kettle-dev 2.3.0 → 2.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 12ded2228617ffab7dbd8c9d6712dbae7ce229cb86e243c49a357f49e2777702
-  data.tar.gz: b2db64901a1d1e8bbaebfcfdc2b12c6c5bb2d67ee970a5216a7e5f2279b3b352
+  metadata.gz: 9af988c7e6584e30cd1ee4c7a799dbe13a7322e166c95a439fb131d627bb5145
+  data.tar.gz: 7579a10cf684681b1ae88cb9d9c2f0c0a73a1acd3a7f22f74a35277a03882e2f
 SHA512:
-  metadata.gz: 28a7ecbc70b68c1f4b430234b006c11643f280b0474c2f4f9627d1896f7cbe8d46e702587528ce4fdec63b730aef6dce72c6ed62dec7cee916ffb5a6b9737084
-  data.tar.gz: 53305c2ed6b3cbf3c66c20f453a90524b28a0af396acc285a905fe6336fdfbd35d98ec21ed503fa4b856ce1324098efe228751b4422c9a01eb49103333cb0d01
+  metadata.gz: 77ca7f3d5b0135b37e2f817c173cc111561d37c805103d1f34fada9b3f4cc42f8c4e47b9e45e2327436221f67918b25ff80e8f6b86b8fca2e2364318bbec059f
+  data.tar.gz: 82e064b7576902016b5443f2b30db1b6a2203259d51b865ea3c0eeaec2e3612b00dabcaee453ae74b7f0015066eedc47bcb2803856ba56b95f16b16ae837cfc0

data/CHANGELOG.md

@@ -30,6 +30,39 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.3.1] - 2026-07-10
+
+- TAG: [v2.3.1][2.3.1t]
+- COVERAGE: 91.69% -- 4271/4658 lines in 36 files
+- BRANCH COVERAGE: 73.08% -- 1683/2303 branches in 36 files
+- 57.30% documented
+
+### Added
+
+- `kettle-pre-release` now skips volatile star-history image URLs by default
+  during Markdown image validation, and accepts additional
+  `.kettle-family.yml` or `KETTLE_FAMILY_CONFIG` patterns under
+  `pre_release.image_url_skip_patterns`.
+
+- `kettle-release --skip-bundle-audit` and `KETTLE_DEV_SKIP_BUNDLE_AUDIT=true`
+  now disable the release-flow `bundle:audit` and `bundle:audit:update` rake
+  defaults so a known advisory can be handled outside the automated release.
+
+### Changed
+
+- `require "kettle/dev"` no longer loads `version_gem` by default; require
+  `kettle/dev/version_gem` for the optional `VersionGem::Basic` extension.
+
+### Fixed
+
+- Legacy-engine CI workflows now install Bundler gems under
+  `${RUNNER_TEMP}/bundle` instead of `vendor/bundle`, and RuboCop now excludes
+  nested `vendor/` trees such as `gemfiles/vendor`.
+
+- `kettle-release --skip-bundle-audit` now also prefixes release `bin/rake`
+  commands with `KETTLE_DEV_SKIP_BUNDLE_AUDIT=true`, ensuring the skip reaches
+  the rake process during release checks.
+
 ## [2.3.0] - 2026-07-02
 
 - TAG: [v2.3.0][2.3.0t]
@@ -2409,7 +2442,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.0...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.1...HEAD
+[2.3.1]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.0...v2.3.1
+[2.3.1t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.1
 [2.3.0]: https://github.com/kettle-dev/kettle-dev/compare/v2.2.25...v2.3.0
 [2.3.0t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.3.0
 [2.2.25]: https://github.com/kettle-dev/kettle-dev/compare/v2.2.24...v2.2.25

data/README.md

@@ -496,6 +496,14 @@ What it does:
     - 1) Validate GitHub Actions workflow action refs with `kettle-gha-sha-pins --check`; if pins are stale, it prints an outdated-actions summary, exits non-zero, and recommends `kettle-gha-sha-pins --write --upgrade patch`.
     - 2) Normalize Markdown image URLs.
     - 3) Validate that all image URLs referenced by Markdown files resolve (HTTP HEAD).
+- Image URL skips:
+    - Star-history image API URLs are skipped by default because they are volatile.
+    - Add project-specific shell-style URL patterns in `.kettle-family.yml` or a config path pointed to by `KETTLE_FAMILY_CONFIG`:
+        ```yaml
+        pre_release:
+          image_url_skip_patterns:
+            - https://assets.example.com/generated/*
+        ```
 
 ### Commit message helper (git hook)
 
@@ -874,7 +882,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.585-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.658-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-release

@@ -43,7 +43,7 @@ end
 # Do not guard with __FILE__ == $PROGRAM_NAME because binstubs use Kernel.load.
 if ARGV.include?("-h") || ARGV.include?("--help")
   puts <<~USAGE
-    Usage: kettle-release [--version VERSION] [--local-ci] [--appraisal-update] [--skip-steps STEPS] [start_step=<0-19>]
+    Usage: kettle-release [--version VERSION] [--local-ci] [--appraisal-update] [--skip-bundle-audit] [--skip-steps STEPS] [start_step=<0-19>]
 
     Automates the release flow for a Ruby gem in the host project.
 
@@ -80,6 +80,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       --skip-steps NUMBERS        # Alias for skip_steps=NUMBERS (e.g., --skip-steps 10 or --skip-steps 10,18)
       --version VERSION           # Use this version instead of detecting VERSION from lib/**/version.rb
       --appraisal-update          # Use slower appraisal:update instead of default appraisal:generate
+      --skip-bundle-audit         # Skip bundle:audit/update during release rake checks
       --local-ci                  # Sensitive release mode: run act locally, publish before any git push,
                                   # create the git tag locally, then push commits and tags after publish
 
@@ -90,6 +91,8 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       K_RELEASE_LOCAL_CI_WORKFLOW # Name of workflow (without .yml) for local CI; defaults to locked_deps or first
       KETTLE_RELEASE_APPRAISAL_TASK=appraisal:update
                                   # Use slower appraisal:update instead of default appraisal:generate
+      KETTLE_DEV_SKIP_BUNDLE_AUDIT=true
+                                  # Skip bundle:audit/update during release rake checks
       GITHUB_TOKEN / GH_TOKEN     # Optional; enables GitHub release creation and API queries
       GITLAB_TOKEN / GL_TOKEN     # Optional; enables GitLab API queries when applicable
       DEBUG=true                  # Print backtraces on errors
@@ -144,13 +147,14 @@ end
 
 local_ci = ARGV.include?("--local-ci")
 appraisal_task = ARGV.delete("--appraisal-update") ? "appraisal:update" : nil
+skip_bundle_audit = !!ARGV.delete("--skip-bundle-audit")
 start_step_arg = ARGV.find { |a| a.start_with?("start_step=") }
 start_step = start_step_arg ? start_step_arg.split("=", 2)[1].to_i : 0
 version_override = extract_version_arg!(ARGV)
 skip_steps = extract_skip_steps_arg!(ARGV)
 
 begin
-  Kettle::Dev::ReleaseCLI.new(start_step: start_step, local_ci: local_ci, version: version_override, appraisal_task: appraisal_task, skip_steps: skip_steps).run
+  Kettle::Dev::ReleaseCLI.new(start_step: start_step, local_ci: local_ci, version: version_override, appraisal_task: appraisal_task, skip_steps: skip_steps, skip_bundle_audit: skip_bundle_audit).run
 rescue LoadError => e
   warn("#{script_basename}: could not load dependency: #{e.class}: #{e.message}")
   warn(Array(e.backtrace).join("\n")) if ENV["DEBUG"]

data/lib/kettle/dev/cache_progress.rb

@@ -8,15 +8,17 @@ module Kettle
       FORMAT = "%t %b %c/%C"
       LENGTH = 30
 
-      def initialize(total:, cached_title:, live_title:, output:, enabled: true)
+      def initialize(total:, cached_title:, live_title:, output:, enabled: true, skipped_title: nil)
         @total = total.to_i
         @cached_count = 0
         @live_count = 0
+        @skipped_count = 0
         @cached_bar = progress_bar(cached_title, output, enabled)
         @live_bar = progress_bar(live_title, output, enabled)
+        @skipped_bar = skipped_title ? progress_bar(skipped_title, output, enabled) : nil
       end
 
-      attr_reader :cached_count, :live_count
+      attr_reader :cached_count, :live_count, :skipped_count
 
       def cached
         @cached_count += 1
@@ -28,6 +30,11 @@ module Kettle
         @live_bar&.increment
       end
 
+      def skipped
+        @skipped_count += 1
+        @skipped_bar&.increment
+      end
+
       private
 
       def progress_bar(title, output, enabled)

data/lib/kettle/dev/pre_release_cli.rb

@@ -4,6 +4,7 @@ require "optparse"
 require "English"
 require "json"
 require "fileutils"
+require "yaml"
 require "uri"
 require "net/http"
 require "openssl"
@@ -26,6 +27,10 @@ module Kettle
     # Usage: Kettle::Dev::PreReleaseCLI.new(check_num: 1).run
     class PreReleaseCLI
       IMAGE_URL_CACHE_TTL_SECONDS = 7 * 24 * 60 * 60
+      DEFAULT_IMAGE_URL_SKIP_PATTERNS = [
+        "https://api.star-history.com/svg*"
+      ].freeze
+      FAMILY_CONFIG_PATHS = [".kettle-family.yml", ".structuredmerge/kettle-family.yml"].freeze
 
       # Simple HTTP helpers for link validation
       module HTTP
@@ -271,6 +276,7 @@ module Kettle
         @check_num = 1 if @check_num < 1
         @image_url_cache_path = configured_image_url_cache_path
         @refresh_image_url_cache = env_truthy?(ENV["KETTLE_IMAGE_URL_CACHE_REFRESH"])
+        @image_url_skip_patterns = configured_image_url_skip_patterns
       end
 
       # Execute configured checks starting from @check_num.
@@ -359,15 +365,23 @@ module Kettle
         puts "[kettle-pre-release] Check 3: Validate Markdown image links (cached HTTP HEAD, with GET fallback)"
         urls = Markdown.extract_image_urls_from_files
         puts "[kettle-pre-release] Found #{urls.size} unique image URL(s)."
+        skipped = []
         cache = image_url_cache
         progress = CacheProgress.new(
           total: urls.size,
           cached_title: "Images cached",
           live_title: "Images live",
+          skipped_title: "Images skipped",
           output: $stdout
         )
         failures = []
         urls.each do |url|
+          if image_url_skipped?(url)
+            skipped << url
+            progress.skipped
+            next
+          end
+
           if cache && !@refresh_image_url_cache && cache.fresh_success?(url)
             progress.cached
             next
@@ -382,6 +396,7 @@ module Kettle
           end
         end
         puts "[kettle-pre-release] Image URL checks: #{progress.cached_count} cached, #{progress.live_count} live."
+        puts "[kettle-pre-release] Skipped #{progress.skipped_count} image URL check(s)." if skipped.any?
         if failures.any?
           warn("[kettle-pre-release] #{failures.size} image URL(s) failed validation:")
           failures.each { |u| warn("  - #{u}") }
@@ -411,6 +426,51 @@ module Kettle
       def env_truthy?(value)
         !!value.to_s.strip.match?(/\A(true|y|yes|1|on)\z/i)
       end
+
+      def configured_image_url_skip_patterns
+        DEFAULT_IMAGE_URL_SKIP_PATTERNS + family_configured_image_url_skip_patterns
+      end
+
+      def family_configured_image_url_skip_patterns
+        data = family_config_data
+        patterns = data.dig("pre_release", "image_url_skip_patterns")
+        Array(patterns).map(&:to_s).reject(&:empty?)
+      end
+
+      def family_config_data
+        config_path = configured_family_config_path
+        return {} unless config_path
+
+        data = stringify_keys(YAML.load_file(config_path) || {})
+        data.is_a?(Hash) ? data : {}
+      rescue Psych::SyntaxError, Errno::EACCES => e
+        warn("[kettle-pre-release] Could not read #{config_path}: #{e.class}: #{e.message}")
+        {}
+      end
+
+      def configured_family_config_path
+        env_path = ENV.fetch("KETTLE_FAMILY_CONFIG", nil)
+        return File.expand_path(env_path) if env_path && File.file?(File.expand_path(env_path))
+
+        FAMILY_CONFIG_PATHS.find { |path| File.file?(path) }
+      end
+
+      def image_url_skipped?(url)
+        @image_url_skip_patterns.any? do |pattern|
+          File.fnmatch?(pattern, url, File::FNM_CASEFOLD)
+        end
+      end
+
+      def stringify_keys(value)
+        case value
+        when Hash
+          value.to_h { |key, item| [key.to_s, stringify_keys(item)] }
+        when Array
+          value.map { |item| stringify_keys(item) }
+        else
+          value
+        end
+      end
     end
   end
 end

data/lib/kettle/dev/rakelib/bundle_audit.rake

@@ -1,20 +1,36 @@
 # frozen_string_literal: true
 
-# Setup Bundle Audit
-begin
-  require "bundler/audit/task"
+skip_bundle_audit = %w[1 true yes on].include?(ENV.fetch("KETTLE_DEV_SKIP_BUNDLE_AUDIT", "").downcase)
 
-  Bundler::Audit::Task.new
-  Kettle::Dev.register_default("bundle:audit:update")
-  Kettle::Dev.register_default("bundle:audit")
-rescue LoadError
-  warn("[kettle-dev][bundle_audit.rake] failed to load bundle/audit/task") if Kettle::Dev::DEBUGGING
-  desc("(stub) bundle:audit is unavailable")
+define_bundle_audit_stub_tasks = lambda do |description_prefix, warning|
+  desc("#{description_prefix} bundle:audit")
   task("bundle:audit") do
-    warn("NOTE: bundler-audit isn't installed, or is disabled for #{RUBY_VERSION} in the current environment")
+    warn(warning.call("bundle:audit"))
   end
-  desc("(stub) bundle:audit:update is unavailable")
+  desc("#{description_prefix} bundle:audit:update")
   task("bundle:audit:update") do
-    warn("NOTE: bundler-audit isn't installed, or is disabled for #{RUBY_VERSION} in the current environment")
+    warn(warning.call("bundle:audit:update"))
+  end
+end
+
+if skip_bundle_audit
+  define_bundle_audit_stub_tasks.call(
+    "(skipped)",
+    ->(task_name) { "NOTE: #{task_name} skipped because KETTLE_DEV_SKIP_BUNDLE_AUDIT is enabled" }
+  )
+else
+  # Setup Bundle Audit
+  begin
+    require "bundler/audit/task"
+
+    Bundler::Audit::Task.new
+    Kettle::Dev.register_default("bundle:audit:update")
+    Kettle::Dev.register_default("bundle:audit")
+  rescue LoadError
+    warn("[kettle-dev][bundle_audit.rake] failed to load bundle/audit/task") if Kettle::Dev::DEBUGGING
+    define_bundle_audit_stub_tasks.call(
+      "(stub)",
+      ->(_task_name) { "NOTE: bundler-audit isn't installed, or is disabled for #{RUBY_VERSION} in the current environment" }
+    )
   end
 end

data/lib/kettle/dev/rakelib/spec_test.rake

@@ -36,7 +36,12 @@ setup_spec_task = ->(default:) {
   unless Rake::Task.task_defined?(:spec)
     desc("Run RSpec code examples")
     task(:spec) do
-      sh("bundle", "exec", "kettle-test")
+      begin
+        skip_bundle_audit = ENV.delete("KETTLE_DEV_SKIP_BUNDLE_AUDIT")
+        sh("bundle", "exec", "kettle-test")
+      ensure
+        ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"] = skip_bundle_audit if skip_bundle_audit
+      end
     end
   end
 

data/lib/kettle/dev/release_cli.rb

@@ -108,18 +108,25 @@ module Kettle
 
       public
 
-      def initialize(start_step: 0, local_ci: false, version: nil, appraisal_task: nil, skip_steps: nil)
+      def initialize(start_step: 0, local_ci: false, version: nil, appraisal_task: nil, skip_steps: nil, skip_bundle_audit: nil)
         @root = Kettle::Dev::CIHelpers.project_root
         @git = Kettle::Dev::GitAdapter.new
         @start_step = (start_step || 0).to_i
         @start_step = 0 if @start_step < 0
         @skip_steps = normalize_skip_steps(skip_steps)
         @local_ci = !!local_ci
+        @skip_bundle_audit = truthy_value?(skip_bundle_audit) || truthy_value?(ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"])
         @version_override = Kettle::Dev::Versioning.normalize_explicit_version(version)
         @appraisal_task = normalize_appraisal_task(appraisal_task || ENV["KETTLE_RELEASE_APPRAISAL_TASK"])
       end
 
       def run
+        with_bundle_audit_skip_env do
+          run_with_release_environment
+        end
+      end
+
+      def run_with_release_environment
         run_pre_release_checks! if run_step?(0)
 
         # 1. Ensure Bundler version ✓
@@ -404,6 +411,16 @@ module Kettle
         @local_ci
       end
 
+      def skip_bundle_audit?
+        @skip_bundle_audit
+      end
+
+      def truthy_value?(value)
+        return true if value == true
+
+        DEBUG_TRUE_VALUES.include?(value.to_s.downcase)
+      end
+
       def run_step?(step)
         @start_step <= step && !@skip_steps.include?(step)
       end
@@ -701,7 +718,30 @@ module Kettle
       end
 
       def run_cmd!(cmd)
-        self.class.run_cmd!(cmd)
+        cmd = bundle_audit_skip_command(cmd)
+        with_bundle_audit_skip_env do
+          self.class.run_cmd!(cmd)
+        end
+      end
+
+      def bundle_audit_skip_command(cmd)
+        return cmd unless skip_bundle_audit?
+        return cmd unless cmd.start_with?("bin/rake")
+        return cmd if cmd.start_with?("KETTLE_DEV_SKIP_BUNDLE_AUDIT=")
+
+        "KETTLE_DEV_SKIP_BUNDLE_AUDIT=true #{cmd}"
+      end
+
+      def with_bundle_audit_skip_env
+        return yield unless skip_bundle_audit?
+
+        previous = ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"]
+        ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"] = "true"
+        yield
+      ensure
+        if skip_bundle_audit?
+          previous.nil? ? ENV.delete("KETTLE_DEV_SKIP_BUNDLE_AUDIT") : ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"] = previous
+        end
       end
 
       def git_output(args)

data/lib/kettle/dev/version.rb

@@ -3,7 +3,7 @@
 module Kettle
   module Dev
     module Version
-      VERSION = "2.3.0"
+      VERSION = "2.3.1"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

data/lib/kettle/dev/version_gem.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+require "version_gem"
+require_relative "version"
+
+Kettle::Dev::Version.class_eval do
+  extend VersionGem::Basic
+end

data/lib/kettle/dev.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
-require "version_gem"
 require_relative "dev/version"
 
 if Gem.ruby_version < Gem::Version.new("2.7")
@@ -13,9 +12,6 @@ if Gem.ruby_version < Gem::Version.new("2.7")
   end
 end
 
-Kettle::Dev::Version.class_eval do
-  extend VersionGem::Basic
-end
 # External gems
 
 # It's not reasonable to test this ENV variable

data/sig/kettle/dev/pre_release_cli.rbs

@@ -1,6 +1,10 @@
 module Kettle
   module Dev
     class PreReleaseCLI
+      IMAGE_URL_CACHE_TTL_SECONDS: Integer
+      DEFAULT_IMAGE_URL_SKIP_PATTERNS: Array[String]
+      FAMILY_CONFIG_PATHS: Array[String]
+
       module HTTP
         def self.parse_http_uri: (String url_str) -> ::URI
         def self.head_ok?: (String url_str, ?limit: Integer, ?timeout: Integer) -> bool

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 2.3.0
+  version: 2.3.1
 platform: ruby
 authors:
 - Peter H. Boling
@@ -340,6 +340,7 @@ files:
 - lib/kettle/dev/tasks/ci_task.rb
 - lib/kettle/dev/version.rb
 - lib/kettle/dev/version_bump.rb
+- lib/kettle/dev/version_gem.rb
 - lib/kettle/dev/versioning.rb
 - lib/kettle/emoji_regex.rb
 - sig/kettle-dev.rbs
@@ -376,10 +377,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.3.0
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.3.0/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.3.1
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.3.1/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.3.0
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.3.1
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev