kettle-dev 2.5.11 → 2.5.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f2c0c759c751e79d77e5cf8495f9c461d514d0b120c97cd95b4ae7222afe7f0c
-  data.tar.gz: 95f799d83838660c1fa6200fe4783368a59456f1e8c6221bfdccff0eb967cecf
+  metadata.gz: 76cf339458385418bcf752559dbb9c6278f3b95ebfa27b26781591564179f263
+  data.tar.gz: 66cae3bfb62ecd922bf2b6ecc16049389a860a20dbaa8492fd6578bdcf3b4922
 SHA512:
-  metadata.gz: 6e95a43755c42b2cf9e45e6d5df069aa0fd5cea4291aeae0ef9f9020a43eed84959a7c734bf8dbd0f719f9d78f6b3f135399cddb9374b616e74abbdb200c6017
-  data.tar.gz: 9bee1f5843526fc154502c909c0144c4440da1610611d6eaf9ef23a4d7f72386071e420cbe267b0ce08d0a82c59abe094b990c85e0d2a813077ab08fe8a147ec
+  metadata.gz: 0ae8aa5d0113e226dab9dbb332b42328bfe738c84ce88a21d919c3a0249d2ad3f70d905aa4cbd76c903608846da8a485a6e68c710934e7eac2443517d71d6a96
+  data.tar.gz: 4470d0bd47c7c95a616b8513a6b590911a4086e6d6f31330e96c45059774ac4d172a0c98ccf5aad53384208cf40fb02de237c68c6326a430acaf89adfe9a89c2

data/CHANGELOG.md

@@ -30,6 +30,89 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.5.13] - 2026-07-31
+
+- TAG: [v2.5.13][2.5.13t]
+- COVERAGE: 91.81% -- 5137/5595 lines in 46 files
+- BRANCH COVERAGE: 76.06% -- 1944/2556 branches in 46 files
+- 50.41% documented
+
+### Fixed
+
+- `kettle-release` now treats `origin` as the default required parity remote
+  while allowing optional mirror remotes to be skipped after fetch retries,
+  so a transient Codeberg/GitLab mirror outage does not block publishing.
+
+### Added
+
+- `kettle-release --events` now emits `remote_parity` events for remote parity
+  fetch attempts, skipped optional remotes, required failures, and parity
+  completion.
+- `kettle-release --events` now emits `ci_monitor` events around CI monitoring
+  start, per-workflow GitHub Actions progress, GitLab pipeline outcomes,
+  success, and failure.
+- `kettle-release --events` now emits `pre_release` events around
+  `kettle-pre-release` checks and selected check summaries.
+- `kettle-changelog --events` now emits `changelog` events around release plan,
+  coverage generation, and changelog update activity, and `kettle-release
+  --events` forwards those child events.
+- `kettle-release --events` now emits `release_lockfile` and `release_probe`
+  events for release lockfile reset/validation and published-gem availability
+  probes.
+- `kettle-dev` now requires `kettle-ndjson` 0.1.9 or newer so release event
+  streams resolve against the protocol that includes remote parity and CI
+  monitor, pre-release, changelog, release lockfile, and release probe events.
+
+- `kettle-release --events` now emits GitHub CI wait/start/tick monitor events
+  while waiting for workflow runs to appear and complete.
+
+### Changed
+
+- `kettle-release --events` now emits clearer `command_step` names and compact
+  per-command summaries for common release commands instead of shell-derived
+  labels such as `env__u`.
+
+## [2.5.12] - 2026-07-31
+
+- TAG: [v2.5.12][2.5.12t]
+- COVERAGE: 91.73% -- 4961/5408 lines in 46 files
+- BRANCH COVERAGE: 75.98% -- 1850/2435 branches in 46 files
+- 50.68% documented
+
+### Added
+
+- `kettle-release-secrets-doctor` can probe 1Password release secret
+  authorization across same-process, child-process, and threaded shapes.
+
+- `kettle-release-secrets-doctor` now probes additional 1Password
+  authorization boundaries, including parent-child, Bundler child, and
+  Bundler-env-reset child process shapes.
+
+- `kettle-release --events` now emits `secret_provider` events around release
+  secret keepalives and provider-backed prompt responses.
+
+### Fixed
+
+- `kettle-release` now keeps configured release secrets providers warm during
+  CI waits and alerts before provider lookups, reducing missed 1Password
+  authorization prompts during long release runs.
+
+- `kettle-release` keepalive alerts now include the elapsed release time so
+  delayed 1Password prompts are easier to correlate with the run.
+
+- `kettle-dev` now requires `kettle-ndjson` 0.1.4 or newer so
+  `kettle-release --events=secret_provider` cannot resolve against an older
+  event protocol.
+- `kettle-release` lockfile reset now preserves existing bundle platforms and
+  adds the current host platform, preventing release-prep lockfiles from losing
+  Linux support during full rebuilds.
+- `kettle-pre-release` Markdown image URL normalization now keeps encoded query
+  values stable, avoiding release-time churn in shields URLs with nested URL
+  parameters.
+- `kettle-release` now runs `bin/setup` with inherited Bundler bootstrap
+  variables unset, so a release lockfile reset can install newly selected gems
+  before later release tasks run.
+
 ## [2.5.11] - 2026-07-30
 
 - TAG: [v2.5.11][2.5.11t]
@@ -3077,7 +3160,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.11...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.13...HEAD
+[2.5.13]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.12...v2.5.13
+[2.5.13t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.5.13
+[2.5.12]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.11...v2.5.12
+[2.5.12t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.5.12
 [2.5.11]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.10...v2.5.11
 [2.5.11t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.5.11
 [2.5.10]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.9...v2.5.10

data/README.md

@@ -1005,7 +1005,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.189-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.595-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-changelog

@@ -50,9 +50,11 @@ begin
 
   # This library
   require "kettle/dev"
+  require "kettle/ndjson"
   require "kettle/dev/executable_version"
   Kettle::Dev::ExecutableVersion.print_and_exit!(script_basename, ARGV, value_option: true)
-  Kettle::Dev::ExecutableVersion.print_header(script_basename) unless ARGV.include?("--json")
+  machine_output = ARGV.any? { |arg| arg == "--json" || arg.start_with?("--events") }
+  Kettle::Dev::ExecutableVersion.print_header(script_basename) unless machine_output
 rescue LoadError => e
   warn("#{script_basename}: could not load dependency: #{e.class}: #{e.message}")
   warn("Hint: Ensure the host project has kettle-dev as a dependency and run bundle install.")
@@ -61,7 +63,7 @@ end
 
 if ARGV.include?("-h") || ARGV.include?("--help")
   puts <<~USAGE
-    Usage: kettle-changelog [--version VERSION] [--yes] [--update-prep] [--pending-release] [--release-state] [--refresh-cache] [--add-unreleased-entry --section SECTION --entry TEXT] [--json] [--no-strict] [--no-coverage-threshold]
+    Usage: kettle-changelog [--version VERSION] [--yes] [--update-prep] [--pending-release] [--release-state] [--refresh-cache] [--add-unreleased-entry --section SECTION --entry TEXT] [--json|--events[=TYPES]] [--no-strict] [--no-coverage-threshold]
 
     Detects the current version from lib/**/version.rb, the latest live release, and
     the most recent CHANGELOG.md release section, then prompts to confirm the selected plan:
@@ -82,6 +84,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       --section SECTION         Unreleased section to receive the entry (Added, Changed, Deprecated, Removed, Fixed, Security)
       --entry TEXT              Changelog entry text; "- " is added when omitted
       --json                    Print query output as JSON
+      --events[=TYPES]          Print newline-delimited JSON changelog events
       --no-strict               Allow missing coverage and yard data (warnings only, no errors)
       --no-coverage-threshold   Generate coverage without hard-failing below configured thresholds
 
@@ -137,6 +140,22 @@ begin
     Kettle::Dev::Versioning.normalize_explicit_version(version)
   end
 
+  def extract_events_arg!(argv)
+    events = false
+    event_types = nil
+    argv.delete_if do |arg|
+      if arg == "--events"
+        events = true
+      elsif arg.start_with?("--events=")
+        events = true
+        event_types = arg.split("=", 2)[1]
+      else
+        false
+      end
+    end
+    [events, event_types]
+  end
+
   # Determine if strict mode is enabled (default: true)
   strict_mode = !ARGV.include?("--no-strict") && ENV.fetch("K_CHANGELOG_STRICT", "true").downcase != "false"
   update_prep = ARGV.delete("--update-prep")
@@ -146,6 +165,8 @@ begin
   refresh_cache = ARGV.delete("--refresh-cache")
   add_unreleased_entry = ARGV.delete("--add-unreleased-entry") || ARGV.delete("--add-changelog-entry")
   json_output = ARGV.delete("--json")
+  events_output, event_types = extract_events_arg!(ARGV)
+  Kettle::Dev::ExitAdapter.abort("--events cannot be combined with --json") if events_output && json_output
   coverage_threshold_disabled = ARGV.include?("--no-coverage-threshold") || ARGV.include?("--no-coverage-thresholds")
   coverage_hard = !coverage_threshold_disabled && ENV.fetch("K_CHANGELOG_COVERAGE_HARD", "true").downcase != "false"
   version_override = extract_version_arg!(ARGV)
@@ -180,7 +201,8 @@ begin
     exit(0)
   end
 
-  cli = Kettle::Dev::ChangelogCLI.new(strict: strict_mode, enforce_coverage_thresholds: coverage_hard, update_prep: update_prep, version: version_override, refresh_cache: refresh_cache, yes: yes)
+  event_stream = events_output ? Kettle::Ndjson.event_stream($stdout, types: event_types) : nil
+  cli = Kettle::Dev::ChangelogCLI.new(strict: strict_mode, enforce_coverage_thresholds: coverage_hard, update_prep: update_prep, version: version_override, refresh_cache: refresh_cache, yes: yes, event_stream: event_stream)
   if release_state_query
     state = cli.release_state
     puts(json_output ? JSON.pretty_generate(state) : cli.release_state_table(state))

data/exe/kettle-release

@@ -49,7 +49,7 @@ end
 # Do not guard with __FILE__ == $PROGRAM_NAME because binstubs use Kernel.load.
 if ARGV.include?("-h") || ARGV.include?("--help")
   puts <<~USAGE
-    Usage: kettle-release [--version VERSION] [--local-ci] [--yes] [--appraisal-update] [--skip-bundle-audit] [--skip-steps STEPS] [--ci-workflows WORKFLOWS] [--skip-remotes REMOTES] [--secrets-provider NAME] [--json|--events[=TYPES]] [--report PATH] [start_step=<0-19>]
+    Usage: kettle-release [--version VERSION] [--local-ci] [--yes] [--appraisal-update] [--skip-bundle-audit] [--skip-steps STEPS] [--ci-workflows WORKFLOWS] [--skip-remotes REMOTES] [--required-remotes REMOTES] [--secrets-provider NAME] [--json|--events[=TYPES]] [--report PATH] [start_step=<0-19>]
 
     Automates the release flow for a Ruby gem in the host project.
 
@@ -90,6 +90,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       --skip-bundle-audit         # Skip bundle:audit/update during release rake checks
       --ci-workflows WORKFLOWS    # Comma-separated workflow files or stems to monitor at CI step 10
       --skip-remotes REMOTES      # Comma-separated git remote names to exclude from release fetch/push parity
+      --required-remotes REMOTES  # Comma-separated remote names that must fetch for release parity; defaults to origin
       --secrets-provider NAME     # Release secrets provider: interactive, 1password
       --json                      # Print final machine-readable release report as JSON
       --events[=TYPES]            # Print newline-delimited JSON release events, optionally filtered by type
@@ -104,6 +105,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       K_RELEASE_LOCAL_CI_WORKFLOW # Name of workflow (without .yml) for local CI; defaults to locked_deps or first
       K_RELEASE_CI_WORKFLOWS      # Comma-separated workflow files or stems to monitor at CI step 10
       K_RELEASE_SKIP_REMOTES      # Comma-separated git remote names to exclude from release fetch/push parity
+      K_RELEASE_REQUIRED_REMOTES  # Comma-separated remotes that must fetch for release parity; defaults to origin
       KETTLE_RELEASE_SECRETS_PROVIDER=1password
                                   # Load release secrets through the configured provider
       KETTLE_RELEASE_1PASSWORD_ITEM=Rubygems
@@ -215,6 +217,27 @@ def extract_skip_remotes_arg!(argv)
   remotes
 end
 
+def extract_required_remotes_arg!(argv)
+  remotes = nil
+  if (idx = argv.index("--required-remotes"))
+    remotes = argv[idx + 1]
+    if remotes.to_s.empty? || remotes.to_s.start_with?("-")
+      Kettle::Dev::ExitAdapter.abort("--required-remotes requires a comma-separated remote list")
+    end
+    argv.slice!(idx, 2)
+  end
+  argv.delete_if do |arg|
+    if arg.start_with?("--required-remotes=", "required_remotes=")
+      remotes = arg.split("=", 2)[1]
+      Kettle::Dev::ExitAdapter.abort("--required-remotes requires a comma-separated remote list") if remotes.to_s.empty?
+      true
+    else
+      false
+    end
+  end
+  remotes
+end
+
 def extract_report_arg!(argv)
   report_path = nil
   if (idx = argv.index("--report"))
@@ -286,12 +309,13 @@ version_override = extract_version_arg!(ARGV)
 skip_steps = extract_skip_steps_arg!(ARGV)
 ci_workflows = extract_ci_workflows_arg!(ARGV)
 skip_remotes = extract_skip_remotes_arg!(ARGV)
+required_remotes = extract_required_remotes_arg!(ARGV)
 report_path = extract_report_arg!(ARGV)
 secrets_provider = extract_secrets_provider_arg!(ARGV)
 
 begin
   event_stream = events_output ? Kettle::Ndjson.event_stream($stdout, types: event_types) : nil
-  Kettle::Dev::ReleaseCLI.new(start_step: start_step, local_ci: local_ci, version: version_override, appraisal_task: appraisal_task, skip_steps: skip_steps, skip_bundle_audit: skip_bundle_audit, ci_workflows: ci_workflows, skip_remotes: skip_remotes, secrets_provider_name: secrets_provider, yes: yes, event_stream: event_stream, json_output: json_output, json_io: $stdout, report_path: report_path).run
+  Kettle::Dev::ReleaseCLI.new(start_step: start_step, local_ci: local_ci, version: version_override, appraisal_task: appraisal_task, skip_steps: skip_steps, skip_bundle_audit: skip_bundle_audit, ci_workflows: ci_workflows, skip_remotes: skip_remotes, required_remotes: required_remotes, secrets_provider_name: secrets_provider, yes: yes, event_stream: event_stream, json_output: json_output, json_io: $stdout, report_path: report_path).run
 rescue LoadError => e
   warn("#{script_basename}: could not load dependency: #{e.class}: #{e.message}")
   warn(Array(e.backtrace).join("\n")) if ENV["DEBUG"]

data/exe/kettle-release-secrets-doctor

@@ -0,0 +1,39 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "optparse"
+
+$stdout.sync = true
+$stderr.sync = true
+
+script_basename = File.basename(__FILE__)
+repo_lib = File.expand_path("../lib", __dir__)
+$LOAD_PATH.unshift(repo_lib) if File.directory?(repo_lib) && !$LOAD_PATH.include?(repo_lib)
+
+begin
+  require "kettle/dev"
+  require "kettle/dev/executable_version"
+  Kettle::Dev::ExecutableVersion.print_and_exit!(script_basename, ARGV, value_option: true)
+  Kettle::Dev::ExecutableVersion.print_header(script_basename)
+rescue LoadError
+  warn "kettle-release-secrets-doctor must run with kettle-dev on the load path"
+  exit 1
+end
+
+options = Kettle::Dev::ReleaseSecretsDoctor.options_from_env
+
+OptionParser.new do |parser|
+  parser.banner = "Usage: kettle-release-secrets-doctor [options]"
+  parser.on("--provider NAME", "Secrets provider name, default: op") { |value| options[:provider] = value }
+  parser.on("--sleep SECONDS", Float, "Seconds to wait between probes") { |value| options[:sleep_seconds] = value }
+  parser.on("--keepalive SECONDS", Float, "Run keepalive every N seconds while waiting; 0 disables") { |value| options[:keepalive_seconds] = value }
+  parser.on("--shape SHAPE", "Shape: #{Kettle::Dev::ReleaseSecretsDoctor::SHAPES.join(", ")}") { |value| options[:shape] = value }
+  parser.on("--otp", "Fetch RubyGems OTP after the wait") { options[:otp] = true }
+end.parse!
+
+begin
+  Kettle::Dev::ReleaseSecretsDoctor.new(options: options, program_name: $PROGRAM_NAME).run
+rescue Kettle::Dev::Error => e
+  warn e.message
+  exit 1
+end

data/lib/kettle/dev/bundler_env_guard.rb

@@ -19,6 +19,7 @@ module Kettle
         BUNDLE_SILENCE_ROOT_WARNING
         BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES
         BUNDLE_VERBOSE
+        BUNDLER_DEBUG
       ].freeze
 
       INERT_ENV_PREFIXES = %w[

data/lib/kettle/dev/changelog_cli.rb

@@ -5,6 +5,7 @@ require "json"
 require "net/http"
 require "uri"
 require "fileutils"
+require "kettle/ndjson"
 
 module Kettle
   module Dev
@@ -28,7 +29,7 @@ module Kettle
       # @param update_prep [Boolean] when true, update the most recent prepared release section in place
       # @param version [String, nil] explicit version override for gems without a literal VERSION constant
       # @param yes [Boolean] when true, approve the selected release plan without prompting
-      def initialize(strict: true, enforce_coverage_thresholds: true, update_prep: false, version: nil, root: Kettle::Dev::CIHelpers.project_root, refresh_cache: false, yes: false)
+      def initialize(strict: true, enforce_coverage_thresholds: true, update_prep: false, version: nil, root: Kettle::Dev::CIHelpers.project_root, refresh_cache: false, yes: false, event_stream: nil)
         @root = root
         @changelog_path = resolved_changelog_path
         @coverage_root = resolved_coverage_root
@@ -39,6 +40,7 @@ module Kettle
         @version_override = Kettle::Dev::Versioning.normalize_explicit_version(version)
         @refresh_cache = refresh_cache
         @yes = !!yes
+        @event_recorder = Kettle::Ndjson.event_recorder(event_stream, phase_timings: [])
       end
 
       # Main entry point to update CHANGELOG.md
@@ -70,6 +72,7 @@ module Kettle
 
         if plan.fetch(:action) == :update_prepared_release
           update_prepared_release!(changelog, today, owner, repo, line_cov_line, branch_cov_line, yard_line)
+          emit_changelog_event(action: "update", status: "ok", version: version, plan: plan.fetch(:action).to_s)
           return
         end
 
@@ -140,6 +143,7 @@ module Kettle
         updated = updated.rstrip + "\n"
 
         File.write(@changelog_path, updated)
+        emit_changelog_event(action: "update", status: "ok", version: version, plan: plan.fetch(:action).to_s)
         puts "CHANGELOG.md updated with v#{version} section."
       end
 
@@ -348,6 +352,16 @@ module Kettle
         puts "  latest released for current series: #{plan.fetch(:latest_for_series) || "unknown"}"
         puts "  latest CHANGELOG.md release: #{plan.fetch(:latest_changelog_version) || "none"}"
         puts "  gem: #{plan.fetch(:gem_name) || "unknown"}"
+        emit_changelog_event(
+          action: "plan",
+          status: "ok",
+          plan: plan.fetch(:action).to_s,
+          version: plan.fetch(:version),
+          gem_name: plan.fetch(:gem_name),
+          latest_overall: plan.fetch(:latest_overall),
+          latest_for_series: plan.fetch(:latest_for_series),
+          latest_changelog_version: plan.fetch(:latest_changelog_version)
+        )
         if @yes
           puts("Continue with this plan? [y/N]: y")
           return
@@ -665,20 +679,25 @@ module Kettle
           coverage_dir = File.dirname(@coverage_path)
           if Dir.exist?(coverage_dir)
             puts "Cleaning old coverage data from #{Kettle::Dev.display_path(coverage_dir)}..."
+            emit_changelog_event(action: "coverage_clean", status: "started", path: Kettle::Dev.display_path(coverage_dir))
             Dir.glob(File.join(coverage_dir, "*")).each do |file|
               File.delete(file) if File.file?(file)
             end
+            emit_changelog_event(action: "coverage_clean", status: "ok", path: Kettle::Dev.display_path(coverage_dir))
           end
 
           puts "Generating fresh coverage data by running: bundle exec kettle-test"
+          emit_changelog_event(action: "coverage", status: "started", command: "bundle exec kettle-test", root: Kettle::Dev.display_path(@coverage_root))
 
           success = system(changelog_coverage_env, "bundle", "exec", "kettle-test", chdir: @coverage_root)
 
           unless success
+            emit_changelog_event(action: "coverage", status: "failed", command: "bundle exec kettle-test", root: Kettle::Dev.display_path(@coverage_root), reason: "exit status #{$?.exitstatus || "unknown"}")
             raise "bundle exec kettle-test failed with exit status #{$?.exitstatus || "unknown"}"
           end
 
           puts "Coverage generation complete."
+          emit_changelog_event(action: "coverage", status: "ok", command: "bundle exec kettle-test", root: Kettle::Dev.display_path(@coverage_root))
 
           ensure_changelog_coverage_json!
         else
@@ -739,6 +758,29 @@ module Kettle
         end
       end
 
+      def emit_changelog_event(action:, status:, **payload)
+        mark = case status.to_s
+        when "started"
+          ">"
+        when "ok", "skipped"
+          "."
+        when "failed"
+          "!"
+        else
+          "?"
+        end
+        Kettle::Ndjson.emit_event(
+          @event_recorder,
+          "changelog",
+          payload.merge(
+            action: action,
+            phase: "release",
+            status: status,
+            mark: mark
+          )
+        )
+      end
+
       def changelog_coverage_env
         env = BundlerEnvGuard.unbundled_env.merge(
           "PATH" => ENV.fetch("PATH", ""),