kettle-dev 3.0.18 → 3.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4dc02c70ec8eb1cdf707e6cbef542a3117258006a83a9f6ac15261388c05b147
-  data.tar.gz: 6c4a8431553b479404d1a3d4264e633fd54e9154fbb305e7f10b80167da53220
+  metadata.gz: 20e87802965f21d08fce4a1bb8eaab16a950611e67268f55284610c9e7601d6a
+  data.tar.gz: 26d1ac30a1bba63404ec8463290e20effd4039393c179842e61cf98ed5e89760
 SHA512:
-  metadata.gz: 0e400e4b0bcfe3019606b4954b91430818ff760f69497dbe5c18a2a9a9f2f82755a496a2773db82c830477eb4e7785344108cb93294224b70dc249c37dc10dae
-  data.tar.gz: 8163c6e8ff99e586bc2085184968509ae28bbb6c547c0189a08c2a48780e6b8260598421a695a089a1e856dd1d82beff34d8122583f21e3762e808daac6f4114
+  metadata.gz: d6d0157c9bd6b22580c9c4304ed9ec0d2a87f55d8e8afe33cf4e81e14a3905f979e30397143047979bfed0c795b321acfaa9739988c9fb6f8546c1e45ceffa17
+  data.tar.gz: cf6a29d466ad157170224b8aca7cb9569e2de56711825487d18f8e68ef3ca5e5d546b215d2b00d34d9e9dbe49d49e2a326c37883b9eab66cc0835f97420732c0

checksums.yaml.gz.sig

@@ -1,5 +1 @@
-/��i�|��,(۪[�r9�n�N-ƨs�$S�*x-�M��s�sK⏭#f�x�����T�8
-i��$7�(^�a��YM�o
-;�6���x����2ĕ��{-�mM��df��S���x%nSt���ݓ�%�=f�O5l�=�w\D�THw%�����
-�k�$7�sЛϸ���wjʞu���8���,��4��T�G��5�m���L��ëV�4?�3.V���0��}ב��_�Y��rM�v]��<�%��%�§:q/��^�)����<��@̎�ڧ�Nټu��������D�s��侊B���Mo������zĉ=$���ט��)F%@��g�j
-s}`Z{�J��
+,8����ۆ����n�tр���aV�8�^�*¼zo�:t�`�m$'���c@

data/CHANGELOG.md

@@ -30,6 +30,32 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.20] - 2026-08-30
+
+- TAG: [v3.0.20][3.0.20t]
+- COVERAGE: 91.44% -- 5875/6425 lines in 47 files
+- BRANCH COVERAGE: 76.07% -- 2248/2955 branches in 47 files
+- 50.47% documented
+
+### Fixed
+
+- Preserve configured monorepo member-path lockfiles during release while rejecting unapproved local paths.
+
+## [3.0.19] - 2026-08-30
+
+- TAG: [v3.0.19][3.0.19t]
+- COVERAGE: 91.50% -- 5855/6399 lines in 47 files
+- BRANCH COVERAGE: 76.21% -- 2249/2951 branches in 47 files
+- 50.97% documented
+
+### Fixed
+
+- Run changelog coverage with the disposable release lockfile so host platform reconciliation cannot dirty a release.
+
+- Normalize release lockfiles before changelog coverage runs.
+
+- Isolate changelog coverage with the selected coverage Gemfile lockfile during release.
+
 ## [3.0.18] - 2026-08-30
 
 - TAG: [v3.0.18][3.0.18t]
@@ -3651,7 +3677,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.18...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.20...HEAD
+[3.0.20]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.19...v3.0.20
+[3.0.20t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.20
+[3.0.19]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.18...v3.0.19
+[3.0.19t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.19
 [3.0.18]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.17...v3.0.18
 [3.0.18t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.18
 [3.0.17]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.16...v3.0.17

data/README.md

@@ -508,7 +508,7 @@ What it does:
       | Role | Lockfile | Used by |
       | --- | --- | --- |
       | Family runner | The family/orchestrator bundle | May resolve local sibling gems to run `kettle-family`; it never becomes the target project's lockfile. |
-      | Canonical release state | Tracked `Gemfile.lock` and, when present, `Appraisal.root.gemfile.lock` | Step 1 Bundler update, steps 3-6 setup/checks/appraisals/docs/prep commit, and step 16 checksums. These commands disable local `*_DEV`/`*_LOCAL` switches. |
+      | Canonical release state | Tracked `Gemfile.lock` and, when present, `Appraisal.root.gemfile.lock` | Step 1 Bundler update, steps 3-6 setup/checks/appraisals/docs/prep commit, and step 16 checksums. These commands disable local `*_DEV`/`*_LOCAL` switches, except a narrow member-root policy supplied by `kettle-family` for an explicit monorepo. |
       | Release task state | `tmp/kettle-release/lockfiles/Gemfile-<pid>.lock` | Steps 14-15 build and publish only. It begins as a copy of canonical `Gemfile.lock` and is deleted at process exit. |
       | Tool state | A tool-owned Gemfile such as `kettle-changelog/gemfiles/release.gemfile` | The tool's own dependencies. The command still disables local dependency switches before it can trigger target-project work. |
       | Git-hook state | Canonical release environment | Every release-created commit and amend. Hooks remain enabled, but cannot inherit the family runner's local sibling graph. |
@@ -518,6 +518,14 @@ What it does:
       a release phase. `ReleaseCLI#release_child_command` owns canonical/tool
       command construction; `ReleaseCLI#release_project_command` selects the
       disposable task lock only for build and publish.
+
+      The monorepo exception is intentionally narrow. `kettle-family` derives
+      it only from `family.mode: monorepo` and its configured members root, then
+      passes the allowed root and activating environment name to
+      `kettle-release`. A sibling Kettle Dev checkout is not covered: normal
+      releases must use the released `kettle-family`, `kettle-changelog`, and
+      other Kettle dependencies. Local Kettle Dev integration is an explicit
+      development opt-in, never a canonical release-lock default.
 - Tips:
     - The commit message helper `exe/kettle-commit-msg` prefers project-local `.git-hooks` (then falls back to `~/.git-hooks`).
     - The goalie file `commit-subjects-goalie.txt` controls when a footer is appended; customize `footer-template.erb.txt` as you like.
@@ -1048,7 +1056,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.390-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.425-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -21,6 +21,8 @@ module Kettle
         "GALTZO_FLOSS_DEV" => "false",
         "UR_BRAIN_DEV" => "false"
       }.freeze
+      ALLOWED_LOCAL_PATH_ROOTS_ENV = "KETTLE_RELEASE_ALLOWED_LOCAL_PATH_ROOTS"
+      ALLOWED_LOCAL_PATH_ENVS_ENV = "KETTLE_RELEASE_ALLOWED_LOCAL_PATH_ENVS"
       RELEASE_LOCKFILES_TARGET = "release-lockfiles"
       SUPPORTED_TARGETS = ["Gemfile.lock", "Appraisal.root.gemfile.lock", RELEASE_LOCKFILES_TARGET].freeze
       UNBUNDLED_ENV_KEYS = (BundlerEnvGuard::RESET_ENV_KEYS + %w[
@@ -110,12 +112,18 @@ module Kettle
         @root = root
         @command_runner = command_runner
         @release_platforms = {}
+        @allowed_local_path_roots = configured_allowed_local_path_roots
+        @allowed_local_path_env_names = configured_allowed_local_path_env_names
       end
 
       def reset(target, skip_changelog_dependency: false)
         BundlerEnvGuard.warn_unexpected_env!
         paths = lockfile_paths_for(target)
-        force_full_update = release_lockfiles_target?(target)
+        # A monorepo lockfile may deliberately use paths rooted in the
+        # repository's members directory. Keep that valid development graph;
+        # only rebuild when an unapproved path or other diagnostic remains.
+        force_full_update = release_lockfiles_target?(target) &&
+          (allowed_local_path_roots.empty? || paths.any? { |path| normalization_needed?(path) })
         platforms = release_platforms_for(paths) if force_full_update
         uninstall_unreleased_local_gems(paths) if force_full_update
         paths.each do |path|
@@ -251,7 +259,7 @@ module Kettle
 
       def diagnostics(path)
         diagnostics = []
-        local_path_remote_lines(path).each do |line_number|
+        disallowed_local_path_remote_lines(path).each do |line_number|
           diagnostics << "#{display_path(path)} has local path remote at line #{line_number}"
         end
         empty_registry_checksums(path).each do |name, version, line_number|
@@ -308,13 +316,16 @@ module Kettle
       end
 
       def normalization_env
-        DEFAULT_DISABLED_ENV.merge(dynamic_local_path_env)
+        DEFAULT_DISABLED_ENV
+          .reject { |name, _| allowed_local_path_env_names.include?(name) }
+          .merge(dynamic_local_path_env)
       end
 
       def dynamic_local_path_env
         ENV.each_with_object({}) do |(key, value), env|
           next unless key.end_with?("_DEV", "_LOCAL")
           next unless local_path_env_value?(value)
+          next if allowed_local_path_env_names.include?(key)
 
           env[key] = "false"
         end
@@ -329,13 +340,49 @@ module Kettle
       end
 
       def has_local_path_remote?(path)
-        !local_path_remote_lines(path).empty?
+        !disallowed_local_path_remote_lines(path).empty?
       end
 
       def local_path_remote_lines(path)
         self.class.local_path_remote_lines_from_source(File.read(path))
       end
 
+      attr_reader :allowed_local_path_roots, :allowed_local_path_env_names
+
+      def disallowed_local_path_remote_lines(path)
+        local_path_remote_lines(path).reject do |line_number|
+          allowed_local_path?(local_path_remote_at(path, line_number))
+        end
+      end
+
+      def configured_allowed_local_path_roots
+        ENV.fetch(ALLOWED_LOCAL_PATH_ROOTS_ENV, "").split(File::PATH_SEPARATOR).filter_map do |value|
+          next if value.strip.empty?
+
+          canonical_path(value)
+        end.uniq
+      end
+
+      def configured_allowed_local_path_env_names
+        ENV.fetch(ALLOWED_LOCAL_PATH_ENVS_ENV, "").split(",").map(&:strip).reject(&:empty?).uniq
+      end
+
+      def local_path_remote_at(path, line_number)
+        File.readlines(path)[line_number - 1].to_s.split("remote:", 2).last.to_s.strip
+      end
+
+      def allowed_local_path?(path)
+        remote = canonical_path(path)
+        allowed_local_path_roots.any? { |root| remote == root || remote.start_with?("#{root}/") }
+      end
+
+      def canonical_path(path)
+        expanded = File.expand_path(path, root)
+        File.realpath(expanded)
+      rescue Errno::ENOENT
+        expanded
+      end
+
       def empty_registry_checksums(path)
         non_registry_gems = non_registry_source_gems(path) | path_dependency_gems(path)
         in_checksums = false

data/lib/kettle/dev/release_cli.rb

@@ -218,7 +218,7 @@ module Kettle
         @started_at = nil
         @finished_report = nil
         @changelog_generated_coverage = false
-        @release_task_lockfile_path = nil
+        @release_task_lockfile_paths = {}
       end
 
       def run
@@ -251,6 +251,11 @@ module Kettle
       attr_reader :finished_report
 
       def run_with_release_environment
+        # Changelog generation at step 0 runs the target project's test bundle
+        # to collect coverage. Normalize its canonical release lockfile before
+        # that subprocess starts; otherwise a local development PATH lock can
+        # force Bundler to resolve an invalid mixed local/released graph.
+        prepare_release_lockfiles_for_release_tasks! if release_lockfile_preflight_needed?
         run_pre_release_checks! if run_step?(0)
 
         # 1. Ensure Bundler version and record its current release in the
@@ -357,7 +362,6 @@ module Kettle
         end
 
         prepare_rubocop_lts_local_branch! if rubocop_lts_release_preflight_needed?
-        prepare_release_lockfiles_for_release_tasks! if release_lockfile_preflight_needed?
 
         # 3. bin/setup
         run_cmd!(release_setup_command) if run_step?(3)
@@ -602,7 +606,10 @@ module Kettle
       end
 
       def release_lockfile_preflight_needed?
-        (3..5).any? { |step| run_step?(step) }
+        # Step 0 invokes kettle-changelog, which runs `bundle exec kettle-test`
+        # for fresh coverage. It therefore needs the same registry-backed
+        # release lockfile as later setup, task, and documentation steps.
+        run_step?(0) || (3..5).any? { |step| run_step?(step) }
       end
 
       def prepare_rubocop_lts_local_branch!
@@ -927,6 +934,14 @@ module Kettle
         return release_child_command("bundle exec kettle-changelog") unless gemfile
 
         environment = {"BUNDLE_GEMFILE" => gemfile}
+        coverage_gemfile = changelog_coverage_gemfile
+        environment["K_CHANGELOG_COVERAGE_GEMFILE"] = coverage_gemfile if coverage_gemfile
+        # Changelog coverage runs the target project's bundle. Give that nested
+        # invocation a disposable lockfile for its selected coverage Gemfile so
+        # Bundler's host-platform reconciliation cannot dirty the prep commit.
+        if (lockfile = release_task_lockfile_path(gemfile: coverage_gemfile || File.join(@root, "Gemfile")))
+          environment["KETTLE_CHANGELOG_COVERAGE_LOCKFILE"] = lockfile
+        end
         if (local_root = release_changelog_local_root)
           environment["KETTLE_CHANGELOG_DEV_ROOT"] = local_root
         end
@@ -960,6 +975,18 @@ module Kettle
         File.expand_path(local_root)
       end
 
+      # A generated coverage appraisal is intentionally smaller than the root
+      # development bundle and therefore avoids release-only tool dependency
+      # conflicts. Let kettle-changelog retain the root-Gemfile fallback when
+      # a project has not generated this optional bundle.
+      def changelog_coverage_gemfile
+        configured = ENV["K_CHANGELOG_COVERAGE_GEMFILE"].to_s.strip
+        return File.expand_path(configured, @root) unless configured.empty?
+
+        generated = File.join(@root, "gemfiles", "coverage.gemfile")
+        generated if File.file?(generated)
+      end
+
       # Monorepo subprojects commonly disable their local hard coverage gate
       # because their narrow test suite cannot satisfy the aggregate root
       # thresholds. Preserve an explicit changelog policy, otherwise derive
@@ -1036,26 +1063,26 @@ module Kettle
       # bundler/gem_tasks' release:guard_clean check. Keep that reconciliation
       # in a disposable lockfile so the committed, normalized lockfile remains
       # unchanged throughout build and publication.
-      def release_task_lockfile_path
-        return @release_task_lockfile_path if @release_task_lockfile_path
+      def release_task_lockfile_path(gemfile: File.join(@root, "Gemfile"))
+        return @release_task_lockfile_paths[gemfile] if @release_task_lockfile_paths.key?(gemfile)
 
-        source = File.join(@root, "Gemfile.lock")
+        source = "#{gemfile}.lock"
         return unless File.file?(source)
 
         directory = File.join(@root, "tmp", "kettle-release", "lockfiles")
         FileUtils.mkdir_p(directory)
-        @release_task_lockfile_path = File.join(directory, "Gemfile-#{$$}.lock")
-        FileUtils.cp(source, @release_task_lockfile_path)
-        @release_task_lockfile_path
+        path = File.join(directory, "#{File.basename(gemfile)}-#{$$}.lock")
+        FileUtils.cp(source, path)
+        @release_task_lockfile_paths[gemfile] = path
       rescue SystemCallError => error
         abort("Unable to isolate the release task lockfile: #{error.message}")
       end
 
       def cleanup_release_task_lockfile!
-        return unless @release_task_lockfile_path
+        return if @release_task_lockfile_paths.empty?
 
-        FileUtils.rm_f(@release_task_lockfile_path)
-        @release_task_lockfile_path = nil
+        @release_task_lockfile_paths.each_value { |path| FileUtils.rm_f(path) }
+        @release_task_lockfile_paths.clear
       end
 
       def confirm_yes!(message, prompt, abort_message)

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.18"
+      VERSION = "3.0.20"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.18
+  version: 3.0.20
 platform: ruby
 authors:
 - Peter H. Boling
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.18
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.18/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.20
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.20/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.18
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.20
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev