kettle-dev 3.1.3 → 3.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0af4e7c94cc4d2320e2ac4f19162509c98cc3bc322281fbe09968fe211af1d2f
-  data.tar.gz: 1d4734bb8a3a6768340d2ddb35294d704d7c203f4052246554ff17460e65e5b3
+  metadata.gz: 3eaffce406ad243001b13e3e5fc92c3ffff48a7eac174506b7bcf6db2fb5031f
+  data.tar.gz: 67d34d5ab8630a31f4526c7c315b3647991b76c37b03617a153aaeb7f52320ab
 SHA512:
-  metadata.gz: c3fd59b7f8de46b09620502a2c104599d31614f6f011cabe1adca6ee9e75c92bc70e32ebeaa46c897802ac1a629e4cfccbec093a2a572caed2720e2d52fa65aa
-  data.tar.gz: 844135ea482141c8feaf2b48aeb837775492a70cf335fe6e4c97f9745bc6de92616787b6a6e5fb486b7b8b401a1147caa006af747cb06b8b75d8ed4987832454
+  metadata.gz: edb236854f14490bb18db34924f4ae92b94d471d3e7210fbf8ec696d68c43510720f80f5982dfab08f3fe8a5e7354e590c4d9c158ad102ecea341738fa917dc2
+  data.tar.gz: d09c6f5d8cfdbb4d1734b711c8889f8f5b9ec76fc54278a9709bcdb48aed27975e7913036d0d98a1fa88d17ec0962251991b711646c0645708dee69bd2477bea

data/CHANGELOG.md

@@ -30,6 +30,17 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.4] - 2026-09-28
+
+- TAG: [v3.1.4][3.1.4t]
+- COVERAGE: 91.89% -- 6197/6744 lines in 49 files
+- BRANCH COVERAGE: 76.24% -- 2359/3094 branches in 49 files
+- 51.34% documented
+
+### Fixed
+
+- Centralize canonical path and component-aware containment checks for Kettle tools.
+
 ## [3.1.3] - 2026-09-27
 
 - TAG: [v3.1.3][3.1.3t]
@@ -3916,7 +3927,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.3...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.4...HEAD
+[3.1.4]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.3...v3.1.4
+[3.1.4t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.4
 [3.1.3]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.2...v3.1.3
 [3.1.3t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.3
 [3.1.2]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.1...v3.1.2

data/README.md

@@ -1066,7 +1066,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.717-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.744-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/paths.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+module Kettle
+  module Dev
+    # Filesystem path operations shared by Kettle tools.
+    module Paths
+      module_function
+
+      # Expands a path and resolves its longest existing ancestor. This keeps
+      # comparisons useful for generated paths that do not exist yet.
+      def canonical(path, base: nil)
+        expanded = File.expand_path(path, base)
+        existing = expanded
+        suffix = []
+        until File.exist?(existing) || File.symlink?(existing)
+          parent = File.dirname(existing)
+          return expanded if parent == existing
+
+          suffix.unshift(File.basename(existing))
+          existing = parent
+        end
+
+        suffix.reduce(File.realpath(existing)) { |resolved, component| File.join(resolved, component) }
+      rescue Errno::EACCES, Errno::ENOENT
+        expanded
+      end
+
+      # Uses filesystem identity for existing paths, so symlink aliases and
+      # platform-specific aliases are compared by the operating system.
+      def same?(left, right, base: nil)
+        left_path = canonical(left, base: base)
+        right_path = canonical(right, base: base)
+        return true if left_path == right_path
+
+        return File.identical?(left_path, right_path) if File.exist?(left_path) && File.exist?(right_path)
+
+        comparable_parts(left_path) == comparable_parts(right_path)
+      rescue Errno::EACCES, Errno::ENOENT, Errno::ENOTDIR, NotImplementedError
+        comparable_parts(left_path || left) == comparable_parts(right_path || right)
+      end
+
+      # Tests containment by path components, not by a string prefix.
+      def within?(path, root, base: nil)
+        candidate = canonical(path, base: base)
+        boundary = canonical(root, base: base)
+        return true if same?(candidate, boundary)
+
+        candidate_parts = comparable_parts(candidate)
+        boundary_parts = comparable_parts(boundary)
+        candidate_parts[0, boundary_parts.length] == boundary_parts
+      rescue Errno::EACCES, Errno::ENOENT, Errno::ENOTDIR
+        false
+      end
+
+      def path_parts(path)
+        path.tr("\\", "/").split("/").reject(&:empty?)
+      end
+
+      def comparable_parts(path)
+        parts = path_parts(path)
+        Gem.win_platform? ? parts.map(&:downcase) : parts
+      end
+    end
+  end
+end

data/lib/kettle/dev/release_graph_contract.rb

@@ -30,7 +30,7 @@ module Kettle
 
       def initialize(name:, root:, ci_root:, local_path_roots: [], selector_env: {})
         @name = String(name)
-        @root = File.realpath(root)
+        @root = Paths.canonical(root)
         @ci_root = canonical_path(ci_root)
         @local_path_roots = Array(local_path_roots).map { |path| canonical_path(path) }.uniq.freeze
         @selector_env = selector_env.to_h.map { |key, value| [String(key), String(value)] }.to_h.freeze
@@ -86,25 +86,11 @@ module Kettle
       end
 
       def canonical_path(path)
-        expanded = File.expand_path(path, @root)
-        candidate = expanded
-        suffix = []
-
-        until File.exist?(candidate) || File.symlink?(candidate)
-          parent = File.dirname(candidate)
-          return expanded if parent == candidate
-
-          suffix.unshift(File.basename(candidate))
-          candidate = parent
-        end
-
-        suffix.reduce(File.realpath(candidate)) { |base, component| File.join(base, component) }
-      rescue Errno::ENOENT
-        expanded
+        Paths.canonical(path, base: @root)
       end
 
       def path_within_root?(path, root)
-        path == root || (path[0, root.length] == root && path[root.length] == "/")
+        Paths.within?(path, root)
       end
     end
   end

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.3"
+      VERSION = "3.1.4"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/dev.rb

@@ -47,6 +47,7 @@ module Kettle
     autoload :MarkdownReferenceValidator, "kettle/dev/markdown_reference_validator"
     autoload :ReadmeBackers, "kettle/dev/readme_backers"
     autoload :OpenCollectiveConfig, "kettle/dev/open_collective_config"
+    autoload :Paths, "kettle/dev/paths"
     autoload :ReleaseNotifier, "kettle/dev/release_notifier"
     autoload :ReleaseCLI, "kettle/dev/release_cli"
     autoload :ReleaseGraphContract, "kettle/dev/release_graph_contract"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.3
+  version: 3.1.4
 platform: ruby
 authors:
 - Peter H. Boling
@@ -390,6 +390,7 @@ files:
 - lib/kettle/dev/lockfile_reset.rb
 - lib/kettle/dev/markdown_reference_validator.rb
 - lib/kettle/dev/open_collective_config.rb
+- lib/kettle/dev/paths.rb
 - lib/kettle/dev/pre_release_cli.rb
 - lib/kettle/dev/rakelib/appraisal.rake
 - lib/kettle/dev/rakelib/bench.rake
@@ -421,10 +422,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.3
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.3/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.4
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.4/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.3
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.4
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev