kettle-family 1.2.92 → 1.2.94

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c1646ca3577c370624800077609c69c0decd4a50ad6924e82cfe3c050c1757df
-  data.tar.gz: 361e0ac1cd39a97b442d3296635055b5bd34c24ced7d3944cec4a0984df6babb
+  metadata.gz: 60682b3f2d2f1017624cc67b428ff954b71f03eca4fdb6034cbe229183cba970
+  data.tar.gz: ea873857902fa44d2b2051e6449f21d84515139f005e1a9c148dfedf5062ce2f
 SHA512:
-  metadata.gz: fa89492878000e8fa0b08b244b95a432ddb96e11130da0d4655087580b63260242b00f28a3f76af32c3a9dc8d9d2830f815f22f960f5c835b4b3af851196b510
-  data.tar.gz: 1a801e2a97fdb2726e8ac282f88686e87aff42b680b54e2798b09bd70aa4e6be3678e9bf45625ab057a3d2210e99cd59eeeba31fd2761880f27cabc2b53a1566
+  metadata.gz: a14c847688ce762dbf03be0229b1c5ac0da23d3892e2e803467b8dc6efe73df4ede2b43d64a6ffedbccaf38f11da162bfad6bbf574a44b29739dafe8b8d70cba
+  data.tar.gz: 8ad7d29e783dace84ef807339b81907fe9e6e7c7f35ee60c4ac95b412a0972983c6eb7d9e8dad708801b270eda6ee0bb87d8759a22e3d4e29d6f254d4bfa6ff3

data/CHANGELOG.md

@@ -30,6 +30,30 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.94] - 2026-09-07
+
+- TAG: [v1.2.94][1.2.94t]
+- COVERAGE: 93.50% -- 6183/6613 lines in 35 files
+- BRANCH COVERAGE: 78.04% -- 2512/3219 branches in 35 files
+- 32.58% documented
+
+### Fixed
+
+- Restrict inferred monorepo release path allowances to CI-resident paths, preserving external development overrides for local-only dependency work.
+
+- Allow bup and bupb to commit explicitly selected development path graphs while continuing to reject unrequested local lockfile paths.
+
+## [1.2.93] - 2026-09-07
+
+- TAG: [v1.2.93][1.2.93t]
+- COVERAGE: 93.54% -- 6165/6591 lines in 35 files
+- BRANCH COVERAGE: 78.08% -- 2507/3211 branches in 35 files
+- 32.41% documented
+
+### Fixed
+
+- Update family-root bundles before member bundles for bup and bupb, committing the root lockfile only when the family is a monorepo.
+
 ## [1.2.92] - 2026-09-07
 
 - TAG: [v1.2.92][1.2.92t]
@@ -2616,7 +2640,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.92...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.94...HEAD
+[1.2.94]: https://github.com/kettle-dev/kettle-family/compare/v1.2.93...v1.2.94
+[1.2.94t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.94
+[1.2.93]: https://github.com/kettle-dev/kettle-family/compare/v1.2.92...v1.2.93
+[1.2.93t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.93
 [1.2.92]: https://github.com/kettle-dev/kettle-family/compare/v1.2.91...v1.2.92
 [1.2.92t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.92
 [1.2.91]: https://github.com/kettle-dev/kettle-family/compare/v1.2.90...v1.2.91

data/README.md

@@ -255,13 +255,19 @@ release:
       - kettle-jem
 ```
 
-`family.local_path_env` names the environment variable that activates local
-path dependencies for this family. For an explicitly configured
-`family.mode: monorepo`, `kettle-family` derives a release-lock policy that
-allows only `family.members_root` (or the configured member root) and passes
-that policy to each `kettle-release` child. Those paths are valid because the
-same monorepo checkout exists in CI. The tracked `Gemfile.lock` remains a
-development lockfile and may retain those member `PATH` sources.
+`family.local_path_env` names the environment variable that activates the
+family's development path graph. It does not, by itself, make a path valid in
+CI or safe to retain in a release lockfile. For an explicitly configured
+`family.mode: monorepo`, `kettle-family` derives a release-lock policy only
+when that path is contained by the family repository; this is the case when
+the CI checkout contains the same member graph. The tracked `Gemfile.lock`
+may then retain those member `PATH` sources.
+
+A monorepo can also reference a separate checkout, for example a shared base
+gem in its parent workspace. That is an external development override, not an
+internal monorepo path: it is removed for release unless
+`release.allowed_local_path_roots` and `release.allowed_local_path_env`
+explicitly describe matching CI checkout provisioning.
 
 Sibling-repository families do not receive this exception. Their canonical
 lockfiles must use released dependencies: a local Kettle Dev workspace, or
@@ -496,8 +502,8 @@ The command names below are available from `kettle-family --help`:
 | `docs` | Run the configured documentation workflow for each selected member. |
 | `template` | Apply the configured `kettle-jem` template for each selected member. |
 | `gha-sha-pins` | Inspect or update GitHub Actions SHA pins. |
-| `bup` | Run `bundle update --all`, or update a named dependency, per member. |
-| `bupb` | Run `bundle update --bundler` per member. |
+| `bup` | Run `bundle update --all`, or update a named dependency, at the family root and per member. |
+| `bupb` | Run `bundle update --bundler` at the family root and per member. |
 | `bex` | Run an arbitrary `bundle exec` command per member. |
 | `install` | Build and install selected local family gems. |
 | `bump` | Check, plan, or execute family version alignment. |
@@ -596,13 +602,24 @@ kettle-family bup --execute
 kettle-family template --execute
 ```
 
-`bup` runs `bundle update --all` for every selected member. A gem name may be
-passed to update only that dependency, for example `kettle-family bup --execute
-kettle-test`. Executed updates commit successful lockfile changes by default;
-use `--no-commit` for a working-tree-only refresh, or `--commit` to state the
-default explicitly. Local dependency environment variables are preserved when
-explicitly supplied, so use the family's local or released dependency mode
-deliberately before running it.
+`bup` first runs `bundle update --all` at the family root when that root has a
+`Gemfile`, then runs it for every selected member. `bupb` follows the same
+root-first order with `bundle update --bundler`. A root that is itself a member
+is updated only once. A gem name may be passed to `bup` to update only that
+dependency, for example `kettle-family bup --execute kettle-test`.
+
+Executed member updates commit successful lockfile changes by default. The
+family-root lockfile is also validated and committed for monorepos, where the
+root and members share one Git repository. A sibling-repository family root is
+updated for its orchestration bundle but is not included in any member commit.
+Use `--no-commit` for a working-tree-only refresh, or `--commit` to state the
+default explicitly. `bup` and `bupb` validate the development graph selected
+by their explicit local-path environment and commit it by default; this keeps
+template synchronization from being blocked by expected local-path lockfile
+changes. Release workflows separately normalize and validate their
+CI/release graph. A normal family-local graph and an unreleased external
+Kettle toolchain are separate choices; project task wrappers should not
+silently enable the latter for ordinary `bup` or `bupb` runs.
 
 Plan or update GitHub Actions workflow SHA pins across the selected family
 members:
@@ -1137,7 +1154,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.570-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.613-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/config.rb

@@ -285,18 +285,29 @@ module Kettle
       end
 
       def release_allowed_local_path_roots
-        inferred = configured_monorepo_release? ? [family_local_path_root] : []
+        inferred = ci_resident_monorepo_local_path_graph? ? [family_local_path_root] : []
         configured = Array(fetch_path("release", "allowed_local_path_roots"))
           .map { |path| expand_config_relative_path(path) }
         (inferred + configured).uniq
       end
 
       def release_allowed_local_path_env_names
-        inferred = configured_monorepo_release? ? [family_local_path_env_name] : []
+        inferred = ci_resident_monorepo_local_path_graph? ? [family_local_path_env_name] : []
         configured = Array(fetch_path("release", "allowed_local_path_env"))
         (inferred + configured).compact.map(&:to_s).reject(&:empty?).uniq
       end
 
+      # A monorepo may still use an environment switch to reach a separate
+      # sibling checkout. Only a path contained by this repository can be
+      # inferred as CI-resident and retained in release lockfiles.
+      def ci_resident_monorepo_local_path_graph?
+        return false unless fetch_path("family", "mode") == "monorepo"
+
+        path_within_root?(family_local_path_root)
+      end
+
+      # This remains the repository-topology predicate used by release
+      # scheduling. CI-safe local path inference is deliberately narrower.
       def configured_monorepo_release?
         fetch_path("family", "mode") == "monorepo"
       end
@@ -371,6 +382,12 @@ module Kettle
 
       private
 
+      def path_within_root?(path)
+        expanded_path = File.expand_path(path)
+        expanded_root = File.expand_path(root)
+        expanded_path == expanded_root || expanded_path.start_with?("#{expanded_root}/")
+      end
+
       def expand_config_relative_path(value)
         text = value.to_s
         return text if text.start_with?("/")

data/lib/kettle/family/report.rb

@@ -702,6 +702,7 @@ module Kettle
 
       def resume_hint_for(result)
         return release_resume_hint(result) if command == "release"
+        return "kettle-family #{command}" if result.phase.start_with?("family_root_") || result.phase == "commit_family_root_bundle_update"
 
         "kettle-family #{command} --start-at #{result.member_name}"
       end

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.92"
+      VERSION = "1.2.94"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -575,6 +575,9 @@ module Kettle
 
         runner = CommandRunner.new(execute: execute, accept: accept)
         results = []
+        update_family_root_bundle(runner: runner, memo: results) if %w[bup bupb].include?(command)
+        return results unless results.all?(&:ok?)
+
         if command == "gha-sha-pins" && execute
           return results unless review_gha_sha_pins(workflow_members, runner: runner, memo: results)
         end
@@ -617,6 +620,39 @@ module Kettle
         results
       end
 
+      def update_family_root_bundle(runner:, memo:)
+        return unless family_root_bundle_update_required?
+
+        root_member = family_member
+        memo << runner.call(
+          member: root_member,
+          phase: "family_root_#{command}",
+          command: workflow_command,
+          env: command_env
+        )
+        return unless memo.last.ok?
+        return unless family_root_bundle_commit?
+        return unless validate_bundle_update_lockfile(
+          member: root_member,
+          memo: memo,
+          phase: "family_root_bundle_update_readiness"
+        )
+
+        commit_family_root_bundle_update(member: root_member, runner: runner, memo: memo)
+      end
+
+      def family_root_bundle_update_required?
+        return false unless File.file?(File.join(config.root, "Gemfile"))
+
+        family_members.none? do |member|
+          File.expand_path(member.root) == File.expand_path(config.root)
+        end
+      end
+
+      def family_root_bundle_commit?
+        commit && config.family_mode == "monorepo"
+      end
+
       # Sibling repositories have isolated working trees and can run their
       # tests concurrently. A monorepo's default kettle-test command normally
       # executes the shared root suite, so it is represented by one selected
@@ -5529,13 +5565,13 @@ module Kettle
         memo << result
       end
 
-      def validate_bundle_update_lockfile(member:, memo:)
+      def validate_bundle_update_lockfile(member:, memo:, phase: "bundle_update_readiness")
         return true unless execute && commit
 
         diagnostics = bundle_update_lockfile_diagnostics(member)
         result = CommandResult.new(
           member.name,
-          "bundle_update_readiness",
+          phase,
           ["internal", "bundle-update-readiness"],
           member.root,
           diagnostics.empty? ? 0 : 1,
@@ -5544,18 +5580,61 @@ module Kettle
           "",
           0.0,
           false,
-          diagnostics.empty? ? nil : "bundle update produced release-invalid lockfile"
+          diagnostics.empty? ? nil : "bundle update produced an unexpected local-path lockfile"
         )
         memo << result
         result.ok?
       end
 
+      def commit_family_root_bundle_update(member:, runner:, memo:)
+        return unless family_root_bundle_commit?
+
+        result = runner.call(
+          member: member,
+          phase: "commit_family_root_bundle_update",
+          command: [
+            "sh",
+            "-lc",
+            "files=$(git ls-files --modified --others --exclude-standard -- Gemfile.lock); " \
+              "if [ -n \"$files\" ]; then git add -- Gemfile.lock && git commit --only -m '🔒️ Update family root bundle' -- Gemfile.lock; fi"
+          ]
+        )
+        memo << result
+      end
+
       def bundle_update_lockfile_diagnostics(member)
         ReadinessCheck.call(
           member: member,
           config: config,
-          allowed_local_path_roots: release_allowed_local_path_roots
-        ).stdout.lines.grep(/^release lockfile has local path remote at /).map(&:chomp)
+          allowed_local_path_roots: bundle_update_allowed_local_path_roots
+        ).stdout.lines.grep(/^release lockfile has local path remote at /).map do |line|
+          line.sub("release lockfile", "bundle update lockfile").chomp
+        end
+      end
+
+      # Bundle updates record the graph intentionally selected by the caller.
+      # Release validation remains stricter: it accepts only CI-resident paths.
+      def bundle_update_allowed_local_path_roots
+        explicit = explicit_local_path_env_overrides
+        roots = release_allowed_local_path_roots.dup
+        family_env_name = config.family_local_path_env_name
+
+        explicit.each do |name, value|
+          next unless local_path_env_value?(value)
+
+          if name == family_env_name
+            roots << config.family_local_path_root
+          elsif explicit_local_path_root?(value)
+            roots << File.expand_path(value, config.root)
+          end
+        end
+
+        roots.uniq
+      end
+
+      def explicit_local_path_root?(value)
+        text = value.to_s.strip
+        !%w[true yes 1 on enabled].include?(text.downcase)
       end
 
       def commit_bex_changes(member:, runner:, memo:)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.92
+  version: 1.2.94
 platform: ruby
 authors:
 - Peter H. Boling
@@ -443,10 +443,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.92
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.92/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.94
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.94/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.92
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.94
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family