kettle-dev 3.1.28 → 3.1.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7b32e53c198f91521db0de1d622d3eaf2a05e9f3e36ef26a168b2514b38494d7
-  data.tar.gz: d36fb7303f562a7556317337f39b7f7824ec5ff5bc33174334aaf8743d1e059e
+  metadata.gz: b5bbcae9e4ae2d02da16163b286f45912220cd5efba41059ece7180b8f8f87bf
+  data.tar.gz: ca49ffbec4f7e7ab8063fb8dc12751e097cedd7c5401aa7ea6a379331d3f0c48
 SHA512:
-  metadata.gz: 3f070d4cee546793360971982e5edd75d99b05bd97c03a0d809664e1fb45bde935e304246744d74238152c90ebeb8310945712efca507a5a4609db2601dd3ebd
-  data.tar.gz: df03d639bb72e06cc70177706dd0dfc185a00cfec4544e6cef5ce44edfbff35813b5cf35b2c143190ec3309a3e7e84e420c0ad5e232a281fcd4d78c341cc92ba
+  metadata.gz: 5109ef39ece4dcd59b0277b25b28c29463c48f8f3bfecbc3508fe9742cd8860e734629c18b377b150ef81894cb78e4f5fbe2d515ffd20c1a591b7936f5d95cf9
+  data.tar.gz: bae2bd4613e1666fdd80c40a3ad24fc43d2950de94c6983bbf954ed8658ed09f89b4e121d7d70bbe987ba64dd89e04d787dd75156fa54ea7609c006ff43ed791

data/CHANGELOG.md

@@ -30,6 +30,37 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.29] - 2026-11-15
+
+- TAG: [v3.1.29][3.1.29t]
+- COVERAGE: 91.95% -- 5856/6369 lines in 48 files
+- BRANCH COVERAGE: 75.81% -- 2247/2964 branches in 48 files
+- 53.68% documented
+
+### Changed
+
+- [kc] kettle-jem/prepare: updated 14 project files:
+  - dependencies (14)
+
+- [kc] kettle-jem/template: updated 17 project files:
+  - code and tests (2)
+  - dependencies (3)
+  - other (3)
+  - workflows (9)
+
+### Fixed
+
+- `BundlerPinning.install_stable` no longer reinstalls an exact Bundler version
+  that is already installed, and serializes installs with a blocking `flock` in
+  the gem dir. Rewriting an installed Bundler in place made parallel family
+  members that were loading it fail with `LoadError` for files under
+  `bundler-X/lib/bundler`.
+
+- `bundle:audit:update` is serialized across processes with a blocking `flock`
+  on a lock file next to the shared ruby-advisory-db, and a failed update is a
+  warning (audit uses the existing copy) when a local database exists. Fixes
+  `cannot lock ref 'refs/remotes/origin/master'` in parallel releases ([#57](https://github.com/kettle-dev/kettle-dev/issues/57)).
+
 ## [3.1.28] - 2026-11-08
 
 - TAG: [v3.1.28][3.1.28t]
@@ -1901,6 +1932,10 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Added
 
+- `KETTLE_DEV_SKIP_AUDIT_UPDATE=true` (also `1`/`yes`/`on`) skips only
+  `bundle:audit:update` while `bundle:audit` still runs, so a coordinator such
+  as kettle-family can update the shared advisory database once ([#57](https://github.com/kettle-dev/kettle-dev/issues/57)).
+
 - `kettle-pre-release` now skips volatile star-history image URLs by default
   during Markdown image validation, and accepts additional
   `.kettle-family.yml` or `KETTLE_FAMILY_CONFIG` patterns under
@@ -4304,7 +4339,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.28...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.29...HEAD
+[3.1.29]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.28...v3.1.29
+[3.1.29t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.29
 [3.1.28]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.27...v3.1.28
 [3.1.28t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.28
 [3.1.27]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.26...v3.1.27

data/README.md

@@ -1048,7 +1048,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.334-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.369-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-release

@@ -137,6 +137,8 @@ if ARGV.include?("-h") || ARGV.include?("--help")
                                   # Use slower appraisal:update instead of default appraisal:generate
       KETTLE_DEV_SKIP_BUNDLE_AUDIT=true
                                   # Skip bundle:audit/update during release rake checks
+      KETTLE_DEV_SKIP_AUDIT_UPDATE=true
+                                  # Skip only bundle:audit:update (advisory-db pull); bundle:audit still runs
       GITHUB_TOKEN / GH_TOKEN     # Optional; enables GitHub release creation and API queries
       GITLAB_TOKEN / GL_TOKEN     # Optional; enables GitLab API queries when applicable
       DEBUG=true                  # Print backtraces on errors

data/lib/kettle/dev/bundler_pinning.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require "bundler"
+require "fileutils"
 require "rubygems/dependency_installer"
 
 module Kettle
@@ -58,15 +59,49 @@ module Kettle
       # stable when nil. rubygems.org only, never prereleases, and a spec
       # reset so the just-installed version is visible to later gem lookups
       # in this process. Returns the installed specs.
+      #
+      # An exact version that is already installed is NOT reinstalled:
+      # RubyGems rewrites an installed gem's files in place, and parallel
+      # family members that are loading that Bundler at the time die with
+      # LoadError for random files under bundler-X/lib/bundler. Installs are
+      # also serialized across processes with a blocking flock in the gem dir,
+      # and the installed check is repeated once the lock is held, so only the
+      # first of several concurrent members actually installs.
       def install_stable(version = nil)
-        original_sources = Gem.sources.to_a
-        Gem.sources = [RUBYGEMS_SOURCE]
-        requirements = version ? ["= #{version}"] : []
-        specs = Gem::DependencyInstaller.new(domain: :remote, prerelease: false, document: []).install("bundler", *requirements)
-        Gem::Specification.reset
-        specs
-      ensure
-        Gem.sources = original_sources if original_sources
+        return [] if version && version_installed?(version)
+
+        with_install_lock do
+          next [] if version && version_installed?(version)
+
+          original_sources = Gem.sources.to_a
+          begin
+            Gem.sources = [RUBYGEMS_SOURCE]
+            requirements = version ? ["= #{version}"] : []
+            specs = Gem::DependencyInstaller.new(domain: :remote, prerelease: false, document: []).install("bundler", *requirements)
+            Gem::Specification.reset
+            specs
+          ensure
+            Gem.sources = original_sources if original_sources
+          end
+        end
+      end
+
+      # True when bundler-VERSION's gemspec is on disk in any Gem.path entry.
+      # Reads the specifications dir directly (see installed_stable) so a
+      # bundle-scoped spec index cannot hide an installed version.
+      def version_installed?(version)
+        Array(Gem.path).any? do |base|
+          File.file?(File.join(base, "specifications", "bundler-#{version}.gemspec"))
+        end
+      end
+
+      def with_install_lock(&block)
+        dir = Gem.dir
+        FileUtils.mkdir_p(dir)
+        File.open(File.join(dir, ".kettle-bundler-install.lock"), File::RDWR | File::CREAT, 0o644) do |lock|
+          lock.flock(File::LOCK_EX)
+          block.call
+        end
       end
 
       # The version a release should pin BUNDLED WITH to: the registry's

data/lib/kettle/dev/rakelib/bundle_audit.rake

@@ -1,6 +1,43 @@
 # frozen_string_literal: true
 
 skip_bundle_audit = %w[1 true yes on].include?(ENV.fetch("KETTLE_DEV_SKIP_BUNDLE_AUDIT", "").downcase)
+# Skips only the advisory database update; bundle:audit itself still runs.
+skip_audit_update = %w[1 true yes on].include?(ENV.fetch("KETTLE_DEV_SKIP_AUDIT_UPDATE", "").downcase)
+
+# Replaces bundler-audit's `bundle:audit:update` body. The ruby-advisory-db
+# lives in one directory shared by every process (e.g. parallel family
+# releases), so the update is serialized with a blocking flock on a lock file
+# next to the database, and a failed update is non-fatal when a usable local
+# copy exists.
+redefine_audit_update_task = lambda do
+  require "fileutils"
+  require "bundler/audit/database"
+  Rake::Task["bundle:audit:update"].clear
+  # rubocop:disable Rake/DuplicateTask
+  desc("Updates the bundler-audit vulnerability database (serialized; see KETTLE_DEV_SKIP_AUDIT_UPDATE)")
+  task("bundle:audit:update") do
+    if skip_audit_update
+      warn("NOTE: bundle:audit:update skipped because KETTLE_DEV_SKIP_AUDIT_UPDATE is enabled")
+      next
+    end
+    db_path = Bundler::Audit::Database.path
+    lock_path = "#{db_path.to_s.chomp("/")}.lock"
+    FileUtils.mkdir_p(File.dirname(lock_path))
+    ok = File.open(lock_path, File::RDWR | File::CREAT, 0o644) do |lock|
+      lock.flock(File::LOCK_EX) # blocks until other updaters finish
+      system("bundler-audit", "update")
+    end
+    unless ok
+      if Bundler::Audit::Database.exists?(db_path)
+        warn("WARNING: bundle:audit:update failed; auditing with the existing local database at #{db_path}")
+      else
+        warn("ERROR: bundle:audit:update failed and no local advisory database exists at #{db_path}")
+        exit($?&.exitstatus || 1)
+      end
+    end
+  end
+  # rubocop:enable Rake/DuplicateTask
+end
 
 define_bundle_audit_stub_tasks = lambda do |description_prefix, warning|
   desc("#{description_prefix} bundle:audit")
@@ -8,7 +45,7 @@ define_bundle_audit_stub_tasks = lambda do |description_prefix, warning|
     warn(warning.call("bundle:audit"))
   end
   desc("#{description_prefix} bundle:audit:update")
-  task("bundle:audit:update") do
+  task("bundle:audit:update") do # rubocop:disable Rake/DuplicateTask
     warn(warning.call("bundle:audit:update"))
   end
 end
@@ -24,6 +61,7 @@ else
     require "bundler/audit/task"
 
     Bundler::Audit::Task.new
+    redefine_audit_update_task.call
     Kettle::Dev.register_default("bundle:audit:update")
     Kettle::Dev.register_default("bundle:audit")
   rescue LoadError

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.28"
+      VERSION = "3.1.29"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data.tar.gz.sig

@@ -1,2 +1,6 @@
-t�h�KBbj�v�N���l�ܧ$��;
Mc����i�n��m��VEx��bgݏ�>����E#����6���Q#�l?w��Dy��ZX*ϑr���]�{~���0����7ʲdI3���tlF«"i����}&L3ʅ�v=����h_b���Fj��X��5����%�g�
��!�sX�f[�>���GF����٩�.���"5�|��]
(���O���-��n�܈u�]5B5\�p���3�eC��2�Ǭ�!��f�%���_f{�:)�����ƙ������]�1�h��i"��)����4�2��
-PU[��
+Zpܪ7����:�}���c2:,:�.�[�0����ߑ!@�î�s��(��+�B����*��P�+��F��}T���>����m�Cvx��-�	+5��x
+��WɶRh�T׮���-�N9��\�ut��:��G��
+fy&�V��x
+f:|�l	^�`��"^ɒ�>]�I('ڕ�k
+���
+�K3��W��'�7��Ja��A݌���"���iF}O49���\��}�cR,\p
��(�y/���@��@e�Y<p�O��"��i�:}�6�js���ƃ�RʏCO �T

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.28
+  version: 3.1.29
 platform: ruby
 authors:
 - Peter H. Boling
@@ -120,7 +120,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.29
+        version: 2.0.30
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -130,7 +130,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.29
+        version: 2.0.30
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -276,7 +276,7 @@ dependencies:
         version: '4.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -286,7 +286,7 @@ dependencies:
         version: '4.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 4.0.0
+        version: 4.0.2
 - !ruby/object:Gem::Dependency
   name: stone_checksums
   requirement: !ruby/object:Gem::Requirement
@@ -296,7 +296,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.9
+        version: 1.0.10
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -306,7 +306,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.9
+        version: 1.0.10
 - !ruby/object:Gem::Dependency
   name: gitmoji-regex
   requirement: !ruby/object:Gem::Requirement
@@ -316,7 +316,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.15
+        version: 2.0.16
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -326,7 +326,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.15
+        version: 2.0.16
 description: "\U0001F372 Kettle::Dev is a meta tool from kettle-dev to streamline
   development and testing. Acts as a shim dependency, pulling in many other dependencies,
   to give you OOTB productivity with a RubyGem, or Ruby app project. Configures a
@@ -423,10 +423,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.28
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.28/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.29
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.29/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.28
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.29
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev