kettle-dev 3.0.1 → 3.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 335bd9651ff7bbe5381c8e050a26f070c6accd8054ab581226ba3355c8a4aa6e
-  data.tar.gz: 7f59238412adde48ba5f2b524b08e4ce77a5348c81d0984e44013e6ce905b2dc
+  metadata.gz: ac5e19991ef314add0cbb6f8c764a0389df6003ea291e5ea08bb76bf32c2786a
+  data.tar.gz: 894c0f1521ec987771056394037f3aa2108634bea11830c47f630b43b65727e7
 SHA512:
-  metadata.gz: 94e3d356b963078c8dd46d50d0f2b7ed92f656327bd3f766618617b56172ae0051dc32f6469cfd5c9faf539e00a4bbdf123947dd8febbd10c34172f51a2efc2d
-  data.tar.gz: d2eee5766a478c4846f05969ac4fcbf4614793740911c029219d85fb446fd308f9c376c5fa8d68edbdc71bd144dba09a1ad927c5915278c7933d0fc50ac74dca
+  metadata.gz: 2bbb2b78730584bfdddbf66664679393ec7c282ea8e24130b01019bc4e61c48da2d4be751d354679c0a76f6ac4ed23a28bfcf60efae081468ffa98cfbe66dfb5
+  data.tar.gz: cc6156801f9ef0b6cd6e39ee614b63729acff1862e83cd4390319a98a6978ef06e148d82c255beb38a0d68a09531e435a4d57c7f315a9e4f4cb1cd929b16edff

data/CHANGELOG.md

@@ -30,6 +30,23 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.2] - 2026-08-10
+
+- TAG: [v3.0.2][3.0.2t]
+- COVERAGE: 91.56% -- 5629/6148 lines in 47 files
+- BRANCH COVERAGE: 76.14% -- 2128/2795 branches in 47 files
+- 51.00% documented
+
+### Fixed
+
+- Stop polling 1Password during release monitoring and support family-owned release secret brokers.
+
+- Allow pre-release GitHub Actions pin validation to use the explicitly requested persistent cache when live TLS access is unavailable.
+
+- Detect locally installed unreleased workspace gems through an unbundled RubyGems probe during release lockfile normalization.
+
+- Isolate standalone kettle-changelog coverage and tests from family release orchestration environment.
+
 ## [3.0.1] - 2026-08-10
 
 - TAG: [v3.0.1][3.0.1t]
@@ -3414,7 +3431,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.1...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.2...HEAD
+[3.0.2]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.1...v3.0.2
+[3.0.2t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.2
 [3.0.1]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.0...v3.0.1
 [3.0.1t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.1
 [3.0.0]: https://github.com/kettle-dev/kettle-dev/compare/v2.5.28...v3.0.0

data/README.md

@@ -1007,7 +1007,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.098-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.148-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-pre-release

@@ -59,6 +59,10 @@ parser = OptionParser.new do |opts|
     puts "  KETTLE_IMAGE_URL_CACHE=/path/to/cache.json  Use a custom cache path"
     puts "  KETTLE_IMAGE_URL_CACHE=false                Disable the image URL cache"
     puts "  KETTLE_IMAGE_URL_CACHE_REFRESH=true         Ignore cached successes and refresh"
+    puts
+    puts "GitHub Actions pin cache:"
+    puts "  Live cache validation is the default and refreshes stale entries from GitHub."
+    puts "  KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE=true  Trust the persistent pin cache without network access"
     exit(0)
   end
 end

data/lib/kettle/dev/lockfile_reset.rb

@@ -3,6 +3,7 @@
 require "set"
 require "shellwords"
 require "fileutils"
+require "open3"
 require "bundler"
 
 require_relative "bundler_env_guard"
@@ -418,12 +419,26 @@ module Kettle
       end
 
       def locally_installed?(name, version)
-        Gem::Specification.reset
-        Gem::Specification.find_all_by_name(name, "= #{version}").any?
-      rescue
+        _stdout, _stderr, status = Open3.capture3(
+          unbundled_env,
+          "gem",
+          "specification",
+          name,
+          "--version",
+          version.to_s,
+          "--local"
+        )
+        status.success?
+      rescue SystemCallError
         false
       end
 
+      def unbundled_env
+        UNBUNDLED_ENV_KEYS.each_with_object({}) do |key, env|
+          env[key] = nil
+        end
+      end
+
       def gem_source_version_available?(name, version, source_urls)
         urls = Array(source_urls).compact.uniq
         return false if urls.empty?

data/lib/kettle/dev/pre_release_cli.rb

@@ -316,8 +316,12 @@ module Kettle
       # Check 1: Ensure GitHub Actions workflow action refs are current SHA pins.
       # @return [void]
       def check_github_actions_sha_pins!
-        puts "[kettle-pre-release] Check 1: Validate GitHub Actions SHA pins"
-        status = Kettle::Dev::GhaShaPinsCLI.new(["--root", Dir.pwd, "--check", "--upgrade", "major"]).run!
+        offline = env_truthy?(ENV["KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE"])
+        mode = offline ? "offline cache" : "live cache validation"
+        puts "[kettle-pre-release] Check 1: Validate GitHub Actions SHA pins (#{mode})"
+        args = ["--root", Dir.pwd, "--check", "--upgrade", "major"]
+        args << "--offline" if offline
+        status = Kettle::Dev::GhaShaPinsCLI.new(args).run!
         return nil if status.zero?
 
         Kettle::Dev::ExitAdapter.abort("GitHub Actions SHA pin validation failed")

data/lib/kettle/dev/release_cli.rb

@@ -46,6 +46,23 @@ module Kettle
         "BUNDLE_SILENCE_ROOT_WARNING" => "true",
         "BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES" => "true"
       }.freeze
+      RELEASE_CHILD_ENV_KEYS = %w[
+        K_RELEASE_CI_CONTINUE
+        K_RELEASE_REQUIRED_REMOTES
+        KETTLE_FAMILY_CONFIG
+        KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE
+        KETTLE_RELEASE_SECRETS_PROVIDER
+        KETTLE_RELEASE_SECRETS_BROKER
+        KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE
+        KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE_SOURCE
+        KETTLE_RELEASE_1PASSWORD_ACCOUNT
+        KETTLE_RELEASE_1PASSWORD_CLI
+        KETTLE_RELEASE_1PASSWORD_ITEM
+        KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_FIELD
+        KETTLE_RELEASE_1PASSWORD_RUBYGEMS_OTP_FIELD
+        KETTLE_RELEASE_1PASSWORD_GEM_SIGNING_PASSPHRASE_REFERENCE
+        KETTLE_RELEASE_1PASSWORD_RUBYGEMS_OTP_REFERENCE
+      ].freeze
       DEBUG_TRUE_VALUES = %w[1 true yes on].freeze
       RELEASE_VALIDATION_SOURCE = "https://gem.coop"
 
@@ -110,7 +127,9 @@ module Kettle
           env_hash = command_env
           return env_hash unless project_bundle_command?(cmd)
 
-          env_hash.merge(BundlerEnvGuard.unbundled_env)
+          env_hash.merge(BundlerEnvGuard.unbundled_env).merge(
+            RELEASE_CHILD_ENV_KEYS.each_with_object({}) { |key, env| env[key] = nil }
+          )
         end
 
         def project_bundle_command?(cmd)
@@ -1170,7 +1189,7 @@ module Kettle
           Kettle::Dev::CIMonitor.monitor_all!(
             restart_hint: restart_hint,
             workflows: @ci_workflows,
-            keepalive: release_secrets_configured? ? -> { keep_release_secrets_alive!("CI monitoring") } : nil,
+            keepalive: release_secrets_keepalive_required? ? -> { keep_release_secrets_alive!("CI monitoring") } : nil,
             event_recorder: @event_recorder
           )
           emit_ci_monitor_event(action: "finish", status: "ok", workflows: @ci_workflows, restart_hint: restart_hint)
@@ -1368,7 +1387,7 @@ module Kettle
       end
 
       def keep_release_secrets_alive!(purpose)
-        return unless release_secrets_configured?
+        return unless release_secrets_keepalive_required?
         return unless @secrets_provider.respond_to?(:keepalive!)
 
         emit_secret_event(action: "keepalive", status: "started", purpose: purpose, source: release_secrets_provider_label, elapsed: release_elapsed_label)
@@ -1379,6 +1398,16 @@ module Kettle
         abort("Release secrets provider keepalive failed before #{purpose}: #{error.message}")
       end
 
+      def release_secrets_keepalive_required?
+        return false unless release_secrets_configured?
+        if @secrets_provider.respond_to?(:keepalive_required?)
+          configured = @secrets_provider.keepalive_required?
+          return configured unless configured.nil?
+        end
+
+        true
+      end
+
       def release_elapsed_label
         return nil unless @started_at
 

data/lib/kettle/dev/release_secrets.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 require "open3"
+require "json"
+require "socket"
 require "kettle/dev/interactive_release_command"
 require "kettle/dev/release_notifier"
 
@@ -10,6 +12,10 @@ module Kettle
 
     module ReleaseSecrets
       class Provider
+        def keepalive_required?
+          true
+        end
+
         def gem_signing_passphrase
           nil
         end
@@ -23,6 +29,63 @@ module Kettle
         end
       end
 
+      # Secret provider used by a family-owned release broker. The broker keeps
+      # all 1Password lookups in the family process; member release processes
+      # never authenticate independently.
+      class BrokerClient < Provider
+        def initialize(endpoint)
+          @endpoint = endpoint.to_s
+          raise Kettle::Dev::Error, "release secrets broker endpoint is required" if @endpoint.empty?
+        end
+
+        def gem_signing_passphrase
+          return cached_gem_signing_passphrase if cached_gem_signing_passphrase?
+
+          request("gem_signing_passphrase")
+        end
+
+        def rubygems_otp
+          request("rubygems_otp")
+        end
+
+        # A family broker owns authorization. Polling must never start a new
+        # authentication lookup in the member process.
+        def keepalive!(elapsed: nil)
+          true
+        end
+
+        def keepalive_required?
+          false
+        end
+
+        private
+
+        def cached_gem_signing_passphrase?
+          %w[cached family kettle-family].include?(ENV.fetch("KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE_SOURCE", "").downcase)
+        end
+
+        def cached_gem_signing_passphrase
+          value = ENV.fetch("KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE", "").to_s
+          raise Kettle::Dev::Error, "cached gem signing passphrase was requested but KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE is empty" if value.empty?
+
+          value
+        end
+
+        def request(operation)
+          socket = UNIXSocket.new(@endpoint)
+          socket.write(JSON.generate("operation" => operation))
+          socket.write("\n")
+          response = JSON.parse(socket.gets.to_s)
+          return response.fetch("value").to_s if response["ok"]
+
+          raise Kettle::Dev::Error, response.fetch("error", "release secrets broker request failed")
+        rescue Errno::ENOENT, Errno::ECONNREFUSED => error
+          raise Kettle::Dev::Error, "release secrets broker is unavailable: #{error.message}"
+        ensure
+          socket&.close
+        end
+      end
+
       class OnePassword < Provider
         PROVIDER_NAMES = %w[1password onepassword op].freeze
         DEFAULTS = {
@@ -71,13 +134,16 @@ module Kettle
         end
 
         def keepalive!(elapsed: nil)
-          argv = [op_cli, "account", "get"]
-          account = string_config("account")
-          argv.concat(["--account", account]) unless account.empty?
-          run_op(argv, purpose: "authorization keepalive", elapsed: elapsed, interactive: true)
+          # 1Password CLI authentication is session-scoped. Starting a fresh
+          # `op account get` for every release poll does not keep it alive; it
+          # only creates repeated authorization prompts and noise.
           true
         end
 
+        def keepalive_required?
+          false
+        end
+
         private
 
         attr_reader :config
@@ -177,6 +243,10 @@ module Kettle
             provider_name.to_s
           end
           return Provider.new if name.empty? || name == "interactive"
+          if %w[family broker].include?(name.downcase)
+            endpoint = configured.fetch("endpoint", ENV.fetch("KETTLE_RELEASE_SECRETS_BROKER", ""))
+            return BrokerClient.new(endpoint)
+          end
           return OnePassword.new(env_config.merge(configured)) if OnePassword.configured?(name)
 
           raise Kettle::Dev::Error, "unsupported release secrets provider #{name.inspect}"

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.1"
+      VERSION = "3.0.2"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.1
+  version: 3.0.2
 platform: ruby
 authors:
 - Peter H. Boling
@@ -60,7 +60,7 @@ dependencies:
         version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.3.10
+        version: 0.3.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -70,7 +70,7 @@ dependencies:
         version: '0.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.3.10
+        version: 0.3.11
 - !ruby/object:Gem::Dependency
   name: kettle-ndjson
   requirement: !ruby/object:Gem::Requirement
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.1
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.1/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.2
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.2/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.1
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.2
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev