kettle-dev 3.0.16 → 3.0.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 48b3c836485ea5f578606d3a5582aa4877084c04b7c9d8b8a85151d8203288e2
-  data.tar.gz: 229c452a7a514cfad31324d5eacdd5d207efd5624c922c2afc20415cad5434e1
+  metadata.gz: 4dc02c70ec8eb1cdf707e6cbef542a3117258006a83a9f6ac15261388c05b147
+  data.tar.gz: 6c4a8431553b479404d1a3d4264e633fd54e9154fbb305e7f10b80167da53220
 SHA512:
-  metadata.gz: 0526d9339e4f74739f332051beaa8e079d51e7f291754604ade207d25767e3458001501aaed9a84e9887ede43ebfe74125654df94410ce66903ab09cedbee752
-  data.tar.gz: 5301eaf6485588d958c780b0b0378d847cfa85097bf3819441a0139c8752807ade609509aad0ddbe425de46d8b3bfd7fb04f926a6c8d5e83dc9d8fa82193f83a
+  metadata.gz: 0e400e4b0bcfe3019606b4954b91430818ff760f69497dbe5c18a2a9a9f2f82755a496a2773db82c830477eb4e7785344108cb93294224b70dc249c37dc10dae
+  data.tar.gz: 8163c6e8ff99e586bc2085184968509ae28bbb6c547c0189a08c2a48780e6b8260598421a695a089a1e856dd1d82beff34d8122583f21e3762e808daac6f4114

data/CHANGELOG.md

@@ -30,6 +30,38 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.18] - 2026-08-30
+
+- TAG: [v3.0.18][3.0.18t]
+- COVERAGE: 91.58% -- 5852/6390 lines in 47 files
+- BRANCH COVERAGE: 76.21% -- 2243/2943 branches in 47 files
+- 50.97% documented
+
+### Fixed
+
+- Skip volatile contrib.rocks contributor images during pre-release Markdown image validation.
+
+- Prevent temporary Git fixture maintenance from racing with parallel test cleanup.
+
+- Ensure release Git hooks receive nil-valued environment overrides as unset variables on JRuby.
+
+- Prevent temporary Git fixture cleanup from racing with Git auto-maintenance on older Ruby CI.
+
+## [3.0.17] - 2026-08-29
+
+- TAG: [v3.0.17][3.0.17t]
+- COVERAGE: 91.48% -- 5839/6383 lines in 47 files
+- BRANCH COVERAGE: 76.16% -- 2240/2941 branches in 47 files
+- 50.97% documented
+
+### Fixed
+
+- Stage Bundler update lockfiles correctly when releasing a monorepo subgem.
+
+- Bound RubyGems version lookups so release reconciliation cannot wait indefinitely on a live registry request.
+
+- Keep release child commands and commit hooks on the canonical registry-backed lockfile environment.
+
 ## [3.0.16] - 2026-08-28
 
 - TAG: [v3.0.16][3.0.16t]
@@ -3619,7 +3651,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.16...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.18...HEAD
+[3.0.18]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.17...v3.0.18
+[3.0.18t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.18
+[3.0.17]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.16...v3.0.17
+[3.0.17t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.17
 [3.0.16]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.15...v3.0.16
 [3.0.16t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.16
 [3.0.15]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.14...v3.0.15

data/README.md

@@ -503,6 +503,21 @@ What it does:
       removed when the release process exits. `BUNDLE_FROZEN=true` is not a
       substitute because it converts the same reconciliation into a failure
       when Bundler needs to write its resolved lockfile.
+    - Lockfile roles are explicit during a release:
+
+      | Role | Lockfile | Used by |
+      | --- | --- | --- |
+      | Family runner | The family/orchestrator bundle | May resolve local sibling gems to run `kettle-family`; it never becomes the target project's lockfile. |
+      | Canonical release state | Tracked `Gemfile.lock` and, when present, `Appraisal.root.gemfile.lock` | Step 1 Bundler update, steps 3-6 setup/checks/appraisals/docs/prep commit, and step 16 checksums. These commands disable local `*_DEV`/`*_LOCAL` switches. |
+      | Release task state | `tmp/kettle-release/lockfiles/Gemfile-<pid>.lock` | Steps 14-15 build and publish only. It begins as a copy of canonical `Gemfile.lock` and is deleted at process exit. |
+      | Tool state | A tool-owned Gemfile such as `kettle-changelog/gemfiles/release.gemfile` | The tool's own dependencies. The command still disables local dependency switches before it can trigger target-project work. |
+      | Git-hook state | Canonical release environment | Every release-created commit and amend. Hooks remain enabled, but cannot inherit the family runner's local sibling graph. |
+
+      A command must select one of these roles. Do not construct an ad hoc
+      `BUNDLE_GEMFILE`, `BUNDLE_LOCKFILE`, or local-development environment in
+      a release phase. `ReleaseCLI#release_child_command` owns canonical/tool
+      command construction; `ReleaseCLI#release_project_command` selects the
+      disposable task lock only for build and publish.
 - Tips:
     - The commit message helper `exe/kettle-commit-msg` prefers project-local `.git-hooks` (then falls back to `~/.git-hooks`).
     - The goalie file `commit-subjects-goalie.txt` controls when a footer is appended; customize `footer-template.erb.txt` as you like.
@@ -657,7 +672,7 @@ versions that are newer than the latest released version.
     - 3) Validate Markdown references and local heading targets.
     - 4) Validate that all image URLs referenced by Markdown files resolve (HTTP HEAD).
 - Image URL skips:
-    - Star-history image API URLs are skipped by default because they are volatile.
+    - Star-history and contrib.rocks generated image URLs are skipped by default because they are volatile.
     - Unresolved Kettle-Jem template tokens are skipped because they are not URLs until templating completes.
     - Add project-specific shell-style URL patterns in `.kettle-family.yml` or a config path pointed to by `KETTLE_FAMILY_CONFIG`. `kettle-family` passes this path through when it orchestrates a member release, but `kettle-dev` owns the matching and validation:
         ```yaml
@@ -1033,7 +1048,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.367-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.390-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/git_adapter.rb

@@ -71,12 +71,28 @@ module Kettle
         false
       end
 
+      # Stage paths reported by Git commands such as `git diff --name-only`.
+      # Git reports these paths relative to the repository root, even when this
+      # adapter operates from a monorepo subdirectory. `:(top)` keeps the
+      # pathspec rooted at that repository root in either topology.
+      #
+      # @param paths [Array<String>] repository-root-relative paths
+      # @return [Boolean] true when Git stages every path
+      def add_repository_paths(paths)
+        pathspecs = Array(paths).map { |path| ":(top)#{path}" }
+        git_system("add", "--", *pathspecs)
+      rescue => e
+        Kettle::Dev.debug_error(e, __method__)
+        false
+      end
+
       # Commit all staged/tracked changes with a message.
       #
       # @param message [String]
+      # @param env [Hash{String => String, nil}] environment overrides for Git hooks
       # @return [Boolean]
-      def commit_all(message)
-        git_system("commit", "-am", message.to_s)
+      def commit_all(message, env: {})
+        git_system("commit", "-am", message.to_s, env: env)
       rescue => e
         Kettle::Dev.debug_error(e, __method__)
         false
@@ -89,9 +105,10 @@ module Kettle
       # atomic commit.
       #
       # @param message [String]
+      # @param env [Hash{String => String, nil}] environment overrides for Git hooks
       # @return [Boolean]
-      def commit_staged(message)
-        git_system("commit", "-m", message.to_s)
+      def commit_staged(message, env: {})
+        git_system("commit", "-m", message.to_s, env: env)
       rescue => e
         Kettle::Dev.debug_error(e, __method__)
         false
@@ -99,9 +116,10 @@ module Kettle
 
       # Amend the current commit without changing its message.
       #
+      # @param env [Hash{String => String, nil}] environment overrides for Git hooks
       # @return [Boolean]
-      def commit_amend_no_edit
-        git_system("commit", "--amend", "--no-edit")
+      def commit_amend_no_edit(env: {})
+        git_system("commit", "--amend", "--no-edit", env: env)
       rescue => e
         Kettle::Dev.debug_error(e, __method__)
         false
@@ -406,13 +424,31 @@ module Kettle
         end
       end
 
-      def git_system(*args)
+      def git_system(*args, env: {})
+        command = ["git", *args]
+        return system(*command) if env.empty? && @root == Dir.pwd
+        return system(*command, chdir: @root) if env.empty?
+
+        # JRuby 9.2 passes nil-valued entries to child processes as empty
+        # strings. Use POSIX env(1) for those entries so release hooks see an
+        # actually absent Bundler variable on every supported Unix engine.
+        if env.values.any?(&:nil?) && !Gem.win_platform?
+          command = command_with_unset_environment(command, env)
+          env = {}
+        end
+
         if @root == Dir.pwd
-          system("git", *args)
+          system(env, *command)
         else
-          system("git", *args, chdir: @root)
+          system(env, *command, chdir: @root)
         end
       end
+
+      def command_with_unset_environment(command, env)
+        unset_names = env.select { |_name, value| value.nil? }.keys
+        set_values = env.reject { |_name, value| value.nil? }.map { |name, value| "#{name}=#{value}" }
+        ["env", *unset_names.flat_map { |name| ["-u", name] }, *set_values, *command]
+      end
     end
   end
 end

data/lib/kettle/dev/pre_release_cli.rb

@@ -33,7 +33,8 @@ module Kettle
       IMAGE_URL_CACHE_TTL_SECONDS = 7 * 24 * 60 * 60
       DEFAULT_IMAGE_URL_SKIP_PATTERNS = [
         "https://api.star-history.com/svg*",
-        "https://star-history.dera.page/svg*"
+        "https://star-history.dera.page/svg*",
+        "https://contrib.rocks/image*"
       ].freeze
       FAMILY_CONFIG_PATHS = [".kettle-family.yml", ".structuredmerge/kettle-family.yml"].freeze
 

data/lib/kettle/dev/release_cli.rb

@@ -506,7 +506,7 @@ module Kettle
           # Generate checksums for the just-built artifact, commit them, then validate
           version ||= detect_version
           gem_path = checksum_gem_path_for_version!(version)
-          run_cmd!("bin/gem_checksums #{Shellwords.escape(gem_path)}")
+          run_cmd!(release_child_command("bin/gem_checksums #{Shellwords.escape(gem_path)}"))
           validate_checksums!(version, stage: "after release")
         end
 
@@ -802,6 +802,20 @@ module Kettle
         lockfile_reset.normalization_env
       end
 
+      # The release process has three distinct lockfile roles:
+      #
+      # - canonical: tracked project lockfiles, always registry-backed;
+      # - task: a disposable Gemfile.lock copy for build and publication; and
+      # - tool: a tool-owned Gemfile, such as kettle-changelog's release bundle.
+      #
+      # A family may use local sibling gems to launch this process, but no
+      # release child may inherit that graph. Git hooks are release children
+      # too: they commonly load project tooling and otherwise can silently
+      # rewrite the canonical lockfile with local PATH sources.
+      def release_git_hook_environment
+        release_child_environment
+      end
+
       def release_lockfile_diagnostics(path)
         lockfile_reset.diagnostics(path)
       end
@@ -869,7 +883,7 @@ module Kettle
 
         puts "Fallback release lockfile reset result: diagnostics cleared; amending release prep commit with #{paths.length} lockfile(s)."
         abort("Failed to stage reset release lockfiles.") unless @git.add_paths(paths)
-        abort("Failed to amend release prep commit with reset lockfiles.") unless @git.commit_amend_no_edit
+        abort("Failed to amend release prep commit with reset lockfiles.") unless @git.commit_amend_no_edit(env: release_git_hook_environment)
       end
 
       def changed_release_lockfile_paths
@@ -910,18 +924,13 @@ module Kettle
       # of relying on an ambient installed executable.
       def release_changelog_command
         gemfile = release_changelog_gemfile
-        return "bundle exec kettle-changelog" unless gemfile
+        return release_child_command("bundle exec kettle-changelog") unless gemfile
 
-        escaped_gemfile = Shellwords.escape(gemfile)
-        command = +"env -u BUNDLE_GEMFILE -u BUNDLE_LOCKFILE"
+        environment = {"BUNDLE_GEMFILE" => gemfile}
         if (local_root = release_changelog_local_root)
-          # Changelog coverage runs before the release lockfile reset. Keep it
-          # on the registry-backed release graph instead of reintroducing local
-          # sibling paths through the inherited templating switch.
-          command << " KETTLE_DEV_DEV=false K_JEM_TEMPLATING=false KETTLE_CHANGELOG_DEV_ROOT=#{Shellwords.escape(local_root)}"
+          environment["KETTLE_CHANGELOG_DEV_ROOT"] = local_root
         end
-        command << " BUNDLE_GEMFILE=#{escaped_gemfile} bundle exec kettle-changelog"
-        command
+        release_child_command("bundle exec kettle-changelog", environment: environment)
       end
 
       def release_changelog_gemfile
@@ -981,29 +990,44 @@ module Kettle
         release_project_command("bin/setup")
       end
 
-      # Every command that loads the project bundle must run outside the
-      # release tool's bundle and with local workspace dependency switches
-      # disabled. The default task may carry a leading environment assignment,
-      # so relying on BundlerEnvGuard's command classification alone is not
-      # sufficient.
+      # Canonical release commands use the tracked project lockfiles. These
+      # lockfiles are shared state and are normalized/committed before release
+      # prep; they must never contain sibling PATH sources.
       def release_project_command(command)
-        project_command = command
-        unbundled_keys = (BundlerEnvGuard::RESET_ENV_KEYS + %w[RUBYLIB RUBYOPT]).uniq
-        command = +"env #{unbundled_keys.map { |key| "-u #{Shellwords.escape(key)}" }.join(" ")}"
-        release_lockfile_normalization_env.each do |key, value|
-          command << " #{key}=#{Shellwords.escape(value)}"
+        release_child_command(command, lockfile: release_task_command?(command) ? release_task_lockfile_path : nil)
+      end
+
+      def release_task_command?(command)
+        ["bundle exec rake build", "bundle exec rake release"].include?(command.to_s.strip)
+      end
+
+      # Every release child runs outside the release tool's Bundler context and
+      # with local sibling switches disabled. The optional lockfile identifies
+      # a disposable task lockfile; omitting it deliberately selects the
+      # canonical tracked lockfile for setup, checks, docs, and checksums.
+      def release_child_command(command, environment: {}, lockfile: nil)
+        command_body = command
+        command = +"env"
+        release_child_environment.each do |key, value|
+          command << " -u #{Shellwords.escape(key)}" if value.nil?
         end
-        if release_task_command?(project_command)
-          if (lockfile = release_task_lockfile_path)
-            command << " BUNDLE_LOCKFILE=#{Shellwords.escape(lockfile)}"
-          end
+        release_child_environment.each do |key, value|
+          command << " #{key}=#{Shellwords.escape(value)}" unless value.nil?
+        end
+        environment.each do |key, value|
+          command << " #{key}=#{Shellwords.escape(value)}"
         end
-        command << " #{project_command}"
+        command << " BUNDLE_LOCKFILE=#{Shellwords.escape(lockfile)}" if lockfile
+        command << " #{command_body}"
         command
       end
 
-      def release_task_command?(command)
-        ["bundle exec rake build", "bundle exec rake release"].include?(command.to_s.strip)
+      def release_child_environment
+        @release_child_environment ||= begin
+          release_lockfile_normalization_env
+            .merge(BundlerEnvGuard.unbundled_env)
+            .merge("RUBYLIB" => nil, "RUBYOPT" => nil)
+        end
       end
 
       # Bundler may reconcile the current machine's platform while loading a
@@ -1647,8 +1671,8 @@ module Kettle
         end
 
         puts "Committing Bundler update in #{paths.length} lockfile(s)."
-        abort("Failed to stage Bundler update lockfiles.") unless @git.add_paths(paths)
-        abort("Failed to commit Bundler update lockfiles.") unless @git.commit_staged("🔒️ Update bundle")
+        abort("Failed to stage Bundler update lockfiles.") unless @git.add_repository_paths(paths)
+        abort("Failed to commit Bundler update lockfiles.") unless @git.commit_staged("🔒️ Update bundle", env: release_git_hook_environment)
         reconcile_bundle_update_commit!
         true
       end
@@ -1678,8 +1702,8 @@ module Kettle
           return if paths.empty?
 
           puts "Bundler changed lockfiles while committing; amending the bundle update commit."
-          abort("Failed to stage post-commit Bundler lockfile changes.") unless @git.add_paths(paths)
-          abort("Failed to amend the bundle update commit.") unless @git.commit_amend_no_edit
+          abort("Failed to stage post-commit Bundler lockfile changes.") unless @git.add_repository_paths(paths)
+          abort("Failed to amend the bundle update commit.") unless @git.commit_amend_no_edit(env: release_git_hook_environment)
         end
 
         abort("Bundler continued changing lockfiles after the bundle update commit.") unless changed_bundle_lockfile_paths.empty?
@@ -1692,7 +1716,7 @@ module Kettle
 
           puts "Release commit hooks changed tracked files; amending the release preparation commit."
           abort("Failed to stage post-commit release changes.") unless @git.add_all
-          abort("Failed to amend the release preparation commit.") unless @git.commit_amend_no_edit
+          abort("Failed to amend the release preparation commit.") unless @git.commit_amend_no_edit(env: release_git_hook_environment)
         end
 
         output, = git_output(["status", "--porcelain"])
@@ -1994,7 +2018,7 @@ module Kettle
           puts "No changes to commit for release prep (continuing)."
           false
         else
-          abort("Failed to commit release prep changes.") unless @git.commit_all(msg)
+          abort("Failed to commit release prep changes.") unless @git.commit_all(msg, env: release_git_hook_environment)
           reconcile_release_prep_commit!
           true
         end

data/lib/kettle/dev/ruby_gems_versions.rb

@@ -14,6 +14,8 @@ module Kettle
     module RubyGemsVersions
       CACHE_BUST_TTL_SECONDS = 30 * 24 * 60 * 60
       VERSION_CACHE_TTL_SECONDS = 30 * 24 * 60 * 60
+      HTTP_OPEN_TIMEOUT_SECONDS = 5
+      HTTP_READ_TIMEOUT_SECONDS = 10
       ENV_REFRESH = "KETTLE_RUBYGEMS_REFRESH"
       ENV_MARKER_PATH = "KETTLE_RUBYGEMS_CACHE_BUST_PATH"
       ENV_VERSION_CACHE_PATH = "KETTLE_RUBYGEMS_VERSION_CACHE_PATH"
@@ -32,7 +34,13 @@ module Kettle
             request["Cache-Control"] = "no-cache"
             request["Pragma"] = "no-cache"
           end
-          response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http|
+          response = Net::HTTP.start(
+            uri.host,
+            uri.port,
+            use_ssl: uri.scheme == "https",
+            open_timeout: HTTP_OPEN_TIMEOUT_SECONDS,
+            read_timeout: HTTP_READ_TIMEOUT_SECONDS
+          ) do |http|
             http.request(request)
           end
           if response.code.to_i == 404

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.16"
+      VERSION = "3.0.18"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.16
+  version: 3.0.18
 platform: ruby
 authors:
 - Peter H. Boling
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.16
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.16/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.18
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.18/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.16
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.18
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev