kettle-dev 2.4.0 → 2.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc6dd6b412d11d659d2f5ed0916372e599642a82640335700f3e723937638cba
-  data.tar.gz: 86114a4e096dd7da0934477c06aee521372d6eeb5f2114377d0a035b32be42f1
+  metadata.gz: a251345bb56780a5c5b9efcfb53d394ca469581b5798f10839ac8ed5b4cae682
+  data.tar.gz: 4a81578792afe11fd09299ea7d1836d66f0cd8c76af00235491b8234fcec1553
 SHA512:
-  metadata.gz: f056c2d67dee284c734c2b0bf5cb06ce957d981cc7c8f922108b2cf1c3b3a8acf5c0c2a1fe8b7b3347ae92c85f780f82ab1e14cf677e12591ece125522bdf967
-  data.tar.gz: 1c5db4b16afe9840dca06f5a6a1528fe3afa3dadb68b727c2b95c43bfa3240d19625aad892a792000841b42640d07451136f0f87a18f2e711aba5f7107721368
+  metadata.gz: 0cfa39888af23e14856d9874d965248c8d68a83b88c42bd3cc722b1a84fe8564b3c1381aa714aaebe0df531822365b70e4f2e7e2eff913f5e781e201e5f49b13
+  data.tar.gz: aefab75e861bc0c2132385b4e7411904b01cb6562c82d3485cdbdbb27d407004450b8e0a7030f33abf869bc73df4074f2cbdd1c3ef7abcfb21e9222b5c1c7f9e

data/CHANGELOG.md

@@ -30,6 +30,34 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.4.2] - 2026-07-24
+
+- TAG: [v2.4.2][2.4.2t]
+- COVERAGE: 92.36% -- 3991/4321 lines in 38 files
+- BRANCH COVERAGE: 76.06% -- 1563/2055 branches in 38 files
+- 59.00% documented
+
+### Fixed
+
+- `kettle-release` now validates published gem availability with an isolated
+  Bundler probe against gem.coop before continuing past the publish step, and
+  uninstalls newly introduced local candidate gems when the release did not
+  happen or cannot be validated.
+
+## [2.4.1] - 2026-07-24
+
+- TAG: [v2.4.1][2.4.1t]
+- COVERAGE: 92.29% -- 3928/4256 lines in 38 files
+- BRANCH COVERAGE: 76.09% -- 1550/2037 branches in 38 files
+- 58.66% documented
+
+### Fixed
+
+- `kettle-release` now normalizes and revalidates release lockfiles after
+  mutating setup/appraisal/doc steps, before committing or pushing, so local
+  path remotes and locally installed registry gems with empty lockfile
+  checksums cannot leak into CI.
+
 ## [2.4.0] - 2026-07-23
 
 - TAG: [v2.4.0][2.4.0t]
@@ -2646,7 +2674,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.0...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.2...HEAD
+[2.4.2]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.1...v2.4.2
+[2.4.2t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.2
+[2.4.1]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.0...v2.4.1
+[2.4.1t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.1
 [2.4.0]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.11...v2.4.0
 [2.4.0t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.0
 [2.3.11]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.10...v2.3.11

data/README.md

@@ -891,7 +891,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.141-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.321-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/release_cli.rb

@@ -10,6 +10,7 @@ require "net/http"
 require "json"
 require "uri"
 require "yaml"
+require "set"
 
 # External gems
 require "kettle/rb/compat_matrix"
@@ -39,6 +40,8 @@ module Kettle
         "BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES" => "true"
       }.freeze
       DEBUG_TRUE_VALUES = %w[1 true yes on].freeze
+      RELEASE_VALIDATION_SOURCE = "https://gem.coop"
+
       class << self
         def run_cmd!(cmd)
           # For Bundler-invoked build/release, explicitly prefix SKIP_GEM_SIGNING so
@@ -120,6 +123,7 @@ module Kettle
         @skip_bundle_audit = truthy_value?(skip_bundle_audit) || truthy_value?(ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"])
         @version_override = Kettle::Dev::Versioning.normalize_explicit_version(version)
         @appraisal_task = normalize_appraisal_task(appraisal_task || ENV["KETTLE_RELEASE_APPRAISAL_TASK"])
+        @release_candidate = nil
       end
 
       def run
@@ -256,6 +260,7 @@ module Kettle
 
         # 6. git user + commit release prep
         if run_step?(6)
+          prepare_release_lockfiles_for_commit!
           ensure_git_user!
           version ||= detect_version
           committed = commit_release_prep!(version)
@@ -279,10 +284,16 @@ module Kettle
         end
 
         # 9. push branches
-        push! if run_step?(9) && !local_ci?
+        if run_step?(9) && !local_ci?
+          validate_release_lockfiles!(stage: "before push")
+          push!
+        end
 
         # 10. monitor CI after push
-        monitor_workflows_after_push! if run_step?(10) && !local_ci?
+        if run_step?(10) && !local_ci?
+          validate_release_lockfiles!(stage: "before CI monitoring")
+          monitor_workflows_after_push!
+        end
 
         # 11. merge feature into trunk and push
         if run_step?(11) && !local_ci?
@@ -338,13 +349,18 @@ module Kettle
 
         # 15. release and tag
         if run_step?(15)
+          version ||= detect_version
+          gem_name = detect_gem_name
+          @release_candidate = build_release_candidate(gem_name, version)
           if local_ci?
-            version ||= detect_version
-            release_gem_and_tag_locally!(version)
+            with_unpublished_candidate_cleanup { release_gem_and_tag_locally!(version) }
           else
             puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
-            run_cmd!("bundle exec rake release")
-            mark_gem_coop_release_cache_bust(version || detect_version)
+            with_unpublished_candidate_cleanup do
+              run_cmd!("bundle exec rake release")
+              confirm_release_candidate_available!(@release_candidate)
+            end
+            mark_gem_coop_release_cache_bust(version)
           end
         end
 
@@ -505,6 +521,187 @@ module Kettle
         run_changelog!
       end
 
+      def prepare_release_lockfiles_for_commit!
+        dirty_lockfiles = release_lockfile_paths.select { |path| release_lockfile_normalization_needed?(path) }
+        unless dirty_lockfiles.empty?
+          puts "Normalizing release lockfiles with local path dependencies disabled..."
+          dirty_lockfiles.each { |path| normalize_release_lockfile!(path) }
+        end
+
+        validate_release_lockfiles!(stage: "before release prep commit")
+      end
+
+      def validate_release_lockfiles!(stage:)
+        diagnostics = release_lockfile_paths.flat_map { |path| release_lockfile_diagnostics(path) }
+        return if diagnostics.empty?
+
+        abort(<<~MSG)
+          Release lockfile validation failed #{stage}:
+          #{diagnostics.map { |diagnostic| "  - #{diagnostic}" }.join("\n")}
+          Re-run bundle lock/update with local path development env disabled before releasing.
+        MSG
+      end
+
+      def release_lockfile_paths
+        candidates = [
+          File.join(@root, "Gemfile.lock"),
+          File.join(@root, "Appraisal.root.gemfile.lock")
+        ]
+        candidates.select { |path| File.file?(path) }.sort
+      end
+
+      def release_lockfile_normalization_needed?(path)
+        release_lockfile_has_local_path_remote?(path) || !release_lockfile_empty_registry_checksums(path).empty?
+      end
+
+      def normalize_release_lockfile!(path)
+        gemfile = release_gemfile_for_lockfile(path)
+        unless gemfile && File.file?(gemfile)
+          warn("Cannot normalize #{Kettle::Dev.display_path(path)} because its Gemfile was not found.")
+          return
+        end
+
+        update_gems = release_lockfile_empty_registry_checksums(path).map(&:first).uniq.sort
+        env = release_lockfile_normalization_env.merge("BUNDLE_GEMFILE" => gemfile)
+        command = +"env"
+        env.each do |key, value|
+          command << " #{key}=#{Shellwords.escape(value)}"
+        end
+        command << " bundle lock"
+        command << " --update #{update_gems.map { |gem_name| Shellwords.escape(gem_name) }.join(" ")}" unless update_gems.empty?
+        run_cmd!(command)
+      end
+
+      def release_gemfile_for_lockfile(path)
+        basename = File.basename(path)
+        return File.join(@root, "Gemfile") if basename == "Gemfile.lock"
+
+        path.delete_suffix(".lock")
+      end
+
+      def release_lockfile_normalization_env
+        {
+          "KETTLE_DEV_DEV" => "false",
+          "K_JEM_TEMPLATING" => "false",
+          "STRUCTUREDMERGE_DEV" => "false",
+          "TREE_SITTER_LANGUAGE_PACK_DEV" => "false",
+          "RUBOCOP_LTS_LOCAL" => "false",
+          "GALTZO_FLOSS_DEV" => "false",
+          "UR_BRAIN_DEV" => "false"
+        }
+      end
+
+      def release_lockfile_diagnostics(path)
+        diagnostics = []
+        release_lockfile_local_path_remote_lines(path).each do |line_number|
+          diagnostics << "#{release_lockfile_label(path)} has local path remote at line #{line_number}"
+        end
+        release_lockfile_empty_registry_checksums(path).each do |name, version, line_number|
+          diagnostics << "#{release_lockfile_label(path)} CHECKSUMS has no sha256 for #{name} #{version} at line #{line_number}"
+        end
+        diagnostics
+      end
+
+      def release_lockfile_has_local_path_remote?(path)
+        !release_lockfile_local_path_remote_lines(path).empty?
+      end
+
+      def release_lockfile_local_path_remote_lines(path)
+        File.readlines(path).filter_map.with_index(1) do |line, index|
+          next unless line.start_with?("  remote: /", "  remote: ./", "  remote: ../")
+
+          index
+        end
+      end
+
+      def release_lockfile_empty_registry_checksums(path)
+        path_gems = release_lockfile_path_source_gems(path) | release_lockfile_path_dependency_gems(path)
+        in_checksums = false
+        entries = File.readlines(path).filter_map.with_index(1) do |line, index|
+          stripped = line.strip
+          if stripped == "CHECKSUMS"
+            in_checksums = true
+            next
+          end
+          next unless in_checksums
+          next if stripped.empty?
+          next if stripped == "BUNDLED WITH"
+
+          match = stripped.match(/\A([A-Za-z0-9_.-]+) \(([^)]+)\)(?:\s+(sha256=.*))?\z/)
+          next unless match
+
+          name = match[1]
+          checksum = match[3].to_s
+          next if !checksum.empty?
+          next if path_gems.include?(name)
+
+          [name, match[2], index]
+        end
+        return [] unless release_lockfile_has_any_sha_checksum?(path)
+
+        entries
+      end
+
+      def release_lockfile_has_any_sha_checksum?(path)
+        in_checksums = false
+        File.readlines(path).any? do |line|
+          stripped = line.strip
+          if stripped == "CHECKSUMS"
+            in_checksums = true
+            next false
+          end
+          next false unless in_checksums
+
+          stripped.include?("sha256=")
+        end
+      end
+
+      def release_lockfile_path_source_gems(path)
+        gems = Set.new
+        in_path = false
+        in_specs = false
+        File.readlines(path).each do |line|
+          header = line.strip
+          if header.match?(/\A[A-Z][A-Z ]*\z/)
+            in_path = header == "PATH"
+            in_specs = false
+            next
+          end
+          next unless in_path
+
+          if header == "specs:"
+            in_specs = true
+            next
+          end
+          next unless in_specs
+
+          match = line.match(/\A    ([A-Za-z0-9_.-]+) \([^)]+\)/)
+          gems << match[1] if match
+        end
+        gems
+      end
+
+      def release_lockfile_path_dependency_gems(path)
+        gems = Set.new
+        in_dependencies = false
+        File.readlines(path).each do |line|
+          header = line.strip
+          if header.match?(/\A[A-Z][A-Z ]*\z/)
+            in_dependencies = header == "DEPENDENCIES"
+            next
+          end
+          next unless in_dependencies
+
+          match = line.match(/\A  ([A-Za-z0-9_.-]+)!\z/)
+          gems << match[1] if match
+        end
+        gems
+      end
+
+      def release_lockfile_label(path)
+        Kettle::Dev.display_path(path)
+      end
+
       def run_changelog!
         cmd = "bundle exec kettle-changelog"
         cmd = "#{cmd} --version #{Shellwords.escape(@version_override)}" if @version_override
@@ -955,9 +1152,123 @@ module Kettle
 
         puts "Publishing #{File.basename(gem_path)} to RubyGems without pushing git refs..."
         run_cmd!("gem push #{Shellwords.escape(gem_path)}")
+        confirm_release_candidate_available!(@release_candidate || build_release_candidate(gem_name_from_gem_path(gem_path, version), version))
         mark_gem_coop_release_cache_bust(version, gem_name: gem_name_from_gem_path(gem_path, version))
       end
 
+      def build_release_candidate(gem_name, version)
+        ReleaseCandidate.new(
+          gem_name: gem_name.to_s,
+          version: version.to_s,
+          installed_before: gem_version_installed?(gem_name, version),
+          published: false
+        )
+      end
+
+      def with_unpublished_candidate_cleanup
+        yield
+      rescue SystemExit, StandardError
+        cleanup_unpublished_release_candidate(@release_candidate)
+        raise
+      end
+
+      def cleanup_unpublished_release_candidate(candidate)
+        return unless candidate
+        return if candidate.published
+        return if candidate.installed_before
+        return unless gem_version_installed?(candidate.gem_name, candidate.version)
+
+        warn(
+          "Release of #{candidate.gem_name} #{candidate.version} was not validated; " \
+          "uninstalling the local candidate gem so future bundle updates cannot resolve an unreleased version."
+        )
+        uninstall_release_candidate(candidate)
+      end
+
+      def uninstall_release_candidate(candidate)
+        run_cmd!(
+          "gem uninstall #{Shellwords.escape(candidate.gem_name)} " \
+          "-v #{Shellwords.escape(candidate.version)} -x -I --ignore-dependencies"
+        )
+      rescue SystemExit, StandardError => error
+        warn("Could not uninstall local candidate #{candidate.gem_name} #{candidate.version}: #{error.message}")
+        warn("Manual cleanup: gem uninstall #{candidate.gem_name} -v #{candidate.version} -x -I --ignore-dependencies")
+      end
+
+      def gem_version_installed?(gem_name, version)
+        Gem::Specification.reset
+        Gem::Specification.find_all_by_name(gem_name.to_s, "= #{version}").any?
+      rescue Gem::LoadError
+        false
+      end
+
+      def confirm_release_candidate_available!(candidate)
+        run_release_availability_probe(candidate)
+        candidate.published = true
+        true
+      rescue SystemExit
+        raise
+      rescue => error
+        abort(<<~MSG)
+          Published gem availability could not be validated for #{candidate.gem_name} #{candidate.version}: #{error.class}: #{error.message}
+          kettle-release will clean up any local candidate install that was introduced by this failed release attempt.
+          If the push actually succeeded, resolve the registry/checksum state manually before resuming.
+        MSG
+      end
+
+      def run_release_availability_probe(candidate)
+        script_path = write_release_availability_probe(candidate)
+        stdout_str = nil
+        stderr_str = nil
+        status = nil
+        with_unbundled_release_probe_env do
+          stdout_str, stderr_str, status = Open3.capture3(self.class.send(:command_env), Gem.ruby, script_path)
+        end
+        $stdout.print(stdout_str) unless stdout_str.to_s.empty?
+        return true if status.success?
+
+        diag = stderr_str.to_s.empty? ? "" : "\n--- STDERR ---\n#{stderr_str}".rstrip
+        abort("Published gem availability probe failed for #{candidate.gem_name} #{candidate.version} (exit #{status.exitstatus})#{diag}")
+      ensure
+        FileUtils.rm_f(script_path) if script_path
+      end
+
+      def with_unbundled_release_probe_env(&block)
+        if defined?(Bundler)
+          Bundler.with_unbundled_env(&block)
+        else
+          yield
+        end
+      end
+
+      def write_release_availability_probe(candidate)
+        dir = File.join(@root, "tmp", "kettle-release")
+        FileUtils.mkdir_p(dir)
+        path = File.join(dir, "validate-#{candidate.gem_name}-#{candidate.version}-#{$$}.rb")
+        File.write(path, release_availability_probe_script(candidate))
+        path
+      end
+
+      def release_availability_probe_script(candidate)
+        <<~RUBY
+          # frozen_string_literal: true
+
+          gem_name = #{candidate.gem_name.dump}
+          version = #{candidate.version.dump}
+
+          require "bundler/inline"
+
+          gemfile(true) do
+            source #{RELEASE_VALIDATION_SOURCE.dump}
+            gem gem_name, "= \#{version}"
+          end
+
+          spec = Gem.loaded_specs.fetch(gem_name)
+          abort("loaded \#{gem_name} \#{spec.version}, expected \#{version}") unless spec.version.to_s == version
+          puts "Validated \#{gem_name} \#{version} from #{RELEASE_VALIDATION_SOURCE}"
+        RUBY
+      end
+
       def detect_version
         Kettle::Dev::Versioning.detect_version(@root, override: @version_override)
       end
@@ -1520,3 +1831,14 @@ module Kettle
     end
   end
 end
+
+class Kettle::Dev::ReleaseCLI::ReleaseCandidate
+  attr_accessor :gem_name, :version, :installed_before, :published
+
+  def initialize(gem_name:, version:, installed_before:, published:)
+    @gem_name = gem_name
+    @version = version
+    @installed_before = installed_before
+    @published = published
+  end
+end

data/lib/kettle/dev/version.rb

@@ -3,7 +3,7 @@
 module Kettle
   module Dev
     module Version
-      VERSION = "2.4.0"
+      VERSION = "2.4.2"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.4.2
 platform: ruby
 authors:
 - Peter H. Boling
@@ -349,10 +349,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.4.0
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.4.0/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.4.2
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.4.2/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.4.0
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.4.2
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev