kettle-dev 2.5.25 → 2.5.26

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 56ce68001beed714f8b15c44336ffe111f1509dfffd9a7063b1bb50f0580fc08
-  data.tar.gz: 3088a81db9f6327c55fe9113f45be1768f734d2c8b05cfd0c5a55080450de63f
+  metadata.gz: 94148c67bb625244972fa5139eeb53715b4589ddcef5bd86375c34e221f462a1
+  data.tar.gz: e3763e0664e3a96d57c78ab2f2b4f91d7dabaa2c383f50e2558244e6c17070d5
 SHA512:
-  metadata.gz: e9ad45713716d0583fc83e302ea574a67a7855757efc7abf9de24764abd5d66388056677a74a6fbf67a6d05894b4e7edb813c8e9919ddcdb61b03ed694bd70e2
-  data.tar.gz: 7aa96f4e87ddb6e6b0d41b19e43c56229cca35dbf470313b50f15c6a35124e4e171383c666766ad6a9a937bf3cc6d496df9be5dd71213647ebb2768937852b8f
+  metadata.gz: 4ed2d0dcc407ef62c72336c8d824841ec3e7c8d52f228029f56cb50d55260208a2a03483d347e539db50e7df4206b831f2e084dcdcb444f9a4f90b7299fc0913
+  data.tar.gz: dd79b14807550e3ed34ef788f51d5326d332a67689cefeb7e1ebba6f9bc9e95108ba724cbb7e08f2b7165d343b0f7ae69b04eaa3ec248c19ee3d057dcb8026fc

data/CHANGELOG.md

@@ -30,6 +30,31 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [2.5.26] - 2026-08-08
+
+- TAG: [v2.5.26][2.5.26t]
+- COVERAGE: 91.64% -- 5522/6026 lines in 47 files
+- BRANCH COVERAGE: 76.03% -- 2087/2745 branches in 47 files
+- 50.90% documented
+
+### Fixed
+
+- Support family-level gem names and changelog paths when creating aggregate GitHub releases.
+
+- Treat never-published RubyGems packages as having no release history.
+
+- Keep local development paths disabled through release setup so release lockfiles remain registry-resolvable.
+
+- Preserve kettle-jem template tokens during Markdown image URL normalization.
+
+- Reset inherited Bundler file selection before running project release tasks.
+
+- Run every project-local release check with the release lockfile environment, including prefixed rake commands, so local workspace paths cannot leak back into release lockfiles.
+
+- Run gem build and publish commands with local workspace dependency switches disabled so release guards see the registry-backed lockfile.
+
+- Recognize release commands with environment prefixes so configured secret providers can answer signing and RubyGems MFA prompts.
+
 ## [2.5.25] - 2026-08-07
 
 - TAG: [v2.5.25][2.5.25t]
@@ -3335,7 +3360,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.25...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.26...HEAD
+[2.5.26]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.25...v2.5.26
+[2.5.26t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.5.26
 [2.5.25]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.24...v2.5.25
 [2.5.25t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v2.5.25
 [2.5.24]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.23...v2.5.24

data/README.md

@@ -1007,7 +1007,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.974-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.026-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/pre_release_cli.rb

@@ -374,6 +374,10 @@ module Kettle
       end
 
       def normalized_markdown_image_url(url_str)
+        # Kettle-Jem template tokens are intentionally not URI components yet;
+        # encoding them here prevents the templater from recognizing them.
+        return url_str if url_str.include?("{KJ|")
+
         addr = Addressable::URI.parse(url_str)
         normalized = addr.normalize
         normalized.query = addr.query if addr.query && normalized.query != addr.query

data/lib/kettle/dev/release_cli.rb

@@ -58,14 +58,15 @@ module Kettle
           end
           puts "$ #{cmd}"
           # Pass a plain Hash for the environment to satisfy tests and avoid ENV object oddities
-          env_hash = command_env
+          env_hash = command_env_for(cmd)
 
           # Some commands are interactive (e.g., `bundle exec rake release` prompting for RubyGems MFA).
           # Using capture3 detaches STDIN, preventing prompts from working. For such commands, use system
           # so they inherit the current TTY and can read the user's input.
-          interactive = /\Abundle(\s+exec)?\s+rake\s+release\b/.match?(cmd) ||
-            /\Agem\s+push\b/.match?(cmd) ||
-            /\A(bundle\s+exec\s+)?kettle-changelog\b/.match?(cmd)
+          interactive_words = effective_command_words(cmd)
+          interactive = interactive_words.first(4) == ["bundle", "exec", "rake", "release"] ||
+            interactive_words.first(2) == ["gem", "push"] ||
+            interactive_words.first(2) == ["bundle", "exec"] && interactive_words[2] == "kettle-changelog"
           if interactive
             ok = system(env_hash, cmd)
             unless ok
@@ -104,6 +105,42 @@ module Kettle
           env_hash.merge(QUIET_ENV)
         end
 
+        def command_env_for(cmd)
+          env_hash = command_env
+          return env_hash unless project_bundle_command?(cmd)
+
+          env_hash.merge(BundlerEnvGuard.unbundled_env)
+        end
+
+        def project_bundle_command?(cmd)
+          words = effective_command_words(cmd)
+          words == ["bin/setup"] ||
+            words.first(1) == ["bin/rake"] ||
+            words.first(3) == ["bundle", "exec", "rake"]
+        rescue ArgumentError
+          false
+        end
+
+        def effective_command_words(cmd)
+          words = Shellwords.split(cmd.to_s)
+          words.shift while words.first&.match?(/\A[A-Za-z_][A-Za-z0-9_]*=/)
+
+          if words.first == "env"
+            words.shift
+            while words.any?
+              if words.first == "-u"
+                words.shift(2)
+              elsif words.first&.include?("=")
+                words.shift
+              else
+                break
+              end
+            end
+          end
+
+          words
+        end
+
         def debug_env_enabled?
           DEBUG_TRUE_VALUES.include?(ENV.fetch("KETTLE_DEV_DEBUG", "").downcase)
         end
@@ -286,13 +323,13 @@ module Kettle
           appraisals_path = File.join(@root, "Appraisals")
           if File.file?(appraisals_path)
             puts "Appraisals detected at #{Kettle::Dev.display_path(appraisals_path)}. Running: bin/rake #{@appraisal_task}"
-            run_cmd!("bin/rake #{@appraisal_task}")
+            run_cmd!(release_project_command("bin/rake #{@appraisal_task}"))
           else
             puts "No Appraisals file found; skipping #{@appraisal_task}"
           end
 
           puts "Generating docs site via canonical task: bin/rake yard"
-          run_cmd!("bin/rake yard")
+          run_cmd!(release_project_command("bin/rake yard"))
         end
 
         # 6. git user + commit release prep
@@ -389,7 +426,7 @@ module Kettle
           else
             puts "Running build (you may be prompted for the signing key password)..."
           end
-          run_cmd!("bundle exec rake build")
+          run_cmd!(release_project_command("bundle exec rake build"))
         end
 
         # 15. release and tag
@@ -407,7 +444,7 @@ module Kettle
               puts "Running release (you may be prompted for signing key password and RubyGems MFA OTP)..."
             end
             with_unpublished_candidate_cleanup do
-              run_cmd!("bundle exec rake release")
+              run_cmd!(release_project_command("bundle exec rake release"))
               @release_candidate.published = true
               confirm_release_candidate_available!(@release_candidate)
             end
@@ -819,14 +856,29 @@ module Kettle
         # its test/coverage prerequisites and still run lint, audit, documentation, and any
         # other non-test release checks. Resumed releases do not set this flag, so they keep
         # the full default task behavior.
-        return "KETTLE_DEV_SKIP_TESTS=true bin/rake" if @changelog_generated_coverage
+        return release_project_command("KETTLE_DEV_SKIP_TESTS=true bin/rake") if @changelog_generated_coverage
 
-        "bin/rake"
+        release_project_command("bin/rake")
       end
 
       def release_setup_command
+        release_project_command("bin/setup")
+      end
+
+      # Every command that loads the project bundle must run outside the
+      # release tool's bundle and with local workspace dependency switches
+      # disabled. The default task may carry a leading environment assignment,
+      # so relying on BundlerEnvGuard's command classification alone is not
+      # sufficient.
+      def release_project_command(command)
+        project_command = command
         unbundled_keys = (BundlerEnvGuard::RESET_ENV_KEYS + %w[RUBYLIB RUBYOPT]).uniq
-        "env #{unbundled_keys.map { |key| "-u #{Shellwords.escape(key)}" }.join(" ")} bin/setup"
+        command = +"env #{unbundled_keys.map { |key| "-u #{Shellwords.escape(key)}" }.join(" ")}"
+        release_lockfile_normalization_env.each do |key, value|
+          command << " #{key}=#{Shellwords.escape(value)}"
+        end
+        command << " #{project_command}"
+        command
       end
 
       def confirm_yes!(message, prompt, abort_message)
@@ -1189,7 +1241,7 @@ module Kettle
           secrets_provider: @secrets_provider,
           secret_event_handler: ->(payload) { emit_secret_event(payload) }
         ).call(
-          self.class.send(:command_env),
+          self.class.send(:command_env_for, cmd),
           cmd
         )
         return if status.success?
@@ -1264,8 +1316,31 @@ module Kettle
       end
 
       def release_secret_command?(cmd)
-        /\Abundle(\s+exec)?\s+rake\s+(build|release)\b/.match?(cmd) ||
-          /\Agem\s+push\b/.match?(cmd)
+        words = effective_command_words(cmd)
+        (words.first(3) == ["bundle", "exec", "rake"] && %w[build release].include?(words[3])) ||
+          words.first(2) == ["gem", "push"]
+      rescue ArgumentError
+        false
+      end
+
+      def effective_command_words(cmd)
+        words = Shellwords.split(cmd.to_s)
+        words.shift while words.first&.match?(/\A[A-Za-z_][A-Za-z0-9_]*=/)
+
+        if words.first == "env"
+          words.shift
+          while words.any?
+            if words.first == "-u"
+              words.shift(2)
+            elsif words.first&.include?("=")
+              words.shift
+            else
+              break
+            end
+          end
+        end
+
+        words
       end
 
       def with_bundle_audit_skip_env
@@ -1549,6 +1624,9 @@ module Kettle
       end
 
       def detect_gem_name
+        env_gem_name = ENV.fetch("K_CHANGELOG_GEM_NAME", "").to_s.strip
+        return env_gem_name unless env_gem_name.empty?
+
         gemspecs = Dir[File.join(@root, "*.gemspec")]
         abort("Could not find a .gemspec in project root.") if gemspecs.empty?
         path = gemspecs.min
@@ -2496,7 +2574,7 @@ module Kettle
 
       # Returns [section_text, compare_ref_line, tag_ref_line]
       def extract_changelog_for_version(version)
-        path = File.join(@root, "CHANGELOG.md")
+        path = resolved_changelog_path
         return [nil, nil, nil] unless File.file?(path)
 
         content = File.read(path)
@@ -2525,6 +2603,12 @@ module Kettle
         [nil, nil, nil]
       end
 
+      def resolved_changelog_path
+        path = ENV.fetch("K_CHANGELOG_PATH", "").to_s.strip
+        path = "CHANGELOG.md" if path.empty?
+        File.expand_path(path, @root)
+      end
+
       def extract_release_notes_footer
         path = File.join(@root, "FUNDING.md")
         return unless File.file?(path)

data/lib/kettle/dev/ruby_gems_versions.rb

@@ -35,6 +35,10 @@ module Kettle
           response = Net::HTTP.start(uri.host, uri.port, use_ssl: uri.scheme == "https") do |http|
             http.request(request)
           end
+          if response.code.to_i == 404
+            write_versions(name, [])
+            return []
+          end
           return cached unless response.is_a?(Net::HTTPSuccess)
 
           data = JSON.parse(response.body)

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "2.5.25"
+      VERSION = "2.5.26"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 2.5.25
+  version: 2.5.26
 platform: ruby
 authors:
 - Peter H. Boling
@@ -402,10 +402,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.5.25
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.5.25/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v2.5.26
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v2.5.26/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.5.25
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/2.5.26
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev