kettle-dev 3.1.7 → 3.1.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2de1266e7cdbbfd6174c040d8602cf8c3349a423bc301f071ba45da206cba969
-  data.tar.gz: f93264ee009dbede2c2ff3273a396916a31d51a70b1ac1cab817532e11f396f5
+  metadata.gz: 78a3ee1fd963f1a7cb5b8a4c0f0a7ad45b13245a6ad3359505f230298b29a6f6
+  data.tar.gz: 647c9da39ce601b3279cfe863cde3986006040cc26ae81ffe51f91164acb9b46
 SHA512:
-  metadata.gz: 6a10b65136115e119f2b24eea184c114ea09ae969bed38f71005f39f0fe2f1f0ef1a9869449cf70cf895f075c0c01387918b02bafb914237ca3136d2f4ef868f
-  data.tar.gz: 9e14f9945043f4f104c65e34dae30e11301e84caa63f474555d0befe80a35508d604b331da62306808a927eb881e2a41a66562582896b4145cf22e9051db8c65
+  metadata.gz: 2f18613e1d4d7459c3537c710caa4b705eb940c55342d65d96657ebf992961464a1f79e2511505026af8d0726d1738fd6e9ebcd6cd9d306d77f9a90ae0f55228
+  data.tar.gz: 95d49245a2e0335c60a12ce97b20a46db0e921ec35c943641fc973c71391875d12f4d82164a222012e777b18a82c84fdfc2ad5a52aa825a67501ba7312efdba7

data/CHANGELOG.md

@@ -30,6 +30,23 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [3.1.8] - 2026-10-07
+
+- TAG: [v3.1.8][3.1.8t]
+- COVERAGE: 91.65% -- 6276/6848 lines in 49 files
+- BRANCH COVERAGE: 75.90% -- 2390/3149 branches in 49 files
+- 51.77% documented
+
+### Added
+
+- `Kettle::Dev::RubyGemsVersions.fetch` accepts a `source:` keyword so callers can query a RubyGems-compatible private registry such as gem.coop instead of only rubygems.org. The version cache is now namespaced by source host, so a private registry lagging rubygems.org cannot serve stale answers for the other. The default source keeps the historical bare gem-name cache key, so existing caches remain valid.
+
+- `Kettle::Dev::RubyGemsVersions.published_version_numbers(gem_name, source:)` returns the version numbers a registry serves for a gem, or nil when the registry could not be consulted. Callers must treat nil as "unknown" rather than "unpublished" so an offline run is not blocked; an empty list, by contrast, means the registry was reached and serves no versions.
+
+- [kc] lockfile-registry-specs: `Kettle::Dev::LockfileReset.registry_gem_specs_from_source` returns GEM-section specs as `{remote:, name:, version:}` so a caller can attribute each pinned version to the registry it was resolved from, which is what makes it possible to detect a locally built and installed gem leaking into a lockfile: bundler resolves against the local gem dir, so an ordinary `bundle install` can pin a version no registry serves, and the resulting entry is a normal GEM-section line carrying a valid checksum taken from the installed spec, so nothing in the lockfile text distinguishes it and "is this version published?" can only be answered against the remote that section recorded. `gem_specs_from_source` is now a thin wrapper over it and keeps returning `[[name, version]]` unchanged.
+
+- `Kettle::Dev::RubyGemsVersions.published_version_numbers` accepts a `version:` keyword and forwards it to `fetch` as a cache-bust hint, so the on-disk release marker that `kettle-release` writes after publishing busts the cache for exactly that gem and version instead of for every gem released within the marker TTL. Without it a caller cannot distinguish "published moments ago in this very run" from "released sometime in the last month". Also adds `RubyGemsVersions.recently_released?(gem_name, version)`, which reports whether the marker records that exact gem and version as published within the TTL, treating a missing or corrupt marker as false rather than raising.
+
 ## [3.1.7] - 2026-10-04
 
 - TAG: [v3.1.7][3.1.7t]
@@ -3984,7 +4001,9 @@ Please file a bug if you notice a violation of semantic versioning.
   - Selecting will run the selected workflow via `act`
   - This may move to its own gem in the future.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.7...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.8...HEAD
+[3.1.8]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.7...v3.1.8
+[3.1.8t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.8
 [3.1.7]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.6...v3.1.7
 [3.1.7t]: https://github.com/kettle-dev/kettle-dev/releases/tag/v3.1.7
 [3.1.6]: https://github.com/kettle-dev/kettle-dev/compare/v3.1.5...v3.1.6

data/README.md

@@ -1067,7 +1067,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.824-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.848-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-dev/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/dev/lockfile_reset.rb

@@ -75,19 +75,42 @@ module Kettle
         end
 
         def gem_specs_from_source(lockfile_source)
+          registry_gem_specs_from_source(lockfile_source).map { |spec| [spec.fetch(:name), spec.fetch(:version)] }.uniq
+        end
+
+        # Like gem_specs_from_source, but attributes each spec to the registry
+        # remote of the GEM section it appeared in.
+        #
+        # Remote attribution matters for detecting locally installed but
+        # unpublished versions: a lockfile can carry several GEM sections with
+        # different remotes, and "is this version published?" can only be
+        # answered against the source that was actually used. Bundler resolves
+        # a locally installed spec during an ordinary `bundle install`, so the
+        # pinned entry looks exactly like a published one — same GEM section,
+        # valid checksum — and only a registry query for that remote reveals
+        # the version does not exist there.
+        #
+        # @return [Array<Hash>] entries of {remote:, name:, version:}
+        def registry_gem_specs_from_source(lockfile_source)
           in_gem = false
           in_specs = false
+          remote = nil
           specs = []
           lockfile_source.each_line do |line|
             stripped = line.chomp
             if stripped == "GEM"
               in_gem = true
               in_specs = false
+              remote = nil
               next
             end
             next unless in_gem
             break if !stripped.empty? && stripped == stripped.upcase && !stripped.start_with?(" ")
 
+            if stripped.start_with?("  remote:")
+              remote = stripped.delete_prefix("  remote:").strip
+              next
+            end
             if stripped == "  specs:"
               in_specs = true
               next
@@ -96,7 +119,9 @@ module Kettle
             next unless line.start_with?("    ") && !line.start_with?("      ")
 
             parsed = parse_lockfile_spec_line(stripped)
-            specs << [parsed.fetch(:name), parsed.fetch(:version)] if parsed
+            next unless parsed
+
+            specs << {remote: remote, name: parsed.fetch(:name), version: parsed.fetch(:version)}
           end
           specs.uniq
         end

data/lib/kettle/dev/ruby_gems_versions.rb

@@ -16,19 +16,27 @@ module Kettle
       VERSION_CACHE_TTL_SECONDS = 30 * 24 * 60 * 60
       HTTP_OPEN_TIMEOUT_SECONDS = 5
       HTTP_READ_TIMEOUT_SECONDS = 10
+      DEFAULT_SOURCE = "https://rubygems.org"
       ENV_REFRESH = "KETTLE_RUBYGEMS_REFRESH"
       ENV_MARKER_PATH = "KETTLE_RUBYGEMS_CACHE_BUST_PATH"
       ENV_VERSION_CACHE_PATH = "KETTLE_RUBYGEMS_VERSION_CACHE_PATH"
       ENV_LEGACY_VERSION_CACHE_PATH = "KETTLE_JEM_DEPS_FLOOR_CACHE"
 
       class << self
-        def fetch(gem_name, version_hint: nil, refresh: false)
+        # Query a RubyGems-compatible versions API.
+        #
+        # +source+ selects which registry to ask, because a private registry
+        # such as gem.coop can lag rubygems.org: a version present on one may
+        # be absent from the other. Cache entries are keyed by source for the
+        # same reason, so the two registries cannot poison each other.
+        def fetch(gem_name, version_hint: nil, refresh: false, source: DEFAULT_SOURCE)
           name = gem_name.to_s
-          cached = cached_versions(name)
+          key = cache_key(name, source)
+          cached = cached_versions(key)
           cache_bust = refresh || env_refresh? || fresh_release_marker?(name, version_hint) || cached_behind_version?(cached, version_hint)
           return cached if cached && !cache_bust
 
-          uri = versions_uri(gem_name, cache_bust: cache_bust)
+          uri = versions_uri(gem_name, source: source, cache_bust: cache_bust)
           request = Net::HTTP::Get.new(uri)
           if cache_bust
             request["Cache-Control"] = "no-cache"
@@ -44,13 +52,13 @@ module Kettle
             http.request(request)
           end
           if response.code.to_i == 404
-            write_versions(name, [])
+            write_versions(key, [])
             return []
           end
           return cached unless response.is_a?(Net::HTTPSuccess)
 
           data = JSON.parse(response.body)
-          write_versions(name, data) if data.is_a?(Array)
+          write_versions(key, data) if data.is_a?(Array)
           data
         rescue => error
           return cached if cached
@@ -58,6 +66,40 @@ module Kettle
           raise error
         end
 
+        # Published version numbers for a gem on one registry, or nil when the
+        # registry could not be consulted (caller must treat that as "unknown",
+        # never as "unpublished", so offline runs are not blocked).
+        #
+        # +source+ is matched against the remote a lockfile actually recorded,
+        # since a private registry such as gem.coop can lag rubygems.org.
+        #
+        # +version+ is the version the caller is asking about, forwarded as
+        # fetch's version_hint. That makes cache-busting precise: the on-disk
+        # release marker written by kettle-release busts the cache only for the
+        # exact gem+version just published, instead of for every gem released
+        # within the marker TTL. Without it a caller cannot tell "this version
+        # was published moments ago in this very run" from "this gem was
+        # released at some point in the last month".
+        def published_version_numbers(gem_name, source: DEFAULT_SOURCE, version: nil)
+          versions = fetch(gem_name, version_hint: version, source: normalize_source(source))
+          return nil if versions.nil?
+
+          versions.filter_map { |entry| entry["number"] if entry.is_a?(Hash) }
+        rescue
+          nil
+        end
+
+        # Whether kettle-release's on-disk marker says this exact gem+version
+        # was published recently enough that cached registry data must not be
+        # trusted for it.
+        #
+        # The marker file is the authority on what this machine just published,
+        # so any process-local cache layered on top of the registry must consult
+        # it rather than serve a pre-publish answer.
+        def recently_released?(gem_name, version = nil)
+          fresh_release_marker?(gem_name.to_s, version&.to_s)
+        end
+
         def mark_released(gem_name, version)
           return if gem_name.to_s.empty? || version.to_s.empty?
 
@@ -99,8 +141,25 @@ module Kettle
 
         private
 
-        def versions_uri(gem_name, cache_bust:)
-          uri = URI("https://rubygems.org/api/v1/versions/#{gem_name}.json")
+        # Cache entries are namespaced by source host so a version list fetched
+        # from a private registry cannot be served for rubygems.org, or vice
+        # versa. The default source keeps the historical bare gem name as its
+        # key so existing caches remain valid.
+        def cache_key(gem_name, source)
+          normalized = normalize_source(source)
+          return gem_name.to_s if normalized == DEFAULT_SOURCE
+
+          "#{URI(normalized).host}:#{gem_name}"
+        rescue URI::InvalidURIError
+          "#{normalized}:#{gem_name}"
+        end
+
+        def normalize_source(source)
+          source.to_s.sub(%r{/+\z}, "")
+        end
+
+        def versions_uri(gem_name, source:, cache_bust:)
+          uri = URI("#{normalize_source(source)}/api/v1/versions/#{gem_name}.json")
           uri.query = "_kettle_cache_bust=#{Time.now.to_i}" if cache_bust
           uri
         end
@@ -145,31 +204,31 @@ module Kettle
           ENV.fetch(ENV_REFRESH, "").match?(Kettle::Dev::ENV_TRUE_RE)
         end
 
-        def cached_versions(gem_name)
+        def cached_versions(cache_key)
           path = version_cache_path
           return nil if path.empty?
 
-          entry = read_version_cache(path).fetch("versions", {})[gem_name]
+          entry = read_version_cache(path).fetch("versions", {})[cache_key]
           return nil unless entry.is_a?(Hash)
           return nil unless fresh_version_cache_entry?(entry)
 
           Array(entry["entries"])
         end
 
-        def write_versions(gem_name, entries)
+        def write_versions(cache_key, entries)
           path = version_cache_path
           return if path.empty?
 
           data = read_version_cache(path)
           data["versions"] ||= {}
-          data["versions"][gem_name] = {
+          data["versions"][cache_key] = {
             "cached_at" => Time.now.utc.iso8601,
             "entries" => entries
           }
           FileUtils.mkdir_p(File.dirname(path))
           File.write(path, JSON.pretty_generate(data) << "\n")
         rescue => error
-          warn("[kettle-dev] could not update RubyGems.org version cache: #{error.class}: #{error.message}") if Kettle::Dev::DEBUGGING
+          warn("[kettle-dev] could not update RubyGems version cache: #{error.class}: #{error.message}") if Kettle::Dev::DEBUGGING
         end
 
         def read_version_cache(path)

data/lib/kettle/dev/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "3.1.7"
+      VERSION = "3.1.8"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-dev
 version: !ruby/object:Gem::Version
-  version: 3.1.7
+  version: 3.1.8
 platform: ruby
 authors:
 - Peter H. Boling
@@ -422,10 +422,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-dev.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.7
-  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.7/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-dev/tree/v3.1.8
+  changelog_uri: https://github.com/kettle-dev/kettle-dev/blob/v3.1.8/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-dev/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.7
+  documentation_uri: https://www.rubydoc.info/gems/kettle-dev/3.1.8
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-dev/wiki
   news_uri: https://www.railsbling.com/tags/kettle-dev