kettle-dev 3.1.10 → 3.1.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 402314d89802c8ea05c0ad109c93b25ee8a703e767a5581855ac80ab1981f139
-  data.tar.gz: 91d16f55dfe212bb82f0506d030734daa151dcbd0cc1cf2cf9f7f4547597e82c
+  metadata.gz: c6532c0b875c1c1581f43bf3035bc3f9b4ff7ba8d04f7a90f6bf78be7fb167ac
+  data.tar.gz: 9894c1dd7477202261502e23f1e6d37b6f0f174350ac456b834dc8df19b143ba
 SHA512:
-  metadata.gz: 3e4c5dbd0e71242d0b8d7ad112858de871a169f76dfe49d1754525656e31f5d7421c324dcdbddc597a2a38e55228640f57d34a637d7d30f35a0565476a32442f
-  data.tar.gz: c1ceeb7a1c40a1f989ff4ba76fe44bebc988c76d82fb945c6f15ccac66d6e547e6924557bb3cef10f661fd1f91b82407613a014462bbae47fa63b8c70f460a52
+  metadata.gz: 5bf4bd022743bdac03fc5806ff9598781abf17814c14ec9cddd5a917d33af628055dea5adbdbf11ee3d4284aa9f5dc2926c8456dab0710fc59ea7093aa23d457
+  data.tar.gz: a9aa5312d72d80c8868becdb10cbf8e11f57ae4df5e37edc78f781656873b4dea9bc1fd48aca064a4ec63e76ee2156dfe05626e8efa90743a7ffda4b24a397bd

data/CHANGELOG.md

@@ -30,6 +30,17 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.11] - 2026-10-11
+
+- TAG: [v3.1.11][3.1.11t]
+- COVERAGE: 91.71% -- 6352/6926 lines in 49 files
+- BRANCH COVERAGE: 75.79% -- 2420/3193 branches in 49 files
+- 52.20% documented
+
+### Fixed
+
+- CI monitor aborts on the first failed GitHub Actions job instead of waiting for run-level completion: a large matrix keeps the run in_progress for minutes after a red job, so releases burned dead time a re-run must spend anyway; the abort names the job and links it
+
 ## [3.1.10] - 2026-10-11
 
 - TAG: [v3.1.10][3.1.10t]
@@ -43,7 +54,7 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
-- InteractiveReleaseCommand now scrubs every configured secret from child output before printing, capturing, or logging it: a PTY echoes bytes written to its input back onto the output stream while the child's terminal echo is on (e.g. before RubyGems' noecho wraps the password read), so the gem signing passphrase previously appeared in release logs; the scrubber tracks written secrets in memory, removes them from every chunk including secrets split across chunk boundaries, and clears the prompt buffer after answering so a stale prompt cannot trigger a duplicate write
+- InteractiveReleaseCommand now scrubs every configured secret from child output before printing, capturing, or logging it: a PTY echoes bytes written to its input back onto the output stream while the child's terminal echo is on (e.g. before RubyGems' noecho wraps the password read), so the gem signing passphrase previously appeared in release logs; the scrubber tracks written secrets in memory, removes them from every chunk including secrets split across chunk boundaries, and clears the prompt buffer after answering so a stale prompt cannot trigger a duplicate write. Prompt detection runs on a scrubbed-but-untruncated view of the stream while emitted output keeps the anti-leak holdback, fixing a deadlock where `gem push` printed the RubyGems OTP prompt as its final output and blocked forever on stdin with the prompt tail withheld (the fix landed mid-release and was omitted from this section's original content)
 
 - kettle-release aborts at startup under a prerelease Bundler, and LockfileReset now treats a lockfile BUNDLED WITH a prerelease Bundler as drift: Bundler auto-installs the locked version (including betas) on every bundle install, so one beta-pinned lockfile re-infects every machine that bundles against it; the reset re-locks with the currently running stable Bundler
 
@@ -4038,7 +4049,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.10...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.11...HEAD
+[3.1.11]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.10...v3.1.11
+[3.1.11t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.11
 [3.1.10]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.9...v3.1.10
 [3.1.10t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.10
 [3.1.9]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.8...v3.1.9

data/README.md

@@ -421,6 +421,7 @@ What it does:
         - Select workflow with `K_RELEASE_LOCAL_CI_WORKFLOW` (with or without .yml/.yaml). Defaults to `locked_deps.yml` if present; otherwise the first workflow discovered.
         - On failure, the release prep commit is soft-rolled-back (`git reset --soft HEAD^`) and the process aborts.
     - Ensures trunk sync and rebases feature branches as needed, pushes, monitors GitHub Actions with a progress bar, and merges feature to trunk on success.
+    - CI monitoring aborts as soon as any single workflow job fails (not only when the whole run concludes), naming the failed job and linking to it — a large matrix can keep a run in_progress for many minutes after its first red job.
     - For release branches listed in `.kettle-family.yml` branch-stack targets, it intentionally does not pull/rebase from trunk or merge the leaf branch into trunk. Instead, it starts the selected GitHub Actions workflows directly on the pushed release branch; each selected workflow must declare `workflow_dispatch`. This validates the exact branch-stack commit without requiring an often-conflicting PR to trunk.
     - Exports `SOURCE_DATE_EPOCH`, builds (optionally signed), creates gem checksums, and runs `bundle exec rake release` (prompts for signing key + RubyGems MFA OTP as needed).
 - Options:
@@ -1067,7 +1068,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.909-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.926-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/ci_helpers.rb

@@ -188,6 +188,38 @@ module Kettle
         run && run["status"] == "completed" && run["conclusion"] && run["conclusion"] != "success"
       end
 
+      # Jobs of a workflow run. Used to detect a failed job BEFORE the
+      # workflow-level status completes: a large matrix keeps the run
+      # in_progress for many minutes after its first job has already
+      # concluded failure, while an operator watching the Actions UI sees
+      # the red job immediately.
+      # @param owner [String]
+      # @param repo [String]
+      # @param run_id [Integer, String]
+      # @param token [String, nil]
+      # @return [Array<Hash>] job summaries: name, status, conclusion, html_url
+      def run_jobs(owner:, repo:, run_id:, token: default_token)
+        return [] unless owner && repo && run_id
+
+        data = github_get_json(
+          "https://api.github.com/repos/#{owner}/#{repo}/actions/runs/#{run_id}/jobs?per_page=100",
+          token: token
+        )
+        return [] unless data
+
+        Array(data["jobs"]).map do |job|
+          {
+            "name" => job["name"],
+            "status" => job["status"],
+            "conclusion" => job["conclusion"],
+            "html_url" => job["html_url"]
+          }
+        end
+      rescue => e
+        Kettle::Dev.debug_error(e, __method__)
+        []
+      end
+
       # Default GitHub token sourced from environment.
       # @return [String, nil]
       def default_token

data/lib/kettle/dev/ci_monitor.rb

@@ -404,9 +404,31 @@ module Kettle
                     total: total
                   )
                 end
-              elsif Kettle::Dev::CIHelpers.failed?(run) && !passed[wf] && !failed[wf]
+              elsif !failed[wf]
+                # Detect a failure at the JOB level while the run is still
+                # in_progress: a large matrix keeps the run-level status
+                # pending for many minutes after its first job has already
+                # concluded failure, but an operator watching the Actions UI
+                # sees the red job immediately. Abort as soon as any job is
+                # definitively red so the release stops burning minutes that
+                # a re-run will have to spend anyway.
+                run_failed = Kettle::Dev::CIHelpers.failed?(run)
+                failed_job = nil
+                if !passed[wf] && !run_failed && run["status"] != "completed"
+                  # Run still in flight: poll its jobs so a single red job in
+                  # a large matrix aborts immediately instead of waiting for
+                  # the whole workflow to conclude.
+                  jobs = Kettle::Dev::CIHelpers.run_jobs(owner: owner, repo: repo, run_id: run["id"])
+                  failed_job = jobs.find do |job|
+                    job["status"] == "completed" && job["conclusion"] && job["conclusion"] != "success" && job["conclusion"] != "skipped"
+                  end
+                end
+                next unless run_failed || failed_job
+
                 puts
                 wf_url = run["html_url"] || "https://github.com/#{owner}/#{repo}/actions/workflows/#{wf}"
+                failed_job_note = failed_job ? " (job: #{failed_job["name"]})" : ""
+                wf_url = failed_job["html_url"] if failed_job && failed_job["html_url"]
                 emit_ci_monitor_event(
                   event_recorder,
                   action: "github_workflow",
@@ -416,12 +438,13 @@ module Kettle
                   url: wf_url,
                   run_status: run["status"],
                   conclusion: run["conclusion"],
+                  failed_job: failed_job && failed_job["name"],
                   completed: passed.size,
                   total: total,
-                  reason: "Workflow failed"
+                  reason: "Workflow failed#{failed_job_note}"
                 )
                 unless continue_ci_failures?
-                  abort("Workflow failed: #{wf} -> #{wf_url} Fix the workflow, then restart this tool from CI validation with: #{restart_hint}")
+                  abort("Workflow failed#{failed_job_note}: #{wf} -> #{wf_url} Fix the workflow, then restart this tool from CI validation with: #{restart_hint}")
                 end
 
                 failed[wf] = true

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.10"
+      VERSION = "3.1.11"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.10
+  version: 3.1.11
 platform: ruby
 authors:
 - Peter H. Boling
@@ -422,10 +422,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.10
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.10/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.11
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.11/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.10
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.11
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev