kettle-dev 3.1.14 → 3.1.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f91c0c4ef8cfb88983835109c778d084a739a78ed4cfc83318be404cd2ba9eee
-  data.tar.gz: c16964dc845379bc31fa3106af5567d950d00a2a2741bb79e50f816235420f41
+  metadata.gz: a92c25418ab7487a902fd03260cf2c457e2d156c09f2ec9ec426998fd7a31729
+  data.tar.gz: 437b8e39726ba9a2ed4990b38217dcb1336f48eeb504e5edff13009601febc8e
 SHA512:
-  metadata.gz: 7b9d783784e66864cd733aa63abdfb15161b93224b81bd8d5db9a2a2dc71cd3ca45ef1bd87f389895b9ef3e78d2d7c3432b4ea78ef176e70c3e6936eac9e5ce7
-  data.tar.gz: a7fb4dedb0aeb325ffca2a717e0700ae2d37a73ef38bde1006bfd5b8926bf6b6d9ebedefbe45400ba885c1aaa523db229854b6a0f0174a42ca0229ce5b47d925
+  metadata.gz: ce6778cb2d3676ef46727327a08f464a6c664cec8e6d1c472ed6ef283c4e8e8d132a6b1a36012597efaf392d22785c2c559b07c107c13eb2fba142a4f21255ed
+  data.tar.gz: 8ff9fc510de127537b010179d6f67548e2df8a0b72c76e7ab1a680d9417aeb16c2f98eda05ef532b51c9604a85b98dbe03d1678220e89ea65982dd2e0e538297

data/CHANGELOG.md

@@ -30,6 +30,21 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.15] - 2026-10-16
+
+- TAG: [v3.1.15][3.1.15t]
+- COVERAGE: 91.74% -- 5733/6249 lines in 48 files
+- BRANCH COVERAGE: 75.88% -- 2209/2911 branches in 48 files
+- 53.60% documented
+
+### Added
+
+- RubyGemsVersions confirm reads: fetch and published_version_numbers accept confirm: true for answers feeding destructive or commit-producing decisions — the registry is always contacted, revalidation rides the cached entrys ETag/Last-Modified (a 304 re-arms the TTL without rewriting the payload, even past expiry), and an unconfirmable answer returns nil instead of the stale entry
+
+- kettle-release step 1 now pins release lockfiles to the newest STABLE Bundler the registry serves instead of the executing Bundler: when the registry is newer it installs that version (rubygems.org only, prereleases excluded) and runs the bundler update under it, so BUNDLED WITH stops drifting behind CI images; a registry outage fails open to the executing Bundler
+
+- New Kettle::Dev::BundlerPinning module: shared stable-Bundler resolution (installed_stable, published_stable, install_stable, ensure_latest_stable, update_argv) so kettle-release step 1 and kettle-family bupb/update-bundler can share one implementation instead of divergent copies; kettle-release now delegates to it
+
 ## [3.1.14] - 2026-10-16
 
 - TAG: [v3.1.14][3.1.14t]
@@ -4130,7 +4145,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.14...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.15...HEAD
+[3.1.15]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.14...v3.1.15
+[3.1.15t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.15
 [3.1.14]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.13...v3.1.14
 [3.1.14t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.14
 [3.1.13]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.12...v3.1.13

data/README.md

@@ -1084,7 +1084,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.177-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.249-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/bundler_pinning.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require "rubygems/dependency_installer"
+
+module Kettle
+  module Dev
+    # Shared Bundler version resolution and maintenance for the release
+    # toolchain. Both kettle-release (release prep pins BUNDLED WITH) and
+    # kettle-family (bupb / update-bundler pin every member lockfile) need the
+    # same three answers — what stable Bundler is installed, what stable
+    # Bundler the registry serves, and how to install/pin one — and divergent
+    # copies are how lockfiles drifted behind CI images.
+    #
+    # Every lookup rejects prereleases: bundler betas ship as "latest" and a
+    # beta in BUNDLED WITH reinfects every child that boots the bundle.
+    module BundlerPinning
+      RUBYGEMS_SOURCE = "https://rubygems.org"
+
+      module_function
+
+      # Newest stable Bundler installed locally. Consults BOTH sources —
+      # the activated spec and every installed spec — because bundler/setup
+      # scoping can hide one from the other depending on how the process booted.
+      def installed_stable
+        active = Gem.loaded_specs["bundler"]&.version
+        versions = Gem::Specification.find_all_by_name("bundler").map(&:version)
+        versions.push(active) if active
+        versions.reject(&:prerelease?).max
+      end
+
+      # Newest stable Bundler the registry serves; nil when the registry
+      # cannot be consulted, so callers can fail open to local state.
+      def published_stable
+        numbers = Kettle::Dev::RubyGemsVersions.published_version_numbers("bundler")
+        return nil unless numbers
+
+        numbers.filter_map { |number| published_candidate(number) }.max
+      end
+
+      # Install a stable Bundler — the exact version given, or the latest
+      # stable when nil. rubygems.org only, never prereleases, and a spec
+      # reset so the just-installed version is visible to later gem lookups
+      # in this process. Returns the installed specs.
+      def install_stable(version = nil)
+        original_sources = Gem.sources.to_a
+        Gem.sources = [RUBYGEMS_SOURCE]
+        requirements = version ? ["= #{version}"] : []
+        specs = Gem::DependencyInstaller.new(domain: :remote, prerelease: false, document: []).install("bundler", *requirements)
+        Gem::Specification.reset
+        specs
+      ensure
+        Gem.sources = original_sources if original_sources
+      end
+
+      # The version a release should pin BUNDLED WITH to: the registry's
+      # newest stable, installing it first when the executing Bundler lags.
+      # A registry outage fails open to the executing Bundler rather than
+      # blocking the release.
+      def ensure_latest_stable(executing: Bundler::VERSION)
+        current = Gem::Version.new(executing)
+        latest = published_stable
+        return current.to_s if latest.nil? || latest <= current
+
+        install_stable(latest)
+        latest.to_s
+      end
+
+      # Pinned argv for a bundler-update spawn. A bare `--bundler` lets
+      # RubyGems resolve the newest bundler INCLUDING prereleases (the
+      # recurring 4.1.0.betaN infection vector), so the version is pinned on
+      # both the executable selector and the flag.
+      def update_argv(version, extra_gems: [])
+        ["bundle", "_#{version}_", "update", *extra_gems, "--bundler=#{version}"]
+      end
+
+      def published_candidate(number)
+        candidate = Gem::Version.new(number)
+        candidate unless candidate.prerelease?
+      rescue ArgumentError
+        nil
+      end
+    end
+  end
+end

data/lib/kettle/dev/release_cli.rb

@@ -1891,23 +1891,30 @@ module Kettle
         end
       end
 
+      # The release must pin BUNDLED WITH to the newest stable Bundler the
+      # registry serves; BundlerPinning installs it first when the executing
+      # Bundler lags and fails open to the executing Bundler on a registry
+      # outage. kettle-family's bupb/update-bundler delegate to the same
+      # module once the floor reaches the version shipping it.
+      def ensure_latest_stable_bundler!
+        Kettle::Dev::BundlerPinning.ensure_latest_stable
+      end
+
       # Keep Bundler maintenance separate from the release metadata commit.
       # The project lockfiles are shared development state, so the update must
       # be real and committed rather than hidden behind a temporary lockfile.
       #
-      # The version is pinned to the Bundler actually executing rather than left
-      # bare. `bundle update --bundler` resolves to whatever RubyGems reports as
-      # bundler's "latest", which includes prereleases: bundler published
-      # 4.1.0.beta1 as latest, so a bare update installed the beta and rewrote
-      # BUNDLED WITH to it. That beta vendors its own copy of rubygems' URI
-      # constants, and loading it against rubygems' copy emits a wall of
-      # "already initialized constant Gem::URI::..." warnings on stderr, which
-      # broke any spec shelling out to the executable and asserting clean stderr
-      # — failing a later release at its coverage step. Pinning matches
-      # LockfileReset#lockfile_command, which already documents this hazard.
+      # The version is pinned to the newest STABLE Bundler the registry
+      # serves, not whatever is executing: a bare `bundle update --bundler`
+      # resolves "latest" including prereleases (bundler 4.1.0.beta1 shipped
+      # as latest and its vendored rubygems URI constants broke specs
+      # asserting clean stderr), while pinning to the executing Bundler
+      # quietly re-records a stale BUNDLED WITH whenever the releasing
+      # machine lags the registry — and CI images carrying a newer default
+      # Bundler then drift from the committed lockfile.
       def update_bundler_and_commit!
-        bundler_version = Shellwords.escape(Bundler::VERSION)
-        run_cmd!(release_project_command("bundle update --bundler=#{bundler_version}"))
+        bundler_version = Shellwords.escape(ensure_latest_stable_bundler!)
+        run_cmd!(release_project_command("bundle _#{bundler_version}_ update --bundler=#{bundler_version}"))
 
         appraisal_gemfile = File.join(@root, "Appraisal.root.gemfile")
         if File.file?(appraisal_gemfile)
@@ -1923,7 +1930,7 @@ module Kettle
           unless File.file?(appraisal_lockfile)
             run_cmd!(release_project_command("#{appraisal_env} bundle install"))
           end
-          appraisal_command = "#{appraisal_env} bundle update --bundler=#{bundler_version}"
+          appraisal_command = "#{appraisal_env} bundle _#{bundler_version}_ update --bundler=#{bundler_version}"
           run_cmd!(release_project_command(appraisal_command))
           run_cmd!(release_project_command("bundle exec rake appraisal:reset"))
         end

data/lib/kettle/dev/ruby_gems_versions.rb

@@ -70,11 +70,21 @@ module Kettle
         # such as gem.coop can lag rubygems.org: a version present on one may
         # be absent from the other. Cache entries are keyed by source for the
         # same reason, so the two registries cannot poison each other.
-        def fetch(gem_name, version_hint: nil, refresh: false, source: DEFAULT_SOURCE)
+        #
+        # +confirm: true+ is the consequence-based read: the answer feeds a
+        # destructive or commit-producing decision (uninstalling a gem,
+        # resetting a lockfile), so the TTL'd cache is never trusted on its
+        # own. The registry is always contacted, but revalidation is cheap:
+        # the cached entry's ETag/Last-Modified go out as conditional headers
+        # and a 304 re-arms the cached answer instead of replacing it. When
+        # the network cannot confirm freshness, +nil+ is returned — never the
+        # stale entry — because a destructive caller must read that as
+        # "unknown", and absence is the dangerous answer to get wrong.
+        def fetch(gem_name, version_hint: nil, refresh: false, source: DEFAULT_SOURCE, confirm: false)
           name = gem_name.to_s
           key = cache_key(name, source)
           cached = cached_versions(key)
-          cache_bust = refresh || env_refresh? || fresh_release_marker?(name, version_hint) || cached_behind_version?(cached, version_hint)
+          cache_bust = refresh || confirm || env_refresh? || fresh_release_marker?(name, version_hint) || cached_behind_version?(cached, version_hint)
           return cached if cached && !cache_bust
 
           uri = versions_uri(gem_name, source: source, cache_bust: cache_bust)
@@ -82,6 +92,9 @@ module Kettle
           if cache_bust
             request["Cache-Control"] = "no-cache"
             request["Pragma"] = "no-cache"
+            validators = cache_validators(key)
+            request["If-None-Match"] = validators["etag"] if validators["etag"]
+            request["If-Modified-Since"] = validators["last_modified"] if validators["last_modified"]
           end
           response = Net::HTTP.start(
             uri.host,
@@ -92,16 +105,28 @@ module Kettle
           ) do |http|
             http.request(request)
           end
+          if response.is_a?(Net::HTTPNotModified)
+            stored = stored_entry(key)
+            if stored
+              rearm_versions(key)
+              return Array(stored["entries"])
+            end
+          end
           if response.code.to_i == 404
             write_versions(key, [])
             return []
           end
-          return cached unless response.is_a?(Net::HTTPSuccess)
+          unless response.is_a?(Net::HTTPSuccess)
+            return nil if confirm
+
+            return cached
+          end
 
           data = JSON.parse(response.body)
-          write_versions(key, data) if data.is_a?(Array)
+          write_versions(key, data, etag: response["etag"], last_modified: response["last-modified"]) if data.is_a?(Array)
           data
         rescue => error
+          return nil if confirm
           return cached if cached
 
           raise error
@@ -121,8 +146,12 @@ module Kettle
         # within the marker TTL. Without it a caller cannot tell "this version
         # was published moments ago in this very run" from "this gem was
         # released at some point in the last month".
-        def published_version_numbers(gem_name, source: DEFAULT_SOURCE, version: nil)
-          versions = fetch(gem_name, version_hint: version, source: normalize_source(source))
+        # +confirm: true+ marks the read as feeding a destructive or
+        # commit-producing decision; it always revalidates against the
+        # registry (cheaply, via the cached entry's validators) and returns
+        # nil when freshness cannot be confirmed.
+        def published_version_numbers(gem_name, source: DEFAULT_SOURCE, version: nil, confirm: false)
+          versions = fetch(gem_name, version_hint: version, source: normalize_source(source), confirm: confirm)
           return nil if versions.nil?
 
           versions.filter_map { |entry| entry["number"] if entry.is_a?(Hash) }
@@ -246,26 +275,69 @@ module Kettle
         end
 
         def cached_versions(cache_key)
+          entry = cached_entry(cache_key)
+          return nil unless entry
+
+          Array(entry["entries"])
+        end
+
+        # Validators from the last successful fetch, sent as conditional
+        # headers on revalidation so a 304 can confirm freshness cheaply.
+        # Deliberately TTL-agnostic: an expired entry's validators still prove
+        # payload currency when the server answers 304, which is the entire
+        # point of carrying them.
+        def cache_validators(cache_key)
+          entry = stored_entry(cache_key)
+          return {} unless entry
+
+          {"etag" => entry["etag"], "last_modified" => entry["last_modified"]}.compact
+        end
+
+        def cached_entry(cache_key)
+          entry = stored_entry(cache_key)
+          return nil unless entry
+          return nil unless fresh_version_cache_entry?(entry)
+
+          entry
+        end
+
+        def stored_entry(cache_key)
           path = version_cache_path
           return nil if path.empty?
 
           entry = read_version_cache(path).fetch("versions", {})[cache_key]
-          return nil unless entry.is_a?(Hash)
-          return nil unless fresh_version_cache_entry?(entry)
+          entry.is_a?(Hash) ? entry : nil
+        end
 
-          Array(entry["entries"])
+        # A 304 means the cached payload is still current; re-arming the TTL
+        # without rewriting the payload keeps the entry valid for TTL reads.
+        def rearm_versions(cache_key)
+          path = version_cache_path
+          return if path.empty?
+
+          data = read_version_cache(path)
+          entry = data.fetch("versions", {})[cache_key]
+          return unless entry.is_a?(Hash)
+
+          entry["cached_at"] = Time.now.utc.iso8601
+          File.write(path, JSON.pretty_generate(data) << "\n")
+        rescue => error
+          warn("[kettle-dev] could not re-arm RubyGems version cache: #{error.class}: #{error.message}") if Kettle::Dev::DEBUGGING
         end
 
-        def write_versions(cache_key, entries)
+        def write_versions(cache_key, entries, etag: nil, last_modified: nil)
           path = version_cache_path
           return if path.empty?
 
           data = read_version_cache(path)
           data["versions"] ||= {}
-          data["versions"][cache_key] = {
+          entry = {
             "cached_at" => Time.now.utc.iso8601,
             "entries" => entries
           }
+          entry["etag"] = etag if etag
+          entry["last_modified"] = last_modified if last_modified
+          data["versions"][cache_key] = entry
           FileUtils.mkdir_p(File.dirname(path))
           File.write(path, JSON.pretty_generate(data) << "\n")
         rescue => error

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.14"
+      VERSION = "3.1.15"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/dev.rb

@@ -30,6 +30,7 @@ module Kettle
     autoload :ChangelogEntryAdder, "kettle/dev/changelog_entry_adder"
     autoload :BumpCLI, "kettle/dev/bump_cli"
     autoload :BundlerEnvGuard, "kettle/dev/bundler_env_guard"
+    autoload :BundlerPinning, "kettle/dev/bundler_pinning"
     autoload :CIHelpers, "kettle/dev/ci_helpers"
     autoload :CIMonitor, "kettle/dev/ci_monitor"
     autoload :CommitMsg, "kettle/dev/commit_msg"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.14
+  version: 3.1.15
 platform: ruby
 authors:
 - Peter H. Boling
@@ -371,6 +371,7 @@ files:
 - lib/kettle/dev.rb
 - lib/kettle/dev/bump_cli.rb
 - lib/kettle/dev/bundler_env_guard.rb
+- lib/kettle/dev/bundler_pinning.rb
 - lib/kettle/dev/cache_progress.rb
 - lib/kettle/dev/changelog_cli.rb
 - lib/kettle/dev/changelog_entry_adder.rb
@@ -422,10 +423,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.14
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.14/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.15
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.15/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.14
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.15
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev