kettle-family 1.2.13 → 1.2.15

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 14997d7ae5a4ba5f2e3ec46f9fe9925a15020a0549fc779d70c57171492edd57
-  data.tar.gz: e9e84f2d92c1b8e2434ddc01a2d275e4b9077b06644b854ec817893a7e4157f1
+  metadata.gz: 9ccc9063ef81ee8d6b8bee27424903371b47863d9fb2903b4461c2e132b757d9
+  data.tar.gz: ec46a0708e899590fb95d67d1f8e9dbe002195b21cf9a635c2c8b4a726a693c9
 SHA512:
-  metadata.gz: aac3fc439504f17be4685f87f7bd1d4c213f885941f5c7793f1bca2369e92c384c7ae3cc8919fbf8f1023e7d1d812abe29c76d0a7fbef0301a5a8125b42217f3
-  data.tar.gz: 9d4ad335a463968aad4643d36b616f37b5d99b1431c659f2f3ae329017f304e5115dff3be3be72829ca99744a8cdf4b81619949146ce1df6f6ae7516226a12e6
+  metadata.gz: 883955e631cd8b19ee2219a98267465307dec049d35c7f209f61ce23465eeb05665a88954b0dcac39e70f980aa39a02bdc6f2539c4897ef6418412a7d5ad1054
+  data.tar.gz: 8c584b648f8fe2914ac5077b8b181f398b2fe1507eb30278927c13408f5b3b7e6c4a7b1beba417f1dcc1a0ae80a0e7a460d433bb1336615a6ccb3759e2abee34

data/CHANGELOG.md

@@ -30,6 +30,75 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.15] - 2026-07-31
+
+- TAG: [v1.2.15][1.2.15t]
+- COVERAGE: 94.03% -- 4192/4458 lines in 28 files
+- BRANCH COVERAGE: 76.46% -- 1634/2137 branches in 28 files
+- 28.88% documented
+
+### Fixed
+
+- Family-owned release OTP lookups now render as structured secret-provider
+  progress events, including a visible `👀 🔒` authorization prompt cue, instead
+  of printing loose MFA status lines through the release tape.
+
+## [1.2.14] - 2026-07-31
+
+- TAG: [v1.2.14][1.2.14t]
+- COVERAGE: 94.22% -- 4175/4431 lines in 28 files
+- BRANCH COVERAGE: 76.69% -- 1622/2115 branches in 28 files
+- 28.88% documented
+
+### Added
+
+- Release publish/build commands now write per-member transcript logs under
+  `tmp/kettle-family/release-*`, and failure summaries include the log path.
+
+- Release progress now renders child `kettle-release` `remote_parity` events,
+  keeping remote fetch, skip, failure, and completion activity visible without
+  scraping raw command output.
+
+- Release progress now renders child `kettle-release` `ci_monitor` events with
+  provider and workflow or pipeline context, so CI activity is visible as
+  structured progress.
+
+- Release progress now renders child `kettle-release` `pre_release` events, so
+  pre-release checks are visible as structured progress while raw output stays
+  in the transcript log.
+
+- Release progress now renders child `kettle-changelog` `changelog` events, so
+  release plan, coverage, and changelog update activity is visible as structured
+  progress.
+
+### Changed
+
+- Family release now keeps raw child `kettle-release` output in the per-member
+  transcript log by default and renders structured NDJSON progress in the
+  terminal, with raw passthrough still available under verbose/debug output.
+- Release summary footers now include the transcript log directory when release
+  logs were written, including successful runs where raw output stayed quiet.
+- Release progress now renders child `command_step` summaries, so phases can
+  show context such as `release:bundle_lock:Gemfile` or
+  `release:yard:documentation`.
+- Release progress now renders child `release_lockfile` and `release_probe`
+  events, so lockfile reset retries and published-gem availability probes show
+  as structured progress.
+- Release progress now renders GitHub CI wait/start/tick events with completion
+  counts, so CI monitoring no longer appears stuck while waiting for workflows.
+- Release preflight now renders through the shared progress event tape instead
+  of printing separate start and finish lines for each successful phase.
+
+### Fixed
+
+- Release preflight no longer prints a nested 1Password authorization alert
+  between the phase start and finish lines; the preflight phase itself is the
+  user-facing authorization notice.
+
+- Family release runs can now pass configured required release remotes through
+  to `kettle-release`, allowing mirrors to remain optional while primary remotes
+  still block release parity failures.
+
 ## [1.2.13] - 2026-07-31
 
 - TAG: [v1.2.13][1.2.13t]
@@ -1443,7 +1512,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.13...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.15...HEAD
+[1.2.15]: https://github.com/kettle-dev/kettle-family/compare/v1.2.14...v1.2.15
+[1.2.15t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.15
+[1.2.14]: https://github.com/kettle-dev/kettle-family/compare/v1.2.13...v1.2.14
+[1.2.14t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.14
 [1.2.13]: https://github.com/kettle-dev/kettle-family/compare/v1.2.12...v1.2.13
 [1.2.13t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.13
 [1.2.12]: https://github.com/kettle-dev/kettle-family/compare/v1.2.11...v1.2.12

data/README.md

@@ -819,7 +819,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.297-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.458-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/cli.rb

@@ -151,6 +151,7 @@ module Kettle
             release_ci_workflows: nil,
             release_skip_bundle_audit: false,
             release_skip_remotes: nil,
+            release_required_remotes: nil,
             release_secrets_provider: nil,
             accept: true,
             tag: false,
@@ -464,6 +465,7 @@ module Kettle
         option :ci_workflows, long: "--ci-workflows", value: {type: String, usage: "LIST"}, desc: "Pass a comma-separated CI workflow monitor subset through to kettle-release commands"
         option :skip_bundle_audit, long: "--skip-bundle-audit", desc: "Skip bundle:audit/update during release rake checks"
         option :skip_remotes, long: "--skip-remotes", value: {type: String, usage: "LIST"}, desc: "Pass a comma-separated git remote skip list through to kettle-release commands"
+        option :required_remotes, long: "--required-remotes", value: {type: String, usage: "LIST"}, desc: "Pass a comma-separated required git remote list through to kettle-release commands"
         option :secrets_provider, long: "--secrets-provider", value: {type: String, usage: "NAME"}, desc: "Release secrets provider: interactive, 1password"
         option :no_auto_floors, long: "--no-auto-floors", desc: "Do not raise family dependency floors between member releases" do
           options[:no_auto_floors] = true
@@ -487,6 +489,7 @@ module Kettle
             release_ci_workflows: options[:ci_workflows],
             release_skip_bundle_audit: truthy_option?(:skip_bundle_audit),
             release_skip_remotes: options[:skip_remotes],
+            release_required_remotes: options[:required_remotes],
             release_secrets_provider: options[:secrets_provider],
             release_auto_dependency_floors: !truthy_option?(:no_auto_floors),
             accept: !options.key?(:accept) || options[:accept],
@@ -662,6 +665,7 @@ module Kettle
           ci_workflows: options[:release_ci_workflows],
           skip_bundle_audit: options[:release_skip_bundle_audit],
           skip_remotes: options[:release_skip_remotes],
+          required_remotes: options[:release_required_remotes],
           secrets_provider: release_secrets_provider(command: command, config: config, options: options),
           auto_dependency_floors: options[:release_auto_dependency_floors],
           gha_sha_pins_upgrade: options[:gha_sha_pins_upgrade],

data/lib/kettle/family/command_result.rb

@@ -15,7 +15,8 @@ module Kettle
       :skipped,
       :reason,
       :branch,
-      :output_streamed
+      :output_streamed,
+      :log_path
     ) do
       def to_h
         {
@@ -31,7 +32,8 @@ module Kettle
           "elapsed_seconds" => elapsed_seconds,
           "skipped" => skipped,
           "reason" => reason,
-          "output_streamed" => output_streamed?
+          "output_streamed" => output_streamed?,
+          "log_path" => log_path
         }
       end
 

data/lib/kettle/family/command_runner.rb

@@ -2,6 +2,7 @@
 
 require "open3"
 require "io/console"
+require "fileutils"
 
 module Kettle
   module Family
@@ -11,10 +12,11 @@ module Kettle
       ].freeze
 
       class OtpCoordinator
-        def initialize(input: $stdin, output: $stdout, queue_total: nil, secrets_provider: nil)
+        def initialize(input: $stdin, output: $stdout, queue_total: nil, secrets_provider: nil, event_handler: nil)
           @input = input
           @output = output
           @secrets_provider = secrets_provider
+          @event_handler = event_handler
           @mutex = Mutex.new
           @condition = ConditionVariable.new
           @prompting = false
@@ -40,7 +42,7 @@ module Kettle
             if @prompting
               generation = @generation
               @queued_count += 1
-              render_queue_status_locked
+              render_queue_status_locked(member_name: member_name)
               return wait_for_response(generation)
             end
 
@@ -52,7 +54,7 @@ module Kettle
             start_prompt_locked(member_name: member_name)
           end
 
-          response = read_response(chunk: chunk)
+          response = read_response(chunk: chunk, member_name: member_name)
           close_queue
           @mutex.synchronize do
             @response = response
@@ -66,7 +68,7 @@ module Kettle
 
         private
 
-        attr_reader :secrets_provider
+        attr_reader :secrets_provider, :event_handler
 
         def wait_for_response(generation)
           @condition.wait(@mutex) while @prompting
@@ -82,22 +84,49 @@ module Kettle
         end
 
         def start_prompt_locked(member_name:)
-          @output.puts
-          @output.puts("[#{member_name}] RubyGems MFA requested.")
-          render_queue_status_locked
+          unless emit_event(
+            member_name: member_name,
+            action: "mfa_requested",
+            label: "RubyGems MFA",
+            status: "requested",
+            mark: ">"
+          )
+            @output.puts
+            @output.puts("[#{member_name}] RubyGems MFA requested.")
+          end
+          render_queue_status_locked(member_name: member_name)
+          return if event_handler
+
           @output.puts("Queued prompts at entry will share this code; later prompts will ask again.")
         end
 
-        def render_queue_status_locked
+        def render_queue_status_locked(member_name:)
           suffix = @queue_total ? " / #{@queue_total}" : ""
+          return if emit_event(
+            member_name: member_name,
+            action: "otp_queue",
+            label: "RubyGems MFA prompts",
+            status: "queued",
+            mark: ">",
+            queued: @queued_count,
+            total: @queue_total
+          )
+
           @output.puts("RubyGems MFA prompts queued: #{@queued_count}#{suffix}")
           @output.flush if @output.respond_to?(:flush)
         end
 
-        def read_response(chunk:)
-          provided = read_provider_response
+        def read_response(chunk:, member_name:)
+          provided = read_provider_response(member_name: member_name)
           unless provided.empty?
-            @output.puts("RubyGems MFA code loaded from configured secrets provider.")
+            emit_event(
+              member_name: member_name,
+              action: "prompt_response",
+              label: "RubyGems MFA code",
+              source: secret_provider_source,
+              status: "ok",
+              mark: "."
+            ) || @output.puts("RubyGems MFA code loaded from configured secrets provider.")
             return provided
           end
 
@@ -116,17 +145,57 @@ module Kettle
           chunk.to_s.lines.last&.strip.to_s.empty? ? "Code:" : chunk.to_s.lines.last.strip
         end
 
-        def read_provider_response
+        def read_provider_response(member_name:)
           return "" unless secrets_provider
 
           @output.print("\a") if @output.respond_to?(:print)
+          emit_event(
+            member_name: member_name,
+            action: "prompt_request",
+            label: "👀 🔒 watch for authorization prompt",
+            source: secret_provider_source,
+            status: "started",
+            mark: ">"
+          )
           secrets_provider.rubygems_otp.to_s
         rescue Error => error
           raise unless @input.respond_to?(:tty?) && @input.tty?
 
+          emit_event(
+            member_name: member_name,
+            action: "prompt_response",
+            label: "RubyGems MFA code",
+            source: secret_provider_source,
+            status: "failed",
+            mark: "F"
+          )
           @output.puts("#{error.message}; falling back to manual OTP entry.")
           ""
         end
+
+        def emit_event(member_name:, action:, label:, status:, mark:, **payload)
+          return false unless event_handler
+
+          event_handler.call(
+            member_name,
+            {
+              "event_version" => 1,
+              "type" => "secret_provider",
+              "action" => action,
+              "label" => label,
+              "status" => status,
+              "mark" => mark
+            }.merge(payload.transform_keys(&:to_s))
+          )
+          true
+        end
+
+        def secret_provider_source
+          return "" unless secrets_provider
+          return "1Password" if secrets_provider.is_a?(Secrets::OnePassword)
+
+          secrets_provider.class.name.to_s.split("::").last.to_s
+        end
       end
 
       FailureStatus = Struct.new(:exitstatus) do
@@ -143,26 +212,33 @@ module Kettle
         @otp_coordinator = otp_coordinator
       end
 
-      def call(member:, phase:, command:, env: {}, interactive: false, stdout_line_handler: nil)
+      def call(member:, phase:, command:, env: {}, interactive: false, stdout_line_handler: nil, log_path: nil, passthrough_output: true)
         argv = command_argv(member: member, command: command, env: env)
         process_env = process_env(member: member, env: env)
         spawn_options = process_options
         return skipped_result(member: member, phase: phase, argv: argv) unless execute
 
         started = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        stdout, stderr, status = if interactive
-          run_interactive(
-            env: process_env,
-            argv: argv,
-            chdir: member.root,
-            member_name: member.name,
-            process_options: spawn_options,
-            stdout_line_handler: stdout_line_handler
-          )
-        elsif stdout_line_handler
-          run_streaming(env: process_env, argv: argv, chdir: member.root, process_options: spawn_options, stdout_line_handler: stdout_line_handler)
-        else
-          Open3.capture3(process_env, *argv, chdir: member.root, **spawn_options)
+        stdout, stderr, status = with_transcript(log_path, argv: argv, chdir: member.root) do |log_io|
+          if interactive
+            run_interactive(
+              env: process_env,
+              argv: argv,
+              chdir: member.root,
+              member_name: member.name,
+              process_options: spawn_options,
+              stdout_line_handler: stdout_line_handler,
+              log_io: log_io,
+              passthrough_output: passthrough_output
+            )
+          elsif stdout_line_handler
+            run_streaming(env: process_env, argv: argv, chdir: member.root, process_options: spawn_options, stdout_line_handler: stdout_line_handler, log_io: log_io)
+          else
+            result = Open3.capture3(process_env, *argv, chdir: member.root, **spawn_options)
+            transcript_write(log_io, result[0])
+            transcript_write(log_io, result[1])
+            result
+          end
         end
         stdout = normalize_output(stdout)
         stderr = normalize_output(stderr)
@@ -179,7 +255,8 @@ module Kettle
           elapsed_seconds: elapsed.round(3),
           skipped: false,
           reason: status.success? ? nil : "command failed",
-          output_streamed: interactive
+          output_streamed: interactive,
+          log_path: log_path
         )
       end
 
@@ -187,7 +264,7 @@ module Kettle
 
       attr_reader :execute, :accept, :gem_signing_password, :otp_coordinator
 
-      def run_streaming(env:, argv:, chdir:, process_options:, stdout_line_handler:)
+      def run_streaming(env:, argv:, chdir:, process_options:, stdout_line_handler:, log_io: nil)
         captured_stdout = +""
         captured_stderr = +""
         stdout_line_buffer = +""
@@ -197,12 +274,14 @@ module Kettle
           until readers.empty?
             ready = IO.select(readers)
             ready.first.each do |reader|
+              chunk = reader.readpartial(1024)
               if reader.equal?(output)
-                chunk = reader.readpartial(1024)
                 captured_stdout << chunk
+                transcript_write(log_io, chunk)
                 stdout_line_buffer = stream_stdout_lines(stdout_line_buffer, chunk, stdout_line_handler)
               else
-                captured_stderr << reader.readpartial(1024)
+                captured_stderr << chunk
+                transcript_write(log_io, chunk)
               end
             rescue EOFError
               readers.delete(reader)
@@ -222,7 +301,7 @@ module Kettle
         remainder
       end
 
-      def run_interactive(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:)
+      def run_interactive(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:, log_io: nil, passthrough_output: true)
         if pty_available?
           return run_interactive_pty(
             env: env,
@@ -230,7 +309,9 @@ module Kettle
             chdir: chdir,
             member_name: member_name,
             process_options: process_options,
-            stdout_line_handler: stdout_line_handler
+            stdout_line_handler: stdout_line_handler,
+            log_io: log_io,
+            passthrough_output: passthrough_output
           )
         end
 
@@ -240,11 +321,13 @@ module Kettle
           chdir: chdir,
           member_name: member_name,
           process_options: process_options,
-          stdout_line_handler: stdout_line_handler
+          stdout_line_handler: stdout_line_handler,
+          log_io: log_io,
+          passthrough_output: passthrough_output
         )
       end
 
-      def run_interactive_pty(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:)
+      def run_interactive_pty(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:, log_io: nil, passthrough_output: true)
         stdout = +""
         stderr = +""
         stdout_line_buffer = +""
@@ -259,10 +342,12 @@ module Kettle
                 if reader.equal?(output)
                   chunk = output.readpartial(1024)
                   stdout << chunk
-                  stdout_line_buffer = print_interactive_stdout(stdout_line_buffer, chunk, stdout_line_handler)
+                  transcript_write(log_io, chunk)
+                  stdout_line_buffer = print_interactive_stdout(stdout_line_buffer, chunk, stdout_line_handler, passthrough_output: passthrough_output)
                   handle_interactive_prompt(input, chunk, member_name: member_name)
                 else
-                  input.write($stdin.readpartial(1024))
+                  chunk = $stdin.readpartial(1024)
+                  input.write(chunk)
                 end
               end
             end
@@ -270,16 +355,17 @@ module Kettle
             # PTY raises EIO when the child process exits after closing the slave.
           rescue Error => error
             stderr << "#{error.message}\n"
+            transcript_write(log_io, "#{error.message}\n")
             terminate_process(pid)
           end
-          flush_interactive_stdout(stdout_line_buffer, stdout_line_handler)
+          flush_interactive_stdout(stdout_line_buffer, stdout_line_handler, passthrough_output: passthrough_output)
           _, status = Process.wait2(pid)
           status = failure_status if !stderr.empty? && status.success?
         end
         [stdout, stderr, status]
       end
 
-      def run_interactive_open3(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:)
+      def run_interactive_open3(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:, log_io: nil, passthrough_output: true)
         captured_stdout = +""
         captured_stderr = +""
         stdout_line_buffer = +""
@@ -303,19 +389,22 @@ module Kettle
                     readers,
                     member_name: member_name,
                     stdout_line_buffer: stdout_line_buffer,
-                    stdout_line_handler: stdout_line_handler
+                    stdout_line_handler: stdout_line_handler,
+                    log_io: log_io,
+                    passthrough_output: passthrough_output
                   )
                 end
               end
             end
           rescue Error => error
             captured_stderr << "#{error.message}\n"
+            transcript_write(log_io, "#{error.message}\n")
             terminate_process(wait_thread.pid)
             status = failure_status
           else
             status = wait_thread.value
           end
-          flush_interactive_stdout(stdout_line_buffer, stdout_line_handler)
+          flush_interactive_stdout(stdout_line_buffer, stdout_line_handler, passthrough_output: passthrough_output)
         end
         [captured_stdout, captured_stderr, status]
       end
@@ -329,15 +418,19 @@ module Kettle
         readers,
         member_name:,
         stdout_line_buffer:,
-        stdout_line_handler:
+        stdout_line_handler:,
+        log_io: nil,
+        passthrough_output: true
       )
         chunk = reader.readpartial(1024)
         if reader.equal?(output)
           captured_stdout << chunk
-          stdout_line_buffer = print_interactive_stdout(stdout_line_buffer, chunk, stdout_line_handler)
+          transcript_write(log_io, chunk)
+          stdout_line_buffer = print_interactive_stdout(stdout_line_buffer, chunk, stdout_line_handler, passthrough_output: passthrough_output)
         else
           captured_stderr << chunk
-          $stderr.print(chunk)
+          transcript_write(log_io, chunk)
+          $stderr.print(chunk) if passthrough_output
         end
         handle_interactive_prompt(input, chunk, member_name: member_name)
         stdout_line_buffer
@@ -346,36 +439,55 @@ module Kettle
         stdout_line_buffer
       end
 
-      def print_interactive_stdout(buffer, chunk, stdout_line_handler)
-        return print_interactive_chunk(chunk) unless stdout_line_handler
+      def with_transcript(log_path, argv:, chdir:)
+        return yield(nil) if log_path.to_s.empty?
+
+        FileUtils.mkdir_p(File.dirname(log_path))
+        File.open(log_path, "wb") do |log_io|
+          log_io.sync = true
+          log_io.puts("$ #{argv.join(" ")}")
+          log_io.puts("workdir: #{chdir}")
+          log_io.puts
+          yield(log_io)
+        end
+      end
+
+      def transcript_write(log_io, chunk)
+        return if log_io.nil? || chunk.to_s.empty?
+
+        log_io.write(chunk)
+      end
+
+      def print_interactive_stdout(buffer, chunk, stdout_line_handler, passthrough_output: true)
+        return print_interactive_chunk(chunk, passthrough_output: passthrough_output) unless stdout_line_handler
 
         pending = buffer + chunk
         lines = pending.lines
         remainder = pending.end_with?("\n") ? +"" : lines.pop.to_s
-        lines.each { |line| print_interactive_line(line, stdout_line_handler) }
+        lines.each { |line| print_interactive_line(line, stdout_line_handler, passthrough_output: passthrough_output) }
         return +"" if remainder.empty?
         unless possible_event_line?(remainder)
-          $stdout.print(remainder)
+          $stdout.print(remainder) if passthrough_output
           return +""
         end
 
         remainder
       end
 
-      def flush_interactive_stdout(buffer, stdout_line_handler)
+      def flush_interactive_stdout(buffer, stdout_line_handler, passthrough_output: true)
         return if buffer.empty?
 
-        print_interactive_line(buffer, stdout_line_handler)
+        print_interactive_line(buffer, stdout_line_handler, passthrough_output: passthrough_output)
       end
 
-      def print_interactive_chunk(chunk)
-        $stdout.print(chunk)
+      def print_interactive_chunk(chunk, passthrough_output: true)
+        $stdout.print(chunk) if passthrough_output
         +""
       end
 
-      def print_interactive_line(line, stdout_line_handler)
+      def print_interactive_line(line, stdout_line_handler, passthrough_output: true)
         consumed = possible_event_line?(line) && stdout_line_handler.call(line.chomp)
-        $stdout.print(line) unless consumed
+        $stdout.print(line) if !consumed && passthrough_output
       end
 
       def possible_event_line?(line)

data/lib/kettle/family/config.rb

@@ -249,6 +249,10 @@ module Kettle
         fetch_path("release", "publish_command") || command_for("release_publish") || "bundle exec kettle-release"
       end
 
+      def release_required_remotes
+        fetch_path("release", "required_remotes")
+      end
+
       def release_env
         stringify_env(fetch_path("release", "env") || {})
       end

data/lib/kettle/family/report.rb

@@ -134,6 +134,7 @@ module Kettle
         lines << "summary:"
         lines << "  outcome: #{data.fetch("outcome")}"
         lines << "  elapsed: #{format_elapsed(data.fetch("elapsed_seconds"))}"
+        lines << "  logs: #{data.fetch("release_log_dirs").join(", ")}" unless data.fetch("release_log_dirs").empty?
         lines << "  selected: #{data.fetch("selected_count")}"
         lines << "  results: #{data.fetch("result_count")}"
         lines << "  succeeded: #{summary_list(data.fetch("succeeded"))}"
@@ -164,10 +165,20 @@ module Kettle
           "skipped" => summary_skipped,
           "failed" => summary_failed,
           "pending" => summary_pending,
+          "release_log_dirs" => release_log_dirs,
           "resume_hint" => resume_hint
         }
       end
 
+      def release_log_dirs
+        return [] unless command == "release"
+
+        visible_results.filter_map do |result|
+          path = result.log_path.to_s if result.respond_to?(:log_path)
+          File.dirname(path) unless path.to_s.empty?
+        end.uniq
+      end
+
       def append_release_waves(lines)
         wave_results = results.select { |result| release_wave_result?(result) }
         return if wave_results.empty?
@@ -205,7 +216,10 @@ module Kettle
       end
 
       def append_result_stdout(lines, result)
-        return if suppress_success_output?(result)
+        if suppress_success_output?(result)
+          append_result_log_path(lines, result) unless result.ok?
+          return
+        end
 
         if output_streamed?(result)
           append_streamed_output_summary(lines, result) unless result.ok?
@@ -216,6 +230,11 @@ module Kettle
         else
           append_indented_output(lines, result.stdout)
         end
+        append_result_log_path(lines, result) unless result.ok? || output_streamed?(result)
+      end
+
+      def append_result_log_path(lines, result)
+        lines << "    log: #{result.log_path}" if result.respond_to?(:log_path) && !result.log_path.to_s.empty?
       end
 
       def suppress_success_output?(result)
@@ -239,6 +258,7 @@ module Kettle
         lines << "    summary: #{summary}" if summary
         recommended_fix = streamed_recommended_fix(result)
         lines << "    recommended fix: #{recommended_fix}" if recommended_fix
+        append_result_log_path(lines, result)
         lines << "    output: omitted because it was already streamed"
       end
 

data/lib/kettle/family/secrets.rb

@@ -19,7 +19,7 @@ module Kettle
           end
 
           def authorize!
-            gem_signing_passphrase
+            with_release_secret_alert_suppressed { gem_signing_passphrase }
           rescue => error
             raise Error, error.message
           end
@@ -31,10 +31,20 @@ module Kettle
           end
 
           def rubygems_otp
-            super
+            with_release_secret_alert_suppressed { super }
           rescue => error
             raise Error, error.message
           end
+
+          private
+
+          def with_release_secret_alert_suppressed
+            previous = ENV.fetch("KETTLE_RELEASE_SECRET_ALERT", nil)
+            ENV["KETTLE_RELEASE_SECRET_ALERT"] = "false"
+            yield
+          ensure
+            previous.nil? ? ENV.delete("KETTLE_RELEASE_SECRET_ALERT") : ENV["KETTLE_RELEASE_SECRET_ALERT"] = previous
+          end
         end
       else
         class Provider

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.13"
+      VERSION = "1.2.15"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -16,6 +16,8 @@ require_relative "workflow_progress"
 module Kettle
   module Family
     class Workflow
+      PreflightProgressMember = Struct.new(:name)
+
       DEFAULT_COMMANDS = {
         "template" => "bundle exec kettle-jem install",
         "test" => "bundle exec kettle-test",
@@ -100,7 +102,7 @@ module Kettle
       REGISTRY_WAIT_ATTEMPTS = 15
       REGISTRY_WAIT_INTERVAL_SECONDS = 15
 
-      def initialize(command:, config:, members:, execute: false, accept: true, commit: true, allow_dirty: false, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, auto_dependency_floors: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, **options)
+      def initialize(command:, config:, members:, execute: false, accept: true, commit: true, allow_dirty: false, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, **options)
         @command = command
         @config = config
         @members = members
@@ -117,7 +119,8 @@ module Kettle
         @continue_ci_failures = continue_ci_failures
         @ci_workflows = validate_ci_workflows(ci_workflows)
         @skip_bundle_audit = skip_bundle_audit
-        @skip_remotes = validate_skip_remotes(skip_remotes)
+        @skip_remotes = validate_remote_list(skip_remotes, "--skip-remotes")
+        @required_remotes = validate_remote_list(required_remotes.nil? ? config.release_required_remotes : required_remotes, "--required-remotes")
         @auto_dependency_floors = auto_dependency_floors.nil? ? config.release_auto_dependency_floors? : auto_dependency_floors
         @gha_sha_pins_upgrade = gha_sha_pins_upgrade
         @gha_sha_pins_check = gha_sha_pins_check
@@ -159,7 +162,7 @@ module Kettle
 
       private
 
-      attr_reader :command, :config, :members, :execute, :accept, :commit, :allow_dirty, :publish, :push, :tag, :start_step, :skip_steps, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :auto_dependency_floors, :gha_sha_pins_upgrade, :gha_sha_pins_check, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
+      attr_reader :command, :config, :members, :execute, :accept, :commit, :allow_dirty, :publish, :push, :tag, :start_step, :skip_steps, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :required_remotes, :auto_dependency_floors, :gha_sha_pins_upgrade, :gha_sha_pins_check, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
 
       def current_branch_results(workflow_members)
         return check_results(workflow_members) if command == "check"
@@ -421,14 +424,23 @@ module Kettle
 
       def release_preflight_results
         phases = release_preflight_phases
-        emit_release_preflight_start(phases)
+        progress = start_release_preflight_progress(phases)
+        progress&.start
+        preflight_member = release_preflight_progress_member
+        progress&.start_member(preflight_member, total: phases.length, status: phases.first.fetch(:label))
         phases.each_with_index do |phase, index|
-          emit_release_preflight_phase(phase.fetch(:label), index: index, total: phases.length)
+          label = phase.fetch(:label)
+          progress&.update(preflight_member, status: label, mark: ">")
           result = send(phase.fetch(:method))
-          emit_release_preflight_phase_finish(phase.fetch(:label), result)
+          progress&.advance(preflight_member, status: label, success: result.empty?, mark: result.empty? ? "." : "F")
+          unless result.empty?
+            progress&.finish_member(preflight_member, success: false, status: label)
+            progress&.stop
+          end
           return result unless result.empty?
         end
-        emit_release_preflight_summary(phases)
+        progress&.finish_member(preflight_member, success: true, status: "ok")
+        progress&.stop
         []
       end
 
@@ -745,7 +757,9 @@ module Kettle
             command: release_command,
             env: release_env,
             interactive: release_command_interactive?,
-            stdout_line_handler: release_event_line_handler(member, progress: progress)
+            stdout_line_handler: release_event_line_handler(member, progress: progress),
+            log_path: release_command_log_path(member, release_phase),
+            passthrough_output: release_command_passthrough_output?
           )
           emit_member_result_progress(member, memo.last, progress: progress)
           return memo unless memo.last.ok?
@@ -792,7 +806,29 @@ module Kettle
       def release_otp_coordinator
         return nil unless execute && release_command_interactive?
 
-        @release_otp_coordinator ||= CommandRunner::OtpCoordinator.new(secrets_provider: @secrets_provider)
+        @release_otp_coordinator ||= CommandRunner::OtpCoordinator.new(
+          secrets_provider: @secrets_provider,
+          event_handler: method(:handle_release_otp_event)
+        )
+      end
+
+      def handle_release_otp_event(member_name, event)
+        progress = @release_progress
+        return unless progress
+
+        member = release_progress_member_for(member_name)
+        if progress_io
+          if verbose || debug
+            emit_release_event_progress(member, event)
+          elsif progress.tty?
+            emit_release_event_status(member, event, progress: progress)
+          end
+        end
+      end
+
+      def release_progress_member_for(member_name)
+        @release_progress_members_by_name ||= members.to_h { |member| [member.name, member] }
+        @release_progress_members_by_name.fetch(member_name.to_s) { PreflightProgressMember.new(member_name.to_s) }
       end
 
       def parallel_release_members?(release_members)
@@ -1378,6 +1414,10 @@ module Kettle
         publish || !!@gem_signing_password
       end
 
+      def release_command_passthrough_output?
+        verbose || debug
+      end
+
       def kettle_release_command?(command)
         case command
         when Array
@@ -1408,6 +1448,7 @@ module Kettle
         args << "--local-ci" if local_ci
         args << "--skip-bundle-audit" if skip_bundle_audit
         args << "--skip-remotes=#{skip_remotes}" if skip_remotes && !skip_remotes.to_s.empty?
+        args << "--required-remotes=#{required_remotes}" if required_remotes && !required_remotes.to_s.empty?
         args << "--yes" if release_command_uses_kettle_release_yes? && !command_includes_arg?(command, "--yes")
         args << "--events" unless command_includes_arg?(command, "--events")
         return command if args.empty?
@@ -1436,12 +1477,14 @@ module Kettle
         workflows.join(",")
       end
 
-      def validate_skip_remotes(value)
-        return nil if value.nil? || value.to_s.empty?
+      def validate_remote_list(value, option_name)
+        return nil if value.nil?
+
+        remotes = Array(value).flat_map { |entry| entry.to_s.split(",") }.map(&:strip)
+        return nil if remotes.all?(&:empty?)
 
-        remotes = value.to_s.split(",").map(&:strip)
         invalid = remotes.find { |remote| remote.empty? || !remote.match?(/\A[A-Za-z0-9_.-]+\z/) }
-        raise Error, "invalid --skip-remotes value #{value.inspect}" if invalid
+        raise Error, "invalid #{option_name} value #{value.inspect}" if invalid
 
         remotes.join(",")
       end
@@ -1460,6 +1503,7 @@ module Kettle
         env["K_RELEASE_CI_WORKFLOWS"] = ci_workflows if ci_workflows && !ci_workflows.to_s.empty?
         env["KETTLE_DEV_SKIP_BUNDLE_AUDIT"] = "true" if skip_bundle_audit
         env["K_RELEASE_SKIP_REMOTES"] = skip_remotes if skip_remotes && !skip_remotes.to_s.empty?
+        env["K_RELEASE_REQUIRED_REMOTES"] = required_remotes if required_remotes && !required_remotes.to_s.empty?
         env.merge!(kettle_release_secrets_env)
         env
       end
@@ -1903,6 +1947,24 @@ module Kettle
         progress
       end
 
+      def start_release_preflight_progress(phases)
+        return nil unless progress_io
+
+        phase_label = (phases.length == 1) ? "phase" : "phases"
+        WorkflowProgress.new(
+          io: progress_io,
+          label: "release preflight",
+          total: phases.length,
+          jobs: 1,
+          members: [release_preflight_progress_member],
+          heading: "release preflight #{phases.length} #{phase_label}:"
+        )
+      end
+
+      def release_preflight_progress_member
+        @release_preflight_progress_member ||= PreflightProgressMember.new("preflight")
+      end
+
       def template_phase_total(member = nil)
         total = 1
         total += 2 if config.normalize_lockfiles?
@@ -1927,6 +1989,20 @@ module Kettle
         end
       end
 
+      def release_command_log_path(member, phase)
+        return nil unless execute
+
+        File.join(release_log_dir, "#{safe_log_name(member.name)}-#{safe_log_name(phase)}.log")
+      end
+
+      def release_log_dir
+        @release_log_dir ||= File.join(config.root, "tmp", "kettle-family", "release-#{Time.now.strftime("%Y%m%d-%H%M%S")}-#{$$}")
+      end
+
+      def safe_log_name(value)
+        value.to_s.gsub(/[^A-Za-z0-9_.-]+/, "_")
+      end
+
       def template_initial_status(member = nil)
         return "prepare_lockfiles" if config.normalize_lockfiles?
         return "prepare_template_dependencies" if member.nil? || template_prepares_dependencies?(member)
@@ -1977,36 +2053,6 @@ module Kettle
         progress.summary("release summary: #{release_results.count(&:ok?)}/#{release_results.length} members ok")
       end
 
-      def emit_release_preflight_start(phases)
-        return unless progress_io
-
-        phase_label = (phases.length == 1) ? "phase" : "phases"
-        progress_io.puts("release preflight #{phases.length} #{phase_label}:")
-        progress_io.flush
-      end
-
-      def emit_release_preflight_phase(label, index:, total:)
-        return unless progress_io
-
-        progress_io.puts("[release preflight] (#{index + 1}/#{total}) > #{label}")
-        progress_io.flush
-      end
-
-      def emit_release_preflight_phase_finish(label, results)
-        return unless progress_io
-
-        mark = results.empty? ? "." : "F"
-        progress_io.puts("[release preflight] #{mark} #{label}")
-        progress_io.flush
-      end
-
-      def emit_release_preflight_summary(phases)
-        return unless progress_io
-
-        progress_io.puts("release preflight summary: #{phases.length}/#{phases.length} phases ok")
-        progress_io.flush
-      end
-
       def template_event_line_handler(member, progress: nil)
         lambda do |line|
           event = parse_template_event(line)
@@ -2087,10 +2133,21 @@ module Kettle
         when "run_start"
           emit_template_event_line(member, ">", "release")
         when "command_step"
-          label = [event["phase"], event["name"]].map(&:to_s).reject(&:empty?).join(":")
-          emit_template_event_line(member, template_event_mark(event), label)
+          emit_template_event_line(member, template_event_mark(event), command_step_event_label(event))
         when "secret_provider"
           emit_template_event_line(member, release_event_status_mark(event), secret_provider_event_label(event))
+        when "remote_parity"
+          emit_template_event_line(member, release_event_status_mark(event), remote_parity_event_label(event))
+        when "ci_monitor"
+          emit_template_event_line(member, release_event_status_mark(event), ci_monitor_event_label(event))
+        when "pre_release"
+          emit_template_event_line(member, release_event_status_mark(event), pre_release_event_label(event))
+        when "changelog"
+          emit_template_event_line(member, release_event_status_mark(event), changelog_event_label(event))
+        when "release_lockfile"
+          emit_template_event_line(member, release_event_status_mark(event), release_lockfile_event_label(event))
+        when "release_probe"
+          emit_template_event_line(member, release_event_status_mark(event), release_probe_event_label(event))
         when "diagnostic"
           emit_template_event_line(member, "!", diagnostic_event_label(event))
         when "summary"
@@ -2103,9 +2160,21 @@ module Kettle
         when "run_start"
           "release"
         when "command_step"
-          [event["phase"], event["name"]].map(&:to_s).reject(&:empty?).join(":")
+          command_step_event_label(event)
         when "secret_provider"
           secret_provider_event_label(event)
+        when "remote_parity"
+          remote_parity_event_label(event)
+        when "ci_monitor"
+          ci_monitor_event_label(event)
+        when "pre_release"
+          pre_release_event_label(event)
+        when "changelog"
+          changelog_event_label(event)
+        when "release_lockfile"
+          release_lockfile_event_label(event)
+        when "release_probe"
+          release_probe_event_label(event)
         when "diagnostic"
           diagnostic_event_label(event)
         when "summary"
@@ -2123,6 +2192,18 @@ module Kettle
           template_event_mark(event)
         when "secret_provider"
           template_event_mark(event)
+        when "remote_parity"
+          template_event_mark(event)
+        when "ci_monitor"
+          template_event_mark(event)
+        when "pre_release"
+          template_event_mark(event)
+        when "changelog"
+          template_event_mark(event)
+        when "release_lockfile"
+          template_event_mark(event)
+        when "release_probe"
+          template_event_mark(event)
         when "diagnostic"
           "!"
         when "summary"
@@ -2155,9 +2236,85 @@ module Kettle
         parts << purpose unless purpose.empty?
         parts << label unless label.empty?
         parts << source if purpose.empty? && label.empty? && !source.empty?
+        parts << "#{event["queued"]}/#{event["total"]}" if event["queued"] && event["total"]
+        parts.join(":")
+      end
+
+      def command_step_event_label(event)
+        parts = [event["phase"], event["name"]].map(&:to_s).reject(&:empty?)
+        summary = event["summary"].to_s
+        parts << summary unless summary.empty?
         parts.join(":")
       end
 
+      def remote_parity_event_label(event)
+        action = event["action"].to_s
+        remote = event["remote"].to_s
+        trunk = event["trunk"].to_s
+        parts = ["remote"]
+        parts << action unless action.empty?
+        parts << remote unless remote.empty?
+        parts << trunk if remote.empty? && !trunk.empty?
+        parts.join(":")
+      end
+
+      def ci_monitor_event_label(event)
+        action = event["action"].to_s
+        provider = event["provider"].to_s
+        target = event["workflow"].to_s
+        target = "pipeline" if target.empty? && provider == "gitlab"
+        parts = ["ci"]
+        parts << action unless action.empty?
+        parts << provider unless provider.empty?
+        parts << target unless target.empty?
+        if %w[github_wait github_started github_tick].include?(action) && event["completed"] && event["total"]
+          parts << "#{event["completed"]}/#{event["total"]}"
+        end
+        completed_workflow = event["completed_workflow"].to_s
+        parts << completed_workflow unless completed_workflow.empty? || completed_workflow == target
+        parts.join(":")
+      end
+
+      def pre_release_event_label(event)
+        action = event["action"].to_s
+        check = event["check"].to_s
+        parts = ["pre"]
+        parts << action unless action.empty?
+        parts << check unless check.empty?
+        parts.join(":")
+      end
+
+      def changelog_event_label(event)
+        action = event["action"].to_s
+        plan = event["plan"].to_s
+        parts = ["changelog"]
+        parts << action unless action.empty?
+        parts << plan unless plan.empty? || action == "coverage"
+        parts.join(":")
+      end
+
+      def release_lockfile_event_label(event)
+        action = event["action"].to_s
+        stage = event["stage"].to_s
+        stage = stage.tr(" ", "_")
+        parts = ["lockfile"]
+        parts << action unless action.empty?
+        parts << stage unless stage.empty?
+        parts << "#{event["attempt"]}/#{event["attempts"]}" if event["attempt"] && event["attempts"]
+        parts.join(":")
+      end
+
+      def release_probe_event_label(event)
+        action = event["action"].to_s
+        gem_name = event["gem"].to_s
+        version = event["version"].to_s
+        parts = ["probe"]
+        parts << action unless action.empty?
+        parts << [gem_name, version].reject(&:empty?).join("-")
+        parts << "#{event["attempt"]}/#{event["attempts"]}" if event["attempt"] && event["attempts"]
+        parts.reject(&:empty?).join(":")
+      end
+
       def diagnostic_event_label(event)
         message = event["message"]
         return message.to_s unless message.to_s.empty? || message.is_a?(Hash)

data/lib/kettle/family/workflow_progress.rb

@@ -15,11 +15,12 @@ module Kettle
       DEFAULT_TERMINAL_WIDTH = 80
       ELLIPSIS = "..."
 
-      def initialize(io:, label:, total:, jobs:, members: [], enabled: true, clock: nil)
+      def initialize(io:, label:, total:, jobs:, members: [], enabled: true, clock: nil, heading: nil)
         @io = io
         @label = label
         @total = total.to_i
         @jobs = jobs.to_i
+        @heading = heading
         @clock = clock || lambda { Process.clock_gettime(Process::CLOCK_MONOTONIC) }
         @enabled = enabled && !!io
         @bars = {}
@@ -43,7 +44,7 @@ module Kettle
         synchronize do
           next if @started
 
-          write_line("#{@label} #{@total} member#{plural(@total)} with #{@jobs} job#{plural(@jobs)}:")
+          write_line(@heading || "#{@label} #{@total} member#{plural(@total)} with #{@jobs} job#{plural(@jobs)}:")
           @started = true
           @line_order.each { |member_name| render_name(member_name, status: "") } if @tty
         end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.13
+  version: 1.2.15
 platform: ruby
 authors:
 - Peter H. Boling
@@ -74,7 +74,7 @@ dependencies:
         version: '2.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.12
+        version: 2.5.13
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -84,7 +84,7 @@ dependencies:
         version: '2.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.12
+        version: 2.5.13
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -342,10 +342,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.13
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.13/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.15
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.15/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.13
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.15
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family