kettle-dev 3.0.19 → 3.0.20

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d876b80536e92761ec39671fee1b416885fceba475be7ade298e9dd8985df29e
-  data.tar.gz: d9075edc61ba1b98e98b7a4024d53d8c57e4beb0a0239059eeb0ddc6ec597c35
+  metadata.gz: 20e87802965f21d08fce4a1bb8eaab16a950611e67268f55284610c9e7601d6a
+  data.tar.gz: 26d1ac30a1bba63404ec8463290e20effd4039393c179842e61cf98ed5e89760
 SHA512:
-  metadata.gz: aa04b5dc3afa36b4dfdb5c7671ec2fba75fbb0bf73a1d88ee00c0e66d0c81bea453e57670f659a830a4042c98199d9f0fb280602bca5e0840395a998761e3fcd
-  data.tar.gz: 57ba7e91a1130bcb673b40b1c278b9206157163121a7bac829cf784641d2095153577bae43595d0fcba02f2f7ddb4b008c741f7599819f98e7678ebf36e45ce5
+  metadata.gz: d6d0157c9bd6b22580c9c4304ed9ec0d2a87f55d8e8afe33cf4e81e14a3905f979e30397143047979bfed0c795b321acfaa9739988c9fb6f8546c1e45ceffa17
+  data.tar.gz: cf6a29d466ad157170224b8aca7cb9569e2de56711825487d18f8e68ef3ca5e5d546b215d2b00d34d9e9dbe49d49e2a326c37883b9eab66cc0835f97420732c0

data/CHANGELOG.md

@@ -30,6 +30,17 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.0.20] - 2026-08-30
+
+- TAG: [v3.0.20][3.0.20t]
+- COVERAGE: 91.44% -- 5875/6425 lines in 47 files
+- BRANCH COVERAGE: 76.07% -- 2248/2955 branches in 47 files
+- 50.47% documented
+
+### Fixed
+
+- Preserve configured monorepo member-path lockfiles during release while rejecting unapproved local paths.
+
 ## [3.0.19] - 2026-08-30
 
 - TAG: [v3.0.19][3.0.19t]
@@ -3666,7 +3677,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.19...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.20...HEAD
+[3.0.20]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.19...v3.0.20
+[3.0.20t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.20
 [3.0.19]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.18...v3.0.19
 [3.0.19t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.0.19
 [3.0.18]: https://github.com/kettle-dev/kettle-dev/compare/v3.0.17...v3.0.18

data/README.md

@@ -508,7 +508,7 @@ What it does:
       | Role | Lockfile | Used by |
       | --- | --- | --- |
       | Family runner | The family/orchestrator bundle | May resolve local sibling gems to run `kettle-family`; it never becomes the target project's lockfile. |
-      | Canonical release state | Tracked `Gemfile.lock` and, when present, `Appraisal.root.gemfile.lock` | Step 1 Bundler update, steps 3-6 setup/checks/appraisals/docs/prep commit, and step 16 checksums. These commands disable local `*_DEV`/`*_LOCAL` switches. |
+      | Canonical release state | Tracked `Gemfile.lock` and, when present, `Appraisal.root.gemfile.lock` | Step 1 Bundler update, steps 3-6 setup/checks/appraisals/docs/prep commit, and step 16 checksums. These commands disable local `*_DEV`/`*_LOCAL` switches, except a narrow member-root policy supplied by `kettle-family` for an explicit monorepo. |
       | Release task state | `tmp/kettle-release/lockfiles/Gemfile-<pid>.lock` | Steps 14-15 build and publish only. It begins as a copy of canonical `Gemfile.lock` and is deleted at process exit. |
       | Tool state | A tool-owned Gemfile such as `kettle-changelog/gemfiles/release.gemfile` | The tool's own dependencies. The command still disables local dependency switches before it can trigger target-project work. |
       | Git-hook state | Canonical release environment | Every release-created commit and amend. Hooks remain enabled, but cannot inherit the family runner's local sibling graph. |
@@ -518,6 +518,14 @@ What it does:
       a release phase. `ReleaseCLI#release_child_command` owns canonical/tool
       command construction; `ReleaseCLI#release_project_command` selects the
       disposable task lock only for build and publish.
+
+      The monorepo exception is intentionally narrow. `kettle-family` derives
+      it only from `family.mode: monorepo` and its configured members root, then
+      passes the allowed root and activating environment name to
+      `kettle-release`. A sibling Kettle Dev checkout is not covered: normal
+      releases must use the released `kettle-family`, `kettle-changelog`, and
+      other Kettle dependencies. Local Kettle Dev integration is an explicit
+      development opt-in, never a canonical release-lock default.
 - Tips:
     - The commit message helper `exe/kettle-commit-msg` prefers project-local `.git-hooks` (then falls back to `~/.git-hooks`).
     - The goalie file `commit-subjects-goalie.txt` controls when a footer is appended; customize `footer-template.erb.txt` as you like.
@@ -1048,7 +1056,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.399-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.425-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -21,6 +21,8 @@ module Kettle
         "GALTZO_FLOSS_DEV" => "false",
         "UR_BRAIN_DEV" => "false"
       }.freeze
+      ALLOWED_LOCAL_PATH_ROOTS_ENV = "KETTLE_RELEASE_ALLOWED_LOCAL_PATH_ROOTS"
+      ALLOWED_LOCAL_PATH_ENVS_ENV = "KETTLE_RELEASE_ALLOWED_LOCAL_PATH_ENVS"
       RELEASE_LOCKFILES_TARGET = "release-lockfiles"
       SUPPORTED_TARGETS = ["Gemfile.lock", "Appraisal.root.gemfile.lock", RELEASE_LOCKFILES_TARGET].freeze
       UNBUNDLED_ENV_KEYS = (BundlerEnvGuard::RESET_ENV_KEYS + %w[
@@ -110,12 +112,18 @@ module Kettle
         @root = root
         @command_runner = command_runner
         @release_platforms = {}
+        @allowed_local_path_roots = configured_allowed_local_path_roots
+        @allowed_local_path_env_names = configured_allowed_local_path_env_names
       end
 
       def reset(target, skip_changelog_dependency: false)
         BundlerEnvGuard.warn_unexpected_env!
         paths = lockfile_paths_for(target)
-        force_full_update = release_lockfiles_target?(target)
+        # A monorepo lockfile may deliberately use paths rooted in the
+        # repository's members directory. Keep that valid development graph;
+        # only rebuild when an unapproved path or other diagnostic remains.
+        force_full_update = release_lockfiles_target?(target) &&
+          (allowed_local_path_roots.empty? || paths.any? { |path| normalization_needed?(path) })
         platforms = release_platforms_for(paths) if force_full_update
         uninstall_unreleased_local_gems(paths) if force_full_update
         paths.each do |path|
@@ -251,7 +259,7 @@ module Kettle
 
       def diagnostics(path)
         diagnostics = []
-        local_path_remote_lines(path).each do |line_number|
+        disallowed_local_path_remote_lines(path).each do |line_number|
           diagnostics << "#{display_path(path)} has local path remote at line #{line_number}"
         end
         empty_registry_checksums(path).each do |name, version, line_number|
@@ -308,13 +316,16 @@ module Kettle
       end
 
       def normalization_env
-        DEFAULT_DISABLED_ENV.merge(dynamic_local_path_env)
+        DEFAULT_DISABLED_ENV
+          .reject { |name, _| allowed_local_path_env_names.include?(name) }
+          .merge(dynamic_local_path_env)
       end
 
       def dynamic_local_path_env
         ENV.each_with_object({}) do |(key, value), env|
           next unless key.end_with?("_DEV", "_LOCAL")
           next unless local_path_env_value?(value)
+          next if allowed_local_path_env_names.include?(key)
 
           env[key] = "false"
         end
@@ -329,13 +340,49 @@ module Kettle
       end
 
       def has_local_path_remote?(path)
-        !local_path_remote_lines(path).empty?
+        !disallowed_local_path_remote_lines(path).empty?
       end
 
       def local_path_remote_lines(path)
         self.class.local_path_remote_lines_from_source(File.read(path))
       end
 
+      attr_reader :allowed_local_path_roots, :allowed_local_path_env_names
+
+      def disallowed_local_path_remote_lines(path)
+        local_path_remote_lines(path).reject do |line_number|
+          allowed_local_path?(local_path_remote_at(path, line_number))
+        end
+      end
+
+      def configured_allowed_local_path_roots
+        ENV.fetch(ALLOWED_LOCAL_PATH_ROOTS_ENV, "").split(File::PATH_SEPARATOR).filter_map do |value|
+          next if value.strip.empty?
+
+          canonical_path(value)
+        end.uniq
+      end
+
+      def configured_allowed_local_path_env_names
+        ENV.fetch(ALLOWED_LOCAL_PATH_ENVS_ENV, "").split(",").map(&:strip).reject(&:empty?).uniq
+      end
+
+      def local_path_remote_at(path, line_number)
+        File.readlines(path)[line_number - 1].to_s.split("remote:", 2).last.to_s.strip
+      end
+
+      def allowed_local_path?(path)
+        remote = canonical_path(path)
+        allowed_local_path_roots.any? { |root| remote == root || remote.start_with?("#{root}/") }
+      end
+
+      def canonical_path(path)
+        expanded = File.expand_path(path, root)
+        File.realpath(expanded)
+      rescue Errno::ENOENT
+        expanded
+      end
+
       def empty_registry_checksums(path)
         non_registry_gems = non_registry_source_gems(path) | path_dependency_gems(path)
         in_checksums = false

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.0.19"
+      VERSION = "3.0.20"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.0.19
+  version: 3.0.20
 platform: ruby
 authors:
 - Peter H. Boling
@@ -400,10 +400,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.19
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.19/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.0.20
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.0.20/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.19
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.0.20
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev