kettle-dev 2.5.11 → 2.5.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2c0c759c751e79d77e5cf8495f9c461d514d0b120c97cd95b4ae7222afe7f0c
-  data.tar.gz: 95f799d83838660c1fa6200fe4783368a59456f1e8c6221bfdccff0eb967cecf
+  metadata.gz: 60069f78cc45c33bf7d2616ea76c456e98cf9885da75331a553f5c9e2b96bbe8
+  data.tar.gz: d58499d2f31cbffc408e15af977b93b3254f310d021822d90726c7407f4436c3
 SHA512:
-  metadata.gz: 6e95a43755c42b2cf9e45e6d5df069aa0fd5cea4291aeae0ef9f9020a43eed84959a7c734bf8dbd0f719f9d78f6b3f135399cddb9374b616e74abbdb200c6017
-  data.tar.gz: 9bee1f5843526fc154502c909c0144c4440da1610611d6eaf9ef23a4d7f72386071e420cbe267b0ce08d0a82c59abe094b990c85e0d2a813077ab08fe8a147ec
+  metadata.gz: b34e918fa0cce724b098ab97e46abd768a65938d52f908f87515a5f64b8c3c8d68e6717c05529045da5ce1670e407fa1fa955cfb3c9c2cbd6a4c72d46b64577b
+  data.tar.gz: d9dcb4194c6f22c6f6ba1b3311b8f7e644766b52bb36f80d4f59130e48f32d2d4917541c3aebf25e253adb4e3914485b9d66b7f77ebf64b73e56804686dc4276

data/CHANGELOG.md

@@ -30,6 +30,47 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.5.12] - 2026-07-31
+
+- TAG: [v2.5.12][2.5.12t]
+- COVERAGE: 91.73% -- 4961/5408 lines in 46 files
+- BRANCH COVERAGE: 75.98% -- 1850/2435 branches in 46 files
+- 50.68% documented
+
+### Added
+
+- `kettle-release-secrets-doctor` can probe 1Password release secret
+  authorization across same-process, child-process, and threaded shapes.
+
+- `kettle-release-secrets-doctor` now probes additional 1Password
+  authorization boundaries, including parent-child, Bundler child, and
+  Bundler-env-reset child process shapes.
+
+- `kettle-release --events` now emits `secret_provider` events around release
+  secret keepalives and provider-backed prompt responses.
+
+### Fixed
+
+- `kettle-release` now keeps configured release secrets providers warm during
+  CI waits and alerts before provider lookups, reducing missed 1Password
+  authorization prompts during long release runs.
+
+- `kettle-release` keepalive alerts now include the elapsed release time so
+  delayed 1Password prompts are easier to correlate with the run.
+
+- `kettle-dev` now requires `kettle-ndjson` 0.1.4 or newer so
+  `kettle-release --events=secret_provider` cannot resolve against an older
+  event protocol.
+- `kettle-release` lockfile reset now preserves existing bundle platforms and
+  adds the current host platform, preventing release-prep lockfiles from losing
+  Linux support during full rebuilds.
+- `kettle-pre-release` Markdown image URL normalization now keeps encoded query
+  values stable, avoiding release-time churn in shields URLs with nested URL
+  parameters.
+- `kettle-release` now runs `bin/setup` with inherited Bundler bootstrap
+  variables unset, so a release lockfile reset can install newly selected gems
+  before later release tasks run.
+
 ## [2.5.11] - 2026-07-30
 
 - TAG: [v2.5.11][2.5.11t]
@@ -3077,7 +3118,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.11...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.12...HEAD
+[2.5.12]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.11...v2.5.12
+[2.5.12t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.5.12
 [2.5.11]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.10...v2.5.11
 [2.5.11t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.5.11
 [2.5.10]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.9...v2.5.10

data/README.md

@@ -1005,7 +1005,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.189-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.408-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-release-secrets-doctor

@@ -0,0 +1,39 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "optparse"
+
+$stdout.sync = true
+$stderr.sync = true
+
+script_basename = File.basename(__FILE__)
+repo_lib = File.expand_path("../lib", __dir__)
+$LOAD_PATH.unshift(repo_lib) if File.directory?(repo_lib) && !$LOAD_PATH.include?(repo_lib)
+
+begin
+  require "kettle/dev"
+  require "kettle/dev/executable_version"
+  Kettle::Dev::ExecutableVersion.print_and_exit!(script_basename, ARGV, value_option: true)
+  Kettle::Dev::ExecutableVersion.print_header(script_basename)
+rescue LoadError
+  warn "kettle-release-secrets-doctor must run with kettle-dev on the load path"
+  exit 1
+end
+
+options = Kettle::Dev::ReleaseSecretsDoctor.options_from_env
+
+OptionParser.new do |parser|
+  parser.banner = "Usage: kettle-release-secrets-doctor [options]"
+  parser.on("--provider NAME", "Secrets provider name, default: op") { |value| options[:provider] = value }
+  parser.on("--sleep SECONDS", Float, "Seconds to wait between probes") { |value| options[:sleep_seconds] = value }
+  parser.on("--keepalive SECONDS", Float, "Run keepalive every N seconds while waiting; 0 disables") { |value| options[:keepalive_seconds] = value }
+  parser.on("--shape SHAPE", "Shape: #{Kettle::Dev::ReleaseSecretsDoctor::SHAPES.join(", ")}") { |value| options[:shape] = value }
+  parser.on("--otp", "Fetch RubyGems OTP after the wait") { options[:otp] = true }
+end.parse!
+
+begin
+  Kettle::Dev::ReleaseSecretsDoctor.new(options: options, program_name: $PROGRAM_NAME).run
+rescue Kettle::Dev::Error => e
+  warn e.message
+  exit 1
+end

data/lib/kettle/dev/bundler_env_guard.rb

@@ -19,6 +19,7 @@ module Kettle
         BUNDLE_SILENCE_ROOT_WARNING
         BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES
         BUNDLE_VERBOSE
+        BUNDLER_DEBUG
       ].freeze
 
       INERT_ENV_PREFIXES = %w[

data/lib/kettle/dev/ci_monitor.rb

@@ -47,10 +47,10 @@ module Kettle
       #
       # @param restart_hint [String] guidance command shown on failure
       # @return [void]
-      def monitor_all!(restart_hint: "bundle exec kettle-release start_step=10", workflows: nil, **options)
+      def monitor_all!(restart_hint: "bundle exec kettle-release start_step=10", workflows: nil, keepalive: nil, **options)
         checks_any = false
-        checks_any |= monitor_github_internal!(restart_hint: restart_hint, workflows: workflows)
-        checks_any |= monitor_gitlab_internal!(restart_hint: restart_hint)
+        checks_any |= monitor_github_internal!(restart_hint: restart_hint, workflows: workflows, keepalive: keepalive)
+        checks_any |= monitor_gitlab_internal!(restart_hint: restart_hint, keepalive: keepalive)
         abort("CI configuration not detected (GitHub or GitLab). Ensure CI is configured and remotes point to the correct hosts.") unless checks_any
       end
 
@@ -267,7 +267,7 @@ module Kettle
       end
       module_function :collect_gitlab
 
-      def monitor_github_internal!(restart_hint:, workflows: nil)
+      def monitor_github_internal!(restart_hint:, workflows: nil, keepalive: nil)
         root = Kettle::Dev::CIHelpers.project_root
         workflows = Array(workflows).empty? ? Kettle::Dev::CIHelpers.workflows_list(root) : Array(workflows)
         gh_remote = preferred_github_remote
@@ -306,8 +306,10 @@ module Kettle
         start_timeout = github_start_timeout
         poll_interval = github_poll_interval
         start_deadline = monotonic_time + start_timeout
+        keepalive_timer = keepalive_timer(keepalive)
         idx = 0
         loop do
+          keepalive_timer.call
           wf = workflows[idx]
           run = Kettle::Dev::CIHelpers.latest_run(owner: owner, repo: repo, workflow_file: wf, branch: branch, require_head: true, head_sha: head_sha)
           if run
@@ -364,7 +366,32 @@ module Kettle
       end
       module_function :github_poll_interval
 
-      def monitor_gitlab_internal!(restart_hint:)
+      def keepalive_timer(keepalive)
+        interval = keepalive_interval
+        last_run = nil
+        lambda do
+          if keepalive
+            now = monotonic_time
+            if !last_run || (now - last_run) >= interval
+              keepalive.call
+              last_run = now
+            end
+          end
+        end
+      end
+      module_function :keepalive_timer
+
+      def keepalive_interval
+        seconds = begin
+          Float(ENV["KETTLE_RELEASE_SECRET_KEEPALIVE_INTERVAL"])
+        rescue
+          nil
+        end
+        (seconds && seconds >= 0) ? seconds : 240.0
+      end
+      module_function :keepalive_interval
+
+      def monitor_gitlab_internal!(restart_hint:, keepalive: nil)
         root = Kettle::Dev::CIHelpers.project_root
         gitlab_ci = File.exist?(File.join(root, ".gitlab-ci.yml"))
         gl_remote = gitlab_remote_candidates.first
@@ -380,7 +407,9 @@ module Kettle
         pbar = if defined?(ProgressBar)
           ProgressBar.create(title: "CI", total: 1, format: "%t %b %c/%C", length: 30)
         end
+        keepalive_timer = keepalive_timer(keepalive)
         loop do
+          keepalive_timer.call
           pipe = Kettle::Dev::CIHelpers.gitlab_latest_pipeline(owner: owner, repo: repo, branch: branch)
           if pipe
             if Kettle::Dev::CIHelpers.gitlab_success?(pipe)

data/lib/kettle/dev/interactive_release_command.rb

@@ -5,11 +5,12 @@ require "open3"
 module Kettle
   module Dev
     class InteractiveReleaseCommand
-      def initialize(secrets_provider:, input: $stdin, output: $stdout, error: $stderr)
+      def initialize(secrets_provider:, input: $stdin, output: $stdout, error: $stderr, secret_event_handler: nil)
         @secrets_provider = secrets_provider
         @input = input
         @output = output
         @error = error
+        @secret_event_handler = secret_event_handler
         @gem_signing_passphrase = nil
       end
 
@@ -21,7 +22,7 @@ module Kettle
 
       private
 
-      attr_reader :secrets_provider
+      attr_reader :secrets_provider, :secret_event_handler
 
       def call_with_pty(env, cmd)
         stdout_str = +""
@@ -77,18 +78,20 @@ module Kettle
 
       def handle_prompt(input, chunk)
         if otp_prompt?(chunk)
-          write_secret(input, secrets_provider.rubygems_otp, label: "RubyGems MFA code") if otp_response_prompt?(chunk)
+          write_secret(input, label: "RubyGems MFA code", source: "rubygems_otp") { secrets_provider.rubygems_otp } if otp_response_prompt?(chunk)
           return
         end
 
-        write_secret(input, gem_signing_passphrase, label: "gem signing passphrase") if signing_password_prompt?(chunk)
+        write_secret(input, label: "gem signing passphrase", source: "gem_signing_passphrase") { gem_signing_passphrase } if signing_password_prompt?(chunk)
       end
 
       def gem_signing_passphrase
         @gem_signing_passphrase ||= secrets_provider.gem_signing_passphrase.to_s
       end
 
-      def write_secret(input, value, label:)
+      def write_secret(input, label:, source:)
+        emit_secret_event(source: source, action: "prompt_response", status: "started", label: label)
+        value = yield
         secret = value.to_s
         if secret.empty?
           raise Kettle::Dev::Error, "#{label} prompt reached, but the configured release secrets provider returned no value. Aborting because secret prompts are not allowed when a secrets provider is configured."
@@ -97,6 +100,14 @@ module Kettle
         @output.puts("#{label} loaded from configured secrets provider.")
         input.write("#{secret}\n")
         input.flush
+        emit_secret_event(source: source, action: "prompt_response", status: "ok", label: label)
+      rescue Kettle::Dev::Error => error
+        emit_secret_event(source: source, action: "prompt_response", status: "failed", label: label, reason: error.message)
+        raise
+      end
+
+      def emit_secret_event(payload)
+        secret_event_handler&.call(payload)
       end
 
       def otp_prompt?(chunk)

data/lib/kettle/dev/lockfile_reset.rb

@@ -79,12 +79,34 @@ module Kettle
           command << " #{key}=#{Shellwords.escape(value)}"
         end
         command << " bundle lock"
+        reset_platforms(path).each do |platform|
+          command << " --add-platform=#{Shellwords.escape(platform)}"
+        end
         command << " --update"
         command << " #{update_gems.map { |gem_name| Shellwords.escape(gem_name) }.join(" ")}" unless update_gems.empty?
         command << " --add-checksums"
         command
       end
 
+      def reset_platforms(path)
+        (lockfile_platforms(path) | [Gem::Platform.local.to_s]).reject(&:empty?).sort
+      end
+
+      def lockfile_platforms(path)
+        in_platforms = false
+        File.readlines(path).filter_map do |line|
+          stripped = line.strip
+          if stripped.match?(/\A[A-Z][A-Z ]*\z/)
+            in_platforms = stripped == "PLATFORMS"
+            next
+          end
+          next unless in_platforms
+          next if stripped.empty?
+
+          stripped
+        end
+      end
+
       def reset_update_gems(path)
         (
           path_source_gems(path).to_a |

data/lib/kettle/dev/pre_release_cli.rb

@@ -335,8 +335,7 @@ module Kettle
           modified = false
 
           urls.each do |url_str|
-            addr = Addressable::URI.parse(url_str)
-            normalized = addr.normalize.to_s
+            normalized = normalized_markdown_image_url(url_str)
             next if normalized == url_str
 
             # Replace exact occurrences of the URL in the markdown content
@@ -359,6 +358,13 @@ module Kettle
         nil
       end
 
+      def normalized_markdown_image_url(url_str)
+        addr = Addressable::URI.parse(url_str)
+        normalized = addr.normalize
+        normalized.query = addr.query if addr.query && normalized.query != addr.query
+        normalized.to_s
+      end
+
       # Check 3: Validate Markdown image links by cached HTTP HEAD/GET.
       # @return [void]
       def check_markdown_images_http!

data/lib/kettle/dev/release_cli.rb

@@ -276,7 +276,7 @@ module Kettle
         prepare_release_lockfiles_for_release_tasks! if release_lockfile_preflight_needed?
 
         # 3. bin/setup
-        run_cmd!("bin/setup") if run_step?(3)
+        run_cmd!(release_setup_command) if run_step?(3)
         # 4. bin/rake
         run_cmd!(release_default_task_command) if run_step?(4)
 
@@ -773,6 +773,11 @@ module Kettle
         "bin/rake"
       end
 
+      def release_setup_command
+        unbundled_keys = (BundlerEnvGuard::RESET_ENV_KEYS + %w[RUBYLIB RUBYOPT]).uniq
+        "env #{unbundled_keys.map { |key| "-u #{Shellwords.escape(key)}" }.join(" ")} bin/setup"
+      end
+
       def confirm_yes!(message, prompt, abort_message)
         puts(message)
         if @yes
@@ -1004,8 +1009,13 @@ module Kettle
 
       def monitor_workflows_after_push!
         ensure_github_pull_request_for_ci!
+        keep_release_secrets_alive!("CI monitoring")
         # Use abort-on-failure CI monitor to match historical behavior and specs
-        Kettle::Dev::CIMonitor.monitor_all!(restart_hint: "bundle exec kettle-release start_step=10", workflows: @ci_workflows)
+        Kettle::Dev::CIMonitor.monitor_all!(
+          restart_hint: "bundle exec kettle-release start_step=10",
+          workflows: @ci_workflows,
+          keepalive: release_secrets_configured? ? -> { keep_release_secrets_alive!("CI monitoring") } : nil
+        )
       end
 
       def ensure_github_pull_request_for_ci!
@@ -1110,8 +1120,12 @@ module Kettle
       def run_command_with_release_secrets!(cmd)
         return self.class.run_cmd!(cmd) unless release_secret_command?(cmd) && release_secrets_configured?
 
+        keep_release_secrets_alive!("prompt-bearing command")
         puts "$ #{cmd}"
-        _stdout_str, stderr_str, status = Kettle::Dev::InteractiveReleaseCommand.new(secrets_provider: @secrets_provider).call(
+        _stdout_str, stderr_str, status = Kettle::Dev::InteractiveReleaseCommand.new(
+          secrets_provider: @secrets_provider,
+          secret_event_handler: ->(payload) { emit_secret_event(payload) }
+        ).call(
           self.class.send(:command_env),
           cmd
         )
@@ -1137,12 +1151,41 @@ module Kettle
       end
 
       def ensure_release_secrets_ready_for_signing!
+        keep_release_secrets_alive!("signing preflight")
         value = @secrets_provider.gem_signing_passphrase.to_s
         abort(release_secrets_configuration_message("gem signing passphrase was empty")) if value.empty?
       rescue Kettle::Dev::Error => error
         abort(release_secrets_configuration_message(error.message))
       end
 
+      def keep_release_secrets_alive!(purpose)
+        return unless release_secrets_configured?
+        return unless @secrets_provider.respond_to?(:keepalive!)
+
+        emit_secret_event(action: "keepalive", status: "started", purpose: purpose, source: release_secrets_provider_label, elapsed: release_elapsed_label)
+        @secrets_provider.keepalive!(elapsed: release_elapsed_label)
+        emit_secret_event(action: "keepalive", status: "ok", purpose: purpose, source: release_secrets_provider_label, elapsed: release_elapsed_label)
+      rescue Kettle::Dev::Error => error
+        emit_secret_event(action: "keepalive", status: "failed", purpose: purpose, source: release_secrets_provider_label, elapsed: release_elapsed_label, reason: error.message)
+        abort("Release secrets provider keepalive failed before #{purpose}: #{error.message}")
+      end
+
+      def release_elapsed_label
+        return nil unless @started_at
+
+        format_elapsed_seconds(monotonic_time - @started_at)
+      end
+
+      def format_elapsed_seconds(seconds)
+        total = seconds.to_f.round
+        hours = total / 3600
+        minutes = (total % 3600) / 60
+        remaining_seconds = total % 60
+        return format("%d:%02d:%02d", hours, minutes, remaining_seconds) if hours.positive?
+
+        format("%02d:%02d", minutes, remaining_seconds)
+      end
+
       def release_secrets_configuration_message(reason)
         <<~MSG.strip
           Release secrets provider was requested, but #{reason}.
@@ -1569,6 +1612,29 @@ module Kettle
         Kettle::Ndjson.emit_diagnostic_event(@event_recorder, diagnostic, index: @diagnostics.length)
       end
 
+      def emit_secret_event(payload)
+        status = payload.fetch(:status).to_s
+        mark = case status
+        when "started"
+          ">"
+        when "ok"
+          "."
+        when "failed"
+          "!"
+        else
+          "?"
+        end
+        Kettle::Ndjson.emit_event(
+          @event_recorder,
+          "secret_provider",
+          payload.merge(
+            phase: "release",
+            provider: release_secrets_provider_label,
+            mark: mark
+          )
+        )
+      end
+
       def finish_release_report(status:, error:)
         return if @finished_report
 

data/lib/kettle/dev/release_notifier.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Kettle
+  module Dev
+    module ReleaseNotifier
+      class << self
+        def alert(message, stream: $stderr)
+          return unless enabled?
+
+          stream.write("\a") if terminal_bell?
+          stream.puts(message)
+          stream.flush if stream.respond_to?(:flush)
+        end
+
+        private
+
+        def enabled?
+          !ENV.fetch("KETTLE_RELEASE_SECRET_ALERT", "true").match?(/\A(?:false|0|no|off|disabled)\z/i)
+        end
+
+        def terminal_bell?
+          !ENV.fetch("KETTLE_RELEASE_SECRET_BELL", "true").match?(/\A(?:false|0|no|off|disabled)\z/i)
+        end
+      end
+    end
+  end
+end

data/lib/kettle/dev/release_secrets.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "open3"
+require "kettle/dev/release_notifier"
 
 module Kettle
   module Dev
@@ -15,6 +16,10 @@ module Kettle
         def rubygems_otp
           nil
         end
+
+        def keepalive!(elapsed: nil)
+          nil
+        end
       end
 
       class OnePassword < Provider
@@ -64,6 +69,14 @@ module Kettle
           run_op(argv, purpose: "RubyGems OTP")
         end
 
+        def keepalive!(elapsed: nil)
+          argv = [op_cli, "account", "get"]
+          account = string_config("account")
+          argv.concat(["--account", account]) unless account.empty?
+          run_op(argv, purpose: "authorization keepalive", elapsed: elapsed)
+          true
+        end
+
         private
 
         attr_reader :config
@@ -99,7 +112,9 @@ module Kettle
           required_config("cli")
         end
 
-        def run_op(argv, purpose:)
+        def run_op(argv, purpose:, elapsed: nil)
+          elapsed_suffix = elapsed.to_s.empty? ? "" : " (elapsed #{elapsed})"
+          Kettle::Dev::ReleaseNotifier.alert("1Password #{purpose} lookup starting#{elapsed_suffix}; watch for authorization prompt.")
           stdout, stderr, status = Open3.capture3(*argv)
           return stdout.to_s.strip if status.success? && !stdout.to_s.strip.empty?
 

data/lib/kettle/dev/release_secrets_doctor.rb

@@ -0,0 +1,204 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+require "shellwords"
+require "time"
+
+module Kettle
+  module Dev
+    class ReleaseSecretsDoctor
+      DEFAULT_SLEEP_SECONDS = 30.0
+      DEFAULT_KEEPALIVE_SECONDS = 0.0
+      DEFAULT_PROVIDER = "op"
+      DEFAULT_SHAPE = "same-process"
+      CHILD_SHAPE = "same-process"
+      SHAPES = %w[same-process child-process parent-child thread bundler-child env-reset-child].freeze
+      BUNDLER_ENV_UNSETS = %w[
+        BUNDLE_BIN_PATH
+        BUNDLE_FROZEN
+        BUNDLE_GEMFILE
+        BUNDLE_LOCKFILE
+        BUNDLER_SETUP
+        BUNDLER_VERSION
+        RUBYLIB
+        RUBYOPT
+      ].freeze
+
+      def self.options_from_env(env = ENV)
+        {
+          provider: env.fetch("KETTLE_RELEASE_SECRETS_PROVIDER", DEFAULT_PROVIDER),
+          sleep_seconds: Float(env.fetch("KETTLE_RELEASE_SECRETS_DOCTOR_SLEEP", DEFAULT_SLEEP_SECONDS.to_s)),
+          keepalive_seconds: Float(env.fetch("KETTLE_RELEASE_SECRETS_DOCTOR_KEEPALIVE", DEFAULT_KEEPALIVE_SECONDS.to_s)),
+          shape: env.fetch("KETTLE_RELEASE_SECRETS_DOCTOR_SHAPE", DEFAULT_SHAPE),
+          otp: false
+        }
+      end
+
+      def initialize(options:, program_name:, output: $stdout, system_runner: Kernel)
+        @options = normalize_options(options)
+        @program_name = program_name
+        @output = output
+        @system_runner = system_runner
+      end
+
+      def run
+        case options.fetch(:shape)
+        when "same-process"
+          run_same_process(options)
+        when "child-process"
+          run_child_process(options)
+        when "parent-child"
+          run_parent_child(options)
+        when "thread"
+          run_thread(options)
+        when "bundler-child"
+          run_bundler_child(options)
+        when "env-reset-child"
+          run_env_reset_child(options)
+        else
+          raise Kettle::Dev::Error, "unknown shape #{options.fetch(:shape).inspect}; expected #{SHAPES.join(", ")}"
+        end
+      end
+
+      def child_env(shape:, options: self.options)
+        env = {
+          "KETTLE_RELEASE_SECRETS_PROVIDER" => options.fetch(:provider),
+          "KETTLE_RELEASE_SECRETS_DOCTOR_SHAPE" => shape,
+          "KETTLE_RELEASE_SECRETS_DOCTOR_SLEEP" => options.fetch(:sleep_seconds).to_s,
+          "KETTLE_RELEASE_SECRETS_DOCTOR_KEEPALIVE" => options.fetch(:keepalive_seconds).to_s
+        }
+        env["KETTLE_RELEASE_SECRETS_DOCTOR_CHILD"] = "true"
+        env
+      end
+
+      def child_args(otp: options.fetch(:otp))
+        args = [RbConfig.ruby, program_name]
+        args << "--otp" if otp
+        args
+      end
+
+      def bundler_child_args(otp: options.fetch(:otp))
+        args = ["bundle", "exec", RbConfig.ruby, program_name]
+        args << "--otp" if otp
+        args
+      end
+
+      private
+
+      attr_reader :options, :program_name, :output, :system_runner
+
+      def normalize_options(raw_options)
+        {
+          provider: raw_options.fetch(:provider, DEFAULT_PROVIDER).to_s,
+          sleep_seconds: Float(raw_options.fetch(:sleep_seconds, DEFAULT_SLEEP_SECONDS)),
+          keepalive_seconds: Float(raw_options.fetch(:keepalive_seconds, DEFAULT_KEEPALIVE_SECONDS)),
+          shape: raw_options.fetch(:shape, DEFAULT_SHAPE).to_s,
+          otp: !!raw_options.fetch(:otp, false)
+        }
+      end
+
+      def provider_for(current_options)
+        Kettle::Dev::ReleaseSecrets::Factory.build(provider_name: current_options.fetch(:provider))
+      end
+
+      def run_same_process(current_options)
+        provider = provider_for(current_options)
+        output.puts("[#{timestamp}] initial keepalive")
+        provider.keepalive!
+        wait_with_keepalive(provider, current_options)
+        output.puts("[#{timestamp}] final keepalive")
+        provider.keepalive!
+        run_otp_lookup(provider) if current_options.fetch(:otp)
+        true
+      end
+
+      def run_parent_child(current_options)
+        provider = provider_for(current_options)
+        output.puts("[#{timestamp}] parent initial keepalive")
+        provider.keepalive!
+        wait_with_keepalive(provider, current_options)
+        output.puts("[#{timestamp}] parent spawning child after keepalive")
+        run_child_process(current_options)
+      end
+
+      def run_child_process(current_options)
+        env = child_env(shape: CHILD_SHAPE, options: current_options)
+        args = child_args(otp: current_options.fetch(:otp))
+        output.puts("[#{timestamp}] spawning child: #{args.shelljoin}")
+        run_system(env, args)
+      end
+
+      def run_bundler_child(current_options)
+        env = child_env(shape: CHILD_SHAPE, options: current_options)
+        args = bundler_child_args(otp: current_options.fetch(:otp))
+        output.puts("[#{timestamp}] spawning bundler child: #{args.shelljoin}")
+        run_system(env, args)
+      end
+
+      def run_env_reset_child(current_options)
+        env = child_env(shape: CHILD_SHAPE, options: current_options)
+        BUNDLER_ENV_UNSETS.each { |key| env[key] = nil }
+        args = child_args(otp: current_options.fetch(:otp))
+        output.puts("[#{timestamp}] spawning env-reset child: #{args.shelljoin}")
+        run_system(env, args)
+      end
+
+      def run_thread(current_options)
+        error = nil
+        # rubocop:disable ThreadSafety/NewThread -- this doctor intentionally probes threaded secret-provider behavior.
+        thread = Thread.new do
+          begin
+            run_same_process(current_options)
+          rescue => e
+            error = e
+          end
+        end
+        # rubocop:enable ThreadSafety/NewThread
+        thread.join
+        raise error if error
+
+        true
+      end
+
+      def run_system(env, args)
+        success = system_runner.system(env, *args)
+        raise Kettle::Dev::Error, "child shape failed: #{args.shelljoin}" unless success
+
+        true
+      end
+
+      def wait_with_keepalive(provider, current_options)
+        sleep_seconds = current_options.fetch(:sleep_seconds)
+        keepalive_seconds = current_options.fetch(:keepalive_seconds)
+        deadline = Process.clock_gettime(Process::CLOCK_MONOTONIC) + sleep_seconds
+        if keepalive_seconds <= 0
+          output.puts("[#{timestamp}] sleeping #{sleep_seconds}s without keepalive")
+          sleep(sleep_seconds)
+          return
+        end
+
+        output.puts("[#{timestamp}] sleeping #{sleep_seconds}s with #{keepalive_seconds}s keepalive")
+        loop do
+          remaining = deadline - Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          break if remaining <= 0
+
+          sleep([remaining, keepalive_seconds].min)
+          break if Process.clock_gettime(Process::CLOCK_MONOTONIC) >= deadline
+
+          output.puts("[#{timestamp}] keepalive")
+          provider.keepalive!
+        end
+      end
+
+      def run_otp_lookup(provider)
+        output.puts("[#{timestamp}] OTP lookup")
+        otp = provider.rubygems_otp
+        output.puts("[#{timestamp}] OTP lookup returned #{otp.to_s.empty? ? "empty" : "#{otp.length} chars"}")
+      end
+
+      def timestamp
+        Time.now.iso8601
+      end
+    end
+  end
+end

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "2.5.11"
+      VERSION = "2.5.12"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/dev.rb

@@ -46,8 +46,10 @@ module Kettle
     autoload :LockfileReset, "kettle/dev/lockfile_reset"
     autoload :ReadmeBackers, "kettle/dev/readme_backers"
     autoload :OpenCollectiveConfig, "kettle/dev/open_collective_config"
+    autoload :ReleaseNotifier, "kettle/dev/release_notifier"
     autoload :ReleaseCLI, "kettle/dev/release_cli"
     autoload :ReleaseSecrets, "kettle/dev/release_secrets"
+    autoload :ReleaseSecretsDoctor, "kettle/dev/release_secrets_doctor"
     autoload :ResetCLI, "kettle/dev/reset_cli"
     autoload :PreReleaseCLI, "kettle/dev/pre_release_cli"
     autoload :Version, "kettle/dev/version"

data.tar.gz.sig

@@ -1,2 +1,3 @@
-cPG����/�@ثM��'en�j3<�f����ƵYS��SR&�\�Ζ�R\����(��".�������Έ���A�Y��1H`����8�G�$�œ/��2}�+L��I6��c(H/�׻;P�G�V���^:�#�	�M��
-���=`٤�V4Q�������bw�Yc�����<5����$�9�u���*��<2w�=*��Hc�Y�Ǭ0��=7�l�[BM���|GRj,\�
+w2��Y�S�s��E�xx���阻Qc��X���_�%�%X.��C⹎���f�,~�d�
+O�OE�_m�Ф�P���s�!j���=�4� ��q�{��0Ӕ�Ʈ}���:���ܪ}ȿ����7yO?�����q׊y��z�';�%��j�5ˠ�����%F��}��*���0fVk2Cp{�
+��#H�٩��� 嫕�d KgHV���'Ꮍ����
.�!�s�U=����@�����|pq����&P���Dqd߹�?�3j2�s�}��	$�ҳ�?R|�2���T

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 2.5.11
+  version: 2.5.12
 platform: ruby
 authors:
 - Peter H. Boling
@@ -80,7 +80,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.3
+        version: 0.1.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -90,7 +90,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.3
+        version: 0.1.4
 - !ruby/object:Gem::Dependency
   name: kettle-rb
   requirement: !ruby/object:Gem::Requirement
@@ -327,6 +327,7 @@ executables:
 - kettle-pre-release
 - kettle-readme-backers
 - kettle-release
+- kettle-release-secrets-doctor
 - kettle-reset
 extensions: []
 extra_rdoc_files: []
@@ -346,6 +347,7 @@ files:
 - exe/kettle-pre-release
 - exe/kettle-readme-backers
 - exe/kettle-release
+- exe/kettle-release-secrets-doctor
 - exe/kettle-reset
 - lib/kettle-dev.rb
 - lib/kettle/dev.rb
@@ -381,7 +383,9 @@ files:
 - lib/kettle/dev/rakelib/yard.rake
 - lib/kettle/dev/readme_backers.rb
 - lib/kettle/dev/release_cli.rb
+- lib/kettle/dev/release_notifier.rb
 - lib/kettle/dev/release_secrets.rb
+- lib/kettle/dev/release_secrets_doctor.rb
 - lib/kettle/dev/reset_cli.rb
 - lib/kettle/dev/ruby_gems_versions.rb
 - lib/kettle/dev/tasks.rb
@@ -397,10 +401,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.5.11
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.5.11/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.5.12
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.5.12/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.5.11
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.5.12
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev