kettle-dev 3.0.23 → 3.0.24

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b985d06999d067d64979c99918110a0203d706c53392e498ab667126e9388d68
-  data.tar.gz: 73b20adeb029d70f67152d6ae8ee4377629c846c851ac1a6c484fc2ff6add583
+  metadata.gz: d210f4626dc19b866996b80ae87c61627e94a7b5c5844262f7b6178fbbacf056
+  data.tar.gz: d4d1775405e309dc934d5258cb9ca9fc0503047188f19c5c04e0e878e172216c
 SHA512:
-  metadata.gz: 4af9b35a01651eb7eab623ea2f7d1a2829fee953467fd92f3fe27886333dc417397ddb430485b74dc1413d2aeb5553d840636fef9cab83425f32eaccd283ce99
-  data.tar.gz: 8d73396e1a95de0eac8a19ec6625830779505144d9dc7bb4852de362e9f3f83bcbc2190b221b971687459e6b7e2b2a3aa7c6453b71e87479a4b14d5ec805d2e1
+  metadata.gz: bc3c91ff5678b13f405174b3400aa45cd6d1536e844ec4180762d44455b30e7fc72bd0ca0fcf6d1c07c911ab9a2c02e7593da9b71126efa7f1d4b1f5977fbeb2
+  data.tar.gz: f725c2f04abcc0b1c3127d9bc86dac6e853aabdcd85a026819fc18dee8246f2ab614d4089588aeb89bca8713c2f589cde03394e0939d806fc5d897ae4335fd18

data/CHANGELOG.md

@@ -30,6 +30,21 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.24] - 2026-08-31
+
+- TAG: [v3.0.24][3.0.24t]
+- COVERAGE: 91.38% -- 5934/6494 lines in 47 files
+- BRANCH COVERAGE: 75.98% -- 2271/2989 branches in 47 files
+- 50.47% documented
+
+### Fixed
+
+- Keep Gemfile bootstrap dependencies available while resetting explicitly allowed monorepo release lockfiles.
+
+- Keep installed Gemfile bootstrap dependencies available for every release lockfile reset.
+
+- Emit explicit logical release resume-step metadata instead of relying on command-event ordering.
+
 ## [3.0.23] - 2026-08-30
 
 - TAG: [v3.0.23][3.0.23t]
@@ -3710,7 +3725,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.23...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.24...HEAD
+[3.0.24]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.23...v3.0.24
+[3.0.24t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.24
 [3.0.23]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.22...v3.0.23
 [3.0.23t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.23
 [3.0.22]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.21...v3.0.22

data/README.md

@@ -467,6 +467,14 @@ What it does:
       variables, known local-template toggles, and writes checksums while
       updating path-sourced and checksum-gap gems back to released registry
       versions.
+    - Gemfile bootstrap dependencies are separate from dependency resolution.
+      A generated Gemfile can require `nomono/bundler` while it is being
+      evaluated, before Bundler has resolved its declared `nomono` gem.
+      `kettle-reset` detects that literal bootstrap require and installs the
+      locked registry version of `nomono` into its temporary `GEM_HOME` before
+      invoking Bundler. Its `GEM_PATH` contains only that reset sandbox: no
+      unrelated gems installed for the invoking Ruby can affect lockfile
+      resolution.
     - Release lockfile resets normally keep the complete development Gemfile
       graph, including the development-only `kettle-changelog` dependency.
       `kettle-changelog` depends on `kettle-dev`, so including it in
@@ -510,7 +518,7 @@ What it does:
       | Role | Lockfile | Used by |
       | --- | --- | --- |
       | Family runner | The family/orchestrator bundle | May resolve local sibling gems to run `kettle-family`; it never becomes the target project's lockfile. |
-      | Canonical release state | Tracked `Gemfile.lock` and, when present, `Appraisal.root.gemfile.lock` | Step 1 Bundler update, steps 3-6 setup/checks/appraisals/docs/prep commit, and step 16 checksums. These commands disable local `*_DEV`/`*_LOCAL` switches, except a narrow member-root policy supplied by `kettle-family` for an explicit monorepo. |
+      | Canonical release state | Tracked `Gemfile.lock` and, when present, `Appraisal.root.gemfile.lock` | Step 1 Bundler update, steps 3-6 setup/checks/appraisals/docs/prep commit, and step 16 checksums. These commands disable local `*_DEV`/`*_LOCAL` switches, except an explicitly allowed monorepo member-root policy supplied by `kettle-family`. Reset `GEM_HOME` and `GEM_PATH` are isolated; direct Gemfile bootstrap requirements are installed from their locked registry source into that sandbox before Bundler evaluates the Gemfile. |
       | Release task state | `tmp/kettle-release/lockfiles/Gemfile-<pid>.lock` | Steps 14-15 build and publish only. It begins as a copy of canonical `Gemfile.lock` and is deleted at process exit. |
       | Tool state | A tool-owned Gemfile such as `kettle-changelog/gemfiles/release.gemfile` | The tool's own dependencies. The command still disables local dependency switches before it can trigger target-project work. |
       | Git-hook state | Canonical release environment | Every release-created commit and amend. Hooks remain enabled, but cannot inherit the family runner's local sibling graph. |
@@ -1058,7 +1066,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.438-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.494-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -6,6 +6,7 @@ require "fileutils"
 require "open3"
 require "tmpdir"
 require "bundler"
+require "ripper"
 
 require_relative "bundler_env_guard"
 
@@ -162,6 +163,7 @@ module Kettle
         end
 
         with_isolated_gem_paths do |gem_home|
+          install_gemfile_bootstrap_gems!(gemfile: gemfile, lockfile: path, gem_home: gem_home)
           command = reset_command(
             path: path,
             gemfile: gemfile,
@@ -179,7 +181,7 @@ module Kettle
         end
       end
 
-      def reset_command(path:, gemfile:, full_update: false, platforms: nil, skip_changelog_dependency: false, update_bundler: false, isolated_gem_home: nil)
+      def reset_command(path:, gemfile:, full_update: false, platforms: nil, skip_changelog_dependency: false, update_bundler: false, isolated_gem_home: nil, isolated_gem_path: nil)
         update_gems = (full_update || has_local_path_remote?(path)) ? [] : reset_update_gems(path)
         platforms ||= reset_platforms(path)
         removed_platforms = full_update ? [] : lockfile_platforms(path) - platforms
@@ -190,7 +192,7 @@ module Kettle
         env["KETTLE_DEV_SKIP_CHANGELOG_DEPENDENCY"] = "true" if skip_changelog_dependency
         if isolated_gem_home
           env["GEM_HOME"] = isolated_gem_home
-          env["GEM_PATH"] = isolated_gem_home
+          env["GEM_PATH"] = isolated_gem_path || isolated_gem_home
         end
         command = +"env"
         UNBUNDLED_ENV_KEYS.each do |key|
@@ -469,7 +471,83 @@ module Kettle
       def with_isolated_gem_paths
         base = File.join(root, "tmp", "kettle-reset")
         FileUtils.mkdir_p(base)
-        Dir.mktmpdir("gem-home-", base) { |gem_home| yield(gem_home) }
+        Dir.mktmpdir("gem-home-", base) do |gem_home|
+          yield(gem_home)
+        end
+      end
+
+      # Bundler evaluates a Gemfile before it resolves the gems declared in it.
+      # Install only direct, literal bootstrap requires into the reset sandbox so
+      # unrelated gems from the invoking Ruby cannot influence resolution.
+      def install_gemfile_bootstrap_gems!(gemfile:, lockfile:, gem_home:)
+        gemfile_bootstrap_gem_names(gemfile).each do |name|
+          version = locked_registry_gem_version(lockfile, name)
+          source_url = registry_source_urls(lockfile).first
+          unless version && source_url
+            raise Error, "Cannot isolate Gemfile bootstrap #{name.inspect}: #{display_path(lockfile)} does not lock it from a registry source"
+          end
+
+          command_runner.call(bootstrap_gem_install_command(name, version, source_url, gem_home))
+        end
+      end
+
+      def gemfile_bootstrap_gem_names(gemfile)
+        calls = require_calls_from_ripper(Ripper.sexp(File.read(gemfile)))
+        calls.filter_map { |method_name, argument| bootstrap_gem_name(method_name, argument) }.uniq
+      end
+
+      def require_calls_from_ripper(node, calls = [])
+        return calls unless node.is_a?(Array)
+
+        case node.first
+        when :command
+          calls << [node.dig(1, 1), string_literal_value(node[2])]
+        when :method_add_arg
+          calls << [node.dig(1, 1, 1), string_literal_value(node[2])]
+        end
+        node.each { |child| require_calls_from_ripper(child, calls) if child.is_a?(Array) }
+        calls
+      end
+
+      def string_literal_value(node)
+        return unless node.is_a?(Array)
+
+        parts = []
+        collect_string_content(node, parts)
+        parts.join unless parts.empty?
+      end
+
+      def collect_string_content(node, parts)
+        return unless node.is_a?(Array)
+
+        parts << node[1] if node.first == :@tstring_content
+        node.each { |child| collect_string_content(child, parts) if child.is_a?(Array) }
+      end
+
+      def bootstrap_gem_name(method_name, argument)
+        return unless method_name == "require" && argument == "nomono/bundler"
+
+        "nomono"
+      end
+
+      def locked_registry_gem_version(lockfile, name)
+        lockfile_parser(lockfile).specs.find do |spec|
+          spec.name == name && registry_source?(spec.source)
+        end&.version&.to_s
+      end
+
+      def bootstrap_gem_install_command(name, version, source_url, gem_home)
+        env = unbundled_env.merge("GEM_HOME" => gem_home, "GEM_PATH" => gem_home)
+        command = +"env"
+        env.each do |key, value|
+          assignment = value.nil? ? " -u #{key}" : " #{key}=#{Shellwords.escape(value)}"
+          command << assignment
+        end
+        command << " gem install #{Shellwords.escape(name)}"
+        command << " -v #{Shellwords.escape("= #{version}")}"
+        command << " --source #{Shellwords.escape(source_url)} --clear-sources --no-document"
+        command << " --install-dir #{Shellwords.escape(gem_home)}"
+        command
       end
 
       def lockfile_parser(path)

data/lib/kettle/dev/release_cli.rb

@@ -365,24 +365,26 @@ module Kettle
         prepare_rubocop_lts_local_branch! if rubocop_lts_release_preflight_needed?
 
         # 3. bin/setup
-        run_cmd!(release_setup_command) if run_step?(3)
+        with_release_resume_step(3) { run_cmd!(release_setup_command) } if run_step?(3)
         # 4. bin/rake
-        run_cmd!(release_default_task_command) if run_step?(4)
+        with_release_resume_step(4) { run_cmd!(release_default_task_command) } if run_step?(4)
 
         # 5. appraisal:generate (optional) + canonical docs build
-        if run_step?(5)
-          appraisals_path = File.join(@root, "Appraisals")
-          if skip_appraisals?
-            puts "Skipping #{@appraisal_task} because --skip-appraisals was provided."
-          elsif File.file?(appraisals_path)
-            puts "Appraisals detected at #{Kettle::Dev.display_path(appraisals_path)}. Running: bin/rake #{@appraisal_task}"
-            run_cmd!(release_project_command("bin/rake #{@appraisal_task}"))
-          else
-            puts "No Appraisals file found; skipping #{@appraisal_task}"
-          end
+        with_release_resume_step(5) do
+          if run_step?(5)
+            appraisals_path = File.join(@root, "Appraisals")
+            if skip_appraisals?
+              puts "Skipping #{@appraisal_task} because --skip-appraisals was provided."
+            elsif File.file?(appraisals_path)
+              puts "Appraisals detected at #{Kettle::Dev.display_path(appraisals_path)}. Running: bin/rake #{@appraisal_task}"
+              run_cmd!(release_project_command("bin/rake #{@appraisal_task}"))
+            else
+              puts "No Appraisals file found; skipping #{@appraisal_task}"
+            end
 
-          puts "Generating docs site via canonical task: bin/rake yard"
-          run_cmd!(release_project_command("bin/rake yard"))
+            puts "Generating docs site via canonical task: bin/rake yard"
+            run_cmd!(release_project_command("bin/rake yard"))
+          end
         end
 
         # 6. git user + commit release prep
@@ -472,36 +474,40 @@ module Kettle
         end
 
         # 14. build
-        if run_step?(14)
-          ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
-          if signing_enabled? && release_secrets_configured?
-            puts "Running build with gem signing passphrase from configured secrets provider (#{release_secrets_provider_label})..."
-          else
-            puts "Running build (you may be prompted for the signing key password)..."
+        with_release_resume_step(14) do
+          if run_step?(14)
+            ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
+            if signing_enabled? && release_secrets_configured?
+              puts "Running build with gem signing passphrase from configured secrets provider (#{release_secrets_provider_label})..."
+            else
+              puts "Running build (you may be prompted for the signing key password)..."
+            end
+            run_cmd!(release_project_command("bundle exec rake build"))
           end
-          run_cmd!(release_project_command("bundle exec rake build"))
         end
 
         # 15. release and tag
-        if run_step?(15)
-          version ||= detect_version
-          gem_name = detect_gem_name
-          @release_candidate = build_release_candidate(gem_name, version)
-          if local_ci?
-            with_unpublished_candidate_cleanup { release_gem_and_tag_locally!(version) }
-          else
-            ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
-            if release_secrets_configured?
-              puts "Running release with configured secrets provider (#{release_secrets_provider_label}) for signing and RubyGems MFA prompts..."
+        with_release_resume_step(15) do
+          if run_step?(15)
+            version ||= detect_version
+            gem_name = detect_gem_name
+            @release_candidate = build_release_candidate(gem_name, version)
+            if local_ci?
+              with_unpublished_candidate_cleanup { release_gem_and_tag_locally!(version) }
             else
-              puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
-            end
-            with_unpublished_candidate_cleanup do
-              run_cmd!(release_project_command("bundle exec rake release"))
-              @release_candidate.published = true
-              confirm_release_candidate_available!(@release_candidate)
+              ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
+              if release_secrets_configured?
+                puts "Running release with configured secrets provider (#{release_secrets_provider_label}) for signing and RubyGems MFA prompts..."
+              else
+                puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
+              end
+              with_unpublished_candidate_cleanup do
+                run_cmd!(release_project_command("bundle exec rake release"))
+                @release_candidate.published = true
+                confirm_release_candidate_available!(@release_candidate)
+              end
+              mark_rubygems_release_cache_bust(version)
             end
-            mark_rubygems_release_cache_bust(version)
           end
         end
 
@@ -509,12 +515,14 @@ module Kettle
         #    Checksums are generated after release to avoid including checksums/ in gem package
         #    Rationale: Running gem_checksums before release may commit checksums/ and cause Bundler's
         #    release build to include them in the gem, thus altering the artifact, and invalidating the checksums.
-        if run_step?(16)
-          # Generate checksums for the just-built artifact, commit them, then validate
-          version ||= detect_version
-          gem_path = checksum_gem_path_for_version!(version)
-          run_cmd!(release_child_command("bin/gem_checksums #{Shellwords.escape(gem_path)}"))
-          validate_checksums!(version, stage: "after release")
+        with_release_resume_step(16) do
+          if run_step?(16)
+            # Generate checksums for the just-built artifact, commit them, then validate
+            version ||= detect_version
+            gem_path = checksum_gem_path_for_version!(version)
+            run_cmd!(release_child_command("bin/gem_checksums #{Shellwords.escape(gem_path)}"))
+            validate_checksums!(version, stage: "after release")
+          end
         end
 
         # 17. push checksum commit (gem_checksums already commits)
@@ -1429,20 +1437,20 @@ module Kettle
         abort("GitHub pull request setup failed: gh CLI is required to create or find the release PR.")
       end
 
-      def run_cmd!(cmd)
+      def run_cmd!(cmd, resume_step: @release_resume_step)
         cmd = bundle_audit_skip_command(cmd)
-        emit_command_event(cmd, "started")
+        emit_command_event(cmd, "started", resume_step: resume_step)
         with_bundle_audit_skip_env do
           with_machine_stdout_redirect do
             run_command_with_release_secrets!(cmd)
           end
         end
-        emit_command_event(cmd, "ok")
+        emit_command_event(cmd, "ok", resume_step: resume_step)
       rescue SystemExit => e
-        emit_command_event(cmd, "failed", reason: e.message)
+        emit_command_event(cmd, "failed", reason: e.message, resume_step: resume_step)
         raise
       rescue => e
-        emit_command_event(cmd, "failed", reason: "#{e.class}: #{e.message}")
+        emit_command_event(cmd, "failed", reason: "#{e.class}: #{e.message}", resume_step: resume_step)
         raise
       end
 
@@ -1454,6 +1462,14 @@ module Kettle
         "KETTLE_DEV_SKIP_BUNDLE_AUDIT=true #{cmd}"
       end
 
+      def with_release_resume_step(step)
+        previous_step = @release_resume_step
+        @release_resume_step = step
+        yield
+      ensure
+        @release_resume_step = previous_step
+      end
+
       def run_command_with_release_secrets!(cmd)
         return self.class.run_cmd!(cmd) unless release_secret_command?(cmd) && release_secrets_configured?
 
@@ -2124,7 +2140,7 @@ module Kettle
         )
       end
 
-      def emit_command_event(command, status, reason: nil)
+      def emit_command_event(command, status, reason: nil, resume_step: nil)
         event = {
           phase: "release",
           index: @command_events.length + 1,
@@ -2135,6 +2151,7 @@ module Kettle
           command: command,
           changed_files: []
         }
+        event[:resume_step] = resume_step if resume_step
         @command_events << event unless status == "started"
         Kettle::Ndjson.emit_step_event(@event_recorder, "command_step", event, phase: "release", index: event[:index])
       end

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.23"
+      VERSION = "3.0.24"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.23
+  version: 3.0.24
 platform: ruby
 authors:
 - Peter H. Boling
@@ -80,7 +80,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.13
+        version: 0.1.14
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -90,7 +90,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.13
+        version: 0.1.14
 - !ruby/object:Gem::Dependency
   name: kettle-rb
   requirement: !ruby/object:Gem::Requirement
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.23
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.23/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.24
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.24/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.23
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.24
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev