kettle-dev 2.4.0 → 2.4.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: dc6dd6b412d11d659d2f5ed0916372e599642a82640335700f3e723937638cba
-  data.tar.gz: 86114a4e096dd7da0934477c06aee521372d6eeb5f2114377d0a035b32be42f1
+  metadata.gz: 77a7621fa0d906b716e933205ff585081b8746345530f540a8c83f6e67d3f347
+  data.tar.gz: ae54a1e1f33347caa8c6d07eae632db0b88c95583a838fece942bd9bb1d84bfb
 SHA512:
-  metadata.gz: f056c2d67dee284c734c2b0bf5cb06ce957d981cc7c8f922108b2cf1c3b3a8acf5c0c2a1fe8b7b3347ae92c85f780f82ab1e14cf677e12591ece125522bdf967
-  data.tar.gz: 1c5db4b16afe9840dca06f5a6a1528fe3afa3dadb68b727c2b95c43bfa3240d19625aad892a792000841b42640d07451136f0f87a18f2e711aba5f7107721368
+  metadata.gz: 03b528fd8d85c047d18606f023a0f9f217ca88556ed26ddbc62504a282bceda6a42ea315c0cd0fdd0e2e4307fefeda357d34fcf4fab98d83dc5214c9d202bbb2
+  data.tar.gz: d630c32d5f8cfbb28b74cdc552a9d331aa73d25de2d80298736f759f2bfe3181649c845a1d812c5ead41f9792a3169091f07ae33a2afb1610028b191effb08e7

data/CHANGELOG.md

@@ -30,6 +30,20 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.4.1] - 2026-07-24
+
+- TAG: [v2.4.1][2.4.1t]
+- COVERAGE: 92.29% -- 3928/4256 lines in 38 files
+- BRANCH COVERAGE: 76.09% -- 1550/2037 branches in 38 files
+- 58.66% documented
+
+### Fixed
+
+- `kettle-release` now normalizes and revalidates release lockfiles after
+  mutating setup/appraisal/doc steps, before committing or pushing, so local
+  path remotes and locally installed registry gems with empty lockfile
+  checksums cannot leak into CI.
+
 ## [2.4.0] - 2026-07-23
 
 - TAG: [v2.4.0][2.4.0t]
@@ -2646,7 +2660,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.0...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.1...HEAD
+[2.4.1]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.0...v2.4.1
+[2.4.1t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.1
 [2.4.0]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.11...v2.4.0
 [2.4.0t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.0
 [2.3.11]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.10...v2.3.11

data/README.md

@@ -891,7 +891,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.141-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.256-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/release_cli.rb

@@ -10,6 +10,7 @@ require "net/http"
 require "json"
 require "uri"
 require "yaml"
+require "set"
 
 # External gems
 require "kettle/rb/compat_matrix"
@@ -256,6 +257,7 @@ module Kettle
 
         # 6. git user + commit release prep
         if run_step?(6)
+          prepare_release_lockfiles_for_commit!
           ensure_git_user!
           version ||= detect_version
           committed = commit_release_prep!(version)
@@ -279,10 +281,16 @@ module Kettle
         end
 
         # 9. push branches
-        push! if run_step?(9) && !local_ci?
+        if run_step?(9) && !local_ci?
+          validate_release_lockfiles!(stage: "before push")
+          push!
+        end
 
         # 10. monitor CI after push
-        monitor_workflows_after_push! if run_step?(10) && !local_ci?
+        if run_step?(10) && !local_ci?
+          validate_release_lockfiles!(stage: "before CI monitoring")
+          monitor_workflows_after_push!
+        end
 
         # 11. merge feature into trunk and push
         if run_step?(11) && !local_ci?
@@ -505,6 +513,187 @@ module Kettle
         run_changelog!
       end
 
+      def prepare_release_lockfiles_for_commit!
+        dirty_lockfiles = release_lockfile_paths.select { |path| release_lockfile_normalization_needed?(path) }
+        unless dirty_lockfiles.empty?
+          puts "Normalizing release lockfiles with local path dependencies disabled..."
+          dirty_lockfiles.each { |path| normalize_release_lockfile!(path) }
+        end
+
+        validate_release_lockfiles!(stage: "before release prep commit")
+      end
+
+      def validate_release_lockfiles!(stage:)
+        diagnostics = release_lockfile_paths.flat_map { |path| release_lockfile_diagnostics(path) }
+        return if diagnostics.empty?
+
+        abort(<<~MSG)
+          Release lockfile validation failed #{stage}:
+          #{diagnostics.map { |diagnostic| "  - #{diagnostic}" }.join("\n")}
+          Re-run bundle lock/update with local path development env disabled before releasing.
+        MSG
+      end
+
+      def release_lockfile_paths
+        candidates = [
+          File.join(@root, "Gemfile.lock"),
+          File.join(@root, "Appraisal.root.gemfile.lock")
+        ]
+        candidates.select { |path| File.file?(path) }.sort
+      end
+
+      def release_lockfile_normalization_needed?(path)
+        release_lockfile_has_local_path_remote?(path) || !release_lockfile_empty_registry_checksums(path).empty?
+      end
+
+      def normalize_release_lockfile!(path)
+        gemfile = release_gemfile_for_lockfile(path)
+        unless gemfile && File.file?(gemfile)
+          warn("Cannot normalize #{Kettle::Dev.display_path(path)} because its Gemfile was not found.")
+          return
+        end
+
+        update_gems = release_lockfile_empty_registry_checksums(path).map(&:first).uniq.sort
+        env = release_lockfile_normalization_env.merge("BUNDLE_GEMFILE" => gemfile)
+        command = +"env"
+        env.each do |key, value|
+          command << " #{key}=#{Shellwords.escape(value)}"
+        end
+        command << " bundle lock"
+        command << " --update #{update_gems.map { |gem_name| Shellwords.escape(gem_name) }.join(" ")}" unless update_gems.empty?
+        run_cmd!(command)
+      end
+
+      def release_gemfile_for_lockfile(path)
+        basename = File.basename(path)
+        return File.join(@root, "Gemfile") if basename == "Gemfile.lock"
+
+        path.delete_suffix(".lock")
+      end
+
+      def release_lockfile_normalization_env
+        {
+          "KETTLE_DEV_DEV" => "false",
+          "K_JEM_TEMPLATING" => "false",
+          "STRUCTUREDMERGE_DEV" => "false",
+          "TREE_SITTER_LANGUAGE_PACK_DEV" => "false",
+          "RUBOCOP_LTS_LOCAL" => "false",
+          "GALTZO_FLOSS_DEV" => "false",
+          "UR_BRAIN_DEV" => "false"
+        }
+      end
+
+      def release_lockfile_diagnostics(path)
+        diagnostics = []
+        release_lockfile_local_path_remote_lines(path).each do |line_number|
+          diagnostics << "#{release_lockfile_label(path)} has local path remote at line #{line_number}"
+        end
+        release_lockfile_empty_registry_checksums(path).each do |name, version, line_number|
+          diagnostics << "#{release_lockfile_label(path)} CHECKSUMS has no sha256 for #{name} #{version} at line #{line_number}"
+        end
+        diagnostics
+      end
+
+      def release_lockfile_has_local_path_remote?(path)
+        !release_lockfile_local_path_remote_lines(path).empty?
+      end
+
+      def release_lockfile_local_path_remote_lines(path)
+        File.readlines(path).filter_map.with_index(1) do |line, index|
+          next unless line.start_with?("  remote: /", "  remote: ./", "  remote: ../")
+
+          index
+        end
+      end
+
+      def release_lockfile_empty_registry_checksums(path)
+        path_gems = release_lockfile_path_source_gems(path) | release_lockfile_path_dependency_gems(path)
+        in_checksums = false
+        entries = File.readlines(path).filter_map.with_index(1) do |line, index|
+          stripped = line.strip
+          if stripped == "CHECKSUMS"
+            in_checksums = true
+            next
+          end
+          next unless in_checksums
+          next if stripped.empty?
+          next if stripped == "BUNDLED WITH"
+
+          match = stripped.match(/\A([A-Za-z0-9_.-]+) \(([^)]+)\)(?:\s+(sha256=.*))?\z/)
+          next unless match
+
+          name = match[1]
+          checksum = match[3].to_s
+          next if !checksum.empty?
+          next if path_gems.include?(name)
+
+          [name, match[2], index]
+        end
+        return [] unless release_lockfile_has_any_sha_checksum?(path)
+
+        entries
+      end
+
+      def release_lockfile_has_any_sha_checksum?(path)
+        in_checksums = false
+        File.readlines(path).any? do |line|
+          stripped = line.strip
+          if stripped == "CHECKSUMS"
+            in_checksums = true
+            next false
+          end
+          next false unless in_checksums
+
+          stripped.include?("sha256=")
+        end
+      end
+
+      def release_lockfile_path_source_gems(path)
+        gems = Set.new
+        in_path = false
+        in_specs = false
+        File.readlines(path).each do |line|
+          header = line.strip
+          if header.match?(/\A[A-Z][A-Z ]*\z/)
+            in_path = header == "PATH"
+            in_specs = false
+            next
+          end
+          next unless in_path
+
+          if header == "specs:"
+            in_specs = true
+            next
+          end
+          next unless in_specs
+
+          match = line.match(/\A    ([A-Za-z0-9_.-]+) \([^)]+\)/)
+          gems << match[1] if match
+        end
+        gems
+      end
+
+      def release_lockfile_path_dependency_gems(path)
+        gems = Set.new
+        in_dependencies = false
+        File.readlines(path).each do |line|
+          header = line.strip
+          if header.match?(/\A[A-Z][A-Z ]*\z/)
+            in_dependencies = header == "DEPENDENCIES"
+            next
+          end
+          next unless in_dependencies
+
+          match = line.match(/\A  ([A-Za-z0-9_.-]+)!\z/)
+          gems << match[1] if match
+        end
+        gems
+      end
+
+      def release_lockfile_label(path)
+        Kettle::Dev.display_path(path)
+      end
+
       def run_changelog!
         cmd = "bundle exec kettle-changelog"
         cmd = "#{cmd} --version #{Shellwords.escape(@version_override)}" if @version_override

data/lib/kettle/dev/version.rb

@@ -3,7 +3,7 @@
 module Kettle
   module Dev
     module Version
-      VERSION = "2.4.0"
+      VERSION = "2.4.1"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 2.4.0
+  version: 2.4.1
 platform: ruby
 authors:
 - Peter H. Boling
@@ -349,10 +349,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.4.0
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.4.0/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.4.1
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.4.1/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.4.0
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.4.1
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev