kettle-dev 3.1.12 → 3.1.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a53813cd27173724428ba3d36dfc9c49c2cd2602235cc6e67ee4c334ac459f19
-  data.tar.gz: 259280a12837d7baa9521d1846977d400ed626779f05d45448dd751711d1b11e
+  metadata.gz: fee58bbb5088875b1370305934e2816bc7b1f7ad5103776d7877f7bfb8383bd2
+  data.tar.gz: 75dd9745eda2bd54c6dcf1a9a5ae9bf8b36fdfcb2edd2e8a3c26ab3bde366aa6
 SHA512:
-  metadata.gz: 57d215d343dfbfe520e7d17802afe6ee84cf54ea9a5558924c42c301a43ea768989045e63714fbd4c3b225a57f4b08fe61d3e2aad9f51248d47c8b9d4457d0b8
-  data.tar.gz: 656b8a321db50a699c0a883c17156c46553cacfc47830de36d2926dfc8bafffab4e83948771692f640325a7474b8a7abec613227e23f321b27ad750aa2d62a6f
+  metadata.gz: e21b6253a77ecf67f42b54a464405baa078615cc99585f1146f432135f347f5fc0e7c4044137841f3da5f589486fc3971cd8b5dbe6285bf1f194de9b7bbd8359
+  data.tar.gz: 0dd4e28b43e6d4ba4ae3481d0464fbeb8b1c7aa39ae1628f0fc9c2ce80fe9d850a738d62414ceda91f6daf43887ee4b400c6621df7b5b1c473bfaa934ade7941

data/CHANGELOG.md

@@ -30,6 +30,36 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.13] - 2026-10-14
+
+- TAG: [v3.1.13][3.1.13t]
+- COVERAGE: 91.53% -- 6427/7022 lines in 49 files
+- BRANCH COVERAGE: 75.69% -- 2456/3245 branches in 49 files
+- 53.23% documented
+
+### Changed
+
+- GitHub API request budget is now enforced machine-wide through an flock'd XDG ledger (XDG_STATE_HOME/kettle-dev/ci-rate-budget.json, override with K_RELEASE_CI_RATE_STATE_FILE) instead of per-process memory: parallel family releases, wave jobs, ci:act, and kettle-release GitHub Releases calls all share one budget (default 90 req/min) matching GitHub's per-token quota; unavailable ledger degrades to in-process spacing
+
+- [kc] kettle-jem/template: updated 80 project files:
+  - code and tests (5)
+  - configuration (2)
+  - dependencies (15)
+  - documentation (1)
+  - other (3)
+  - workflows (54)
+- [kc] kettle-jem/prepare: updated 1 project file:
+  - dependencies (1)
+
+### Fixed
+
+- release:guard_clean no longer aborts a --start-step 15 resume: the publish-boundary lockfile normalization added in 3.1.13 lived only inside the step 14 block, so resuming at step 15 skipped it and the parent's own boot (family local-path toggle + gemspec self-version bump) re-dirtied the canonical Gemfile.lock with sibling PATH remotes; normalization now runs once per run from BOTH the step 14 and step 15 entry points
+- LockfileReset#rebuild_lockfile no longer crashes with Errno::ENOENT when a generated appraisal lockfile (e.g. Appraisal.root.gemfile.lock) vanishes between the entry guard and the backup copy (TOCTOU race with mid-process CI cleanup); the rebuild now yields without a backup and skips restore when the target was already gone
+
+- Test suite no longer mutates the live repo checkout: appraisal rake task specs now run in a sandboxed CWD (the task's File.delete of the relative Appraisal.root.gemfile.lock path was really deleting the repo's lockfile mid-suite, racing parallel workers), and release_cli flow examples stub reset_release_lockfiles! instead of running real bundler resets against the live checkout — root cause of the ENOENT flake seen in ruby-3.4 CI
+
+- CI rate limiter no longer sleeps while holding the machine-wide ledger flock: claims now reserve a future slot under the lock and sleep outside it (ticket limiter), so a wedged or slow claimer can no longer deadlock every other process sharing the ledger — the observed CI hang signature (spec-run worker held the flock for minutes while peers starved past the watchdog). The ledger path override is now read at call time, and the test suite isolates itself onto a per-run tmp ledger instead of the production file
+
 ## [3.1.12] - 2026-10-12
 
 - TAG: [v3.1.12][3.1.12t]
@@ -4064,7 +4094,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.12...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.13...HEAD
+[3.1.13]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.12...v3.1.13
+[3.1.13t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.13
 [3.1.12]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.11...v3.1.12
 [3.1.12t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.12
 [3.1.11]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.10...v3.1.11

data/README.md

@@ -93,7 +93,7 @@ out to `kettle-release` for each member that needs publishing.
 | Tokens to Remember | [![Gem name][⛳️name-img]][⛳️gem-name] [![Gem namespace][⛳️namespace-img]][⛳️gem-namespace] |
 |-------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | Works with JRuby | [![JRuby 9.2 Compat][💎jruby-9.2i]][🚎jruby-9.2-wf] [![JRuby 9.3 Compat][💎jruby-9.3i]][🚎jruby-9.3-wf] <br/> [![JRuby 9.4 Compat][💎jruby-9.4i]][🚎jruby-9.4-wf] [![JRuby 10.0 Compat][💎jruby-10.0i]][🚎jruby-10.0-wf] [![JRuby current Compat][💎jruby-c-i]][🚎10-j-wf] [![JRuby HEAD Compat][💎jruby-headi]][🚎3-hd-wf]|
-| Works with Truffle Ruby | [![Truffle Ruby 22.3 Compat][💎truby-22.3i]][🚎truby-22.3-wf] [![Truffle Ruby 23.0 Compat][💎truby-23.0i]][🚎truby-23.0-wf] [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎truby-23.1-wf] <br/> [![Truffle Ruby 24.2 Compat][💎truby-24.2i]][🚎truby-24.2-wf] [![Truffle Ruby 25.0 Compat][💎truby-25.0i]][🚎truby-25.0-wf] [![Truffle Ruby 33.0 Compat][💎truby-33.0i]][🚎truby-33.0-wf] [![Truffle Ruby current Compat][💎truby-c-i]][🚎9-t-wf] [![Truffle Ruby HEAD Compat][💎truby-headi]][🚎3-hd-wf]|
+| Works with Truffle Ruby | [![Truffle Ruby 22.3 Compat][💎truby-22.3i]][🚎truby-22.3-wf] [![Truffle Ruby 23.1 Compat][💎truby-23.1i]][🚎truby-23.1-wf] <br/> [![Truffle Ruby 24.2 Compat][💎truby-24.2i]][🚎truby-24.2-wf] [![Truffle Ruby 25.0 Compat][💎truby-25.0i]][🚎truby-25.0-wf] [![Truffle Ruby 33.0 Compat][💎truby-33.0i]][🚎truby-33.0-wf] [![Truffle Ruby current Compat][💎truby-c-i]][🚎9-t-wf]|
 | Works with MRI Ruby 4 | [![Ruby current Compat][💎ruby-c-i]][🚎11-c-wf] [![Ruby HEAD Compat][💎ruby-headi]][🚎3-hd-wf]|
 | Works with MRI Ruby 3 | [![Ruby 3.0 Compat][💎ruby-3.0i]][🚎ruby-3.0-wf] [![Ruby 3.1 Compat][💎ruby-3.1i]][🚎ruby-3.1-wf] [![Ruby 3.2 Compat][💎ruby-3.2i]][🚎ruby-3.2-wf] [![Ruby 3.3 Compat][💎ruby-3.3i]][🚎ruby-3.3-wf] [![Ruby 3.4 Compat][💎ruby-3.4i]][🚎ruby-3.4-wf]|
 | Works with MRI Ruby 2 | [![Ruby 2.4 Compat][💎ruby-2.4i]][🚎ruby-2.4-wf] [![Ruby 2.5 Compat][💎ruby-2.5i]][🚎ruby-2.5-wf] [![Ruby 2.6 Compat][💎ruby-2.6i]][🚎ruby-2.6-wf] [![Ruby 2.7 Compat][💎ruby-2.7i]][🚎ruby-2.7-wf]|
@@ -132,6 +132,23 @@ The _amazing_ test matrix is powered by the kettle-dev stack.
 
 </details>
 
+### Runtime and Platform Support
+
+Support tiers describe what this project's CI actually exercises, not what may
+work in an untested environment:
+
+- **Parallel support**: CI runs the test suite with multiple workers available.
+- **Unsupported**: the engine/platform combination is not covered by CI and is
+ not a project compatibility claim.
+
+| Ruby engine/version | Linux | macOS | Windows | Notes |
+|---------------------|-------|-------|---------|-------|
+| MRI 3.1-3.4 | Parallel support | Unsupported | Unsupported | Versioned Ruby workflows run on Linux. |
+| MRI current | Parallel support | Parallel support | Unsupported | Current Ruby workflow covers the declared OS platforms. |
+| MRI head | Parallel support | Unsupported | Unsupported | CI is allowed to fail while Ruby is in development. |
+| JRuby (all CI lanes) | Parallel support | Unsupported | Unsupported | Engine workflows run on Linux; macOS and Windows are not exercised by CI. |
+| TruffleRuby (all CI lanes) | Parallel support | Unsupported | Unsupported | Never shipped a Windows build (zero Windows assets across 66 releases scanned 2026-10-10); setup-ruby hard-fails ([source](https://github.com/ruby/setup-ruby/blob/master/README.md)) |
+
 ### Federated DVCS
 
 <details markdown="1">
@@ -996,7 +1013,6 @@ Thanks for RTFM. ☺️
 [🚎jruby-9.4-wf]: https://github.com/kettle-dev/kettle-dev/actions/workflows/jruby-9.4.yml
 [🚎jruby-10.0-wf]: https://github.com/kettle-dev/kettle-dev/actions/workflows/jruby-10.0.yml
 [🚎truby-22.3-wf]: https://github.com/kettle-dev/kettle-dev/actions/workflows/truffleruby-22.3.yml
-[🚎truby-23.0-wf]: https://github.com/kettle-dev/kettle-dev/actions/workflows/truffleruby-23.0.yml
 [🚎truby-23.1-wf]: https://github.com/kettle-dev/kettle-dev/actions/workflows/truffleruby-23.1.yml
 [🚎truby-24.2-wf]: https://github.com/kettle-dev/kettle-dev/actions/workflows/truffleruby-24.2.yml
 [🚎truby-25.0-wf]: https://github.com/kettle-dev/kettle-dev/actions/workflows/truffleruby-25.0.yml
@@ -1031,13 +1047,11 @@ Thanks for RTFM. ☺️
 [💎ruby-c-i]: https://img.shields.io/badge/Ruby-current-CC342D?style=for-the-badge&logo=ruby&logoColor=green
 [💎ruby-headi]: https://img.shields.io/badge/Ruby-HEAD-CC342D?style=for-the-badge&logo=ruby&logoColor=blue
 [💎truby-22.3i]: https://img.shields.io/badge/Truffle_Ruby-22.3-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
-[💎truby-23.0i]: https://img.shields.io/badge/Truffle_Ruby-23.0-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
 [💎truby-23.1i]: https://img.shields.io/badge/Truffle_Ruby-23.1-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
 [💎truby-24.2i]: https://img.shields.io/badge/Truffle_Ruby-24.2-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
 [💎truby-25.0i]: https://img.shields.io/badge/Truffle_Ruby-25.0-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
 [💎truby-33.0i]: https://img.shields.io/badge/Truffle_Ruby-33.0-34BCB1?style=for-the-badge&logo=ruby&logoColor=pink
 [💎truby-c-i]: https://img.shields.io/badge/Truffle_Ruby-current-34BCB1?style=for-the-badge&logo=ruby&logoColor=green
-[💎truby-headi]: https://img.shields.io/badge/Truffle_Ruby-HEAD-34BCB1?style=for-the-badge&logo=ruby&logoColor=blue
 [💎jruby-9.2i]: https://img.shields.io/badge/JRuby-9.2-FBE742?style=for-the-badge&logo=ruby&logoColor=red
 [💎jruby-9.3i]: https://img.shields.io/badge/JRuby-9.3-FBE742?style=for-the-badge&logo=ruby&logoColor=red
 [💎jruby-9.4i]: https://img.shields.io/badge/JRuby-9.4-FBE742?style=for-the-badge&logo=ruby&logoColor=red
@@ -1070,7 +1084,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.980-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-7.022-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/ci_helpers.rb

@@ -5,6 +5,7 @@ require "open3"
 require "net/http"
 require "json"
 require "uri"
+require "fileutils"
 
 module Kettle
   module Dev
@@ -183,30 +184,101 @@ module Kettle
         end
       end
 
-      # Process-wide rate-limit state shared by every CIHelpers caller in this
-      # process (the release runner polls many member/monitor children in one
-      # process tree, and each child gets its own copy — this throttles within
-      # a process; the budget is sized so even a fully parallel family run
-      # stays inside GitHub's per-token allowance).
+      # Rate-limit budget shared by every CIHelpers caller. The budget is
+      # enforced MACHINE-WIDE: parallel family releases (kettle-family spawns
+      # one kettle-release process per member job, and every family can run
+      # concurrently) all share one GitHub per-token quota, so the limiter
+      # coordinates through an flock'd ledger file under XDG state rather than
+      # per-process memory. kettle-dev owns the file because it makes the
+      # requests; kettle-family never calls the API itself.
       CI_RATE_BUDGET_PER_MINUTE = (ENV["K_RELEASE_CI_REQUESTS_PER_MINUTE"] || 90).to_f
       CI_RATE_MIN_INTERVAL = CI_RATE_BUDGET_PER_MINUTE.positive? ? 60.0 / CI_RATE_BUDGET_PER_MINUTE : 0.0
-      @ci_rate_last_request = 0.0
       @ci_rate_lock = Mutex.new
 
+      # Ledger location: XDG_STATE_HOME/kettle-dev/ci-rate-budget.json
+      # (XDG default is ~/.local/state). Overridable wholesale with
+      # K_RELEASE_CI_RATE_STATE_FILE. Read at CALL time (not frozen at load)
+      # so test suites can point the limiter at a per-run tmp ledger via
+      # stubbed_env: the shared ledger is effectively a local production
+      # system and specs must never consume or corrupt its state.
+      def ci_rate_state_path
+        override = ENV["K_RELEASE_CI_RATE_STATE_FILE"]
+        return override if override && !override.empty?
+
+        base = ENV["XDG_STATE_HOME"]
+        base = (base && !base.empty?) ? base : File.join(Dir.home, ".local", "state")
+        File.join(base, "kettle-dev", "ci-rate-budget.json")
+      end
+
+      # Cross-process spacing, ticket-style: each caller claims the next
+      # request slot under an exclusive flock on the ledger file, RELEASES the
+      # lock, and only then sleeps out its wait. The critical section is a few
+      # microseconds regardless of budget, so hammering claimers queue briefly
+      # on the flock instead of each holding it for a whole interval — the old
+      # in-lock sleep serialized the whole machine behind one interval per
+      # claim, and a claimer wedged mid-sleep deadlocked every other process
+      # (observed in CI: a spec-run worker held the flock for minutes while
+      # its peers silently starved past the watchdog threshold).
+      # The flock is released automatically if a process dies. A missing or
+      # corrupt ledger starts fresh.
       def github_rate_limit_wait!
         return if CI_RATE_MIN_INTERVAL.zero?
 
+        wait = claim_ci_rate_slot
+        sleep(wait) if wait.positive?
+      end
+
+      # Returns how long the caller must wait before its request (0.0 when the
+      # budget is unspent). Never sleeps itself. Lock hold time is bounded by
+      # the file IO only.
+      def claim_ci_rate_slot
         @ci_rate_lock.synchronize do
-          now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-          delta = now - @ci_rate_last_request
-          if delta < CI_RATE_MIN_INTERVAL
-            sleep(CI_RATE_MIN_INTERVAL - delta)
-            now = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+          path = ci_rate_state_path
+          dir = File.dirname(path)
+          begin
+            FileUtils.mkdir_p(dir)
+          rescue SystemCallError
+            # No writable state dir: degrade to in-process throttling only.
+            return ci_rate_claim_in_process
+          end
+
+          begin
+            File.open(path, File::RDWR | File::CREAT, 0o644) do |f|
+              f.flock(File::LOCK_EX)
+              payload = f.size.zero? ? {} : JSON.parse(f.read)
+              last = payload["next_slot"] || payload["last_request"] || 0.0
+              now = Time.now.to_f
+              # Absurdly future (clock skew) or ancient entries start fresh.
+              last = 0.0 if !last.is_a?(Numeric) || (last - now).abs > 3600
+              slot = [last + CI_RATE_MIN_INTERVAL, now].max
+              f.rewind
+              f.truncate(0)
+              f.write(JSON.generate({"next_slot" => slot}))
+              f.flush
+              wait = slot - now
+              return wait.positive? ? wait : 0.0
+            end
+          rescue SystemCallError, JSON::ParserError
+            # Ledger unusable (read-only FS, broken JSON, no flock support):
+            # degrade to in-process throttling rather than failing releases.
+            return ci_rate_claim_in_process
           end
-          @ci_rate_last_request = now
         end
       end
 
+      # Fallback when no shared ledger is available. In-process ticket claims,
+      # sized to the same budget; the caller sleeps outside this method.
+      # rubocop:disable ThreadSafety/ClassInstanceVariable -- callers hold @ci_rate_lock, so this state has no concurrent writers; the degradation path is intentionally module-scoped.
+      def ci_rate_claim_in_process
+        @ci_rate_inproc_last = 0.0 unless defined?(@ci_rate_inproc_last)
+        now = Time.now.to_f
+        slot = [@ci_rate_inproc_last + CI_RATE_MIN_INTERVAL, now].max
+        @ci_rate_inproc_last = slot
+        wait = slot - now
+        wait.positive? ? wait : 0.0
+      end
+      # rubocop:enable ThreadSafety/ClassInstanceVariable
+
       def github_get_json(url, token:)
         github_rate_limit_wait!
         uri = URI(url)

data/lib/kettle/dev/lockfile_reset.rb

@@ -295,7 +295,7 @@ module Kettle
 
       def lockfile_platforms(path)
         in_platforms = false
-        File.readlines(path).filter_map do |line|
+        safe_lockfile_lines(path).filter_map do |line|
           stripped = line.strip
           if stripped.match?(/\A[A-Z][A-Z ]*\z/)
             in_platforms = stripped == "PLATFORMS"
@@ -448,7 +448,7 @@ module Kettle
       end
 
       def local_path_remote_lines(path)
-        self.class.local_path_remote_lines_from_source(File.read(path))
+        self.class.local_path_remote_lines_from_source(safe_lockfile_lines(path).join)
       end
 
       attr_reader :release_graph_contract
@@ -460,7 +460,7 @@ module Kettle
       end
 
       def local_path_remote_at(path, line_number)
-        File.readlines(path)[line_number - 1].to_s.split("remote:", 2).last.to_s.strip
+        safe_lockfile_lines(path)[line_number - 1].to_s.split("remote:", 2).last.to_s.strip
       end
 
       def allowed_local_path?(path)
@@ -477,7 +477,7 @@ module Kettle
       def empty_registry_checksums(path)
         non_registry_gems = non_registry_source_gems(path) | path_dependency_gems(path)
         in_checksums = false
-        entries = File.readlines(path).filter_map.with_index(1) do |line, index|
+        entries = safe_lockfile_lines(path).filter_map.with_index(1) do |line, index|
           stripped = line.strip
           if stripped == "CHECKSUMS"
             in_checksums = true
@@ -517,7 +517,7 @@ module Kettle
 
       def has_any_sha_checksum?(path)
         in_checksums = false
-        File.readlines(path).any? do |line|
+        safe_lockfile_lines(path).any? do |line|
           stripped = line.strip
           if stripped == "CHECKSUMS"
             in_checksums = true
@@ -538,14 +538,14 @@ module Kettle
         version = bundled_with_version(path)
         return false if version.empty?
 
-        checksums = self.class.checksum_entries_from_source(File.read(path))
+        checksums = self.class.checksum_entries_from_source(safe_lockfile_lines(path).join)
         return false unless checksums&.keys&.any? { |name, _checksum_version| name == "bundler" }
 
         !checksums.key?(["bundler", version])
       end
 
       def bundled_with_version(path)
-        lines = File.readlines(path)
+        lines = safe_lockfile_lines(path)
         marker = lines.index { |line| line.strip == "BUNDLED WITH" }
         return "" unless marker
 
@@ -626,7 +626,8 @@ module Kettle
 
       def gemfile_bootstrap_gems(gemfile)
         gemfile_source_paths(gemfile).each_with_index.each_with_object({}) do |(path, index), gems|
-          calls = require_calls_from_ripper(Ripper.sexp(File.read(path)))
+          source = File.file?(path) ? File.read(path) : ""
+          calls = require_calls_from_ripper(Ripper.sexp(source))
           calls.filter_map { |method_name, argument| bootstrap_gem_name(method_name, argument) }.each do |name|
             gems[name] = gems.fetch(name, false) || index.zero?
           end
@@ -711,12 +712,7 @@ module Kettle
 
       def lockfile_source_content(path)
         in_checksums = false
-        # A lockfile can vanish between the lockfile_paths scan and this read
-        # (CI workers clean up generated appraisal locks mid-process). Treat a
-        # missing lockfile as an empty graph: bootstrap version lookups return
-        # nil and the reset skips what no longer exists.
-        return [].freeze unless File.file?(path)
-        File.readlines(path).filter_map do |line|
+        safe_lockfile_lines(path).filter_map do |line|
           stripped = line.strip
           if stripped == "CHECKSUMS"
             in_checksums = true
@@ -746,13 +742,18 @@ module Kettle
       def rebuild_lockfile(path)
         backup = backup_path_for(path)
         FileUtils.mkdir_p(File.dirname(backup))
-        FileUtils.cp(path, backup)
+        # TOCTOU: the target can vanish between the scan/entry guard and this
+        # copy (CI cleanup of generated appraisal lockfiles mid-process).
+        # Nothing to preserve in that case — yield so the rebuild writes a
+        # fresh lockfile, and skip the backup restore entirely.
+        existed = File.file?(path)
+        FileUtils.cp(path, backup) if existed
         FileUtils.rm_f(path)
         yield
-        FileUtils.mv(backup, path, force: true) unless File.file?(path)
+        FileUtils.mv(backup, path, force: true) if existed && !File.file?(path)
         FileUtils.rm_f(backup)
       rescue
-        FileUtils.mv(backup, path, force: true) if File.file?(backup)
+        FileUtils.mv(backup, path, force: true) if existed && File.file?(backup)
         raise
       end
 
@@ -794,11 +795,22 @@ module Kettle
         registry_specs_with_lines(path).map { |name, version, _line_number| [name, version] }
       end
 
+      # Single read path for lockfile contents: a generated appraisal lock
+      # can vanish between the lockfile_paths scan and any read (CI workers
+      # create and clean up locks in the repo root mid-process). Every reader
+      # in this class goes through here and treats absence as an empty file
+      # so a deleted ghost lock degrades to "nothing to do" instead of
+      # crashing the release pipeline with Errno::ENOENT.
+      def safe_lockfile_lines(path)
+        return [].freeze unless File.file?(path)
+        File.readlines(path)
+      end
+
       def registry_specs_with_lines(path)
         specs = []
         in_gem = false
         in_specs = false
-        File.readlines(path).each.with_index(1) do |line, line_number|
+        safe_lockfile_lines(path).each.with_index(1) do |line, line_number|
           stripped = line.chomp
           if stripped == "GEM"
             in_gem = true
@@ -867,7 +879,7 @@ module Kettle
       def registry_source_urls(path)
         urls = []
         in_gem = false
-        File.readlines(path).each do |line|
+        safe_lockfile_lines(path).each do |line|
           stripped = line.strip
           if stripped == "GEM"
             in_gem = true

data/lib/kettle/dev/release_cli.rb

@@ -492,21 +492,7 @@ module Kettle
         # 14. build
         with_release_resume_step(14) do
           if run_step?(14)
-            # When resuming at step 14/15 the step 0-5 lockfile preflight is
-            # skipped, but this process's own boot (`bundle exec
-            # kettle-release` with the family launcher's local-path toggle
-            # active) can silently rewrite the canonical Gemfile.lock with
-            # sibling PATH remotes — the gemspec self-version bump makes every
-            # boot re-resolve. `rake release` aborts on the dirty worktree at
-            # release:guard_clean. Normalize at the publish boundary too.
-            # Projects without any tracked release lockfile (bare scratch
-            # specs) have nothing to normalize; LockfileReset would abort.
-            unless lockfile_reset.lockfile_paths.empty?
-              reset_release_lockfiles!(stage: "before publish tasks")
-              validate_release_lockfiles!(stage: "before publish tasks")
-              prepare_release_lockfiles_for_release_tasks!
-              materialize_release_lockfiles_for_release_tasks!
-            end
+            normalize_release_lockfiles_before_publish_tasks!
             ensure_release_secrets_ready_for_signing! if signing_enabled? && release_secrets_configured?
             if signing_enabled? && release_secrets_configured?
               puts "Running build with gem signing passphrase from configured secrets provider (#{release_secrets_provider_label})..."
@@ -520,6 +506,7 @@ module Kettle
         # 15. release and tag
         with_release_resume_step(15) do
           if run_step?(15)
+            normalize_release_lockfiles_before_publish_tasks!
             version ||= detect_version
             gem_name = detect_gem_name
             @release_candidate = build_release_candidate(gem_name, version)
@@ -778,6 +765,27 @@ module Kettle
         reset_release_lockfiles!(stage: "before release task bundle installs")
       end
 
+      # When resuming at step 14/15 the step 0-5 lockfile preflight is skipped,
+      # but this process's own boot (`bundle exec kettle-release` with the
+      # family launcher's local-path toggle active) can silently rewrite the
+      # canonical Gemfile.lock with sibling PATH remotes — the gemspec
+      # self-version bump makes every boot re-resolve. `rake release` aborts on
+      # the dirty worktree at release:guard_clean. Normalize at the publish
+      # boundary too: once per run, invoked from BOTH the step 14 and step 15
+      # entry points so a `--start-step 15` resume (which skips step 14) is
+      # covered as well. Projects without any tracked release lockfile (bare
+      # scratch specs) have nothing to normalize; LockfileReset would abort.
+      def normalize_release_lockfiles_before_publish_tasks!
+        return if @release_lockfiles_normalized_before_publish
+        return if lockfile_reset.lockfile_paths.empty?
+
+        reset_release_lockfiles!(stage: "before publish tasks")
+        validate_release_lockfiles!(stage: "before publish tasks")
+        prepare_release_lockfiles_for_release_tasks!
+        materialize_release_lockfiles_for_release_tasks!
+        @release_lockfiles_normalized_before_publish = true
+      end
+
       # Resetting can select a platform-specific artifact that is not installed
       # in the invoking development bundle. Materialize every canonical release
       # bundle before a release gate runs `bundle exec`. Use a disposable copy:
@@ -3386,6 +3394,7 @@ module Kettle
           prerelease: false
         })
 
+        Kettle::Dev::CIHelpers.github_rate_limit_wait!
         res = Net::HTTP.start(uri.host, uri.port, use_ssl: true) do |http|
           http.request(req)
         end
@@ -3456,6 +3465,7 @@ module Kettle
         request["Accept"] = "application/vnd.github+json"
         request["Authorization"] = "token #{token}"
         request["User-Agent"] = "kettle-dev-release-cli"
+        Kettle::Dev::CIHelpers.github_rate_limit_wait!
         response = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(request) }
         return [JSON.parse(response.body), nil] if response.is_a?(Net::HTTPSuccess)
 
@@ -3555,6 +3565,7 @@ module Kettle
         request["Authorization"] = "token #{token}"
         request["User-Agent"] = "kettle-dev-release-cli"
         request.body = JSON.dump(name: title, body: body)
+        Kettle::Dev::CIHelpers.github_rate_limit_wait!
         response = Net::HTTP.start(uri.host, uri.port, use_ssl: true) { |http| http.request(request) }
         response.is_a?(Net::HTTPSuccess) ? [true, "updated"] : [false, "HTTP #{response.code}: #{response.body}"]
       rescue => e

data/lib/kettle/dev/tasks/ci_task.rb

@@ -68,6 +68,8 @@ module Kettle
             token = Kettle::Dev::CIHelpers.default_token
             req["Authorization"] = "token #{token}" if token && !token.empty?
             begin
+              # Share the machine-wide GitHub API budget with release monitors.
+              Kettle::Dev::CIHelpers.github_rate_limit_wait!
               res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
               if res.is_a?(Net::HTTPSuccess)
                 data = JSON.parse(res.body)
@@ -299,6 +301,8 @@ module Kettle
                     req = Net::HTTP::Get.new(uri)
                     req["User-Agent"] = "ci:act rake task"
                     req["Authorization"] = "token #{tk}" if tk && !tk.empty?
+                    # Share the machine-wide GitHub API budget with release monitors.
+                    Kettle::Dev::CIHelpers.github_rate_limit_wait!
                     res = Net::HTTP.start(uri.hostname, uri.port, use_ssl: true) { |http| http.request(req) }
                     if res.is_a?(Net::HTTPSuccess)
                       data = JSON.parse(res.body)

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.12"
+      VERSION = "3.1.13"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.12
+  version: 3.1.13
 platform: ruby
 authors:
 - Peter H. Boling
@@ -120,7 +120,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.24
+        version: 2.0.25
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -130,7 +130,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.24
+        version: 2.0.25
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -276,7 +276,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.14
+        version: 3.2.17
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -286,7 +286,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.14
+        version: 3.2.17
 - !ruby/object:Gem::Dependency
   name: stone_checksums
   requirement: !ruby/object:Gem::Requirement
@@ -422,10 +422,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.12
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.12/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.13
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.13/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.12
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.13
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev