kettle-dev 2.3.8 → 2.3.10

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: fb500cfcc82a5cb325eb83ae9a5464e8333cce1c3ec03814b597063d41ec0e8a
-  data.tar.gz: 124a6c4ad4a3dd9172c131d6d5276a685d7e15f2be8f5fc51722c028fc83f136
+  metadata.gz: 043a73e1a2fb35f02748261dc4d5f81865e233a982c10b73d6b957ef7a7ce66d
+  data.tar.gz: 4695065e3a9a9ce34f586fb4baeb76064b59048914a7c12e5e1590435dfe5862
 SHA512:
-  metadata.gz: 1dd9b51023413bc9301d87dfc989dcec0844190b0cccfa90d8344bcd428403c70837f3972fdedc0cf2b4dee103af88923cc41ec43f80a869098a8a20da8a579d
-  data.tar.gz: 94084430abf75c714d2b5be26a25f1a9c1be691fc9c4f2fa760fc767e7ce1698e01ab71f5b978ec744f9981eeedc7b474a663b51504c6d842c0569ffe7e79cb0
+  metadata.gz: 555075c8b24c72b0a3ae955d790d0af6b97f265a5fcd00dd3aad16bf3c46ca315081b64d6a39553039e70c438774553826eb7e2a7ecc358e441fa1a066cadeb1
+  data.tar.gz: 896b19afe31b86aaed964605cf63767ec1d8bc4d8c214e1599835781c2f86919d1510d1601a7597cb53cf57713812779b07de550d710e0d7ac40c3c4f7d28d4b

data/CHANGELOG.md

@@ -30,6 +30,51 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.3.10] - 2026-07-23
+
+- TAG: [v2.3.10][2.3.10t]
+- COVERAGE: 92.35% -- 3790/4104 lines in 37 files
+- BRANCH COVERAGE: 75.95% -- 1500/1975 branches in 37 files
+- 60.00% documented
+
+### Changed
+
+- Local development tooling now uses `kettle-gha-pins` 0.2.0 or newer on
+  Ruby 3.2+, while keeping older supported Ruby bundles solvable.
+- `kettle-gha-sha-pins` now delegates GitHub Actions release-tag parsing,
+  canonicalization, cache persistence, GitHub release/tag/commit resolution,
+  and upgrade-target selection to the shared
+  `kettle-gha-pins` gem.
+- `kettle-gha-sha-pins` is now a compatibility wrapper around the
+  `kettle-gha-pins` executable.
+
+### Fixed
+
+- Restored `kettle-gha-pins` as a normal runtime dependency now that 0.2.1
+  supports the full `kettle-dev` Ruby floor.
+
+- Appraisal rake task specs now rely on kettle-test's `silent_stream`
+  integration instead of stubbing `Object#warn`, which is not supported under
+  JRuby 9.4.
+
+## [2.3.9] - 2026-07-21
+
+- TAG: [v2.3.9][2.3.9t]
+- COVERAGE: 92.06% -- 4443/4826 lines in 37 files
+- BRANCH COVERAGE: 74.09% -- 1733/2339 branches in 37 files
+- 54.64% documented
+
+### Fixed
+
+- `kettle-release` now records a short-lived gem.coop release-state cache-bust
+  marker after publishing, and `kettle-changelog --release-state` uses it to
+  refresh just-published gem version lookups.
+
+- `dep-heads.yml` now runs each engine directly from
+  `gemfiles/dep_heads.gemfile`, avoiding `Appraisal.root.gemfile` bootstrap
+  failures with RubyGems/Bundler and gem.coop before the dep-heads appraisal is
+  selected.
+
 ## [2.3.8] - 2026-07-21
 
 - TAG: [v2.3.8][2.3.8t]
@@ -2568,7 +2613,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.8...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.10...HEAD
+[2.3.10]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.9...v2.3.10
+[2.3.10t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.10
+[2.3.9]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.8...v2.3.9
+[2.3.9t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.9
 [2.3.8]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.7...v2.3.8
 [2.3.8t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.8
 [2.3.7]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.6...v2.3.7

data/README.md

@@ -470,6 +470,8 @@ What it does:
 ### Pre-release checks
 
 - Script: `exe/kettle-gha-sha-pins` (run as `kettle-gha-sha-pins`)
+- New projects should install `kettle-gha-pins` and run `kettle-gha-pins`
+  directly; this `kettle-dev` command remains as a compatibility wrapper.
 - Purpose: Validate and optionally update GitHub Actions `uses:` refs to pinned
   SHAs and current allowed release versions.
 - Usage:
@@ -889,7 +891,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.761-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.104-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-changelog

@@ -55,7 +55,7 @@ end
 
 if ARGV.include?("-h") || ARGV.include?("--help")
   puts <<~USAGE
-    Usage: kettle-changelog [--version VERSION] [--update-prep] [--pending-release] [--release-state] [--add-unreleased-entry --section SECTION --entry TEXT] [--json] [--no-strict] [--no-coverage-threshold]
+    Usage: kettle-changelog [--version VERSION] [--update-prep] [--pending-release] [--release-state] [--refresh-cache] [--add-unreleased-entry --section SECTION --entry TEXT] [--json] [--no-strict] [--no-coverage-threshold]
 
     Detects the current version from lib/**/version.rb, the latest live release, and
     the most recent CHANGELOG.md release section, then prompts to confirm the selected plan:
@@ -70,6 +70,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       --pending-release         Query whether the changelog has release work pending; exits 0 for yes, 1 for no
       --release-state,
       --release-status          Print changelog release state, including latest published release and pending sources
+      --refresh-cache           Bypass cached gem.coop version data for this invocation
       --add-unreleased-entry    Add one entry to an existing section under ## [Unreleased]
       --section SECTION         Unreleased section to receive the entry (Added, Changed, Deprecated, Removed, Fixed, Security)
       --entry TEXT              Changelog entry text; "- " is added when omitted
@@ -82,6 +83,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       K_CHANGELOG_COVERAGE_HARD=false       Disable coverage threshold hard-failure
       K_CHANGELOG_VERSION_FILE=path         Read VERSION from this file instead of lib/**/version.rb
       K_CHANGELOG_GEM_NAME=name             Read live release data as this gem instead of root .gemspec
+      KETTLE_GEM_COOP_REFRESH=true          Bypass cached gem.coop version data
 
     Data generation:
       Strict mode is the default. Release plans remove stale coverage output,
@@ -131,6 +133,7 @@ begin
   update_prep = ARGV.delete("--update-prep")
   pending_release_query = ARGV.delete("--pending-release")
   release_state_query = ARGV.delete("--release-state") || ARGV.delete("--release-status")
+  refresh_cache = ARGV.delete("--refresh-cache")
   add_unreleased_entry = ARGV.delete("--add-unreleased-entry") || ARGV.delete("--add-changelog-entry")
   json_output = ARGV.delete("--json")
   coverage_threshold_disabled = ARGV.include?("--no-coverage-threshold") || ARGV.include?("--no-coverage-thresholds")
@@ -167,7 +170,7 @@ begin
     exit(0)
   end
 
-  cli = Kettle::Dev::ChangelogCLI.new(strict: strict_mode, enforce_coverage_thresholds: coverage_hard, update_prep: update_prep, version: version_override)
+  cli = Kettle::Dev::ChangelogCLI.new(strict: strict_mode, enforce_coverage_thresholds: coverage_hard, update_prep: update_prep, version: version_override, refresh_cache: refresh_cache)
   if release_state_query
     state = cli.release_state
     puts(json_output ? JSON.pretty_generate(state) : cli.release_state_table(state))

data/exe/kettle-gha-sha-pins

@@ -3,38 +3,12 @@
 
 # vim: set syntax=ruby
 
-$stdout.sync = true
-$stderr.sync = true
-
-# Do not rely on Bundler; allow running in repos that do not depend on kettle-dev
-begin
-  require "rubygems"
-rescue LoadError
-  # Older Rubies always have rubygems; continue anyway
-end
-
 script_basename = File.basename(__FILE__)
 
 begin
-  require "kettle/dev"
-rescue LoadError
-  repo_lib = File.expand_path("../lib", __dir__)
-  $LOAD_PATH.unshift(repo_lib) unless $LOAD_PATH.include?(repo_lib)
-  begin
-    require "kettle/dev"
-  rescue LoadError => e
-    warn("#{script_basename}: could not load dependency: #{e.class}: #{e.message}")
-    warn("Hint: Install the kettle-dev gem (`gem install kettle-dev`) or add it to your Gemfile. Bundler is not required for this script.")
-    exit(1)
-  end
-end
-
-begin
-  cli = Kettle::Dev::GhaShaPinsCLI.new(ARGV)
-  status = cli.run!
-  Kettle::Dev::ExitAdapter.exit(status)
-rescue => e
-  warn("#{script_basename}: unexpected error: #{e.class}: #{e.message}")
-  warn(e.backtrace.join("\n"))
-  Kettle::Dev::ExitAdapter.exit(1)
+  Kernel.exec(Gem.ruby, Gem.bin_path("kettle-gha-pins", "kettle-gha-pins"), *ARGV)
+rescue Gem::Exception, LoadError => e
+  warn("#{script_basename}: could not load kettle-gha-pins executable: #{e.class}: #{e.message}")
+  warn("Hint: Install the kettle-gha-pins gem (`gem install kettle-gha-pins`) or add it to your Gemfile.")
+  exit(1)
 end

data/lib/kettle/dev/changelog_cli.rb

@@ -27,7 +27,7 @@ module Kettle
       # @param enforce_coverage_thresholds [Boolean] when true, fail strict coverage generation below project thresholds
       # @param update_prep [Boolean] when true, update the most recent prepared release section in place
       # @param version [String, nil] explicit version override for gems without a literal VERSION constant
-      def initialize(strict: true, enforce_coverage_thresholds: true, update_prep: false, version: nil, root: Kettle::Dev::CIHelpers.project_root)
+      def initialize(strict: true, enforce_coverage_thresholds: true, update_prep: false, version: nil, root: Kettle::Dev::CIHelpers.project_root, refresh_cache: false)
         @root = root
         @changelog_path = File.join(@root, "CHANGELOG.md")
         @coverage_path = File.join(@root, "coverage", "coverage.json")
@@ -35,6 +35,7 @@ module Kettle
         @enforce_coverage_thresholds = enforce_coverage_thresholds
         @update_prep = update_prep
         @version_override = Kettle::Dev::Versioning.normalize_explicit_version(version)
+        @refresh_cache = refresh_cache
       end
 
       # Main entry point to update CHANGELOG.md
@@ -399,11 +400,9 @@ module Kettle
       end
 
       def latest_released_versions(gem_name, current_version)
-        uri = URI("https://gem.coop/api/v1/versions/#{gem_name}.json")
-        res = Net::HTTP.get_response(uri)
-        return [nil, nil] unless res.is_a?(Net::HTTPSuccess)
+        data = Kettle::Dev::GemCoopVersions.fetch(gem_name, version_hint: current_version, refresh: @refresh_cache)
+        return [nil, nil, nil] unless data.is_a?(Array)
 
-        data = JSON.parse(res.body)
         versions = data.map { |h| h["number"] }.compact
         versions.reject! { |v| v.to_s.include?("-pre") || v.to_s.include?(".pre") || v.to_s.match?(/[a-zA-Z]/) }
         gversions = versions.map { |s| Gem::Version.new(s) }.sort

data/lib/kettle/dev/gem_coop_versions.rb

@@ -0,0 +1,92 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "net/http"
+require "time"
+require "uri"
+
+module Kettle
+  module Dev
+    module GemCoopVersions
+      CACHE_BUST_TTL_SECONDS = 15 * 60
+      ENV_REFRESH = "KETTLE_GEM_COOP_REFRESH"
+      ENV_MARKER_PATH = "KETTLE_GEM_COOP_CACHE_BUST_PATH"
+
+      class << self
+        def fetch(gem_name, version_hint: nil, refresh: false)
+          cache_bust = refresh || env_refresh? || fresh_release_marker?(gem_name, version_hint)
+          uri = versions_uri(gem_name, cache_bust: cache_bust)
+          request = Net::HTTP::Get.new(uri)
+          if cache_bust
+            request["Cache-Control"] = "no-cache"
+            request["Pragma"] = "no-cache"
+          end
+          response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http|
+            http.request(request)
+          end
+          return nil unless response.is_a?(Net::HTTPSuccess)
+
+          JSON.parse(response.body)
+        end
+
+        def mark_released(gem_name, version)
+          return if gem_name.to_s.empty? || version.to_s.empty?
+
+          path = marker_path
+          data = read_marker(path)
+          data["releases"] ||= {}
+          data["releases"][gem_name.to_s] = {
+            "version" => version.to_s,
+            "released_at" => Time.now.utc.iso8601
+          }
+          FileUtils.mkdir_p(File.dirname(path))
+          File.write(path, JSON.pretty_generate(data) << "\n")
+        rescue => error
+          warn("[kettle-dev] could not update gem.coop cache-bust marker: #{error.class}: #{error.message}") if Kettle::Dev::DEBUGGING
+        end
+
+        def marker_path
+          configured = ENV.fetch(ENV_MARKER_PATH, "").to_s
+          return configured unless configured.empty?
+
+          state_home = ENV["XDG_STATE_HOME"]
+          state_home = File.join(Dir.home, ".local", "state") if state_home.to_s.empty?
+          File.join(state_home, "kettle-dev", "gem-coop-cache-bust.json")
+        end
+
+        private
+
+        def versions_uri(gem_name, cache_bust:)
+          uri = URI("https://gem.coop/api/v1/versions/#{gem_name}.json")
+          uri.query = "_kettle_cache_bust=#{Time.now.to_i}" if cache_bust
+          uri
+        end
+
+        def fresh_release_marker?(gem_name, version_hint)
+          entry = read_marker(marker_path).fetch("releases", {})[gem_name.to_s]
+          return false unless entry
+          return false if version_hint && entry["version"].to_s != version_hint.to_s
+
+          released_at = Time.iso8601(entry["released_at"].to_s)
+          released_at >= Time.now.utc - CACHE_BUST_TTL_SECONDS
+        rescue ArgumentError
+          false
+        end
+
+        def read_marker(path)
+          return {} unless File.file?(path)
+
+          parsed = JSON.parse(File.read(path))
+          parsed.is_a?(Hash) ? parsed : {}
+        rescue JSON::ParserError
+          {}
+        end
+
+        def env_refresh?
+          ENV.fetch(ENV_REFRESH, "").match?(Kettle::Dev::ENV_TRUE_RE)
+        end
+      end
+    end
+  end
+end