kettle-dev 2.4.1 → 2.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 77a7621fa0d906b716e933205ff585081b8746345530f540a8c83f6e67d3f347
-  data.tar.gz: ae54a1e1f33347caa8c6d07eae632db0b88c95583a838fece942bd9bb1d84bfb
+  metadata.gz: a251345bb56780a5c5b9efcfb53d394ca469581b5798f10839ac8ed5b4cae682
+  data.tar.gz: 4a81578792afe11fd09299ea7d1836d66f0cd8c76af00235491b8234fcec1553
 SHA512:
-  metadata.gz: 03b528fd8d85c047d18606f023a0f9f217ca88556ed26ddbc62504a282bceda6a42ea315c0cd0fdd0e2e4307fefeda357d34fcf4fab98d83dc5214c9d202bbb2
-  data.tar.gz: d630c32d5f8cfbb28b74cdc552a9d331aa73d25de2d80298736f759f2bfe3181649c845a1d812c5ead41f9792a3169091f07ae33a2afb1610028b191effb08e7
+  metadata.gz: 0cfa39888af23e14856d9874d965248c8d68a83b88c42bd3cc722b1a84fe8564b3c1381aa714aaebe0df531822365b70e4f2e7e2eff913f5e781e201e5f49b13
+  data.tar.gz: aefab75e861bc0c2132385b4e7411904b01cb6562c82d3485cdbdbb27d407004450b8e0a7030f33abf869bc73df4074f2cbdd1c3ef7abcfb21e9222b5c1c7f9e

data/CHANGELOG.md

@@ -30,6 +30,20 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.4.2] - 2026-07-24
+
+- TAG: [v2.4.2][2.4.2t]
+- COVERAGE: 92.36% -- 3991/4321 lines in 38 files
+- BRANCH COVERAGE: 76.06% -- 1563/2055 branches in 38 files
+- 59.00% documented
+
+### Fixed
+
+- `kettle-release` now validates published gem availability with an isolated
+  Bundler probe against gem.coop before continuing past the publish step, and
+  uninstalls newly introduced local candidate gems when the release did not
+  happen or cannot be validated.
+
 ## [2.4.1] - 2026-07-24
 
 - TAG: [v2.4.1][2.4.1t]
@@ -2660,7 +2674,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.1...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.2...HEAD
+[2.4.2]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.1...v2.4.2
+[2.4.2t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.2
 [2.4.1]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.0...v2.4.1
 [2.4.1t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.1
 [2.4.0]: https://github.com/kettle-dev/kettle-dev/compare/v2.3.11...v2.4.0

data/README.md

@@ -891,7 +891,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.256-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.321-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/release_cli.rb

@@ -40,6 +40,8 @@ module Kettle
         "BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES" => "true"
       }.freeze
       DEBUG_TRUE_VALUES = %w[1 true yes on].freeze
+      RELEASE_VALIDATION_SOURCE = "https://gem.coop"
+
       class << self
         def run_cmd!(cmd)
           # For Bundler-invoked build/release, explicitly prefix SKIP_GEM_SIGNING so
@@ -121,6 +123,7 @@ module Kettle
         @skip_bundle_audit = truthy_value?(skip_bundle_audit) || truthy_value?(ENV["KETTLE_DEV_SKIP_BUNDLE_AUDIT"])
         @version_override = Kettle::Dev::Versioning.normalize_explicit_version(version)
         @appraisal_task = normalize_appraisal_task(appraisal_task || ENV["KETTLE_RELEASE_APPRAISAL_TASK"])
+        @release_candidate = nil
       end
 
       def run
@@ -346,13 +349,18 @@ module Kettle
 
         # 15. release and tag
         if run_step?(15)
+          version ||= detect_version
+          gem_name = detect_gem_name
+          @release_candidate = build_release_candidate(gem_name, version)
           if local_ci?
-            version ||= detect_version
-            release_gem_and_tag_locally!(version)
+            with_unpublished_candidate_cleanup { release_gem_and_tag_locally!(version) }
           else
             puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
-            run_cmd!("bundle exec rake release")
-            mark_gem_coop_release_cache_bust(version || detect_version)
+            with_unpublished_candidate_cleanup do
+              run_cmd!("bundle exec rake release")
+              confirm_release_candidate_available!(@release_candidate)
+            end
+            mark_gem_coop_release_cache_bust(version)
           end
         end
 
@@ -1144,9 +1152,123 @@ module Kettle
 
         puts "Publishing #{File.basename(gem_path)} to RubyGems without pushing git refs..."
         run_cmd!("gem push #{Shellwords.escape(gem_path)}")
+        confirm_release_candidate_available!(@release_candidate || build_release_candidate(gem_name_from_gem_path(gem_path, version), version))
         mark_gem_coop_release_cache_bust(version, gem_name: gem_name_from_gem_path(gem_path, version))
       end
 
+      def build_release_candidate(gem_name, version)
+        ReleaseCandidate.new(
+          gem_name: gem_name.to_s,
+          version: version.to_s,
+          installed_before: gem_version_installed?(gem_name, version),
+          published: false
+        )
+      end
+
+      def with_unpublished_candidate_cleanup
+        yield
+      rescue SystemExit, StandardError
+        cleanup_unpublished_release_candidate(@release_candidate)
+        raise
+      end
+
+      def cleanup_unpublished_release_candidate(candidate)
+        return unless candidate
+        return if candidate.published
+        return if candidate.installed_before
+        return unless gem_version_installed?(candidate.gem_name, candidate.version)
+
+        warn(
+          "Release of #{candidate.gem_name} #{candidate.version} was not validated; " \
+          "uninstalling the local candidate gem so future bundle updates cannot resolve an unreleased version."
+        )
+        uninstall_release_candidate(candidate)
+      end
+
+      def uninstall_release_candidate(candidate)
+        run_cmd!(
+          "gem uninstall #{Shellwords.escape(candidate.gem_name)} " \
+          "-v #{Shellwords.escape(candidate.version)} -x -I --ignore-dependencies"
+        )
+      rescue SystemExit, StandardError => error
+        warn("Could not uninstall local candidate #{candidate.gem_name} #{candidate.version}: #{error.message}")
+        warn("Manual cleanup: gem uninstall #{candidate.gem_name} -v #{candidate.version} -x -I --ignore-dependencies")
+      end
+
+      def gem_version_installed?(gem_name, version)
+        Gem::Specification.reset
+        Gem::Specification.find_all_by_name(gem_name.to_s, "= #{version}").any?
+      rescue Gem::LoadError
+        false
+      end
+
+      def confirm_release_candidate_available!(candidate)
+        run_release_availability_probe(candidate)
+        candidate.published = true
+        true
+      rescue SystemExit
+        raise
+      rescue => error
+        abort(<<~MSG)
+          Published gem availability could not be validated for #{candidate.gem_name} #{candidate.version}: #{error.class}: #{error.message}
+          kettle-release will clean up any local candidate install that was introduced by this failed release attempt.
+          If the push actually succeeded, resolve the registry/checksum state manually before resuming.
+        MSG
+      end
+
+      def run_release_availability_probe(candidate)
+        script_path = write_release_availability_probe(candidate)
+        stdout_str = nil
+        stderr_str = nil
+        status = nil
+        with_unbundled_release_probe_env do
+          stdout_str, stderr_str, status = Open3.capture3(self.class.send(:command_env), Gem.ruby, script_path)
+        end
+        $stdout.print(stdout_str) unless stdout_str.to_s.empty?
+        return true if status.success?
+
+        diag = stderr_str.to_s.empty? ? "" : "\n--- STDERR ---\n#{stderr_str}".rstrip
+        abort("Published gem availability probe failed for #{candidate.gem_name} #{candidate.version} (exit #{status.exitstatus})#{diag}")
+      ensure
+        FileUtils.rm_f(script_path) if script_path
+      end
+
+      def with_unbundled_release_probe_env(&block)
+        if defined?(Bundler)
+          Bundler.with_unbundled_env(&block)
+        else
+          yield
+        end
+      end
+
+      def write_release_availability_probe(candidate)
+        dir = File.join(@root, "tmp", "kettle-release")
+        FileUtils.mkdir_p(dir)
+        path = File.join(dir, "validate-#{candidate.gem_name}-#{candidate.version}-#{$$}.rb")
+        File.write(path, release_availability_probe_script(candidate))
+        path
+      end
+
+      def release_availability_probe_script(candidate)
+        <<~RUBY
+          # frozen_string_literal: true
+
+          gem_name = #{candidate.gem_name.dump}
+          version = #{candidate.version.dump}
+
+          require "bundler/inline"
+
+          gemfile(true) do
+            source #{RELEASE_VALIDATION_SOURCE.dump}
+            gem gem_name, "= \#{version}"
+          end
+
+          spec = Gem.loaded_specs.fetch(gem_name)
+          abort("loaded \#{gem_name} \#{spec.version}, expected \#{version}") unless spec.version.to_s == version
+          puts "Validated \#{gem_name} \#{version} from #{RELEASE_VALIDATION_SOURCE}"
+        RUBY
+      end
+
       def detect_version
         Kettle::Dev::Versioning.detect_version(@root, override: @version_override)
       end
@@ -1709,3 +1831,14 @@ module Kettle
     end
   end
 end
+
+class Kettle::Dev::ReleaseCLI::ReleaseCandidate
+  attr_accessor :gem_name, :version, :installed_before, :published
+
+  def initialize(gem_name:, version:, installed_before:, published:)
+    @gem_name = gem_name
+    @version = version
+    @installed_before = installed_before
+    @published = published
+  end
+end

data/lib/kettle/dev/version.rb

@@ -3,7 +3,7 @@
 module Kettle
   module Dev
     module Version
-      VERSION = "2.4.1"
+      VERSION = "2.4.2"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 2.4.1
+  version: 2.4.2
 platform: ruby
 authors:
 - Peter H. Boling
@@ -349,10 +349,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.4.1
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.4.1/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.4.2
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.4.2/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.4.1
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.4.2
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev