kettle-dev 2.4.5 → 2.5.0

data/lib/kettle/dev/release_cli.rb

@@ -17,6 +17,10 @@ require "kettle/ndjson"
 require "kettle/rb/compat_matrix"
 require "ruby-progressbar"
 
+require_relative "interactive_release_command"
+require_relative "lockfile_reset"
+require_relative "release_secrets"
+
 module Kettle
   module Dev
     class ReleaseCLI
@@ -112,9 +116,9 @@ module Kettle
 
       public
 
-      def initialize(start_step: 0, local_ci: false, version: nil, appraisal_task: nil, skip_steps: nil, skip_bundle_audit: nil, ci_workflows: nil, skip_remotes: nil, **options)
+      def initialize(start_step: 0, local_ci: false, version: nil, appraisal_task: nil, skip_steps: nil, skip_bundle_audit: nil, ci_workflows: nil, skip_remotes: nil, secrets_provider_name: nil, yes: false, **options)
         @root = Kettle::Dev::CIHelpers.project_root
-        @git = Kettle::Dev::GitAdapter.new
+        @git = Kettle::Dev::GitAdapter.new(@root)
         @start_step = (start_step || 0).to_i
         @start_step = 0 if @start_step < 0
         @skip_steps = normalize_skip_steps(skip_steps)
@@ -122,11 +126,13 @@ module Kettle
         @skip_remotes = normalize_skip_remotes(skip_remotes || ENV["K_RELEASE_SKIP_REMOTES"])
         @local_ci = !!local_ci
         @skip_bundle_audit = truthy_value?(skip_bundle_audit) || truthy_value?(ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"])
+        @yes = !!yes
         @version_override = Kettle::Dev::Versioning.normalize_explicit_version(version)
         @appraisal_task = normalize_appraisal_task(appraisal_task || ENV["KETTLE_RELEASE_APPRAISAL_TASK"])
         @release_candidate = nil
         @event_stream = options[:event_stream]
         @event_recorder = Kettle::Ndjson.event_recorder(@event_stream, phase_timings: [])
+        @secrets_provider = options[:secrets_provider] || Kettle::Dev::ReleaseSecrets::Factory.build(provider_name: secrets_provider_name)
         @report_path = options[:report_path]
         @json_output = !!options[:json_output]
         @json_io = options[:json_io] || $stdout
@@ -134,6 +140,7 @@ module Kettle
         @diagnostics = []
         @started_at = nil
         @finished_report = nil
+        @changelog_generated_coverage = false
       end
 
       def run
@@ -185,9 +192,9 @@ module Kettle
             gem_name = detect_gem_name
             latest_overall, latest_for_series = latest_released_versions(gem_name, version)
           rescue => e
-            warn("[kettle-release] gem.coop release check failed: #{e.class}: #{e.message}")
+            warn("[kettle-release] RubyGems.org release check failed: #{e.class}: #{e.message}")
             warn(e.backtrace.first(3).map { |l| "  " + l }.join("\n")) if ENV["KETTLE_DEV_DEBUG"]
-            warn("Proceeding without gem.coop latest version info.")
+            warn("Proceeding without RubyGems.org latest version info.")
           end
 
           if latest_overall
@@ -209,7 +216,7 @@ module Kettle
               latest_for_series = nil unless lfs_series == cur_series
             end
             # Determine the sanity-check target correctly for the current series.
-            # If gem.coop has a newer overall series than our current series, only compare
+            # If RubyGems.org has a newer overall series than our current series, only compare
             # against the latest published in our current series. If that cannot be determined
             # (e.g., offline), skip the sanity check rather than treating the overall as target.
             target = if (cur_series <=> overall_series) == -1
@@ -218,10 +225,10 @@ module Kettle
               latest_overall
             end
             # IMPORTANT: Never treat a higher different-series "latest_overall" as a downgrade target.
-            # If our current series is behind overall and gem.coop does not report a latest_for_series,
+            # If our current series is behind overall and RubyGems.org does not report a latest_for_series,
             # then we cannot determine the correct target for this series and should skip the check.
             if (cur_series <=> overall_series) == -1 && target.nil?
-              puts "Could not determine latest released version from gem.coop (offline?). Proceeding without sanity check."
+              puts "Could not determine latest released version from RubyGems.org (offline?). Proceeding without sanity check."
             elsif target
               bump = Kettle::Dev::Versioning.classify_bump(target, version)
               case bump
@@ -238,16 +245,13 @@ module Kettle
                 puts "Proposed bump type: #{label} (from #{target} -> #{version})"
               end
             else
-              puts "Could not determine latest released version from gem.coop (offline?). Proceeding without sanity check."
+              puts "Could not determine latest released version from RubyGems.org (offline?). Proceeding without sanity check."
             end
           else
-            puts "Could not determine latest released version from gem.coop (offline?). Proceeding without sanity check."
+            puts "Could not determine latest released version from RubyGems.org (offline?). Proceeding without sanity check."
           end
 
-          puts "Have you updated lib/**/version.rb and CHANGELOG.md for v#{version}? [y/N]"
-          print("> ")
-          ans = Kettle::Dev::InputAdapter.gets&.strip
-          abort("Aborted: please update version.rb and CHANGELOG.md, then re-run.") unless ans&.downcase&.start_with?("y")
+          confirm_yes!("Have you updated lib/**/version.rb and CHANGELOG.md for v#{version}? [y/N]", "> ", "Aborted: please update version.rb and CHANGELOG.md, then re-run.")
 
           # Initial validation: Ensure README.md and LICENSE.txt have identical sets of copyright years; also ensure current year present when matched
           validate_copyright_years!
@@ -272,7 +276,7 @@ module Kettle
         # 3. bin/setup
         run_cmd!("bin/setup") if run_step?(3)
         # 4. bin/rake
-        run_cmd!("bin/rake") if run_step?(4)
+        run_cmd!(release_default_task_command) if run_step?(4)
 
         # 5. appraisal:generate (optional) + canonical docs build
         if run_step?(5)
@@ -352,9 +356,11 @@ module Kettle
 
         # 13. signing guidance and checks
         if run_step?(13)
-          if ENV.fetch("SKIP_GEM_SIGNING", "false").casecmp("false").zero?
+          if signing_enabled?
             puts "TIP: For local dry-runs or testing the release workflow, set SKIP_GEM_SIGNING=true to avoid PEM password prompts."
-            if Kettle::Dev::InputAdapter.tty?
+            if @yes
+              puts "Proceeding with signing enabled because --yes was provided."
+            elsif Kettle::Dev::InputAdapter.tty?
               # In CI, avoid interactive prompts when no TTY is present (e.g., act or GitHub Actions "CI validation").
               # Non-interactive CI runs should not abort here; later signing checks are either stubbed in tests
               # or will be handled explicitly by ensure_signing_setup_or_skip!.
@@ -369,11 +375,17 @@ module Kettle
           end
 
           ensure_signing_setup_or_skip!
+          ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
         end
 
         # 14. build
         if run_step?(14)
-          puts "Running build (you may be prompted for the signing key password)..."
+          ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
+          if signing_enabled? && release_secrets_configured?
+            puts "Running build with gem signing passphrase from configured secrets provider (#{release_secrets_provider_label})..."
+          else
+            puts "Running build (you may be prompted for the signing key password)..."
+          end
           run_cmd!("bundle exec rake build")
         end
 
@@ -385,13 +397,18 @@ module Kettle
           if local_ci?
             with_unpublished_candidate_cleanup { release_gem_and_tag_locally!(version) }
           else
-            puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
+            ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
+            if release_secrets_configured?
+              puts "Running release with configured secrets provider (#{release_secrets_provider_label}) for signing and RubyGems MFA prompts..."
+            else
+              puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
+            end
             with_unpublished_candidate_cleanup do
               run_cmd!("bundle exec rake release")
               @release_candidate.published = true
               confirm_release_candidate_available!(@release_candidate)
             end
-            mark_gem_coop_release_cache_bust(version)
+            mark_rubygems_release_cache_bust(version)
           end
         end
 
@@ -553,18 +570,31 @@ module Kettle
       end
 
       def prepare_release_lockfiles_for_commit!
-        dirty_lockfiles = release_lockfile_paths.select { |path| release_lockfile_normalization_needed?(path) }
-        unless dirty_lockfiles.empty?
-          puts "Normalizing release lockfiles with local path dependencies disabled..."
-          dirty_lockfiles.each { |path| normalize_release_lockfile!(path) }
+        puts "Resetting release lockfiles with local path dependencies disabled..."
+        begin
+          lockfile_reset.reset(Kettle::Dev::LockfileReset::RELEASE_LOCKFILES_TARGET)
+        rescue Kettle::Dev::Error => error
+          raise unless error.message.start_with?("Reset #{Kettle::Dev::LockfileReset::RELEASE_LOCKFILES_TARGET} failed validation:")
+
+          # Keep release-facing failures shaped like the lockfile validation
+          # guard, even when the shared reset helper is the component that
+          # detects the unrepaired lockfile.
         end
 
+        diagnostics = release_lockfile_paths.flat_map { |path| release_lockfile_diagnostics(path) }
+        if diagnostics.empty?
+          puts "Release lockfile reset complete: #{release_lockfile_paths.length} lockfile(s) checked, no diagnostics remain."
+        end
         validate_release_lockfiles!(stage: "before release prep commit")
       end
 
       def validate_release_lockfiles!(stage:)
         diagnostics = release_lockfile_paths.flat_map { |path| release_lockfile_diagnostics(path) }
         return if diagnostics.empty?
+        if stage == "before push"
+          diagnostics = reset_release_lockfiles_before_push(diagnostics)
+          return if diagnostics.empty?
+        end
 
         abort(<<~MSG)
           Release lockfile validation failed #{stage}:
@@ -574,169 +604,140 @@ module Kettle
       end
 
       def release_lockfile_paths
-        candidates = [
-          File.join(@root, "Gemfile.lock"),
-          File.join(@root, "Appraisal.root.gemfile.lock")
-        ]
-        candidates.select { |path| File.file?(path) }.sort
+        lockfile_reset.lockfile_paths
       end
 
       def release_lockfile_normalization_needed?(path)
-        release_lockfile_has_local_path_remote?(path) || !release_lockfile_empty_registry_checksums(path).empty?
+        lockfile_reset.normalization_needed?(path)
       end
 
       def normalize_release_lockfile!(path)
-        gemfile = release_gemfile_for_lockfile(path)
-        unless gemfile && File.file?(gemfile)
-          warn("Cannot normalize #{Kettle::Dev.display_path(path)} because its Gemfile was not found.")
-          return
-        end
-
-        update_gems = release_lockfile_empty_registry_checksums(path).map(&:first).uniq.sort
-        env = release_lockfile_normalization_env.merge("BUNDLE_GEMFILE" => gemfile)
-        command = +"env"
-        env.each do |key, value|
-          command << " #{key}=#{Shellwords.escape(value)}"
-        end
-        command << " bundle lock"
-        command << " --update #{update_gems.map { |gem_name| Shellwords.escape(gem_name) }.join(" ")}" unless update_gems.empty?
-        run_cmd!(command)
+        lockfile_reset.reset_lockfile!(path)
       end
 
       def release_gemfile_for_lockfile(path)
-        basename = File.basename(path)
-        return File.join(@root, "Gemfile") if basename == "Gemfile.lock"
-
-        path.delete_suffix(".lock")
+        lockfile_reset.gemfile_for_lockfile(path)
       end
 
       def release_lockfile_normalization_env
-        {
-          "KETTLE_DEV_DEV" => "false",
-          "K_JEM_TEMPLATING" => "false",
-          "STRUCTUREDMERGE_DEV" => "false",
-          "TREE_SITTER_LANGUAGE_PACK_DEV" => "false",
-          "RUBOCOP_LTS_LOCAL" => "false",
-          "GALTZO_FLOSS_DEV" => "false",
-          "UR_BRAIN_DEV" => "false"
-        }
+        lockfile_reset.normalization_env
       end
 
       def release_lockfile_diagnostics(path)
-        diagnostics = []
-        release_lockfile_local_path_remote_lines(path).each do |line_number|
-          diagnostics << "#{release_lockfile_label(path)} has local path remote at line #{line_number}"
-        end
-        release_lockfile_empty_registry_checksums(path).each do |name, version, line_number|
-          diagnostics << "#{release_lockfile_label(path)} CHECKSUMS has no sha256 for #{name} #{version} at line #{line_number}"
-        end
-        diagnostics
+        lockfile_reset.diagnostics(path)
       end
 
       def release_lockfile_has_local_path_remote?(path)
-        !release_lockfile_local_path_remote_lines(path).empty?
+        lockfile_reset.has_local_path_remote?(path)
       end
 
       def release_lockfile_local_path_remote_lines(path)
-        File.readlines(path).filter_map.with_index(1) do |line, index|
-          next unless line.start_with?("  remote: /", "  remote: ./", "  remote: ../")
-
-          index
-        end
+        lockfile_reset.local_path_remote_lines(path)
       end
 
       def release_lockfile_empty_registry_checksums(path)
-        path_gems = release_lockfile_path_source_gems(path) | release_lockfile_path_dependency_gems(path)
-        in_checksums = false
-        entries = File.readlines(path).filter_map.with_index(1) do |line, index|
-          stripped = line.strip
-          if stripped == "CHECKSUMS"
-            in_checksums = true
-            next
-          end
-          next unless in_checksums
-          next if stripped.empty?
-          next if stripped == "BUNDLED WITH"
+        lockfile_reset.empty_registry_checksums(path)
+      end
 
-          match = stripped.match(/\A([A-Za-z0-9_.-]+) \(([^)]+)\)(?:\s+(sha256=.*))?\z/)
-          next unless match
+      def release_lockfile_has_any_sha_checksum?(path)
+        lockfile_reset.has_any_sha_checksum?(path)
+      end
 
-          name = match[1]
-          checksum = match[3].to_s
-          next if !checksum.empty?
-          next if path_gems.include?(name)
+      def release_lockfile_path_source_gems(path)
+        lockfile_reset.path_source_gems(path)
+      end
 
-          [name, match[2], index]
-        end
-        return [] unless release_lockfile_has_any_sha_checksum?(path)
+      def release_lockfile_path_dependency_gems(path)
+        lockfile_reset.path_dependency_gems(path)
+      end
 
-        entries
+      def release_lockfile_label(path)
+        Kettle::Dev.display_path(path)
       end
 
-      def release_lockfile_has_any_sha_checksum?(path)
-        in_checksums = false
-        File.readlines(path).any? do |line|
-          stripped = line.strip
-          if stripped == "CHECKSUMS"
-            in_checksums = true
-            next false
-          end
-          next false unless in_checksums
+      def reset_release_lockfiles_before_push(diagnostics)
+        puts "Release lockfile validation found #{diagnostics.length} issue(s) before push:"
+        diagnostics.each { |diagnostic| puts "  - #{diagnostic}" }
+        puts "Running one fallback release lockfile reset before push; tracked lockfile changes will amend the release prep commit."
+        changed_before_reset = changed_release_lockfile_paths
+        begin
+          lockfile_reset.reset(Kettle::Dev::LockfileReset::RELEASE_LOCKFILES_TARGET)
+        rescue Kettle::Dev::Error => error
+          puts error.message
+        end
 
-          stripped.include?("sha256=")
+        remaining = release_lockfile_paths.flat_map { |path| release_lockfile_diagnostics(path) }
+        if remaining.empty?
+          amend_release_lockfile_reset_commit(changed_before_reset)
+          return []
         end
-      end
 
-      def release_lockfile_path_source_gems(path)
-        gems = Set.new
-        in_path = false
-        in_specs = false
-        File.readlines(path).each do |line|
-          header = line.strip
-          if header.match?(/\A[A-Z][A-Z ]*\z/)
-            in_path = header == "PATH"
-            in_specs = false
-            next
-          end
-          next unless in_path
+        puts "Release lockfile reset did not repair all before-push issues:"
+        remaining.each { |diagnostic| puts "  - #{diagnostic}" }
+        remaining
+      end
 
-          if header == "specs:"
-            in_specs = true
-            next
+      def amend_release_lockfile_reset_commit(changed_before_reset = [])
+        paths = changed_release_lockfile_paths
+        if paths.empty?
+          if changed_before_reset.empty?
+            puts "Fallback release lockfile reset result: diagnostics cleared, but tracked lockfiles matched the release prep commit before and after reset; no amend is possible."
+          else
+            puts "Fallback release lockfile reset result: diagnostics cleared by restoring tracked lockfiles to the release prep commit; no amend is needed."
           end
-          next unless in_specs
-
-          match = line.match(/\A    ([A-Za-z0-9_.-]+) \([^)]+\)/)
-          gems << match[1] if match
+          return
         end
-        gems
+
+        puts "Fallback release lockfile reset result: diagnostics cleared; amending release prep commit with #{paths.length} lockfile(s)."
+        abort("Failed to stage reset release lockfiles.") unless @git.add_paths(paths)
+        abort("Failed to amend release prep commit with reset lockfiles.") unless @git.commit_amend_no_edit
       end
 
-      def release_lockfile_path_dependency_gems(path)
-        gems = Set.new
-        in_dependencies = false
-        File.readlines(path).each do |line|
-          header = line.strip
-          if header.match?(/\A[A-Z][A-Z ]*\z/)
-            in_dependencies = header == "DEPENDENCIES"
-            next
-          end
-          next unless in_dependencies
+      def changed_release_lockfile_paths
+        release_lockfile_paths.select { |path| git_path_changed?(path) }
+      end
 
-          match = line.match(/\A  ([A-Za-z0-9_.-]+)!\z/)
-          gems << match[1] if match
+      def git_path_changed?(path)
+        if @git.respond_to?(:diff_head_quiet?)
+          !@git.diff_head_quiet?(path)
+        else
+          !@git.diff_quiet?(path)
         end
-        gems
       end
 
-      def release_lockfile_label(path)
-        Kettle::Dev.display_path(path)
+      def lockfile_reset
+        @lockfile_reset ||= Kettle::Dev::LockfileReset.new(root: @root, command_runner: method(:run_cmd!))
       end
 
       def run_changelog!
         cmd = "bundle exec kettle-changelog"
         cmd = "#{cmd} --version #{Shellwords.escape(@version_override)}" if @version_override
+        cmd = "#{cmd} --yes" if @yes
         run_cmd!(cmd)
+        @changelog_generated_coverage = true
+      end
+
+      def release_default_task_command
+        # `kettle-changelog` generates strict coverage by running `bundle exec kettle-test`.
+        # When that happened during this same release invocation, the default task can skip
+        # its test/coverage prerequisites and still run lint, audit, documentation, and any
+        # other non-test release checks. Resumed releases do not set this flag, so they keep
+        # the full default task behavior.
+        return "KETTLE_DEV_SKIP_TESTS=true bin/rake" if @changelog_generated_coverage
+
+        "bin/rake"
+      end
+
+      def confirm_yes!(message, prompt, abort_message)
+        puts(message)
+        if @yes
+          puts("#{prompt}y")
+          return
+        end
+
+        print(prompt)
+        ans = Kettle::Dev::InputAdapter.gets&.strip
+        abort(abort_message) unless ans&.downcase&.start_with?("y")
       end
 
       def changelog_strict?
@@ -1041,7 +1042,7 @@ module Kettle
         emit_command_event(cmd, "started")
         with_bundle_audit_skip_env do
           with_machine_stdout_redirect do
-            self.class.run_cmd!(cmd)
+            run_command_with_release_secrets!(cmd)
           end
         end
         emit_command_event(cmd, "ok")
@@ -1055,12 +1056,65 @@ module Kettle
 
       def bundle_audit_skip_command(cmd)
         return cmd unless skip_bundle_audit?
-        return cmd unless cmd.start_with?("bin/rake")
+        return cmd unless /(?:\A|\s)bin\/rake\b/.match?(cmd)
         return cmd if cmd.start_with?("KETTLE_DEV_SKIP_BUNDLE_AUDIT=")
 
         "KETTLE_DEV_SKIP_BUNDLE_AUDIT=true #{cmd}"
       end
 
+      def run_command_with_release_secrets!(cmd)
+        return self.class.run_cmd!(cmd) unless release_secret_command?(cmd) && release_secrets_configured?
+
+        puts "$ #{cmd}"
+        _stdout_str, stderr_str, status = Kettle::Dev::InteractiveReleaseCommand.new(secrets_provider: @secrets_provider).call(
+          self.class.send(:command_env),
+          cmd
+        )
+        return if status.success?
+
+        exit_code = status.respond_to?(:exitstatus) ? status.exitstatus : 1
+        diag = stderr_str.to_s.empty? ? "" : "\n--- STDERR (last 20 lines) ---\n#{stderr_str.lines.last(20).join}".rstrip
+        abort("Command failed: #{cmd} (exit #{exit_code})#{diag}")
+      rescue Kettle::Dev::Error => error
+        abort(error.message)
+      end
+
+      def release_secrets_configured?
+        !@secrets_provider.instance_of?(Kettle::Dev::ReleaseSecrets::Provider)
+      end
+
+      def release_secrets_provider_label
+        release_secrets_configured? ? @secrets_provider.class.name.to_s.split("::").last : "interactive"
+      end
+
+      def signing_enabled?
+        ENV.fetch("SKIP_GEM_SIGNING", "false").casecmp("false").zero?
+      end
+
+      def ensure_release_secrets_ready_for_signing!
+        value = @secrets_provider.gem_signing_passphrase.to_s
+        abort(release_secrets_configuration_message("gem signing passphrase was empty")) if value.empty?
+      rescue Kettle::Dev::Error => error
+        abort(release_secrets_configuration_message(error.message))
+      end
+
+      def release_secrets_configuration_message(reason)
+        <<~MSG.strip
+          Release secrets provider was requested, but #{reason}.
+          Configure the 1Password CLI before release:
+            KETTLE_RELEASE_1PASSWORD_ITEM=Rubygems
+            KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_FIELD=GEM-SIGN-PASSPHRASE
+          Or provide an explicit reference:
+            KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_REFERENCE=op://<vault>/<item>/<field>
+          Ensure `op` is installed and signed in. Secret prompts are not allowed when --secrets-provider is set.
+        MSG
+      end
+
+      def release_secret_command?(cmd)
+        /\Abundle(\s+exec)?\s+rake\s+(build|release)\b/.match?(cmd) ||
+          /\Agem\s+push\b/.match?(cmd)
+      end
+
       def with_bundle_audit_skip_env
         return yield unless skip_bundle_audit?
 
@@ -1170,7 +1224,7 @@ module Kettle
           puts "Local CI failed for #{chosen}."
           if committed
             puts "Rolling back release prep commit (soft reset)..."
-            system("git", "reset", "--soft", "HEAD^")
+            @git.reset_soft("HEAD^")
           end
           abort("Aborting due to local CI failure.")
         end
@@ -1188,7 +1242,7 @@ module Kettle
           puts "Local tag #{tag} already exists."
         else
           puts "Creating local git tag #{tag} without pushing it."
-          run_cmd!("git tag -a #{Shellwords.escape(tag)} -m #{Shellwords.escape(tag)}")
+          abort("Failed to create local tag #{tag}.") unless @git.tag_annotated(tag, tag)
         end
 
         puts "Publishing #{File.basename(gem_path)} to RubyGems without pushing git refs..."
@@ -1197,7 +1251,7 @@ module Kettle
         @release_candidate ||= build_release_candidate(gem_name, version)
         @release_candidate.published = true
         confirm_release_candidate_available!(@release_candidate)
-        mark_gem_coop_release_cache_bust(version, gem_name: gem_name)
+        mark_rubygems_release_cache_bust(version, gem_name: gem_name)
       end
 
       def build_release_candidate(gem_name, version)
@@ -1368,7 +1422,7 @@ module Kettle
       end
 
       def latest_released_versions(gem_name, current_version)
-        data = Kettle::Dev::GemCoopVersions.fetch(gem_name, version_hint: current_version)
+        data = Kettle::Dev::RubyGemsVersions.fetch(gem_name, version_hint: current_version)
         return [nil, nil] unless data.is_a?(Array)
 
         versions = data.map { |h| h["number"] }.compact
@@ -1386,11 +1440,11 @@ module Kettle
         [nil, nil]
       end
 
-      def mark_gem_coop_release_cache_bust(version, gem_name: nil)
+      def mark_rubygems_release_cache_bust(version, gem_name: nil)
         gem_name ||= detect_gem_name
-        Kettle::Dev::GemCoopVersions.mark_released(gem_name, version)
+        Kettle::Dev::RubyGemsVersions.mark_released(gem_name, version)
       rescue => error
-        warn("[kettle-release] could not mark gem.coop cache-bust for release-state: #{error.class}: #{error.message}") if Kettle::Dev::DEBUGGING
+        warn("[kettle-release] could not mark RubyGems.org cache-bust for release-state: #{error.class}: #{error.message}") if Kettle::Dev::DEBUGGING
       end
 
       def gem_name_from_gem_path(gem_path, version)
@@ -1401,13 +1455,13 @@ module Kettle
       def commit_release_prep!(version)
         msg = "🔖 Prepare release v#{version}"
         # Stage all changes (including new/untracked files) prior to committing
-        run_cmd!("git add -A")
+        abort("Failed to stage release prep changes.") unless @git.add_all
         out, _ = git_output(["status", "--porcelain"])
         if out.empty?
           puts "No changes to commit for release prep (continuing)."
           false
         else
-          run_cmd!(%(git commit -am #{Shellwords.escape(msg)}))
+          abort("Failed to commit release prep changes.") unless @git.commit_all(msg)
           true
         end
       end