kettle-dev 2.4.5 → 2.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 33050e9b303264a6fe036799b05426b026a3d5a46479d03dde14c4ce324f6a6e
-  data.tar.gz: 88cba7649c5199a955ebb83a13b1d9ba7a3942739beb7fb1468e8e889cee21d4
+  metadata.gz: 4e95f076500c09ae192037d1590706647ad90595ae3d3d463cd95bfed5d4ad61
+  data.tar.gz: 2fa51594f020d3aee2013d627522e0ae78244f950eef9ea8c1e3841477baf150
 SHA512:
-  metadata.gz: 45485e2fab41bdf3ea56e9633356262da6ee839db6cdfd85d895f7a9adb6b75d59308ba64d1b20d08199a07e26e9ebda9c4eaa69eaa498407b8458e372816a9b
-  data.tar.gz: c1023667792f6eedbf3a0f246c57e9096ef0c33e09e9ac612190593a2bf4dcb5c55edd759f9db197f34f3bd773f5d1cd62a62e1e49e3e5765b6cc230cd83ddc5
+  metadata.gz: 773c04657cf36d34c0e0be8f848fc398ac204ada102dd8c9aa6315bef274bea4b511d6a569d94b351e58da56b3664576ffe5a955e6a1e30d45c3f00da21cc0cc
+  data.tar.gz: 64fe35b2414b53dbf8fd35248d40e1d6cb5ebefd2c1923dd7d06c419f06248a850801ff882728da6d99b59581221bb889fe0838284a8893e32520be36e911ca5

data/CHANGELOG.md

@@ -30,6 +30,147 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.5.0] - 2026-07-26
+
+- TAG: [v2.5.0][2.5.0t]
+- COVERAGE: 91.71% -- 4589/5004 lines in 42 files
+- BRANCH COVERAGE: 75.98% -- 1743/2294 branches in 42 files
+- 56.21% documented
+
+### Added
+
+- `kettle-release` can now use `--secrets-provider 1password` to load the gem
+  signing passphrase and RubyGems MFA OTP from the local 1Password CLI during
+  direct release runs.
+- `kettle-release` and `kettle-changelog` now accept `--yes` to approve their
+  release confirmation prompts without interactive input.
+
+- `kettle-reset Gemfile.lock` now resets CI-facing lockfiles by disabling local
+  sibling path environments and updating path-sourced or checksum-gap gems back
+  to released registry versions with checksums.
+- `kettle-reset Appraisal.root.gemfile.lock` and
+  `kettle-reset release-lockfiles` now cover the appraisal root lockfile used by
+  release and appraisal generation.
+
+- kettle-jem-template-20260727-001 - Spec harness documentation now lists the
+  RSpec helpers provided by `kettle-test`.
+
+### Changed
+
+- Documented family release credential automation with 1Password and the
+  unreleased-family-gem cleanup workflow.
+- Shared release secret provider code now lives in `kettle-dev`, allowing
+  `kettle-family` to cache the signing passphrase once while child
+  `kettle-release` processes fetch RubyGems OTP values at prompt time.
+
+- `kettle-release` now skips the default task's duplicate test and coverage run
+  when `kettle-changelog` already generated strict coverage in the same release.
+- `kettle-changelog` now requests JSON-only coverage output for release metadata
+  generation, reducing formatter noise during release preparation.
+
+### Fixed
+
+- `kettle-release --secrets-provider 1password` now validates the gem signing
+  passphrase before build/release and aborts instead of prompting if configured
+  secrets are unavailable.
+
+- Direct `kettle-release --secrets-provider 1password` runs now use the same
+  PTY-backed prompt bridge as family releases, so PEM passphrase prompts receive
+  the configured provider value instead of leaking through interactively.
+
+- `kettle-release --secrets-provider 1password` now recognizes the real
+  1Password provider as configured instead of misclassifying it as the
+  interactive fallback provider.
+
+- Release secrets provider lookup now honors `provider` from explicit config,
+  and direct provider lookup failures raise `Kettle::Dev::Error`.
+
+- kettle-jem-template-20260726-003 - Coverage upload steps now treat Coveralls,
+  QLTY, and Codecov as optional, so provider outages do not fail CI when local
+  coverage thresholds still pass.
+
+- `kettle-release` now uses the same lockfile reset logic before release prep
+  commits, and can reset and amend release lockfiles before the first push if
+  local paths reappear mid-release.
+- Release lockfile validation now allows the current gem's own `gemspec` path
+  source while still rejecting local sibling path sources.
+- Release version checks now use RubyGems.org directly, while post-publish
+  availability probes continue to verify the gem.coop Bundler source.
+- Release lockfile reset now uninstalls unreleased locally installed workspace
+  gem versions before regenerating `Gemfile.lock` and
+  `Appraisal.root.gemfile.lock`, preventing local-only versions from being
+  written as registry gems with checksums.
+
+- Release and changelog specs now route git commit, amend, tag, reset, and
+  release-state queries through `GitAdapter`, so test runs do not invoke the
+  caller's real git signing configuration.
+
+- `kettle-release` no longer loads the extracted `cgi` gem while booting, so
+  Ruby 2.4 appraisals can run release executable smoke tests without hitting
+  newer `cgi` code that requires `String#delete_prefix`.
+- `kettle-release` now reports the exact lockfile diagnostics that trigger its
+  pre-push reset attempt, amends the release prep commit only when tracked
+  lockfiles changed, and reports unrepaired diagnostics before aborting.
+- Release lockfile validation no longer treats the current gem's own
+  `remote: .` lockfile source as a local sibling path when line endings or
+  whitespace differ.
+
+- Release lockfile validation now uses `Bundler::LockfileParser` for source
+  classification, so registry remotes such as `https://gem.coop/` are not
+  mistaken for local path sources.
+
+- Release lockfile fallback output now distinguishes between amending the release
+  prep commit and restoring uncommitted lockfile drift back to that commit.
+
+## [2.4.6] - 2026-07-26
+
+- TAG: [v2.4.6][2.4.6t]
+- COVERAGE: 92.57% -- 4135/4467 lines in 38 files
+- BRANCH COVERAGE: 76.58% -- 1612/2105 branches in 38 files
+- 59.47% documented
+
+### Added
+
+- kettle-jem-template-20260726-001 - Projects now include YARD lint
+  configuration and documentation dependencies so documentation issues fail
+  before generated docs are refreshed.
+
+### Changed
+
+- Executable startup headers are now shown only when `--verbose` is passed;
+  `-v` and `--version` still print just the executable version and exit.
+- `yard:lint` now runs `yard-lint --quiet` first and only reruns with full
+  output when lint fails, keeping warning-only default and release output
+  compact while preserving failure diagnostics.
+- `yard:lint` now runs before `yard` and before the default task reaches YARD
+  documentation generation, so documentation lint failures fail earlier in CI.
+
+- kettle-jem-template-20260725-002 - Version specs now use `anonymous_loader` to
+  cover `version.rb` without redefining constants, or are removed when version
+  specs are not managed for the project.
+
+### Fixed
+
+- `yard.rake` specs now account for appraisal bundles without documentation
+  dependencies, so current-appraisal CI does not expect `yard:lint` when YARD
+  is unavailable.
+- Executable version specs now ignore RubyGems platform redefinition warnings
+  from appraisal bundles while still failing on real executable stderr.
+- `kettle-release` lockfile normalization now passes `--add-checksums` when it
+  repairs release lockfiles, so empty CHECKSUMS entries are not left behind for
+  the pre-commit validation pass.
+- `kettle-release` lockfile normalization now passes `BUNDLE_LOCKFILE`, so
+  appraisal root lockfiles are repaired in place instead of accidentally
+  rewriting `Gemfile.lock`.
+- `kettle-dvcs` documentation examples no longer use Ruby-only YARD example
+  tags for shell commands, so `yard:lint` can pass before docs are regenerated.
+- `kettle-changelog` now reports `bin/rake yard` failures directly, including
+  `yard:lint` output, instead of misreporting them as missing documentation
+  percentages.
+
+- kettle-jem-template-20260726-002 - Generated version files now document their
+  version namespace and constants, reducing warning-only YARD lint output.
+
 ## [2.4.5] - 2026-07-25
 
 - TAG: [v2.4.5][2.4.5t]
@@ -2739,7 +2880,11 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.5...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.0...HEAD
+[2.5.0]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.6...v2.5.0
+[2.5.0t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.5.0
+[2.4.6]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.5...v2.4.6
+[2.4.6t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.6
 [2.4.5]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.4...v2.4.5
 [2.4.5t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.4.5
 [2.4.4]: https://github.com/kettle-dev/kettle-dev/compare/v2.4.3...v2.4.4

data/README.md

@@ -72,6 +72,10 @@ bin/kettle-changelog
 bin/kettle-release
 ```
 
+Family-wide releases are coordinated by the separate
+[kettle-family](https://github.com/kettle-dev/kettle-family) gem, which shells
+out to `kettle-release` for each member that needs publishing.
+
 ### What kettle-dev provides
 
 - Rake task loading from `require "kettle/dev"`.
@@ -291,6 +295,22 @@ Releasing and signing
 - `SKIP_GEM_SIGNING`: If set, skip gem signing during build/release
 - `GEM_CERT_USER`: Username for selecting your public cert in `certs/<USER>.pem` (defaults to $USER)
 - `SOURCE_DATE_EPOCH`: Reproducible build timestamp. `kettle-release` will set this automatically for the session.
+- `KETTLE_RELEASE_SECRETS_PROVIDER`: Release secrets provider for direct
+  `kettle-release` runs. Supported values are `interactive` and `1password`.
+- `KETTLE_RELEASE_1PASSWORD_ITEM`: 1Password item for release secrets
+  (default: `Rubygems`).
+- `KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_FIELD`: 1Password field for
+  the gem signing passphrase (default: `GEM-SIGN-PASSPHRASE`).
+- `KETTLE_RELEASE_1PASSWORD_RUBYGEMS_OTP_FIELD`: 1Password OTP field for
+  RubyGems MFA (default: `one-time password`).
+- `KETTLE_RELEASE_1PASSWORD_ACCOUNT`: Optional 1Password account selector.
+- `KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_REFERENCE` and
+  `KETTLE_RELEASE_1PASSWORD_RUBYGEMS_OTP_REFERENCE`: Optional explicit
+  `op://` references.
+
+Family releases can load signing and RubyGems MFA secrets from 1Password via
+`kettle-family` configuration instead of environment variables. See the
+maintainer release section below.
 
 Git hooks and commit message helpers (exe/kettle-commit-msg)
 
@@ -425,10 +445,104 @@ What it does:
     - After intermittent CI failure, restart from monitoring: `bundle exec kettle-release start_step=10`
     - After fixing a failed pre-release gate, rerun from step 0: `bundle exec kettle-release`
     - After intentionally handling a failed pre-release gate, skip it and start numbered release steps: `bundle exec kettle-release start_step=1`
+    - Auto-approve release confirmation prompts: `bundle exec kettle-release --yes`
+    - Run direct release with 1Password secrets: `bundle exec kettle-release --secrets-provider 1password`
+- Lockfile recovery:
+    - Script: `exe/kettle-reset` (run as `kettle-reset`)
+    - Reset a CI-facing lockfile after local development has written sibling
+      paths or checksum-less local gem versions: `bundle exec kettle-reset Gemfile.lock`
+    - Reset both release-facing lockfiles together:
+      `bundle exec kettle-reset release-lockfiles`
+    - Reset the appraisal root lockfile directly:
+      `bundle exec kettle-reset Appraisal.root.gemfile.lock`
+    - Validate without changing the lockfile: `bundle exec kettle-reset --check Gemfile.lock`
+    - `kettle-reset` disables path-like `*_DEV` and `*_LOCAL` environment
+      variables, known local-template toggles, and writes checksums while
+      updating path-sourced and checksum-gap gems back to released registry
+      versions.
+    - During `kettle-release`, release lockfiles are reset before the release
+      prep commit. Before pushing, `kettle-release` validates those committed
+      lockfiles again; if local paths or checksum gaps reappear, it prints the
+      diagnostics, attempts one reset, amends the release prep commit if the
+      reset changed tracked lockfiles, and aborts if diagnostics remain.
 - Tips:
     - The commit message helper `exe/kettle-commit-msg` prefers project-local `.git-hooks` (then falls back to `~/.git-hooks`).
     - The goalie file `commit-subjects-goalie.txt` controls when a footer is appended; customize `footer-template.erb.txt` as you like.
 
+Direct `kettle-release` runs can opt in to 1Password for the gem signing
+passphrase and RubyGems MFA OTP:
+
+```console
+bundle exec kettle-release --secrets-provider 1password
+```
+
+The default 1Password lookup uses item `Rubygems`, field
+`GEM-SIGN-PASSPHRASE` for the signing key passphrase, and the item's OTP for
+RubyGems MFA. Override those values with the `KETTLE_RELEASE_1PASSWORD_*`
+environment variables above. `kettle-release` fetches the OTP at prompt time so
+long releases do not reuse a stale TOTP.
+
+#### Family releases and 1Password
+
+`kettle-release` owns the single-gem release flow. Family-wide release
+orchestration depends on the separate
+[kettle-family](https://github.com/kettle-dev/kettle-family) gem:
+`kettle-family release` selects sibling or monorepo members and delegates each
+publish step to `kettle-release`. For family releases, the usual publish
+command is:
+
+```console
+kettle-family release --publish --execute
+```
+
+By default, `kettle-family` prompts once for the gem signing key password and
+leaves RubyGems MFA prompts interactive. To run a family release with the local
+1Password CLI, configure `release.secrets` in `.kettle-family.yml` and pass
+`--secrets-provider 1password`:
+
+```yaml
+release:
+  secrets:
+    provider: 1password
+    item: Rubygems
+    gem_signing_passphrase_field: GEM-SIGN-PASSPHRASE
+    rubygems_otp_field: one-time password
+```
+
+```console
+kettle-family release --publish --execute --secrets-provider 1password
+```
+
+The gem signing passphrase is loaded once by `kettle-family` and handed to
+child `kettle-release` processes through an internal environment integration so
+1Password is not queried repeatedly for the same value. RubyGems OTP values are
+fetched by `kettle-release` when each MFA prompt appears, so direct and family
+releases share the same OTP behavior. Secret values are not written to the text
+report, NDJSON events, or temporary release files.
+
+For vault-specific or field-specific lookups, use explicit 1Password
+references. `rubygems_otp_reference` is read with `op read`; otherwise the OTP
+path uses `op item get ITEM --otp`.
+
+```yaml
+release:
+  secrets:
+    provider: 1password
+    account: my.1password.com
+    gem_signing_passphrase_reference: op://Private/Rubygems/GEM-SIGN-PASSPHRASE
+    rubygems_otp_reference: op://Private/Rubygems/one-time password?attribute=otp
+```
+
+If an old failed family release left unpublished sibling versions installed
+locally and Bundler keeps selecting them, clean them before retrying:
+
+```console
+kettle-family clean-unreleased --execute
+```
+
+The cleanup command is scoped to selected family members and removes local gem
+versions that are newer than the latest released version.
+
 ### Changelog generator
 
 - Script: `exe/kettle-bump` (run as `kettle-bump`)
@@ -891,7 +1005,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.433-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.004-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-changelog

@@ -59,7 +59,7 @@ end
 
 if ARGV.include?("-h") || ARGV.include?("--help")
   puts <<~USAGE
-    Usage: kettle-changelog [--version VERSION] [--update-prep] [--pending-release] [--release-state] [--refresh-cache] [--add-unreleased-entry --section SECTION --entry TEXT] [--json] [--no-strict] [--no-coverage-threshold]
+    Usage: kettle-changelog [--version VERSION] [--yes] [--update-prep] [--pending-release] [--release-state] [--refresh-cache] [--add-unreleased-entry --section SECTION --entry TEXT] [--json] [--no-strict] [--no-coverage-threshold]
 
     Detects the current version from lib/**/version.rb, the latest live release, and
     the most recent CHANGELOG.md release section, then prompts to confirm the selected plan:
@@ -70,6 +70,7 @@ if ARGV.include?("-h") || ARGV.include?("--help")
 
     Options:
       --version VERSION         Use this version instead of detecting VERSION from lib/**/version.rb
+      --yes                     Auto-approve the selected release plan
       --update-prep             Force updating the most recent prepared release section in place
       --pending-release         Query whether the changelog has release work pending; exits 0 for yes, 1 for no
       --release-state,
@@ -135,6 +136,7 @@ begin
   # Determine if strict mode is enabled (default: true)
   strict_mode = !ARGV.include?("--no-strict") && ENV.fetch("K_CHANGELOG_STRICT", "true").downcase != "false"
   update_prep = ARGV.delete("--update-prep")
+  yes = !!ARGV.delete("--yes")
   pending_release_query = ARGV.delete("--pending-release")
   release_state_query = ARGV.delete("--release-state") || ARGV.delete("--release-status")
   refresh_cache = ARGV.delete("--refresh-cache")
@@ -174,7 +176,7 @@ begin
     exit(0)
   end
 
-  cli = Kettle::Dev::ChangelogCLI.new(strict: strict_mode, enforce_coverage_thresholds: coverage_hard, update_prep: update_prep, version: version_override, refresh_cache: refresh_cache)
+  cli = Kettle::Dev::ChangelogCLI.new(strict: strict_mode, enforce_coverage_thresholds: coverage_hard, update_prep: update_prep, version: version_override, refresh_cache: refresh_cache, yes: yes)
   if release_state_query
     state = cli.release_state
     puts(json_output ? JSON.pretty_generate(state) : cli.release_state_table(state))

data/exe/kettle-release

@@ -49,7 +49,7 @@ end
 # Do not guard with __FILE__ == $PROGRAM_NAME because binstubs use Kernel.load.
 if ARGV.include?("-h") || ARGV.include?("--help")
   puts <<~USAGE
-    Usage: kettle-release [--version VERSION] [--local-ci] [--appraisal-update] [--skip-bundle-audit] [--skip-steps STEPS] [--ci-workflows WORKFLOWS] [--skip-remotes REMOTES] [--json|--events[=TYPES]] [--report PATH] [start_step=<0-19>]
+    Usage: kettle-release [--version VERSION] [--local-ci] [--yes] [--appraisal-update] [--skip-bundle-audit] [--skip-steps STEPS] [--ci-workflows WORKFLOWS] [--skip-remotes REMOTES] [--secrets-provider NAME] [--json|--events[=TYPES]] [--report PATH] [start_step=<0-19>]
 
     Automates the release flow for a Ruby gem in the host project.
 
@@ -85,10 +85,12 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       skip_steps=<numbers>        # Comma-separated numbered steps to skip while running the rest
       --skip-steps NUMBERS        # Alias for skip_steps=NUMBERS (e.g., --skip-steps 10 or --skip-steps 10,18)
       --version VERSION           # Use this version instead of detecting VERSION from lib/**/version.rb
+      --yes                       # Auto-approve release confirmation prompts
       --appraisal-update          # Use slower appraisal:update instead of default appraisal:generate
       --skip-bundle-audit         # Skip bundle:audit/update during release rake checks
       --ci-workflows WORKFLOWS    # Comma-separated workflow files or stems to monitor at CI step 10
       --skip-remotes REMOTES      # Comma-separated git remote names to exclude from release fetch/push parity
+      --secrets-provider NAME     # Release secrets provider: interactive, 1password
       --json                      # Print final machine-readable release report as JSON
       --events[=TYPES]            # Print newline-delimited JSON release events, optionally filtered by type
       --report PATH               # Write final machine-readable release report as JSON
@@ -102,6 +104,19 @@ if ARGV.include?("-h") || ARGV.include?("--help")
       K_RELEASE_LOCAL_CI_WORKFLOW # Name of workflow (without .yml) for local CI; defaults to locked_deps or first
       K_RELEASE_CI_WORKFLOWS      # Comma-separated workflow files or stems to monitor at CI step 10
       K_RELEASE_SKIP_REMOTES      # Comma-separated git remote names to exclude from release fetch/push parity
+      KETTLE_RELEASE_SECRETS_PROVIDER=1password
+                                  # Load release secrets through the configured provider
+      KETTLE_RELEASE_1PASSWORD_ITEM=Rubygems
+      KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_FIELD=GEM-SIGN-PASSPHRASE
+      KETTLE_RELEASE_1PASSWORD_RUBYGEMS_OTP_FIELD='one-time password'
+                                  # Defaults used by the 1Password provider
+      KETTLE_RELEASE_1PASSWORD_ACCOUNT
+      KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_REFERENCE
+      KETTLE_RELEASE_1PASSWORD_RUBYGEMS_OTP_REFERENCE
+                                  # Optional explicit 1Password account or op:// references
+      KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE_SOURCE=cached
+      KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE
+                                  # Internal family integration: reuse a cached passphrase
       KETTLE_RELEASE_APPRAISAL_TASK=appraisal:update
                                   # Use slower appraisal:update instead of default appraisal:generate
       KETTLE_DEV_SKIP_BUNDLE_AUDIT=true
@@ -221,6 +236,27 @@ def extract_report_arg!(argv)
   report_path
 end
 
+def extract_secrets_provider_arg!(argv)
+  provider = nil
+  if (idx = argv.index("--secrets-provider"))
+    provider = argv[idx + 1]
+    if provider.to_s.empty? || provider.to_s.start_with?("-")
+      Kettle::Dev::ExitAdapter.abort("--secrets-provider requires a provider name")
+    end
+    argv.slice!(idx, 2)
+  end
+  argv.delete_if do |arg|
+    if arg.start_with?("--secrets-provider=", "secrets_provider=")
+      provider = arg.split("=", 2)[1]
+      Kettle::Dev::ExitAdapter.abort("--secrets-provider requires a provider name") if provider.to_s.empty?
+      true
+    else
+      false
+    end
+  end
+  provider
+end
+
 def extract_events_arg!(argv)
   events = false
   event_types = nil
@@ -238,6 +274,7 @@ def extract_events_arg!(argv)
 end
 
 local_ci = ARGV.include?("--local-ci")
+yes = !!ARGV.delete("--yes")
 appraisal_task = ARGV.delete("--appraisal-update") ? "appraisal:update" : nil
 skip_bundle_audit = !!ARGV.delete("--skip-bundle-audit")
 json_output = !!ARGV.delete("--json")
@@ -250,10 +287,11 @@ skip_steps = extract_skip_steps_arg!(ARGV)
 ci_workflows = extract_ci_workflows_arg!(ARGV)
 skip_remotes = extract_skip_remotes_arg!(ARGV)
 report_path = extract_report_arg!(ARGV)
+secrets_provider = extract_secrets_provider_arg!(ARGV)
 
 begin
   event_stream = events_output ? Kettle::Ndjson.event_stream($stdout, types: event_types) : nil
-  Kettle::Dev::ReleaseCLI.new(start_step: start_step, local_ci: local_ci, version: version_override, appraisal_task: appraisal_task, skip_steps: skip_steps, skip_bundle_audit: skip_bundle_audit, ci_workflows: ci_workflows, skip_remotes: skip_remotes, event_stream: event_stream, json_output: json_output, json_io: $stdout, report_path: report_path).run
+  Kettle::Dev::ReleaseCLI.new(start_step: start_step, local_ci: local_ci, version: version_override, appraisal_task: appraisal_task, skip_steps: skip_steps, skip_bundle_audit: skip_bundle_audit, ci_workflows: ci_workflows, skip_remotes: skip_remotes, secrets_provider_name: secrets_provider, yes: yes, event_stream: event_stream, json_output: json_output, json_io: $stdout, report_path: report_path).run
 rescue LoadError => e
   warn("#{script_basename}: could not load dependency: #{e.class}: #{e.message}")
   warn(Array(e.backtrace).join("\n")) if ENV["DEBUG"]

data/exe/kettle-reset

@@ -0,0 +1,35 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+$stdout.sync = true
+$stderr.sync = true
+
+begin
+  require "rubygems"
+rescue LoadError
+end
+
+script_basename = File.basename(__FILE__)
+repo_lib = File.expand_path("../lib", __dir__)
+$LOAD_PATH.unshift(repo_lib) if File.directory?(repo_lib) && !$LOAD_PATH.include?(repo_lib)
+
+begin
+  require "kettle/dev"
+  require "kettle/dev/executable_version"
+  Kettle::Dev::ExecutableVersion.print_and_exit!(script_basename, ARGV)
+  Kettle::Dev::ExecutableVersion.print_header(script_basename)
+rescue LoadError => e
+  warn("#{script_basename}: could not load dependency: #{e.class}: #{e.message}")
+  warn("Hint: Ensure the host project has kettle-dev as a dependency and run bundle install.")
+  exit(1)
+end
+
+begin
+  exit(Kettle::Dev::ResetCLI.new(ARGV).run!)
+rescue SystemExit
+  raise
+rescue => e
+  warn("#{script_basename}: #{e.message}")
+  warn(e.backtrace.join("\n")) if ENV["DEBUG"]
+  exit(1)
+end