kettle-dev 3.1.27 → 3.1.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e391ff1f791933e2aaf7c311d4c82b24b20ff96593a5c61f0b3235fa07f45020
-  data.tar.gz: fc411b2a642eee1caf27824ef848639935196208c2feb93d729f7f040332f4bc
+  metadata.gz: b5bbcae9e4ae2d02da16163b286f45912220cd5efba41059ece7180b8f8f87bf
+  data.tar.gz: ca49ffbec4f7e7ab8063fb8dc12751e097cedd7c5401aa7ea6a379331d3f0c48
 SHA512:
-  metadata.gz: 334787f8c781d7b92c660690e8ca95e9e037ed094af6197187e9e2103e5947266fbe1b187a81f54493b55726bc98c5067a51439d1000261851adf12fcea225a7
-  data.tar.gz: 203eccaf2cae1a925fb981b817f1dd4b93e5e7250ba8c3c4860c666dfa9add25b7c9f42a1d645c5e37de16b58ce8b5a860b137d4751e8975ea8e2775b074a7bc
+  metadata.gz: 5109ef39ece4dcd59b0277b25b28c29463c48f8f3bfecbc3508fe9742cd8860e734629c18b377b150ef81894cb78e4f5fbe2d515ffd20c1a591b7936f5d95cf9
+  data.tar.gz: bae2bd4613e1666fdd80c40a3ad24fc43d2950de94c6983bbf954ed8658ed09f89b4e121d7d70bbe987ba64dd89e04d787dd75156fa54ea7609c006ff43ed791

data/CHANGELOG.md

@@ -30,6 +30,48 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.29] - 2026-11-15
+
+- TAG: [v3.1.29][3.1.29t]
+- COVERAGE: 91.95% -- 5856/6369 lines in 48 files
+- BRANCH COVERAGE: 75.81% -- 2247/2964 branches in 48 files
+- 53.68% documented
+
+### Changed
+
+- [kc] kettle-jem/prepare: updated 14 project files:
+  - dependencies (14)
+
+- [kc] kettle-jem/template: updated 17 project files:
+  - code and tests (2)
+  - dependencies (3)
+  - other (3)
+  - workflows (9)
+
+### Fixed
+
+- `BundlerPinning.install_stable` no longer reinstalls an exact Bundler version
+  that is already installed, and serializes installs with a blocking `flock` in
+  the gem dir. Rewriting an installed Bundler in place made parallel family
+  members that were loading it fail with `LoadError` for files under
+  `bundler-X/lib/bundler`.
+
+- `bundle:audit:update` is serialized across processes with a blocking `flock`
+  on a lock file next to the shared ruby-advisory-db, and a failed update is a
+  warning (audit uses the existing copy) when a local database exists. Fixes
+  `cannot lock ref 'refs/remotes/origin/master'` in parallel releases ([#57](https://github.com/kettle-dev/kettle-dev/issues/57)).
+
+## [3.1.28] - 2026-11-08
+
+- TAG: [v3.1.28][3.1.28t]
+- COVERAGE: 91.76% -- 5812/6334 lines in 48 files
+- BRANCH COVERAGE: 75.58% -- 2231/2952 branches in 48 files
+- 53.70% documented
+
+### Fixed
+
+- kettle-release and readme-backers: use `type(scope): Gitmoji subject` messages for generated commits, compatible with Poly and Kettle Jem hooks.
+
 ## [3.1.27] - 2026-11-08
 
 - TAG: [v3.1.27][3.1.27t]
@@ -1890,6 +1932,10 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Added
 
+- `KETTLE_DEV_SKIP_AUDIT_UPDATE=true` (also `1`/`yes`/`on`) skips only
+  `bundle:audit:update` while `bundle:audit` still runs, so a coordinator such
+  as kettle-family can update the shared advisory database once ([#57](https://github.com/kettle-dev/kettle-dev/issues/57)).
+
 - `kettle-pre-release` now skips volatile star-history image URLs by default
   during Markdown image validation, and accepts additional
   `.kettle-family.yml` or `KETTLE_FAMILY_CONFIG` patterns under
@@ -4293,7 +4339,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.27...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.29...HEAD
+[3.1.29]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.28...v3.1.29
+[3.1.29t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.29
+[3.1.28]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.27...v3.1.28
+[3.1.28t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.28
 [3.1.27]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.26...v3.1.27
 [3.1.27t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.27
 [3.1.26]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.25...v3.1.26

data/README.md

@@ -400,8 +400,8 @@ What it does:
     - Validates Markdown reference definitions and local heading anchors across releasable documentation before network checks.
       Markdown fixtures under `spec/` and `test/`, along with `tmp/`, are intentionally excluded.
     - Skips pre-release checks for any `start_step` greater than `0`, so resumptions begin directly at the requested numbered step.
-    - Verifies Bundler >= 2.7, updates the primary and appraisal bundles with `bundle update --bundler`, and commits those lockfiles separately as `🔒️ Update bundle` before release preparation.
-    - Runs sanity checks (`bin/setup`, `bin/rake`), confirms version/changelog, optionally updates Appraisals, regenerates docs via `bin/rake yard`, and commits “🔖 Prepare release vX.Y.Z”. Use `--skip-appraisals` only to omit appraisal generation while retaining documentation generation.
+    - Verifies Bundler >= 2.7, updates the primary and appraisal bundles with `bundle update --bundler`, and commits those lockfiles separately as `chore(deps): 🔒️ update Bundler lockfiles` before release preparation.
+    - Runs sanity checks (`bin/setup`, `bin/rake`), confirms version/changelog, optionally updates Appraisals, regenerates docs via `bin/rake yard`, and commits `chore(release): 🔖 prepare release vX.Y.Z`. Use `--skip-appraisals` only to omit appraisal generation while retaining documentation generation.
     - Optionally runs your CI locally with `act` before any push:
         - Enable with env: `K_RELEASE_LOCAL_CI="true"` (run automatically) or `K_RELEASE_LOCAL_CI="ask"` (prompt \[Y/n\]).
         - Select workflow with `K_RELEASE_LOCAL_CI_WORKFLOW` (with or without .yml/.yaml). Defaults to `locked_deps.yml` if present; otherwise the first workflow discovered.
@@ -476,7 +476,7 @@ What it does:
     - At release step 1, `kettle-release` runs the equivalent of
       `kettle-family bupb`: it updates the primary lockfile and, when present,
       `Appraisal.root.gemfile.lock`, resets appraisal locks, and commits only
-      those lockfiles as `🔒️ Update bundle`. This keeps Bundler maintenance in
+      those lockfiles as `chore(deps): 🔒️ update Bundler lockfiles`. This keeps Bundler maintenance in
       its own atomic commit. `kettle-changelog` writes changelog content but
       does not own this commit; the release helper commits release metadata
       separately.
@@ -743,10 +743,10 @@ versions that are newer than the latest released version.
     - If neither the backers nor sponsors tags are present, prints a helpful warning and exits with status 2.
     - When there are no entries, inserts a friendly placeholder: "No backers yet. Be the first\!" or "No sponsors yet. Be the first\!".
     - When updates are written and the repository is a git work tree, the script stages README.md and commits with a message thanking new backers and subscribers, including mentions for any newly added backers and subscribers (GitHub @handles when their website/profile is a github.com URL; otherwise their name).
-    - Customize the commit subject via env var: `KETTLE_README_BACKERS_COMMIT_SUBJECT="💸 Thanks 🙏 to our new backers 🎒 and subscribers 📜"`.
-        - Or via .opencollective.yml: set `readme-backers-commit-subject: "💸 Thanks 🙏 to our new backers 🎒 and subscribers 📜"`.
+    - Customize the commit subject via env var: `KETTLE_README_BACKERS_COMMIT_SUBJECT="chore(readme): 💸 thank new backers and subscribers"`.
+        - Or via .opencollective.yml: set `readme-backers-commit-subject: "chore(readme): 💸 thank new backers and subscribers"`.
         - Precedence: ENV overrides .opencollective.yml; if neither is set, a sensible default is used.
-        - Note: When used with the provided `.git-hooks`, the subject should start with a gitmoji character (see [gitmoji][📌gitmoji]).
+        - Use the format `type(scope): Gitmoji subject` (see [gitmoji][📌gitmoji]).
 - Tip:
     - Run this locally before committing to keep your README current, or schedule it in CI to refresh periodically.
     - It runs automatically on a once-a-week schedule by the .github/workflows/opencollective.yml workflow that is part of the kettle-jem template.
@@ -1048,7 +1048,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.334-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.369-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-release

@@ -137,6 +137,8 @@ if ARGV.include?("-h") || ARGV.include?("--help")
                                   # Use slower appraisal:update instead of default appraisal:generate
       KETTLE_DEV_SKIP_BUNDLE_AUDIT=true
                                   # Skip bundle:audit/update during release rake checks
+      KETTLE_DEV_SKIP_AUDIT_UPDATE=true
+                                  # Skip only bundle:audit:update (advisory-db pull); bundle:audit still runs
       GITHUB_TOKEN / GH_TOKEN     # Optional; enables GitHub release creation and API queries
       GITLAB_TOKEN / GL_TOKEN     # Optional; enables GitLab API queries when applicable
       DEBUG=true                  # Print backtraces on errors

data/lib/kettle/dev/bundler_pinning.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "bundler"
+require "fileutils"
 require "rubygems/dependency_installer"
 
 module Kettle
@@ -58,15 +59,49 @@ module Kettle
       # stable when nil. rubygems.org only, never prereleases, and a spec
       # reset so the just-installed version is visible to later gem lookups
       # in this process. Returns the installed specs.
+      #
+      # An exact version that is already installed is NOT reinstalled:
+      # RubyGems rewrites an installed gem's files in place, and parallel
+      # family members that are loading that Bundler at the time die with
+      # LoadError for random files under bundler-X/lib/bundler. Installs are
+      # also serialized across processes with a blocking flock in the gem dir,
+      # and the installed check is repeated once the lock is held, so only the
+      # first of several concurrent members actually installs.
       def install_stable(version = nil)
-        original_sources = Gem.sources.to_a
-        Gem.sources = [RUBYGEMS_SOURCE]
-        requirements = version ? ["= #{version}"] : []
-        specs = Gem::DependencyInstaller.new(domain: :remote, prerelease: false, document: []).install("bundler", *requirements)
-        Gem::Specification.reset
-        specs
-      ensure
-        Gem.sources = original_sources if original_sources
+        return [] if version && version_installed?(version)
+
+        with_install_lock do
+          next [] if version && version_installed?(version)
+
+          original_sources = Gem.sources.to_a
+          begin
+            Gem.sources = [RUBYGEMS_SOURCE]
+            requirements = version ? ["= #{version}"] : []
+            specs = Gem::DependencyInstaller.new(domain: :remote, prerelease: false, document: []).install("bundler", *requirements)
+            Gem::Specification.reset
+            specs
+          ensure
+            Gem.sources = original_sources if original_sources
+          end
+        end
+      end
+
+      # True when bundler-VERSION's gemspec is on disk in any Gem.path entry.
+      # Reads the specifications dir directly (see installed_stable) so a
+      # bundle-scoped spec index cannot hide an installed version.
+      def version_installed?(version)
+        Array(Gem.path).any? do |base|
+          File.file?(File.join(base, "specifications", "bundler-#{version}.gemspec"))
+        end
+      end
+
+      def with_install_lock(&block)
+        dir = Gem.dir
+        FileUtils.mkdir_p(dir)
+        File.open(File.join(dir, ".kettle-bundler-install.lock"), File::RDWR | File::CREAT, 0o644) do |lock|
+          lock.flock(File::LOCK_EX)
+          block.call
+        end
       end
 
       # The version a release should pin BUNDLED WITH to: the registry's

data/lib/kettle/dev/rakelib/bundle_audit.rake

@@ -1,6 +1,43 @@
 # frozen_string_literal: true
 
 skip_bundle_audit = %w[1 true yes on].include?(ENV.fetch("KETTLE_DEV_SKIP_BUNDLE_AUDIT", "").downcase)
+# Skips only the advisory database update; bundle:audit itself still runs.
+skip_audit_update = %w[1 true yes on].include?(ENV.fetch("KETTLE_DEV_SKIP_AUDIT_UPDATE", "").downcase)
+
+# Replaces bundler-audit's `bundle:audit:update` body. The ruby-advisory-db
+# lives in one directory shared by every process (e.g. parallel family
+# releases), so the update is serialized with a blocking flock on a lock file
+# next to the database, and a failed update is non-fatal when a usable local
+# copy exists.
+redefine_audit_update_task = lambda do
+  require "fileutils"
+  require "bundler/audit/database"
+  Rake::Task["bundle:audit:update"].clear
+  # rubocop:disable Rake/DuplicateTask
+  desc("Updates the bundler-audit vulnerability database (serialized; see KETTLE_DEV_SKIP_AUDIT_UPDATE)")
+  task("bundle:audit:update") do
+    if skip_audit_update
+      warn("NOTE: bundle:audit:update skipped because KETTLE_DEV_SKIP_AUDIT_UPDATE is enabled")
+      next
+    end
+    db_path = Bundler::Audit::Database.path
+    lock_path = "#{db_path.to_s.chomp("/")}.lock"
+    FileUtils.mkdir_p(File.dirname(lock_path))
+    ok = File.open(lock_path, File::RDWR | File::CREAT, 0o644) do |lock|
+      lock.flock(File::LOCK_EX) # blocks until other updaters finish
+      system("bundler-audit", "update")
+    end
+    unless ok
+      if Bundler::Audit::Database.exists?(db_path)
+        warn("WARNING: bundle:audit:update failed; auditing with the existing local database at #{db_path}")
+      else
+        warn("ERROR: bundle:audit:update failed and no local advisory database exists at #{db_path}")
+        exit($?&.exitstatus || 1)
+      end
+    end
+  end
+  # rubocop:enable Rake/DuplicateTask
+end
 
 define_bundle_audit_stub_tasks = lambda do |description_prefix, warning|
   desc("#{description_prefix} bundle:audit")
@@ -8,7 +45,7 @@ define_bundle_audit_stub_tasks = lambda do |description_prefix, warning|
     warn(warning.call("bundle:audit"))
   end
   desc("#{description_prefix} bundle:audit:update")
-  task("bundle:audit:update") do
+  task("bundle:audit:update") do # rubocop:disable Rake/DuplicateTask
     warn(warning.call("bundle:audit:update"))
   end
 end
@@ -24,6 +61,7 @@ else
     require "bundler/audit/task"
 
     Bundler::Audit::Task.new
+    redefine_audit_update_task.call
     Kettle::Dev.register_default("bundle:audit:update")
     Kettle::Dev.register_default("bundle:audit")
   rescue LoadError

data/lib/kettle/dev/readme_backers.rb

@@ -20,7 +20,7 @@ module Kettle
       # Default README is the one in the current working directory of the host project
       README_PATH = File.expand_path("README.md", Dir.pwd)
       README_OSC_TAG_DEFAULT = "OPENCOLLECTIVE"
-      COMMIT_SUBJECT_DEFAULT = "💸 Thanks 🙏 to our new backers 🎒 and subscribers 📜"
+      COMMIT_SUBJECT_DEFAULT = "chore(readme): 💸 thank new backers and subscribers"
       # Deprecated constant maintained for backwards compatibility in tests/specs.
       # Prefer OpenCollectiveConfig.yaml_path going forward, but resolve to the host project root.
       OC_YML_PATH = OpenCollectiveConfig.yaml_path(Dir.pwd)

data/lib/kettle/dev/release_cli.rb

@@ -2037,7 +2037,7 @@ module Kettle
 
         puts "Committing Bundler update in #{paths.length} lockfile(s)."
         abort("Failed to stage Bundler update lockfiles.") unless @git.add_repository_paths(paths)
-        abort("Failed to commit Bundler update lockfiles.") unless @git.commit_staged("🔒️ Update bundle", env: release_git_hook_environment)
+        abort("Failed to commit Bundler update lockfiles.") unless @git.commit_staged("chore(deps): 🔒️ update Bundler lockfiles", env: release_git_hook_environment)
         reconcile_bundle_update_commit!
         true
       end
@@ -2492,7 +2492,7 @@ module Kettle
       end
 
       def commit_release_prep!(version)
-        msg = "🔖 Prepare release v#{version}#{release_prep_ci_marker}"
+        msg = "chore(release): 🔖 prepare release v#{version}#{release_prep_ci_marker}"
         # Stage all changes (including new/untracked files) prior to committing
         abort("Failed to stage release prep changes.") unless @git.add_all
         out, _ = git_output(["status", "--porcelain"])

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.27"
+      VERSION = "3.1.29"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data.tar.gz.sig

@@ -1,3 +1,6 @@
-?8��4w��/�y2�_R��UO[wY!����I
-����Ы6>��:���Uzg9�q���T��5lQ�<���®��$�m�"���imI�:��Kk�t�yD�L�E-d.6pB�P|b{�f'�ܥ���:���3��>�~�7�/�͔mi���V��(H�����"�Kp�b�eC
-&U�I~����
�&x�/?t'ޯ|=ϯxT��@�^[�ٙ�Ru�[,�aG���3a��W�T��3Z5N{��-�_ŲXF���h��OB�k�ރf=$N�t�E7�f�w^�a��_[-׺��1���4��2�&e�@@����p�Y�)~�he'����Fk��p��-'�8��l�T����>d��*�2��и���٨�I����
+Zpܪ7����:�}���c2:,:�.�[�0����ߑ!@�î�s��(��+�B����*��P�+��F��}T���>����m�Cvx��-�	+5��x
+��WɶRh�T׮���-�N9��\�ut��:��G��
+fy&�V��x
+f:|�l	^�`��"^ɒ�>]�I('ڕ�k
+���
+�K3��W��'�7��Ja��A݌���"���iF}O49���\��}�cR,\p
��(�y/���@��@e�Y<p�O��"��i�:}�6�js���ƃ�RʏCO �T

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.27
+  version: 3.1.29
 platform: ruby
 authors:
 - Peter H. Boling
@@ -120,7 +120,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.29
+        version: 2.0.30
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -130,7 +130,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.29
+        version: 2.0.30
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -276,7 +276,7 @@ dependencies:
         version: '4.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -286,7 +286,7 @@ dependencies:
         version: '4.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.2
 - !ruby/object:Gem::Dependency
   name: stone_checksums
   requirement: !ruby/object:Gem::Requirement
@@ -296,7 +296,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.9
+        version: 1.0.10
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -306,7 +306,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.9
+        version: 1.0.10
 - !ruby/object:Gem::Dependency
   name: gitmoji-regex
   requirement: !ruby/object:Gem::Requirement
@@ -316,7 +316,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.15
+        version: 2.0.16
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -326,7 +326,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.15
+        version: 2.0.16
 description: "\U0001F372 Kettle::Dev is a meta tool from kettle-dev to streamline
   development and testing. Acts as a shim dependency, pulling in many other dependencies,
   to give you OOTB productivity with a RubyGem, or Ruby app project. Configures a
@@ -423,10 +423,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.27
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.27/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.29
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.29/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.27
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.29
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev