kettle-dev 3.0.32 → 3.0.34

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9132d12950e549b34487cfee3dfdbe7fc3e3fc8d09c61e5c469200ebcfd33494
-  data.tar.gz: bc7028945556631f6580263cb484e2fe355eb183230b26858622efd5e72c2684
+  metadata.gz: cf4388ae02268bbe6676ece5cee25b5548277a6e60432554c460f189ca02d2f0
+  data.tar.gz: 80841fd013dbd2868b22e36b185c18c0a7f90ed3698f5cb3a2d666c46a80b41b
 SHA512:
-  metadata.gz: 54f36d581d481382e2916eede84a4445eb89505f87021e422efec8ff7fe1a185059d06e451f1332717a8cd6ccdfb4dd8e4ba22de77ce6b20af4895cbd2d93ca4
-  data.tar.gz: c25ead2234bda685bb6c3e6d4f3a3af33a673788705744a3efd69a866e7d9027034ce1cb6e6775fd63f240455593a2c2b505548331a73fd4ed5148b7de2ad736
+  metadata.gz: 713c1d308268ce8cde18124db06ad5efed08d53fc945af0c723843de08d840b6db23f946941de187b2adcf61e482e206e307fda8bbd52b562c3aaed1fd61ee91
+  data.tar.gz: 8e94e9a97e3ae52b955fd098db642ab23639fb6e0d67b2abed14fe8684248430c50618b8f8d6f3d0a57bb1934954e1f41fe7b17711fac151bdca9928b98a0795

data/CHANGELOG.md

@@ -30,6 +30,30 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.34] - 2026-09-09
+
+- TAG: [v3.0.34][3.0.34t]
+- COVERAGE: 91.95% -- 6101/6635 lines in 47 files
+- BRANCH COVERAGE: 76.43% -- 2332/3051 branches in 47 files
+- 50.23% documented
+
+### Fixed
+
+- Detect and reset release lockfiles whose BUNDLED WITH version lacks a matching Bundler checksum.
+
+- Declare the intentional version_gem runtime-heads dependency overlap for templating self-tests.
+
+## [3.0.33] - 2026-09-07
+
+- TAG: [v3.0.33][3.0.33t]
+- COVERAGE: 91.76% -- 6068/6613 lines in 47 files
+- BRANCH COVERAGE: 76.11% -- 2310/3035 branches in 47 files
+- 50.35% documented
+
+### Fixed
+
+- Isolate the published-gem availability probe from locally activated gems so release validation resolves the registry dependency graph.
+
 ## [3.0.32] - 2026-09-07
 
 - TAG: [v3.0.32][3.0.32t]
@@ -3823,7 +3847,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.32...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.34...HEAD
+[3.0.34]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.33...v3.0.34
+[3.0.34t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.34
+[3.0.33]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.32...v3.0.33
+[3.0.33t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.33
 [3.0.32]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.31...v3.0.32
 [3.0.32t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.32
 [3.0.31]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.30...v3.0.31

data/README.md

@@ -1066,7 +1066,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.607-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.635-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -194,6 +194,29 @@ module Kettle
           env["GEM_HOME"] = isolated_gem_home
           env["GEM_PATH"] = isolated_gem_path || isolated_gem_home
         end
+        command_prefix = bundler_command_prefix(env)
+        command = +"#{command_prefix} bundle lock"
+        # Bundler accepts each platform option once followed by a list. Repeating
+        # either option silently keeps only the final occurrence with Bundler 4.
+        command << " --remove-platform #{removed_platforms.sort.map { |platform| Shellwords.escape(platform) }.join(" ")}" unless removed_platforms.empty?
+        command << " --add-platform #{platforms.map { |platform| Shellwords.escape(platform) }.join(" ")}" unless platforms.empty?
+        command << " --update"
+        command << " #{update_gems.map { |gem_name| Shellwords.escape(gem_name) }.join(" ")}" unless update_gems.empty?
+        command << " --add-checksums" unless update_bundler
+        return command unless update_bundler
+
+        # `bundle lock --bundler` accepts a requirement and retains a locked
+        # prerelease that satisfies it. `bundle update --bundler=VERSION`
+        # records the exact Bundler that is executing the reset instead.
+        # Finish with `bundle lock --add-checksums`, since `bundle update`
+        # does not support that option.
+        bundler_version = Shellwords.escape(Bundler::VERSION)
+        command << " && #{command_prefix} bundle update --bundler=#{bundler_version}"
+        command << " && #{command_prefix} bundle lock --add-checksums"
+        command
+      end
+
+      def bundler_command_prefix(env)
         command = +"env"
         UNBUNDLED_ENV_KEYS.each do |key|
           command << " -u #{key}"
@@ -201,19 +224,6 @@ module Kettle
         env.each do |key, value|
           command << " #{key}=#{Shellwords.escape(value)}"
         end
-        command << " bundle lock"
-        # Bundler accepts each platform option once followed by a list. Repeating
-        # either option silently keeps only the final occurrence with Bundler 4.
-        command << " --remove-platform #{removed_platforms.sort.map { |platform| Shellwords.escape(platform) }.join(" ")}" unless removed_platforms.empty?
-        command << " --add-platform #{platforms.map { |platform| Shellwords.escape(platform) }.join(" ")}" unless platforms.empty?
-        command << " --update"
-        command << " #{update_gems.map { |gem_name| Shellwords.escape(gem_name) }.join(" ")}" unless update_gems.empty?
-        # Bundler preserves BUNDLED WITH during a normal lockfile update.
-        # Release lockfiles must record the Bundler that performed the final
-        # reset, or the next release command can dirty them after the prep
-        # commit by reconciling to a newer installed Bundler.
-        command << " --bundler" if update_bundler
-        command << " --add-checksums"
         command
       end
 
@@ -254,7 +264,10 @@ module Kettle
       end
 
       def normalization_needed?(path)
-        has_local_path_remote?(path) || !empty_registry_checksums(path).empty? || !unreleased_workspace_registry_specs(path).empty?
+        has_local_path_remote?(path) ||
+          !empty_registry_checksums(path).empty? ||
+          !unreleased_workspace_registry_specs(path).empty? ||
+          bundled_with_checksum_mismatch?(path)
       end
 
       def diagnostics(path)
@@ -268,6 +281,9 @@ module Kettle
         unreleased_workspace_registry_specs(path).each do |name, version, line_number|
           diagnostics << "#{display_path(path)} locks local workspace gem #{name} #{version} as a registry gem, but that version is not resolvable from the configured gem source at line #{line_number}"
         end
+        if bundled_with_checksum_mismatch?(path)
+          diagnostics.push("#{display_path(path)} BUNDLED WITH #{bundled_with_version(path)} has no matching Bundler checksum")
+        end
         diagnostics
       end
 
@@ -459,6 +475,33 @@ module Kettle
         end
       end
 
+      # A release reset updates both `BUNDLED WITH` and CHECKSUMS. When a
+      # nested tool leaked its Bundler into a member lockfile, a later cleanup
+      # can otherwise replace only the checksum entry and leave an impossible
+      # lockfile behind. Only flag a mismatch when the lockfile already tracks
+      # Bundler in CHECKSUMS, preserving older lockfiles that lack that entry.
+      def bundled_with_checksum_mismatch?(path)
+        version = bundled_with_version(path)
+        return false if version.empty?
+
+        checksums = self.class.checksum_entries_from_source(File.read(path))
+        return false unless checksums&.keys&.any? { |name, _checksum_version| name == "bundler" }
+
+        !checksums.key?(["bundler", version])
+      end
+
+      def bundled_with_version(path)
+        lines = File.readlines(path)
+        marker = lines.index { |line| line.strip == "BUNDLED WITH" }
+        return "" unless marker
+
+        lines[marker.succ..-1].each do |line|
+          version = line.strip
+          return version unless version.empty?
+        end
+        ""
+      end
+
       def path_source_gems(path)
         lockfile_parser(path).specs.each_with_object(Set.new) do |spec, gems|
           source = spec.source

data/lib/kettle/dev/release_cli.rb

@@ -6,6 +6,7 @@ require "open3"
 require "shellwords"
 require "time"
 require "fileutils"
+require "tmpdir"
 require "net/http"
 require "openssl"
 require "json"
@@ -2035,7 +2036,13 @@ module Kettle
           stderr_str = nil
           status = nil
           with_unbundled_release_probe_env do
-            stdout_str, stderr_str, status = Open3.capture3(self.class.send(:command_env), Gem.ruby, script_path)
+            with_release_availability_probe_gem_home do |gem_home|
+              stdout_str, stderr_str, status = Open3.capture3(
+                self.class.send(:command_env).merge("GEM_HOME" => gem_home, "GEM_PATH" => gem_home),
+                Gem.ruby,
+                script_path
+              )
+            end
           end
           $stdout.print(stdout_str) unless stdout_str.to_s.empty?
           if status.success?
@@ -2074,6 +2081,12 @@ module Kettle
         10
       end
 
+      def with_release_availability_probe_gem_home
+        dir = File.join(@root, "tmp", "kettle-release")
+        FileUtils.mkdir_p(dir)
+        Dir.mktmpdir("probe-gem-home-", dir) { |gem_home| yield gem_home }
+      end
+
       def with_unbundled_release_probe_env(&block)
         if defined?(Bundler)
           Bundler.with_unbundled_env(&block)

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.32"
+      VERSION = "3.0.34"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.32
+  version: 3.0.34
 platform: ruby
 authors:
 - Peter H. Boling
@@ -100,7 +100,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.11
+        version: 0.1.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -110,7 +110,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.11
+        version: 0.1.12
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.32
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.32/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.34
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.34/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.32
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.34
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev