+        def parse_source(source, path)
+          require_prism
+          parse_result = Prism.parse(source)
+          raise Kettle::Dev::Error, "could not parse #{path}" unless parse_result.success?
+
+          parse_result
+        end
+
+        def require_prism
+          return if defined?(Prism)
+
+          require "prism"
+        rescue LoadError => error
+          raise Kettle::Dev::Error, "kettle-bump requires Prism; install the prism gem or run on Ruby 3.3+ (#{error.message})"
+        end
+
+        def each_node(root)
+          return enum_for(__method__, root) unless block_given?
+
+          queue = [root]
+          until queue.empty?
+            node = queue.shift
+            yield node
+            queue.concat(node.child_nodes.compact) if node.respond_to?(:child_nodes)
+          end
+        end
+
+        def file_edit(path, source, start_offset, end_offset, replacement)
+          {path: path, source: source, start_offset: start_offset, end_offset: end_offset, replacement: replacement}
+        end
+
+        def quote_like(original, value)
+          quote = original.start_with?("'") ? "'" : '"'
+          "#{quote}#{value}#{quote}"
+        end
+
+        def write_edits(edits)
+          edits.group_by { |edit| edit.fetch(:path) }.each_value do |file_edits|
+            source = file_edits.first.fetch(:source)
+            file_edits.sort_by { |edit| -edit.fetch(:start_offset) }.each do |edit|
+              source[edit.fetch(:start_offset)...edit.fetch(:end_offset)] = edit.fetch(:replacement)
+            end
+            File.write(file_edits.first.fetch(:path), source)
+          end
+        end
+      end
+
+      def initialize(root:, target_version:, current_version: nil, from_version: nil)
+        @root = root
+        @current_version = current_version || Kettle::Dev::Versioning.detect_version(root)
+        @target_version = self.class.resolve_target_version(target_version, @current_version)
+        @from_version = self.class.validate_version(from_version) if from_version
+      end
+
+      attr_reader :root, :current_version, :target_version, :from_version
+
+      def edits
+        validate_from_version
+        version_file_edits + gemspec_version_edits
+      end
+
+      def write!
+        self.class.write_edits(edits)
+      end
+
+      private
+
+      def validate_from_version
+        return unless from_version && current_version != from_version
+
+        raise Kettle::Dev::Error, "current version is #{current_version}, not --from #{from_version}"
+      end
+
+      def version_file_edits
+        Kettle::Dev::Versioning.version_file_candidates(root).filter_map do |path|
+          source = File.read(path)
+          node = self.class.version_string_node(source, path)
+          current = node.unescaped
+          next if current == target_version
+
+          replacement = self.class.quote_like(node.location.slice, target_version)
+          self.class.file_edit(path, source, node.location.start_offset, node.location.end_offset, replacement)
+        end
+      end
+
+      def gemspec_version_edits
+        gemspec_path = gemspec_path_for_bump
+        return [] unless gemspec_path
+
+        source = File.read(gemspec_path)
+        parse_result = self.class.parse_source(source, gemspec_path)
+        self.class.each_node(parse_result.value).filter_map do |node|
+          next unless node.is_a?(Prism::CallNode) && node.name == :version=
+
+          version_node = node.arguments&.arguments&.first
+          next unless version_node.is_a?(Prism::StringNode)
+          next unless version_node.unescaped == current_version
+          next if version_node.unescaped == target_version
+
+          replacement = self.class.quote_like(version_node.location.slice, target_version)
+          self.class.file_edit(gemspec_path, source, version_node.location.start_offset, version_node.location.end_offset, replacement)
+        end
+      end
+
+      def gemspec_path_for_bump
+        paths = Dir.glob(File.join(root, "*.gemspec")).sort
+        return nil if paths.empty?
+        raise Kettle::Dev::Error, "multiple gemspecs found; kettle-bump supports single gems only" if paths.length > 1
+
+        paths.first
+      end
+    end
+  end
+end

data/lib/kettle/dev/version_gem.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require "version_gem"
+require_relative "version"
+
+Kettle::Dev::Version.class_eval do
+  extend VersionGem::Basic
+end

data/lib/kettle/dev.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "version_gem"
 require_relative "dev/version"
 
 if Gem.ruby_version < Gem::Version.new("2.7")
@@ -13,9 +12,6 @@ if Gem.ruby_version < Gem::Version.new("2.7")
   end
 end
 
-Kettle::Dev::Version.class_eval do
-  extend VersionGem::Basic
-end
 # External gems
 
 # It's not reasonable to test this ENV variable
@@ -47,6 +43,7 @@ module Kettle
     autoload :ReleaseCLI, "kettle/dev/release_cli"
     autoload :PreReleaseCLI, "kettle/dev/pre_release_cli"
     autoload :Version, "kettle/dev/version"
+    autoload :VersionBump, "kettle/dev/version_bump"
     autoload :Versioning, "kettle/dev/versioning"
 
     # Nested tasks namespace with autoloaded task modules

data/sig/kettle/dev/pre_release_cli.rbs

@@ -1,6 +1,10 @@
 module Kettle
   module Dev
     class PreReleaseCLI
+      IMAGE_URL_CACHE_TTL_SECONDS: Integer
+      DEFAULT_IMAGE_URL_SKIP_PATTERNS: Array[String]
+      FAMILY_CONFIG_PATHS: Array[String]
+
       module HTTP
         def self.parse_http_uri: (String url_str) -> ::URI
         def self.head_ok?: (String url_str, ?limit: Integer, ?timeout: Integer) -> bool

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 2.2.25
+  version: 2.3.1
 platform: ruby
 authors:
 - Peter H. Boling
@@ -339,6 +339,8 @@ files:
 - lib/kettle/dev/tasks.rb
 - lib/kettle/dev/tasks/ci_task.rb
 - lib/kettle/dev/version.rb
+- lib/kettle/dev/version_bump.rb
+- lib/kettle/dev/version_gem.rb
 - lib/kettle/dev/versioning.rb
 - lib/kettle/emoji_regex.rb
 - sig/kettle-dev.rbs
@@ -375,10 +377,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.2.25
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.2.25/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.3.1
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.3.1/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.2.25
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.3.1
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev