kettle-dev 3.1.16 → 3.1.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 16802c87427ef8443571014a94b2d7720f246f01ea22cf2821b2b9598f4b804b
-  data.tar.gz: 9ced61074b0241db2b225d5bbbe6d3c1e359a16e587a949e47339a4b8a65f144
+  metadata.gz: 672f320446b4068e5c3baac7ee9a30443791328de854e1d917d7cefc0168ea39
+  data.tar.gz: 368787c9c87aa440b03dab7c3b4a0df2d9a91be96be1de6056a83c62d5e7b929
 SHA512:
-  metadata.gz: 78fab6bbe0cca35be2a872350840b9bcbdc907bbd697ba245c5a47e406790bc72663161bd42518268386bf7df7c8e50900f31ddae2b4b2818670b259db7a7aee
-  data.tar.gz: 6f2fc6046be6343e41ce2b917f274b0f6e726a145a09c6273bace66ecf525fee5567bb3ea4a25cce9fa344e9061e1f6d6cc7327efa8946804191eac783aee588
+  metadata.gz: 97b7bbc123483bf583d88ef67a30e8edbc923b6aab487e1cea2d890716f1a25e95657ab3f308209e61c0fbe42c4d9b06594172ebfb71442e3ce219434e528000
+  data.tar.gz: 02d2b63b536624d834fde01bedc077425bcb248ae4a169ac24e5ca6479130dba398dc1df8caa24e652fb692361c530849e84911cfe57923de0ede14511ee2a15

data/CHANGELOG.md

@@ -30,6 +30,28 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.18] - 2026-10-19
+
+- TAG: [v3.1.18][3.1.18t]
+- COVERAGE: 91.72% -- 5763/6283 lines in 48 files
+- BRANCH COVERAGE: 75.73% -- 2216/2926 branches in 48 files
+- 53.60% documented
+
+### Added
+
+- kettle-release aborts with an explicit outdated-tool error when a newer release of kettle-dev exists in the same minor series (registry lookup; failures never block; newer minors only warn; KETTLE_DEV_SKIP_TOOL_CURRENCY_CHECK skips), so a stale copy resolved from an old lockfile can no longer silently run without lockfile materialization and self-heal fixes.
+
+## [3.1.17] - 2026-10-18
+
+- TAG: [v3.1.17][3.1.17t]
+- COVERAGE: 91.84% -- 5761/6273 lines in 48 files
+- BRANCH COVERAGE: 75.75% -- 2212/2920 branches in 48 files
+- 53.60% documented
+
+### Fixed
+
+- Family member publish materializes the release task lockfile before building: run_family_member_publish now runs the same normalize guard as the step 14/15 build entry points, so the BUNDLE_LOCKFILE snapshot copied from the committed Gemfile.lock is bundle-installed before rake build. Without it, a monorepo member build failed with: Could not find tool-old-version in locally installed gems, when the committed lockfile pinned an older release-tool resolution than the boot environment.
+
 ## [3.1.16] - 2026-10-18
 
 - TAG: [v3.1.16][3.1.16t]
@@ -4156,7 +4178,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.16...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.18...HEAD
+[3.1.18]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.17...v3.1.18
+[3.1.18t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.18
+[3.1.17]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.16...v3.1.17
+[3.1.17t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.17
 [3.1.16]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.15...v3.1.16
 [3.1.16t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.16
 [3.1.15]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.14...v3.1.15

data/README.md

@@ -1084,7 +1084,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.272-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.283-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/release_cli.rb

@@ -268,6 +268,7 @@ module Kettle
 
       def run
         @started_at = monotonic_time
+        ensure_release_tool_current!
         emit_run_start
         status = "ok"
         error = nil
@@ -672,6 +673,14 @@ module Kettle
 
       def run_family_member_publish
         version = detect_version
+        # The build pins BUNDLE_LOCKFILE to this run's task lockfile snapshot,
+        # copied from the committed Gemfile.lock on first use. Materialize it
+        # (bundle install against the snapshot) or the build fails on gems the
+        # snapshot pins but the boot env never installed — exactly what a
+        # stale committed lockfile plus an independently-versioned release
+        # tool produces (e.g. kettle-family 1.3.13 vs 1.3.18). Same guard the
+        # step 14/15 entry points run before `bundle exec rake build`.
+        normalize_release_lockfiles_before_publish_tasks!
         prepare_release_lockfiles_for_release_tasks!
         ensure_signing_setup_or_skip!
         ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
@@ -2314,6 +2323,34 @@ module Kettle
         m[2]
       end
 
+      # Refuse to run a release with an outdated release tool. kettle-release
+      # is resolved from the invoking bundle (for family releases, the family
+      # root's Gemfile, which each family version-manages); a stale copy
+      # silently misses lockfile materialization and self-heal behavior added
+      # in later patch releases. When a newer release of this gem exists in
+      # the same minor series, abort with the reason instead of misbehaving.
+      # Newer releases in other minor series only warn: a family may
+      # deliberately track an older minor. Registry lookup failure never
+      # blocks a release. Skippable with KETTLE_DEV_SKIP_TOOL_CURRENCY_CHECK
+      # for intentionally offline runs.
+      def ensure_release_tool_current!
+        return if truthy_value?(ENV["KETTLE_DEV_SKIP_TOOL_CURRENCY_CHECK"])
+
+        gem_name = "kettle-dev"
+        current = Gem::Version.new(Kettle::Dev::VERSION)
+        latest_overall, latest_series = latest_released_versions(gem_name, current.to_s)
+
+        if latest_series && Gem::Version.new(latest_series) > current
+          raise Error,
+            "kettle-release (#{gem_name} #{current}) is outdated: #{latest_series} is available in " \
+            "the same minor series. Update the invoking Gemfile (bundle update #{gem_name}) and retry."
+        end
+
+        if latest_overall && Gem::Version.new(latest_overall) > current
+          warn("[kettle-release] #{gem_name} #{latest_overall} is available (running #{current} in the #{current.segments[0, 2].join(".")} series).")
+        end
+      end
+
       def latest_released_versions(gem_name, current_version)
         data = Kettle::Dev::RubyGemsVersions.fetch(gem_name, version_hint: current_version)
         return [nil, nil] unless data.is_a?(Array)

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.16"
+      VERSION = "3.1.18"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.16
+  version: 3.1.18
 platform: ruby
 authors:
 - Peter H. Boling
@@ -423,10 +423,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.16
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.16/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.18
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.18/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.16
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.18
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev

metadata.gz.sig

@@ -1,6 +1,2 @@
-fA�J&쨞��/�4�C(gZ��?o��u��%yT��g�Ç�Zyo�i1�������ȬҚ�IU���
-�T�mc4�>୴V;<����DR*j��d�)i�}
-�d�{�������L[��6�_�F��ļ$@
-�B�ᣡk���vqa�Z(�
IU������l>���Z*�?ң�N���{']���!'���N�p�ٚ�t��@IϪ�I�0�P��lA��'���̴e�����D��e3������$|DvA��Qqj���R�����=K*&��s�
�-x��
-o
-hP��&�i�dw����$"�t��0��W����ՠ�B�^��ץ-I<�~l�B6�7{	�
+w,J��5�7-����ϓ?\/�
+�0���,x�i�]k�W~Rs1�D���t��G~���$��NP�+���x�^�f{H�evb��zݽ��Qhk������SYk��0��]�8'�1�$��[*�П��oF�G�k�|`���������+J����"r��	�05�v�m�S��Õ�q<����O�T��+����K�[�����'�"��M�\�lY`"U��|b6�F��<oJh�5ɠ��pvUQ�q���u��_�d�	�6�L�#�ɻ��,���zuN�T¯�Ua��I�e��(�� N�V�r��&Ҍ6r������� �kBK셁d��}b5�^5�����&6w�vr	�?隖Q����&��Hy,�T_�vy�������