kettle-dev 2.5.11 → 2.5.13

data/lib/kettle/dev/release_cli.rb

@@ -117,14 +117,15 @@ module Kettle
 
       public
 
-      def initialize(start_step: 0, local_ci: false, version: nil, appraisal_task: nil, skip_steps: nil, skip_bundle_audit: nil, ci_workflows: nil, skip_remotes: nil, secrets_provider_name: nil, yes: false, **options)
+      def initialize(start_step: 0, local_ci: false, version: nil, appraisal_task: nil, skip_steps: nil, skip_bundle_audit: nil, ci_workflows: nil, skip_remotes: nil, required_remotes: nil, secrets_provider_name: nil, yes: false, **options)
         @root = Kettle::Dev::CIHelpers.project_root
         @git = Kettle::Dev::GitAdapter.new(@root)
         @start_step = (start_step || 0).to_i
         @start_step = 0 if @start_step < 0
         @skip_steps = normalize_skip_steps(skip_steps)
         @ci_workflows = normalize_ci_workflows(ci_workflows || ENV["K_RELEASE_CI_WORKFLOWS"])
-        @skip_remotes = normalize_skip_remotes(skip_remotes || ENV["K_RELEASE_SKIP_REMOTES"])
+        @skip_remotes = normalize_remote_names(skip_remotes || ENV["K_RELEASE_SKIP_REMOTES"], "skip remotes")
+        @required_remotes = normalize_required_remotes(required_remotes)
         @local_ci = !!local_ci
         @skip_bundle_audit = truthy_value?(skip_bundle_audit) || truthy_value?(ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"])
         @yes = !!yes
@@ -276,7 +277,7 @@ module Kettle
         prepare_release_lockfiles_for_release_tasks! if release_lockfile_preflight_needed?
 
         # 3. bin/setup
-        run_cmd!("bin/setup") if run_step?(3)
+        run_cmd!(release_setup_command) if run_step?(3)
         # 4. bin/rake
         run_cmd!(release_default_task_command) if run_step?(4)
 
@@ -479,14 +480,19 @@ module Kettle
         workflows.map { |workflow| workflow.match?(/\.ya?ml\z/) ? workflow : "#{workflow}.yml" }.uniq
       end
 
-      def normalize_skip_remotes(value)
+      def normalize_remote_names(value, label)
         remotes = Array(value).flat_map { |part| part.to_s.split(",") }.map(&:strip).reject(&:empty?)
         invalid = remotes.find { |remote| !remote.match?(/\A[A-Za-z0-9_.-]+\z/) }
-        abort("Invalid skip remotes value #{invalid.inspect}; use comma-separated git remote names.") if invalid
+        abort("Invalid #{label} value #{invalid.inspect}; use comma-separated git remote names.") if invalid
 
         remotes.uniq
       end
 
+      def normalize_required_remotes(value)
+        remotes = normalize_remote_names(value.nil? ? ENV["K_RELEASE_REQUIRED_REMOTES"] : value, "required remotes")
+        remotes.empty? ? ["origin"] : remotes
+      end
+
       private
 
       def local_ci?
@@ -571,7 +577,7 @@ module Kettle
 
       def run_pre_release_checks!
         puts "Running pre-release checks via kettle-pre-release..."
-        Kettle::Dev::PreReleaseCLI.new(check_num: 1).run
+        Kettle::Dev::PreReleaseCLI.new(check_num: 1, event_recorder: @event_recorder).run
         run_changelog!
       end
 
@@ -590,9 +596,11 @@ module Kettle
         attempts = release_lockfile_reset_attempts(stage)
         attempts.times do |index|
           attempt = index + 1
+          emit_release_lockfile_event(action: "reset", status: "started", stage: stage, attempt: attempt, attempts: attempts)
           puts "Resetting release lockfiles with local path dependencies disabled #{stage} (attempt #{attempt}/#{attempts})..."
           begin
             lockfile_reset.reset(Kettle::Dev::LockfileReset::RELEASE_LOCKFILES_TARGET)
+            emit_release_lockfile_event(action: "reset", status: "ok", stage: stage, attempt: attempt, attempts: attempts)
             break
           rescue Kettle::Dev::Error => error
             raise unless error.message.start_with?("Reset #{Kettle::Dev::LockfileReset::RELEASE_LOCKFILES_TARGET} failed validation:")
@@ -600,9 +608,26 @@ module Kettle
             # Keep release-facing failures shaped like the lockfile validation
             # guard, even when the shared reset helper is the component that
             # detects the unrepaired lockfile.
+            emit_release_lockfile_event(
+              action: "reset",
+              status: "blocked",
+              stage: stage,
+              attempt: attempt,
+              attempts: attempts,
+              reason: error.message
+            )
             break
           rescue => error
-            raise unless retryable_release_lockfile_reset_error?(error) && attempt < attempts
+            retryable = retryable_release_lockfile_reset_error?(error) && attempt < attempts
+            emit_release_lockfile_event(
+              action: "reset",
+              status: retryable ? "retrying" : "failed",
+              stage: stage,
+              attempt: attempt,
+              attempts: attempts,
+              reason: error.message
+            )
+            raise unless retryable
 
             puts "Release lockfile reset could not resolve a gem from #{RELEASE_VALIDATION_SOURCE}; waiting before retry #{attempt + 1}/#{attempts}."
             sleep(release_availability_probe_interval)
@@ -611,7 +636,16 @@ module Kettle
 
         diagnostics = release_lockfile_paths.flat_map { |path| release_lockfile_diagnostics(path) }
         if diagnostics.empty?
+          emit_release_lockfile_event(action: "validate", status: "ok", stage: stage, count: release_lockfile_paths.length)
           puts "Release lockfile reset complete: #{release_lockfile_paths.length} lockfile(s) checked, no diagnostics remain."
+        else
+          emit_release_lockfile_event(
+            action: "validate",
+            status: "failed",
+            stage: stage,
+            count: diagnostics.length,
+            reason: "#{diagnostics.length} diagnostic(s)"
+          )
         end
         @release_lockfiles_reset_for_release_tasks = true if stage == "before release task bundle installs"
       end
@@ -758,6 +792,7 @@ module Kettle
         cmd = "bundle exec kettle-changelog"
         cmd = "#{cmd} --version #{Shellwords.escape(@version_override)}" if @version_override
         cmd = "#{cmd} --yes" if @yes
+        cmd = "#{cmd} --events=changelog" if @event_stream
         run_cmd!(cmd)
         @changelog_generated_coverage = true
       end
@@ -773,6 +808,11 @@ module Kettle
         "bin/rake"
       end
 
+      def release_setup_command
+        unbundled_keys = (BundlerEnvGuard::RESET_ENV_KEYS + %w[RUBYLIB RUBYOPT]).uniq
+        "env #{unbundled_keys.map { |key| "-u #{Shellwords.escape(key)}" }.join(" ")} bin/setup"
+      end
+
       def confirm_yes!(message, prompt, abort_message)
         puts(message)
         if @yes
@@ -1004,8 +1044,25 @@ module Kettle
 
       def monitor_workflows_after_push!
         ensure_github_pull_request_for_ci!
+        keep_release_secrets_alive!("CI monitoring")
+        restart_hint = "bundle exec kettle-release start_step=10"
+        emit_ci_monitor_event(action: "start", status: "started", workflows: @ci_workflows, restart_hint: restart_hint)
         # Use abort-on-failure CI monitor to match historical behavior and specs
-        Kettle::Dev::CIMonitor.monitor_all!(restart_hint: "bundle exec kettle-release start_step=10", workflows: @ci_workflows)
+        begin
+          Kettle::Dev::CIMonitor.monitor_all!(
+            restart_hint: restart_hint,
+            workflows: @ci_workflows,
+            keepalive: release_secrets_configured? ? -> { keep_release_secrets_alive!("CI monitoring") } : nil,
+            event_recorder: @event_recorder
+          )
+          emit_ci_monitor_event(action: "finish", status: "ok", workflows: @ci_workflows, restart_hint: restart_hint)
+        rescue SystemExit => error
+          emit_ci_monitor_event(action: "finish", status: "failed", workflows: @ci_workflows, restart_hint: restart_hint, reason: error.message)
+          raise
+        rescue => error
+          emit_ci_monitor_event(action: "finish", status: "failed", workflows: @ci_workflows, restart_hint: restart_hint, reason: "#{error.class}: #{error.message}")
+          raise
+        end
       end
 
       def ensure_github_pull_request_for_ci!
@@ -1110,8 +1167,12 @@ module Kettle
       def run_command_with_release_secrets!(cmd)
         return self.class.run_cmd!(cmd) unless release_secret_command?(cmd) && release_secrets_configured?
 
+        keep_release_secrets_alive!("prompt-bearing command")
         puts "$ #{cmd}"
-        _stdout_str, stderr_str, status = Kettle::Dev::InteractiveReleaseCommand.new(secrets_provider: @secrets_provider).call(
+        _stdout_str, stderr_str, status = Kettle::Dev::InteractiveReleaseCommand.new(
+          secrets_provider: @secrets_provider,
+          secret_event_handler: ->(payload) { emit_secret_event(payload) }
+        ).call(
           self.class.send(:command_env),
           cmd
         )
@@ -1137,12 +1198,41 @@ module Kettle
       end
 
       def ensure_release_secrets_ready_for_signing!
+        keep_release_secrets_alive!("signing preflight")
         value = @secrets_provider.gem_signing_passphrase.to_s
         abort(release_secrets_configuration_message("gem signing passphrase was empty")) if value.empty?
       rescue Kettle::Dev::Error => error
         abort(release_secrets_configuration_message(error.message))
       end
 
+      def keep_release_secrets_alive!(purpose)
+        return unless release_secrets_configured?
+        return unless @secrets_provider.respond_to?(:keepalive!)
+
+        emit_secret_event(action: "keepalive", status: "started", purpose: purpose, source: release_secrets_provider_label, elapsed: release_elapsed_label)
+        @secrets_provider.keepalive!(elapsed: release_elapsed_label)
+        emit_secret_event(action: "keepalive", status: "ok", purpose: purpose, source: release_secrets_provider_label, elapsed: release_elapsed_label)
+      rescue Kettle::Dev::Error => error
+        emit_secret_event(action: "keepalive", status: "failed", purpose: purpose, source: release_secrets_provider_label, elapsed: release_elapsed_label, reason: error.message)
+        abort("Release secrets provider keepalive failed before #{purpose}: #{error.message}")
+      end
+
+      def release_elapsed_label
+        return nil unless @started_at
+
+        format_elapsed_seconds(monotonic_time - @started_at)
+      end
+
+      def format_elapsed_seconds(seconds)
+        total = seconds.to_f.round
+        hours = total / 3600
+        minutes = (total % 3600) / 60
+        remaining_seconds = total % 60
+        return format("%d:%02d:%02d", hours, minutes, remaining_seconds) if hours.positive?
+
+        format("%02d:%02d", minutes, remaining_seconds)
+      end
+
       def release_secrets_configuration_message(reason)
         <<~MSG.strip
           Release secrets provider was requested, but #{reason}.
@@ -1369,6 +1459,7 @@ module Kettle
         sleep(release_availability_probe_initial_delay)
         attempts.times do |index|
           attempt = index + 1
+          emit_release_probe_event(action: "availability", status: "started", candidate: candidate, attempt: attempt, attempts: attempts)
           puts("Validating #{candidate.gem_name} #{candidate.version} from #{RELEASE_VALIDATION_SOURCE} (attempt #{attempt}/#{attempts})")
           stdout_str = nil
           stderr_str = nil
@@ -1377,10 +1468,21 @@ module Kettle
             stdout_str, stderr_str, status = Open3.capture3(self.class.send(:command_env), Gem.ruby, script_path)
           end
           $stdout.print(stdout_str) unless stdout_str.to_s.empty?
-          return true if status.success?
+          if status.success?
+            emit_release_probe_event(action: "availability", status: "ok", candidate: candidate, attempt: attempt, attempts: attempts)
+            return true
+          end
 
           last_stderr = stderr_str
           last_status = status
+          emit_release_probe_event(
+            action: "availability",
+            status: (attempt < attempts) ? "retrying" : "failed",
+            candidate: candidate,
+            attempt: attempt,
+            attempts: attempts,
+            reason: "exit #{status.exitstatus}"
+          )
           sleep(release_availability_probe_interval) if attempt < attempts
         end
 
@@ -1547,6 +1649,7 @@ module Kettle
           name: command_event_name(command),
           status: status,
           reason: reason,
+          summary: command_event_summary(command),
           command: command,
           changed_files: []
         }
@@ -1555,7 +1658,80 @@ module Kettle
       end
 
       def command_event_name(command)
-        command.to_s.split(/\s+/, 3).first(2).join("_").gsub(/[^A-Za-z0-9_]+/, "_").sub(/_+\z/, "")
+        words = Shellwords.split(command.to_s)
+        effective_words = command_event_effective_words(words)
+        joined = effective_words.join(" ")
+
+        return "kettle_changelog" if joined.start_with?("bundle exec kettle-changelog")
+        return "gem_build" if joined == "bundle exec rake build"
+        return "gem_release" if joined == "bundle exec rake release"
+        return "gem_push" if effective_words.first(2) == ["gem", "push"]
+        return "gem_checksums" if effective_words.first == "bin/gem_checksums"
+        return "bundle_lock" if effective_words.first(2) == ["bundle", "lock"]
+        return "bin_setup" if effective_words == ["bin/setup"]
+        return "default_task" if effective_words == ["bin/rake"]
+        return "appraisal_generate" if effective_words == ["bin/rake", "appraisal:generate"]
+        return "appraisal_update" if effective_words == ["bin/rake", "appraisal:update"]
+        return "yard" if effective_words == ["bin/rake", "yard"]
+        return "git_fetch" if effective_words.first(2) == ["git", "fetch"]
+        return "git_pull" if effective_words.first(2) == ["git", "pull"]
+        return "git_rebase" if effective_words.first(2) == ["git", "rebase"]
+        return "git_merge" if effective_words.first(2) == ["git", "merge"]
+        return "git_push" if effective_words.first(2) == ["git", "push"]
+
+        effective_words.first(2).join("_").gsub(/[^A-Za-z0-9_]+/, "_").sub(/_+\z/, "")
+      end
+
+      def command_event_effective_words(words)
+        words = words.dup
+        words.shift while words.first&.match?(/\A[A-Za-z_][A-Za-z0-9_]*=/)
+
+        if words.first == "env"
+          words.shift
+          while words.any?
+            if words.first == "-u"
+              words.shift(2)
+            elsif words.first&.include?("=")
+              words.shift
+            else
+              break
+            end
+          end
+        end
+
+        words
+      end
+
+      def command_event_summary(command)
+        words = Shellwords.split(command.to_s)
+        effective_words = command_event_effective_words(words)
+        joined = effective_words.join(" ")
+
+        return "changelog" if joined.start_with?("bundle exec kettle-changelog")
+        return command_event_bundle_lock_summary(words) if effective_words.first(2) == ["bundle", "lock"]
+        return "setup" if effective_words == ["bin/setup"]
+        return "default task" if effective_words == ["bin/rake"]
+        return "appraisals" if effective_words == ["bin/rake", "appraisal:generate"]
+        return "appraisals" if effective_words == ["bin/rake", "appraisal:update"]
+        return "documentation" if effective_words == ["bin/rake", "yard"]
+        return "build gem" if joined == "bundle exec rake build"
+        return "publish gem" if joined == "bundle exec rake release"
+        return "push gem" if effective_words.first(2) == ["gem", "push"]
+        return "checksums" if effective_words.first == "bin/gem_checksums"
+        return effective_words[2] if effective_words.first(2) == ["git", "fetch"] && effective_words[2]
+        return effective_words[2] if effective_words.first(2) == ["git", "push"] && effective_words[2]
+        return effective_words[2] if effective_words.first(2) == ["git", "pull"] && effective_words[2]
+        return effective_words[2] if effective_words.first(2) == ["git", "rebase"] && effective_words[2]
+        return effective_words[2] if effective_words.first(2) == ["git", "merge"] && effective_words[2]
+
+        nil
+      end
+
+      def command_event_bundle_lock_summary(words)
+        gemfile = words.find { |word| word.start_with?("BUNDLE_GEMFILE=") }&.split("=", 2)&.last
+        return "lockfile" unless gemfile
+
+        File.basename(gemfile)
       end
 
       def record_diagnostic(kind, message, severity:, blocking:)
@@ -1569,6 +1745,120 @@ module Kettle
         Kettle::Ndjson.emit_diagnostic_event(@event_recorder, diagnostic, index: @diagnostics.length)
       end
 
+      def emit_secret_event(payload)
+        status = payload.fetch(:status).to_s
+        mark = case status
+        when "started"
+          ">"
+        when "ok"
+          "."
+        when "failed"
+          "!"
+        else
+          "?"
+        end
+        Kettle::Ndjson.emit_event(
+          @event_recorder,
+          "secret_provider",
+          payload.merge(
+            phase: "release",
+            provider: release_secrets_provider_label,
+            mark: mark
+          )
+        )
+      end
+
+      def emit_remote_parity_event(action:, remote: nil, status: nil, trunk: nil, attempt: nil, attempts: nil, required: nil, reason: nil, remotes: nil)
+        mark = release_progress_mark(status)
+        Kettle::Ndjson.emit_event(
+          @event_recorder,
+          "remote_parity",
+          action: action,
+          phase: "release",
+          remote: remote,
+          status: status,
+          trunk: trunk,
+          attempt: attempt,
+          attempts: attempts,
+          required: required,
+          reason: reason,
+          remotes: remotes,
+          mark: mark
+        )
+      end
+
+      def emit_release_lockfile_event(action:, status:, stage:, attempt: nil, attempts: nil, count: nil, reason: nil)
+        Kettle::Ndjson.emit_event(
+          @event_recorder,
+          "release_lockfile",
+          action: action,
+          phase: "release",
+          status: status,
+          stage: stage,
+          attempt: attempt,
+          attempts: attempts,
+          count: count,
+          reason: reason,
+          mark: release_progress_mark(status)
+        )
+      end
+
+      def emit_release_probe_event(action:, status:, candidate:, attempt:, attempts:, reason: nil)
+        Kettle::Ndjson.emit_event(
+          @event_recorder,
+          "release_probe",
+          action: action,
+          phase: "release",
+          status: status,
+          gem: candidate.gem_name,
+          version: candidate.version,
+          source: RELEASE_VALIDATION_SOURCE,
+          attempt: attempt,
+          attempts: attempts,
+          reason: reason,
+          mark: release_progress_mark(status)
+        )
+      end
+
+      def release_progress_mark(status)
+        case status.to_s
+        when "started"
+          ">"
+        when "ok", "skipped"
+          "."
+        when "failed", "blocked"
+          "!"
+        when "retrying"
+          ">"
+        else
+          ">"
+        end
+      end
+
+      def emit_ci_monitor_event(action:, status:, workflows:, restart_hint:, reason: nil)
+        mark = case status.to_s
+        when "started"
+          ">"
+        when "ok"
+          "."
+        when "failed"
+          "!"
+        else
+          "?"
+        end
+        Kettle::Ndjson.emit_event(
+          @event_recorder,
+          "ci_monitor",
+          action: action,
+          phase: "release",
+          status: status,
+          workflows: workflows,
+          restart_hint: restart_hint,
+          reason: reason,
+          mark: mark
+        )
+      end
+
       def finish_release_report(status:, error:)
         return if @finished_report
 
@@ -1732,6 +2022,10 @@ module Kettle
         @skip_remotes.include?(name)
       end
 
+      def required_remote?(name)
+        @required_remotes.include?(name)
+      end
+
       def active_remotes
         list_remotes.reject { |remote| skipped_remote?(remote) }
       end
@@ -1770,26 +2064,30 @@ module Kettle
         if has_remote?("all")
           remotes = active_remotes
           skipped = list_remotes.select { |remote| skipped_remote?(remote) }
+          required = remotes.select { |remote| required_remote?(remote) }
           puts "Remote 'all' detected. Fetching from active remotes and enforcing strict trunk parity..."
           puts "Skipping configured remotes: #{skipped.join(", ")}" unless skipped.empty?
+          puts "Required release parity remotes: #{required.join(", ")}" unless required.empty?
+          fetched_remotes = []
+          emit_remote_parity_event(action: "start", status: "started", trunk: trunk, remotes: remotes - ["all"])
           remotes.each do |remote|
             next if remote == "all"
 
-            fetch_remote_for_parity!(remote)
+            fetched_remotes << remote if fetch_remote_for_parity!(remote)
           end
           missing_from = []
-          remotes.each do |r|
-            next if r == "all"
-
+          fetched_remotes.each do |r|
             if remote_branch_exists?(r, trunk)
               _ahead, behind = ahead_behind_counts(trunk, "#{r}/#{trunk}")
               missing_from << r if behind.positive?
             end
           end
           unless missing_from.empty?
+            emit_remote_parity_event(action: "missing", status: "failed", trunk: trunk, remotes: missing_from, reason: "missing commits")
             abort("Local #{trunk} is missing commits present on: #{missing_from.join(", ")}. Please sync trunk first.")
           end
-          puts "Local #{trunk} has all commits from remotes: #{(remotes - ["all"]).join(", ")}"
+          puts "Local #{trunk} has all commits from remotes: #{fetched_remotes.join(", ")}"
+          emit_remote_parity_event(action: "ok", status: "ok", trunk: trunk, remotes: fetched_remotes)
           return
         end
 
@@ -1858,8 +2156,10 @@ module Kettle
         attempts.times do |index|
           attempt = index + 1
           puts "Fetching remote '#{remote}' for release parity (attempt #{attempt}/#{attempts})"
+          emit_remote_parity_event(action: "fetch", remote: remote, status: "started", attempt: attempt, attempts: attempts, required: required_remote?(remote))
           begin
             run_cmd!(command)
+            emit_remote_parity_event(action: "fetch", remote: remote, status: "ok", attempt: attempt, attempts: attempts, required: required_remote?(remote))
             return true
           rescue SystemExit => error
             last_error = error
@@ -1869,7 +2169,17 @@ module Kettle
           sleep(remote_fetch_parity_interval) if attempt < attempts
         end
 
-        abort(remote_fetch_failure_message(remote, last_error&.message.to_s))
+        detail = last_error&.message.to_s
+        if required_remote?(remote)
+          emit_remote_parity_event(action: "fetch", remote: remote, status: "failed", attempts: attempts, required: true, reason: detail)
+          abort(remote_fetch_failure_message(remote, detail))
+        end
+
+        message = optional_remote_fetch_failure_message(remote, detail)
+        warn(message)
+        emit_remote_parity_event(action: "skip", remote: remote, status: "skipped", attempts: attempts, required: false, reason: detail)
+        record_diagnostic("release_remote_skipped", message, severity: "warning", blocking: false)
+        false
       end
 
       def remote_fetch_parity_attempts
@@ -1882,7 +2192,7 @@ module Kettle
 
       def remote_fetch_failure_message(remote, detail)
         <<~MSG
-          Unable to fetch git remote '#{remote}' during release parity checks.
+          Unable to fetch required git remote '#{remote}' during release parity checks.
           kettle-release enforces trunk parity across active remotes before publishing.
 
           If this remote is temporarily unavailable or intentionally not part of this release,
@@ -1895,6 +2205,20 @@ module Kettle
         MSG
       end
 
+      def optional_remote_fetch_failure_message(remote, detail)
+        <<~MSG
+          Unable to fetch optional git remote '#{remote}' during release parity checks; skipping this remote for this release.
+          Required remotes still block release parity checks.
+
+          To make this remote block releases, configure:
+            kettle-release --required-remotes #{remote}
+            K_RELEASE_REQUIRED_REMOTES=#{remote} kettle-release
+
+          Original failure:
+          #{detail}
+        MSG
+      end
+
       def merge_feature_into_trunk_and_push!(trunk, feature)
         return if feature.nil? || feature == trunk
 

data/lib/kettle/dev/release_notifier.rb

@@ -0,0 +1,27 @@
+# frozen_string_literal: true
+
+module Kettle
+  module Dev
+    module ReleaseNotifier
+      class << self
+        def alert(message, stream: $stderr)
+          return unless enabled?
+
+          stream.write("\a") if terminal_bell?
+          stream.puts(message)
+          stream.flush if stream.respond_to?(:flush)
+        end
+
+        private
+
+        def enabled?
+          !ENV.fetch("KETTLE_RELEASE_SECRET_ALERT", "true").match?(/\A(?:false|0|no|off|disabled)\z/i)
+        end
+
+        def terminal_bell?
+          !ENV.fetch("KETTLE_RELEASE_SECRET_BELL", "true").match?(/\A(?:false|0|no|off|disabled)\z/i)
+        end
+      end
+    end
+  end
+end

data/lib/kettle/dev/release_secrets.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "open3"
+require "kettle/dev/release_notifier"
 
 module Kettle
   module Dev
@@ -15,6 +16,10 @@ module Kettle
         def rubygems_otp
           nil
         end
+
+        def keepalive!(elapsed: nil)
+          nil
+        end
       end
 
       class OnePassword < Provider
@@ -64,6 +69,14 @@ module Kettle
           run_op(argv, purpose: "RubyGems OTP")
         end
 
+        def keepalive!(elapsed: nil)
+          argv = [op_cli, "account", "get"]
+          account = string_config("account")
+          argv.concat(["--account", account]) unless account.empty?
+          run_op(argv, purpose: "authorization keepalive", elapsed: elapsed)
+          true
+        end
+
         private
 
         attr_reader :config
@@ -99,7 +112,9 @@ module Kettle
           required_config("cli")
         end
 
-        def run_op(argv, purpose:)
+        def run_op(argv, purpose:, elapsed: nil)
+          elapsed_suffix = elapsed.to_s.empty? ? "" : " (elapsed #{elapsed})"
+          Kettle::Dev::ReleaseNotifier.alert("1Password #{purpose} lookup starting#{elapsed_suffix}; watch for authorization prompt.")
           stdout, stderr, status = Open3.capture3(*argv)
           return stdout.to_s.strip if status.success? && !stdout.to_s.strip.empty?