kettle-dev 3.0.28 → 3.0.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dda94d3be88afd70177ebf10e5272e19ade1b64468e8c44479145949382a954f
-  data.tar.gz: cc4a9f69fef74faad9f592909bfdc58caf913c6a7e3f52fde4a70101840b47ed
+  metadata.gz: bc59b144ad35c13c8dc77cdadfcea930ba96aaf4d5d3896de8eaba577e83cd41
+  data.tar.gz: 3c045b3ba0e37e744a2e6305dd2b06edd30726973fb06c8462c2d40bb553e812
 SHA512:
-  metadata.gz: b8c9a7f9b079a7c040dd025ff7093bcf74ac30a37163b32a5460353bf1d1c4cf4a0cff964f14d11eb126343e8d5eb8ef3413e580eb33605d850f23863e25639c
-  data.tar.gz: 7da28d9024ac1c4ae381ae97d6331ee21eb1bda66b720ba09c6d7af5eaf8fcd973cc98eeead7b9710884f056c63a7a981ffd6423ec4389aebbf4bc9a1a2fbf70
+  metadata.gz: 1844c35d044d30ea440baca2c784b7aea035f37848c8dfa5b2a5a7533759e00eeaf20e04af3da857821617c762eaa717639b44fd17aabdd78cba5a1b2b7380ed
+  data.tar.gz: 7b4e5f90dbcf71235efe088f84ae03ec0707539f2072e2f246d0a48e1dc43bd361c8c5befc6a2bebfe7d017ceffca1fab631e897558bbcdf9882f3253cfe747a

data/CHANGELOG.md

@@ -30,6 +30,19 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.29] - 2026-09-01
+
+- TAG: [v3.0.29][3.0.29t]
+- COVERAGE: 91.58% -- 6003/6555 lines in 47 files
+- BRANCH COVERAGE: 76.25% -- 2302/3019 branches in 47 files
+- 50.24% documented
+
+### Fixed
+
+- Install bootstrap gems required by statically evaluated Gemfiles before isolated release lockfile resolution.
+
+- Ignore inactive nested Gemfile bootstrap requirements when their appraisal lockfile does not include the bootstrap gem.
+
 ## [3.0.28] - 2026-09-01
 
 - TAG: [v3.0.28][3.0.28t]
@@ -3773,7 +3786,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.28...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.29...HEAD
+[3.0.29]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.28...v3.0.29
+[3.0.29t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.29
 [3.0.28]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.27...v3.0.28
 [3.0.28t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.28
 [3.0.27]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.26...v3.0.27

data/README.md

@@ -1066,7 +1066,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.542-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.555-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -476,14 +476,18 @@ module Kettle
         end
       end
 
-      # Bundler evaluates a Gemfile before it resolves the gems declared in it.
-      # Install only direct, literal bootstrap requires into the reset sandbox so
-      # unrelated gems from the invoking Ruby cannot influence resolution.
+      # Bundler evaluates a Gemfile and its static eval_gemfile inputs before it
+      # resolves declared gems. Install only literal bootstrap requires into the
+      # reset sandbox so unrelated gems from the invoking Ruby cannot influence
+      # resolution.
       def install_gemfile_bootstrap_gems!(gemfile:, lockfile:, gem_home:)
-        gemfile_bootstrap_gem_names(gemfile).each do |name|
+        gemfile_bootstrap_gems(gemfile).each do |name, required_by_root_gemfile|
           version = locked_registry_gem_version(lockfile, name)
           source_url = registry_source_urls(lockfile).first
-          unless version && source_url
+          needs_install = required_by_root_gemfile || (version && source_url)
+          next unless needs_install
+
+          if !version || !source_url
             raise Error, "Cannot isolate Gemfile bootstrap #{name.inspect}: #{display_path(lockfile)} does not lock it from a registry source"
           end
 
@@ -491,9 +495,27 @@ module Kettle
         end
       end
 
-      def gemfile_bootstrap_gem_names(gemfile)
-        calls = require_calls_from_ripper(Ripper.sexp(File.read(gemfile)))
-        calls.filter_map { |method_name, argument| bootstrap_gem_name(method_name, argument) }.uniq
+      def gemfile_bootstrap_gems(gemfile)
+        gemfile_source_paths(gemfile).each_with_index.each_with_object({}) do |(path, index), gems|
+          calls = require_calls_from_ripper(Ripper.sexp(File.read(path)))
+          calls.filter_map { |method_name, argument| bootstrap_gem_name(method_name, argument) }.each do |name|
+            gems[name] = gems.fetch(name, false) || index.zero?
+          end
+        end
+      end
+
+      def gemfile_source_paths(gemfile, seen = Set.new)
+        path = File.expand_path(gemfile)
+        return [] if seen.include?(path) || !File.file?(path)
+
+        seen << path
+        calls = require_calls_from_ripper(Ripper.sexp(File.read(path)))
+        nested_paths = calls.filter_map do |method_name, argument|
+          next unless method_name == "eval_gemfile" && argument
+
+          File.expand_path(argument, File.dirname(path))
+        end
+        [path, *nested_paths.flat_map { |nested_path| gemfile_source_paths(nested_path, seen) }]
       end
 
       def require_calls_from_ripper(node, calls = [])

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.28"
+      VERSION = "3.0.29"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.28
+  version: 3.0.29
 platform: ruby
 authors:
 - Peter H. Boling
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.28
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.28/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.29
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.29/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.28
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.29
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev