kettle-dev 3.0.0 → 3.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c7cdd1aace2e06deda5e6bb04aa3b2e6ef67408f0521c8d0ed6a8fa27fad23be
-  data.tar.gz: e23d202928cd64875dffdb94bb426e0925e2033a7b07ba36b154eba7c83175d8
+  metadata.gz: ac5e19991ef314add0cbb6f8c764a0389df6003ea291e5ea08bb76bf32c2786a
+  data.tar.gz: 894c0f1521ec987771056394037f3aa2108634bea11830c47f630b43b65727e7
 SHA512:
-  metadata.gz: a6c052d533011b2e59762247ee8cb7d8f794e2383720dc7d589beb1643e8086451f5f2922f5b6f77b3d46cebb4f657c07d290ab3c0146e99e2a9196149ce1002
-  data.tar.gz: 6a38aaf07275a14e588d8e03ab35f8c208755a78c5ac222328688fea61eafde8770bd826abedc8ae91742723dcf69ae09b97782a9eec97e75ebeb380422e6ba2
+  metadata.gz: 2bbb2b78730584bfdddbf66664679393ec7c282ea8e24130b01019bc4e61c48da2d4be751d354679c0a76f6ac4ed23a28bfcf60efae081468ffa98cfbe66dfb5
+  data.tar.gz: cc6156801f9ef0b6cd6e39ee614b63729acff1862e83cd4390319a98a6978ef06e148d82c255beb38a0d68a09531e435a4d57c7f315a9e4f4cb1cd929b16edff

data/CHANGELOG.md

@@ -30,6 +30,36 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.2] - 2026-08-10
+
+- TAG: [v3.0.2][3.0.2t]
+- COVERAGE: 91.56% -- 5629/6148 lines in 47 files
+- BRANCH COVERAGE: 76.14% -- 2128/2795 branches in 47 files
+- 51.00% documented
+
+### Fixed
+
+- Stop polling 1Password during release monitoring and support family-owned release secret brokers.
+
+- Allow pre-release GitHub Actions pin validation to use the explicitly requested persistent cache when live TLS access is unavailable.
+
+- Detect locally installed unreleased workspace gems through an unbundled RubyGems probe during release lockfile normalization.
+
+- Isolate standalone kettle-changelog coverage and tests from family release orchestration environment.
+
+## [3.0.1] - 2026-08-10
+
+- TAG: [v3.0.1][3.0.1t]
+- COVERAGE: 91.87% -- 5602/6098 lines in 47 files
+- BRANCH COVERAGE: 76.29% -- 2117/2775 branches in 47 files
+- 50.64% documented
+
+### Fixed
+
+- Run 1Password authorization keepalives through the interactive terminal so release prompts remain visible.
+
+- Re-normalize release lockfiles after release tasks before commit and CI validation.
+
 ## [3.0.0] - 2026-08-09
 
 - TAG: [v3.0.0][3.0.0t]
@@ -3401,7 +3431,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.0...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.2...HEAD
+[3.0.2]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.1...v3.0.2
+[3.0.2t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.2
+[3.0.1]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.0...v3.0.1
+[3.0.1t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.1
 [3.0.0]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.28...v3.0.0
 [3.0.0t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.0
 [2.5.28]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.27...v2.5.28

data/README.md

@@ -1007,7 +1007,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.069-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.148-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-pre-release

@@ -59,6 +59,10 @@ parser = OptionParser.new do |opts|
     puts "  KETTLE_IMAGE_URL_CACHE=/path/to/cache.json  Use a custom cache path"
     puts "  KETTLE_IMAGE_URL_CACHE=false                Disable the image URL cache"
     puts "  KETTLE_IMAGE_URL_CACHE_REFRESH=true         Ignore cached successes and refresh"
+    puts
+    puts "GitHub Actions pin cache:"
+    puts "  Live cache validation is the default and refreshes stale entries from GitHub."
+    puts "  KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE=true  Trust the persistent pin cache without network access"
     exit(0)
   end
 end

data/lib/kettle/dev/interactive_release_command.rb

@@ -1,39 +1,54 @@
 # frozen_string_literal: true
 
 require "open3"
+require "shellwords"
 
 module Kettle
   module Dev
     class InteractiveReleaseCommand
-      def initialize(secrets_provider:, input: $stdin, output: $stdout, error: $stderr, secret_event_handler: nil)
+      def initialize(secrets_provider:, input: $stdin, output: $stdout, error: $stderr, secret_event_handler: nil, forward_stdin: false)
         @secrets_provider = secrets_provider
         @input = input
         @output = output
         @error = error
         @secret_event_handler = secret_event_handler
+        @forward_stdin = forward_stdin
         @gem_signing_passphrase = nil
       end
 
       def call(env, cmd)
-        return call_with_pty(env, cmd) if pty_available?
+        call_argv(env, Shellwords.split(cmd.to_s))
+      end
+
+      def call_argv(env, argv)
+        return call_with_pty(env, argv) if pty_available?
 
-        call_with_open3(env, cmd)
+        call_with_open3(env, argv)
       end
 
       private
 
       attr_reader :secrets_provider, :secret_event_handler
 
-      def call_with_pty(env, cmd)
+      def call_with_pty(env, argv)
         stdout_str = +""
+        prompt_buffer = +""
         status = nil
-        PTY.spawn(env, cmd) do |output, input, pid|
+        PTY.spawn(env, *argv) do |output, input, pid|
           begin
             loop do
-              chunk = output.readpartial(1024)
-              stdout_str << chunk
-              @output.print(chunk)
-              handle_prompt(input, chunk)
+              readers = [output]
+              readers << @input if @forward_stdin && @input.tty?
+              IO.select(readers).first.each do |reader|
+                if reader.equal?(@input)
+                  input.write(@input.readpartial(1024))
+                else
+                  chunk = output.readpartial(1024)
+                  stdout_str << chunk
+                  @output.print(chunk)
+                  prompt_buffer = handle_prompt(input, chunk, prompt_buffer: prompt_buffer)
+                end
+              end
             end
           rescue Errno::EIO
             # PTY raises EIO when the child process exits after closing the slave.
@@ -47,27 +62,33 @@ module Kettle
         [stdout_str, "", status]
       end
 
-      def call_with_open3(env, cmd)
+      def call_with_open3(env, argv)
         stdout_str = +""
         stderr_str = +""
+        prompt_buffer = +""
         status = nil
-        Open3.popen3(env, cmd) do |input, output, error, wait_thread|
+        Open3.popen3(env, *argv) do |input, output, error, wait_thread|
           readers = [output, error]
+          readers << @input if @forward_stdin && @input.tty?
           until readers.empty?
             ready = IO.select(readers)
             ready.first.each do |reader|
-              begin
-                chunk = reader.readpartial(1024)
-                if reader.equal?(output)
-                  stdout_str << chunk
-                  @output.print(chunk)
-                else
-                  stderr_str << chunk
-                  @error.print(chunk)
+              if reader.equal?(@input)
+                input.write(@input.readpartial(1024))
+              else
+                begin
+                  chunk = reader.readpartial(1024)
+                  if reader.equal?(output)
+                    stdout_str << chunk
+                    @output.print(chunk)
+                  else
+                    stderr_str << chunk
+                    @error.print(chunk)
+                  end
+                  prompt_buffer = handle_prompt(input, chunk, prompt_buffer: prompt_buffer)
+                rescue EOFError
+                  readers.delete(reader)
                 end
-                handle_prompt(input, chunk)
-              rescue EOFError
-                readers.delete(reader)
               end
             end
           end
@@ -76,13 +97,21 @@ module Kettle
         [stdout_str, stderr_str, status]
       end
 
-      def handle_prompt(input, chunk)
-        if otp_prompt?(chunk)
-          write_secret(input, label: "RubyGems MFA code", source: "rubygems_otp") { secrets_provider.rubygems_otp } if otp_response_prompt?(chunk)
-          return
+      def handle_prompt(input, chunk, prompt_buffer: nil)
+        prompt_buffer = prompt_buffer.to_s.dup
+        prompt_buffer << chunk.to_s
+        prompt_buffer = prompt_buffer.byteslice([prompt_buffer.bytesize - 4096, 0].max, 4096).to_s
+
+        if otp_prompt?(prompt_buffer)
+          if otp_response_prompt?(prompt_buffer)
+            write_secret(input, label: "RubyGems MFA code", source: "rubygems_otp") { secrets_provider.rubygems_otp }
+            return +""
+          end
+          return prompt_buffer
         end
 
-        write_secret(input, label: "gem signing passphrase", source: "gem_signing_passphrase") { gem_signing_passphrase } if signing_password_prompt?(chunk)
+        write_secret(input, label: "gem signing passphrase", source: "gem_signing_passphrase") { gem_signing_passphrase } if signing_password_prompt?(prompt_buffer)
+        prompt_buffer
       end
 
       def gem_signing_passphrase

data/lib/kettle/dev/lockfile_reset.rb

@@ -3,6 +3,7 @@
 require "set"
 require "shellwords"
 require "fileutils"
+require "open3"
 require "bundler"
 
 require_relative "bundler_env_guard"
@@ -418,12 +419,26 @@ module Kettle
       end
 
       def locally_installed?(name, version)
-        Gem::Specification.reset
-        Gem::Specification.find_all_by_name(name, "= #{version}").any?
-      rescue
+        _stdout, _stderr, status = Open3.capture3(
+          unbundled_env,
+          "gem",
+          "specification",
+          name,
+          "--version",
+          version.to_s,
+          "--local"
+        )
+        status.success?
+      rescue SystemCallError
         false
       end
 
+      def unbundled_env
+        UNBUNDLED_ENV_KEYS.each_with_object({}) do |key, env|
+          env[key] = nil
+        end
+      end
+
       def gem_source_version_available?(name, version, source_urls)
         urls = Array(source_urls).compact.uniq
         return false if urls.empty?

data/lib/kettle/dev/pre_release_cli.rb

@@ -316,8 +316,12 @@ module Kettle
       # Check 1: Ensure GitHub Actions workflow action refs are current SHA pins.
       # @return [void]
       def check_github_actions_sha_pins!
-        puts "[kettle-pre-release] Check 1: Validate GitHub Actions SHA pins"
-        status = Kettle::Dev::GhaShaPinsCLI.new(["--root", Dir.pwd, "--check", "--upgrade", "major"]).run!
+        offline = env_truthy?(ENV["KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE"])
+        mode = offline ? "offline cache" : "live cache validation"
+        puts "[kettle-pre-release] Check 1: Validate GitHub Actions SHA pins (#{mode})"
+        args = ["--root", Dir.pwd, "--check", "--upgrade", "major"]
+        args << "--offline" if offline
+        status = Kettle::Dev::GhaShaPinsCLI.new(args).run!
         return nil if status.zero?
 
         Kettle::Dev::ExitAdapter.abort("GitHub Actions SHA pin validation failed")

data/lib/kettle/dev/release_cli.rb

@@ -46,6 +46,23 @@ module Kettle
         "BUNDLE_SILENCE_ROOT_WARNING" => "true",
         "BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES" => "true"
       }.freeze
+      RELEASE_CHILD_ENV_KEYS = %w[
+        K_RELEASE_CI_CONTINUE
+        K_RELEASE_REQUIRED_REMOTES
+        KETTLE_FAMILY_CONFIG
+        KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE
+        KETTLE_RELEASE_SECRETS_PROVIDER
+        KETTLE_RELEASE_SECRETS_BROKER
+        KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE
+        KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE_SOURCE
+        KETTLE_RELEASE_1PASSWORD_ACCOUNT
+        KETTLE_RELEASE_1PASSWORD_CLI
+        KETTLE_RELEASE_1PASSWORD_ITEM
+        KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_FIELD
+        KETTLE_RELEASE_1PASSWORD_RUBYGEMS_OTP_FIELD
+        KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_REFERENCE
+        KETTLE_RELEASE_1PASSWORD_RUBYGEMS_OTP_REFERENCE
+      ].freeze
       DEBUG_TRUE_VALUES = %w[1 true yes on].freeze
       RELEASE_VALIDATION_SOURCE = "https://gem.coop"
 
@@ -110,7 +127,9 @@ module Kettle
           env_hash = command_env
           return env_hash unless project_bundle_command?(cmd)
 
-          env_hash.merge(BundlerEnvGuard.unbundled_env)
+          env_hash.merge(BundlerEnvGuard.unbundled_env).merge(
+            RELEASE_CHILD_ENV_KEYS.each_with_object({}) { |key, env| env[key] = nil }
+          )
         end
 
         def project_bundle_command?(cmd)
@@ -622,7 +641,10 @@ module Kettle
       end
 
       def prepare_release_lockfiles_for_commit!
-        reset_release_lockfiles!(stage: "before release prep commit") unless @release_lockfiles_reset_for_release_tasks
+        # Release setup and documentation tasks can re-materialize local PATH
+        # sources in the parent development bundle after the preflight reset.
+        # Always normalize again at the commit boundary.
+        reset_release_lockfiles!(stage: "before release prep commit")
         validate_release_lockfiles!(stage: "before release prep commit")
       end
 
@@ -1167,7 +1189,7 @@ module Kettle
           Kettle::Dev::CIMonitor.monitor_all!(
             restart_hint: restart_hint,
             workflows: @ci_workflows,
-            keepalive: release_secrets_configured? ? -> { keep_release_secrets_alive!("CI monitoring") } : nil,
+            keepalive: release_secrets_keepalive_required? ? -> { keep_release_secrets_alive!("CI monitoring") } : nil,
             event_recorder: @event_recorder
           )
           emit_ci_monitor_event(action: "finish", status: "ok", workflows: @ci_workflows, restart_hint: restart_hint)
@@ -1365,7 +1387,7 @@ module Kettle
       end
 
       def keep_release_secrets_alive!(purpose)
-        return unless release_secrets_configured?
+        return unless release_secrets_keepalive_required?
         return unless @secrets_provider.respond_to?(:keepalive!)
 
         emit_secret_event(action: "keepalive", status: "started", purpose: purpose, source: release_secrets_provider_label, elapsed: release_elapsed_label)
@@ -1376,6 +1398,16 @@ module Kettle
         abort("Release secrets provider keepalive failed before #{purpose}: #{error.message}")
       end
 
+      def release_secrets_keepalive_required?
+        return false unless release_secrets_configured?
+        if @secrets_provider.respond_to?(:keepalive_required?)
+          configured = @secrets_provider.keepalive_required?
+          return configured unless configured.nil?
+        end
+
+        true
+      end
+
       def release_elapsed_label
         return nil unless @started_at
 

data/lib/kettle/dev/release_secrets.rb

@@ -1,6 +1,9 @@
 # frozen_string_literal: true
 
 require "open3"
+require "json"
+require "socket"
+require "kettle/dev/interactive_release_command"
 require "kettle/dev/release_notifier"
 
 module Kettle
@@ -9,6 +12,10 @@ module Kettle
 
     module ReleaseSecrets
       class Provider
+        def keepalive_required?
+          true
+        end
+
         def gem_signing_passphrase
           nil
         end
@@ -22,6 +29,63 @@ module Kettle
         end
       end
 
+      # Secret provider used by a family-owned release broker. The broker keeps
+      # all 1Password lookups in the family process; member release processes
+      # never authenticate independently.
+      class BrokerClient < Provider
+        def initialize(endpoint)
+          @endpoint = endpoint.to_s
+          raise Kettle::Dev::Error, "release secrets broker endpoint is required" if @endpoint.empty?
+        end
+
+        def gem_signing_passphrase
+          return cached_gem_signing_passphrase if cached_gem_signing_passphrase?
+
+          request("gem_signing_passphrase")
+        end
+
+        def rubygems_otp
+          request("rubygems_otp")
+        end
+
+        # A family broker owns authorization. Polling must never start a new
+        # authentication lookup in the member process.
+        def keepalive!(elapsed: nil)
+          true
+        end
+
+        def keepalive_required?
+          false
+        end
+
+        private
+
+        def cached_gem_signing_passphrase?
+          %w[cached family kettle-family].include?(ENV.fetch("KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE_SOURCE", "").downcase)
+        end
+
+        def cached_gem_signing_passphrase
+          value = ENV.fetch("KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE", "").to_s
+          raise Kettle::Dev::Error, "cached gem signing passphrase was requested but KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE is empty" if value.empty?
+
+          value
+        end
+
+        def request(operation)
+          socket = UNIXSocket.new(@endpoint)
+          socket.write(JSON.generate("operation" => operation))
+          socket.write("\n")
+          response = JSON.parse(socket.gets.to_s)
+          return response.fetch("value").to_s if response["ok"]
+
+          raise Kettle::Dev::Error, response.fetch("error", "release secrets broker request failed")
+        rescue Errno::ENOENT, Errno::ECONNREFUSED => error
+          raise Kettle::Dev::Error, "release secrets broker is unavailable: #{error.message}"
+        ensure
+          socket&.close
+        end
+      end
+
       class OnePassword < Provider
         PROVIDER_NAMES = %w[1password onepassword op].freeze
         DEFAULTS = {
@@ -70,13 +134,16 @@ module Kettle
         end
 
         def keepalive!(elapsed: nil)
-          argv = [op_cli, "account", "get"]
-          account = string_config("account")
-          argv.concat(["--account", account]) unless account.empty?
-          run_op(argv, purpose: "authorization keepalive", elapsed: elapsed)
+          # 1Password CLI authentication is session-scoped. Starting a fresh
+          # `op account get` for every release poll does not keep it alive; it
+          # only creates repeated authorization prompts and noise.
           true
         end
 
+        def keepalive_required?
+          false
+        end
+
         private
 
         attr_reader :config
@@ -112,9 +179,11 @@ module Kettle
           required_config("cli")
         end
 
-        def run_op(argv, purpose:, elapsed: nil)
+        def run_op(argv, purpose:, elapsed: nil, interactive: false)
           elapsed_suffix = elapsed.to_s.empty? ? "" : " (elapsed #{elapsed})"
           Kettle::Dev::ReleaseNotifier.alert("1Password #{purpose} lookup starting#{elapsed_suffix}; watch for authorization prompt.")
+          return run_interactive_op(argv, purpose: purpose) if interactive
+
           stdout, stderr, status = Open3.capture3(*argv)
           return stdout.to_s.strip if status.success? && !stdout.to_s.strip.empty?
 
@@ -125,6 +194,23 @@ module Kettle
           raise Kettle::Dev::Error, "1Password CLI executable #{argv.first.inspect} was not found"
         end
 
+        def run_interactive_op(argv, purpose:)
+          _stdout, stderr, status = Kettle::Dev::InteractiveReleaseCommand.new(
+            secrets_provider: Provider.new,
+            input: $stdin,
+            output: $stdout,
+            error: $stderr,
+            forward_stdin: true
+          ).call_argv({}, argv)
+          return if status.success?
+
+          details = stderr.to_s.strip
+          details = "op exited #{status.exitstatus}" if details.empty?
+          raise Kettle::Dev::Error, "1Password #{purpose} lookup failed: #{details}"
+        rescue Errno::ENOENT
+          raise Kettle::Dev::Error, "1Password CLI executable #{argv.first.inspect} was not found"
+        end
+
         def required_config(key)
           value = string_config(key)
           raise Kettle::Dev::Error, "1Password release secrets require #{key}" if value.empty?
@@ -157,6 +243,10 @@ module Kettle
             provider_name.to_s
           end
           return Provider.new if name.empty? || name == "interactive"
+          if %w[family broker].include?(name.downcase)
+            endpoint = configured.fetch("endpoint", ENV.fetch("KETTLE_RELEASE_SECRETS_BROKER", ""))
+            return BrokerClient.new(endpoint)
+          end
           return OnePassword.new(env_config.merge(configured)) if OnePassword.configured?(name)
 
           raise Kettle::Dev::Error, "unsupported release secrets provider #{name.inspect}"

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.0"
+      VERSION = "3.0.2"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.0
+  version: 3.0.2
 platform: ruby
 authors:
 - Peter H. Boling
@@ -60,7 +60,7 @@ dependencies:
         version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.3.10
+        version: 0.3.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -70,7 +70,7 @@ dependencies:
         version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.3.10
+        version: 0.3.11
 - !ruby/object:Gem::Dependency
   name: kettle-ndjson
   requirement: !ruby/object:Gem::Requirement
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.0
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.0/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.2
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.2/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.0
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.2
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev