kettle-dev 2.3.6 → 2.3.7

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 273f836980d8c8210b2aa13b46a7e8abe3c20890caaff4be48303f807ece69bb
-  data.tar.gz: 2cc93d325d82e8f82af073115f5063d684468dbf15978c5300ce44c1384ae9ab
+  metadata.gz: 4e582c50d05608c5e338caeac74f7c339fb2d66010b58c8cce836a78d8e4ded5
+  data.tar.gz: e9ce2e0857dbf506017c8ddab46c5049ffc5003af5778a2e2954dd759cee8183
 SHA512:
-  metadata.gz: 891edcb0fde5e40b98f8f221065e5fa283d249700dfb9e216fc8da6668c6dabfc9cf0ba6892b9f202285d03304a31056dc62e5ee6f56a1a760629d971606d07a
-  data.tar.gz: 10de64450794d5b99b0db2b455a8ed05589e18dacafd1299eb6d01546a7ca759dae64739213b4b64dbc2acbf80c0095d39553027496128977de4eab3267a293f
+  metadata.gz: cea8e2be14321cc1e70534197cd2b01dea382a62f6de651ebfb35ccf1025acdfb0a11ee74c31e7c5c78dfe216ec51fdbe21a02f4f1358b6e8b526365b9a5f5af
+  data.tar.gz: 47dada022728fd8414d252df3d01ecb992f18ccea69ed20ed8670dbd87ab3cf7f205bb488a48ab95039a4548a0b278c5e8aaf7099b7d94248539db5e7630c26b

data/CHANGELOG.md

@@ -30,6 +30,19 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.3.7] - 2026-07-18
+
+- TAG: [v2.3.7][2.3.7t]
+- COVERAGE: 91.84% -- 4311/4694 lines in 36 files
+- BRANCH COVERAGE: 74.20% -- 1694/2283 branches in 36 files
+- 56.25% documented
+
+### Fixed
+
+- `kettle-gha-sha-pins` now canonicalizes duplicate equivalent action tags,
+  preferring explicit release tags such as `v7.0.0` over major-line aliases
+  such as `v7`, so adjacent version comments do not flip between spellings.
+
 ## [2.3.6] - 2026-07-17
 
 - TAG: [v2.3.6][2.3.6t]
@@ -2523,7 +2536,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.6...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.7...HEAD
+[2.3.7]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.6...v2.3.7
+[2.3.7t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.7
 [2.3.6]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.5...v2.3.6
 [2.3.6t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.6
 [2.3.5]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.4...v2.3.5

data/README.md

@@ -887,7 +887,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.673-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.694-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/gha_sha_pins_cli.rb

@@ -35,6 +35,23 @@ module Kettle
       VERSION_COMMENT_SUFFIX_RE = /\A\s+#\s*v?(?<version>\d+(?:\.\d+\.\d+(?:[-.]?[0-9A-Za-z.-]+)?)?)/
       VERSION_COMMENT_REPLACEMENT_RE = /\A(?<prefix>\s+#\s*)v?\d+(?:\.\d+\.\d+(?:[-.]?[0-9A-Za-z.-]+)?)?/
 
+      def self.release_version_sort_key(entry)
+        [entry.fetch(:version_obj), *release_version_specificity(entry)]
+      end
+
+      def self.release_version_specificity(entry)
+        text = entry.fetch(:tag).to_s.sub(/\A[vV]/, "")
+        release_text, suffix = text.split(/[-.](?=[A-Za-z])/, 2)
+        numeric_segments = release_text.to_s.split(".").take_while { |part| part.match?(/\A\d+\z/) }
+
+        [
+          numeric_segments.length,
+          suffix ? 0 : 1,
+          text.length,
+          entry.fetch(:tag).to_s
+        ]
+      end
+
       def initialize(argv, err: $stderr)
         @argv = argv
         @err = err
@@ -521,7 +538,7 @@ module Kettle
           end
         end
 
-        candidates.max_by { |entry| entry[:version_obj] }
+        candidates.max_by { |entry| release_version_sort_key(entry) }
       end
 
       def major_line_version?(value)
@@ -538,7 +555,7 @@ module Kettle
               entry[:version_obj] > current &&
               (!entry[:version_obj].prerelease? || current.prerelease?)
           end
-          .max_by { |entry| entry[:version_obj] }
+          .max_by { |entry| release_version_sort_key(entry) }
       end
 
       def determine_upgrade_plan(old_ref:, repo_ref:, versions:, upgrade_level:, client:)
@@ -645,6 +662,10 @@ module Kettle
         sha
       end
 
+      def release_version_sort_key(entry)
+        self.class.release_version_sort_key(entry)
+      end
+
       def short_sha?(candidate)
         return false unless candidate
         WEAK_SHA_RE.match?(candidate)
@@ -1061,10 +1082,10 @@ module Kettle
           full_semver_entries = entries.reject { |entry| major_line_version?(entry[:version]) }
           {
             "patch" => full_semver_entries.group_by { |entry| entry[:version_obj].segments[0, 2].join(".") }
-              .transform_values { |group| serialize_target(group.max_by { |entry| entry[:version_obj] }) },
+              .transform_values { |group| serialize_target(group.max_by { |entry| GhaShaPinsCLI.release_version_sort_key(entry) }) },
             "minor" => full_semver_entries.group_by { |entry| entry[:version_obj].segments[0].to_s }
-              .transform_values { |group| serialize_target(group.max_by { |entry| entry[:version_obj] }) },
-            "major" => {"*" => serialize_target(entries.max_by { |entry| entry[:version_obj] })}
+              .transform_values { |group| serialize_target(group.max_by { |entry| GhaShaPinsCLI.release_version_sort_key(entry) }) },
+            "major" => {"*" => serialize_target(entries.max_by { |entry| GhaShaPinsCLI.release_version_sort_key(entry) })}
           }
         end
 
@@ -1212,12 +1233,34 @@ module Kettle
             }
           end
           releases.concat(tag_versions)
+          releases = canonicalize_equivalent_release_versions(releases)
 
-          releases.sort_by! { |release| release[:version_obj] }
+          releases.sort_by! { |release| GhaShaPinsCLI.release_version_sort_key(release) }
           releases.reverse!
           releases
         end
 
+        def canonicalize_equivalent_release_versions(releases)
+          groups = []
+          releases.each do |release|
+            group = groups.find { |entries| equivalent_release_tag?(entries.first, release) }
+            if group
+              group << release
+            else
+              groups << [release]
+            end
+          end
+
+          groups.map { |entries| entries.max_by { |entry| GhaShaPinsCLI.release_version_sort_key(entry) } }
+        end
+
+        def equivalent_release_tag?(left, right)
+          left[:version_obj] == right[:version_obj] &&
+            left[:sha] &&
+            right[:sha] &&
+            left[:sha] == right[:sha]
+        end
+
         def parse_release_version_text(value)
           normalized = value.to_s.sub(/\A[vV]/, "")
           return nil unless normalized.match?(/\A(?:\d+|\d+\.\d+\.\d+(?:[-.]?[0-9A-Za-z.-]+)?)\z/)

data/lib/kettle/dev/version.rb

@@ -3,7 +3,7 @@
 module Kettle
   module Dev
     module Version
-      VERSION = "2.3.6"
+      VERSION = "2.3.7"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 2.3.6
+  version: 2.3.7
 platform: ruby
 authors:
 - Peter H. Boling
@@ -313,10 +313,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.3.6
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.3.6/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.3.7
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.3.7/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.3.6
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.3.7
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev