kettle-family 1.2.93 → 1.2.95

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1a24d4a7f560730b58dea502aa74c1f7c2b6b5821c92bc565ee5d0eff79d8be
-  data.tar.gz: 58f47810263c6279e727419acb896abb959ccac76bff444c83b19c88c85f64f5
+  metadata.gz: 9b482c620e7f5e341caead6b52476cc8dc26e56c5d0ecde281ca27f7aaacc3e3
+  data.tar.gz: 78c5c14ec0d5a90a34341650d010216e241fb4927983dff9507b66d9e9ccaf6d
 SHA512:
-  metadata.gz: 7bb4085cb68b1d1ee1592ad1ab43d55afbc08a4c12a341ffffb6f1b3d712f43e51e0b8b4f59095fdd8402e1fa7c21822d6b43da8c8bd4caf340e102418d2974c
-  data.tar.gz: c12db5ebfea5489500b221fbc39f8d638fc6f4ad119eb73a210e195b779804325be2effad8970a78b65f7a5f0b837a9d324bb12242ab33c61b782877de5d6343
+  metadata.gz: 61ab40f1165dc584b786cf9e5f72005390aa786bcc2f6d0b1f4e9c172d566d8efd310625bac5a218312b221e5f8577071d699dc0eadaa6b1260cdb7ac4444736
+  data.tar.gz: f4097829a8ca4127f0a2a6dc4f53ea84886d14e68c9df2ec82db9319904482ba9d6f2339d087596b048419d7c63707462f5c38e45e8bf475149e295fc4479868

checksums.yaml.gz.sig

@@ -1,3 +1,3 @@
-:��H+>��|L̖��~�̃���c:���j�yIs�0���ٛ-I��W~i��E����fb�؃G�~�fl�X<�� $��u��"��7���/���v����]���# q,�/�2o��|.bM���xv.yA!�z�����xH�����0�=���g%r7�Sʶ!�X_���K����ei��V>Cu��
-� �,�M�pye�	��`�+
-63`o�L���nW	��I��V"��[)Zg�%�d���'50���]�Ǖ�}A���J�b��<���}(�_[[��{Q��5����g���)/�2�ܓ�Τ�J
+A(�#�-]Zf��(��ȯ�7ֺJ2Qf
+�Mx'{UM:�F�롄�>�����q�!b�w��2ɤ8#+e*d>#�`NǚB��z��6�8|r�^@����߰���7���G������?�5*݆��.�s9� �y���D��eJ^�N�h����!O]k2ǯ8�/y	T5�}Ϥ�'x�hHg�0�wHE$�~���h�Ť��a���I��W9u�.^J3���%-�YJ�ӓ�����>0����K36���4p
+����U�1?ɔo(S�FC�

data/CHANGELOG.md

@@ -30,6 +30,30 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.95] - 2026-09-07
+
+- TAG: [v1.2.95][1.2.95t]
+- COVERAGE: 93.49% -- 6199/6631 lines in 35 files
+- BRANCH COVERAGE: 78.03% -- 2515/3223 branches in 35 files
+- 32.58% documented
+
+### Fixed
+
+- Run release-target branch worktrees through the full template bootstrap workflow before member preparation.
+
+## [1.2.94] - 2026-09-07
+
+- TAG: [v1.2.94][1.2.94t]
+- COVERAGE: 93.50% -- 6183/6613 lines in 35 files
+- BRANCH COVERAGE: 78.04% -- 2512/3219 branches in 35 files
+- 32.58% documented
+
+### Fixed
+
+- Restrict inferred monorepo release path allowances to CI-resident paths, preserving external development overrides for local-only dependency work.
+
+- Allow bup and bupb to commit explicitly selected development path graphs while continuing to reject unrequested local lockfile paths.
+
 ## [1.2.93] - 2026-09-07
 
 - TAG: [v1.2.93][1.2.93t]
@@ -2627,7 +2651,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.93...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.95...HEAD
+[1.2.95]: https://github.com/kettle-dev/kettle-family/compare/v1.2.94...v1.2.95
+[1.2.95t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.95
+[1.2.94]: https://github.com/kettle-dev/kettle-family/compare/v1.2.93...v1.2.94
+[1.2.94t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.94
 [1.2.93]: https://github.com/kettle-dev/kettle-family/compare/v1.2.92...v1.2.93
 [1.2.93t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.93
 [1.2.92]: https://github.com/kettle-dev/kettle-family/compare/v1.2.91...v1.2.92

data/README.md

@@ -255,13 +255,19 @@ release:
       - kettle-jem
 ```
 
-`family.local_path_env` names the environment variable that activates local
-path dependencies for this family. For an explicitly configured
-`family.mode: monorepo`, `kettle-family` derives a release-lock policy that
-allows only `family.members_root` (or the configured member root) and passes
-that policy to each `kettle-release` child. Those paths are valid because the
-same monorepo checkout exists in CI. The tracked `Gemfile.lock` remains a
-development lockfile and may retain those member `PATH` sources.
+`family.local_path_env` names the environment variable that activates the
+family's development path graph. It does not, by itself, make a path valid in
+CI or safe to retain in a release lockfile. For an explicitly configured
+`family.mode: monorepo`, `kettle-family` derives a release-lock policy only
+when that path is contained by the family repository; this is the case when
+the CI checkout contains the same member graph. The tracked `Gemfile.lock`
+may then retain those member `PATH` sources.
+
+A monorepo can also reference a separate checkout, for example a shared base
+gem in its parent workspace. That is an external development override, not an
+internal monorepo path: it is removed for release unless
+`release.allowed_local_path_roots` and `release.allowed_local_path_env`
+explicitly describe matching CI checkout provisioning.
 
 Sibling-repository families do not receive this exception. Their canonical
 lockfiles must use released dependencies: a local Kettle Dev workspace, or
@@ -607,9 +613,13 @@ family-root lockfile is also validated and committed for monorepos, where the
 root and members share one Git repository. A sibling-repository family root is
 updated for its orchestration bundle but is not included in any member commit.
 Use `--no-commit` for a working-tree-only refresh, or `--commit` to state the
-default explicitly. Local dependency environment variables are preserved when
-explicitly supplied, so use the family's local or released dependency mode
-deliberately before running it.
+default explicitly. `bup` and `bupb` validate the development graph selected
+by their explicit local-path environment and commit it by default; this keeps
+template synchronization from being blocked by expected local-path lockfile
+changes. Release workflows separately normalize and validate their
+CI/release graph. A normal family-local graph and an unreleased external
+Kettle toolchain are separate choices; project task wrappers should not
+silently enable the latter for ordinary `bup` or `bupb` runs.
 
 Plan or update GitHub Actions workflow SHA pins across the selected family
 members:
@@ -892,6 +902,23 @@ the template dependency graph. It must not invoke release-lockfile reset logic:
 release normalization intentionally disables local paths, while template
 recovery needs configured sibling paths to resolve unreleased family versions.
 
+### Branch Worktree Equivalence
+
+A release-target branch worktree is a separate checkout of the same template
+member, not a reduced template workflow. Before its member template body runs,
+it executes the same debugger, Appraisal, and Nomono bootstrap boundary as an
+ordinary member. It then executes the same lockfile preparation, dependency
+preparation and recovery, `kettle-jem` invocation, lockfile normalization, and
+template commit path with the same `template_local` environment.
+
+Only checkout mechanics differ: Family creates and trusts the linked worktree,
+rebases that target branch on its own upstream when one exists, attaches the
+branch name to the results, and removes the worktree after completion. These
+steps are necessary because each target has a distinct Git ref and an absolute
+`mise` configuration path. They do not change the dependency graph or omit a
+template phase. Regression specs assert that branch worktrees call the shared
+bootstrap boundary and cannot start a member template body when it fails.
+
 ## 🔐 Security
 
 See [SECURITY.md][🔐security].
@@ -1144,7 +1171,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.591-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.631-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/config.rb

@@ -285,18 +285,29 @@ module Kettle
       end
 
       def release_allowed_local_path_roots
-        inferred = configured_monorepo_release? ? [family_local_path_root] : []
+        inferred = ci_resident_monorepo_local_path_graph? ? [family_local_path_root] : []
         configured = Array(fetch_path("release", "allowed_local_path_roots"))
           .map { |path| expand_config_relative_path(path) }
         (inferred + configured).uniq
       end
 
       def release_allowed_local_path_env_names
-        inferred = configured_monorepo_release? ? [family_local_path_env_name] : []
+        inferred = ci_resident_monorepo_local_path_graph? ? [family_local_path_env_name] : []
         configured = Array(fetch_path("release", "allowed_local_path_env"))
         (inferred + configured).compact.map(&:to_s).reject(&:empty?).uniq
       end
 
+      # A monorepo may still use an environment switch to reach a separate
+      # sibling checkout. Only a path contained by this repository can be
+      # inferred as CI-resident and retained in release lockfiles.
+      def ci_resident_monorepo_local_path_graph?
+        return false unless fetch_path("family", "mode") == "monorepo"
+
+        path_within_root?(family_local_path_root)
+      end
+
+      # This remains the repository-topology predicate used by release
+      # scheduling. CI-safe local path inference is deliberately narrower.
       def configured_monorepo_release?
         fetch_path("family", "mode") == "monorepo"
       end
@@ -371,6 +382,12 @@ module Kettle
 
       private
 
+      def path_within_root?(path)
+        expanded_path = File.expand_path(path)
+        expanded_root = File.expand_path(root)
+        expanded_path == expanded_root || expanded_path.start_with?("#{expanded_root}/")
+      end
+
       def expand_config_relative_path(value)
         text = value.to_s
         return text if text.start_with?("/")

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.93"
+      VERSION = "1.2.95"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -932,14 +932,8 @@ module Kettle
       end
 
       def template_member_workflow_results(workflow_members)
-        debugger_results = template_debugger_bootstrap_results(workflow_members)
-        return debugger_results unless debugger_results.all?(&:ok?)
-
-        appraisal_results = template_appraisal_bootstrap_results(workflow_members)
-        return debugger_results + appraisal_results unless appraisal_results.all?(&:ok?)
-
-        bootstrap_results = template_bootstrap_dependency_results(workflow_members)
-        return debugger_results + appraisal_results + bootstrap_results unless bootstrap_results.all?(&:ok?)
+        bootstrap_results = template_member_bootstrap_results(workflow_members)
+        return bootstrap_results unless bootstrap_results.all?(&:ok?)
 
         template_progress = start_template_progress(workflow_members)
         results = template_dependency_waves(workflow_members).each_with_object([]) do |wave, memo|
@@ -948,7 +942,22 @@ module Kettle
           break memo unless wave_results.all?(&:ok?)
         end
         emit_template_progress_summary(results, progress: template_progress)
-        debugger_results + appraisal_results + bootstrap_results + results
+        bootstrap_results + results
+      end
+
+      # This is the common preparation boundary for every template member,
+      # regardless of whether it runs in its primary checkout, a monorepo
+      # worktree, or a release-target branch worktree. Keep branch mechanics
+      # outside this method so they cannot silently omit a bootstrap phase.
+      def template_member_bootstrap_results(workflow_members)
+        debugger_results = template_debugger_bootstrap_results(workflow_members)
+        return debugger_results unless debugger_results.all?(&:ok?)
+
+        appraisal_results = template_appraisal_bootstrap_results(workflow_members)
+        return debugger_results + appraisal_results unless appraisal_results.all?(&:ok?)
+
+        bootstrap_results = template_bootstrap_dependency_results(workflow_members)
+        debugger_results + appraisal_results + bootstrap_results
       end
 
       def template_debugger_bootstrap_results(workflow_members)
@@ -1650,6 +1659,17 @@ module Kettle
       end
 
       def template_branch_worktree_entries_results(entries)
+        results = template_branch_worktree_sync_results(entries)
+        return results unless results.all?(&:ok?)
+
+        # A branch worktree is a different checkout, not a different template
+        # profile. Run the exact same member bootstrap boundary used by normal
+        # members before any branch begins its member template body.
+        bootstrap_results = template_member_bootstrap_results(entries.map { |entry| entry.fetch(:member) })
+        tag_template_worktree_results(bootstrap_results, entries)
+        results.concat(bootstrap_results)
+        return results unless bootstrap_results.all?(&:ok?)
+
         wave_jobs = template_jobs(entries)
         queue = Queue.new
         entries.each_with_index { |entry, index| queue << [index, entry] }
@@ -1671,23 +1691,41 @@ module Kettle
             end
           end
         end.each(&:join)
-        ordered_results.compact.flatten
+        results + ordered_results.compact.flatten
       end
 
       def template_branch_worktree_entry_results(entry, wave_jobs: 1)
         member = entry.fetch(:member)
         branch = entry.fetch(:branch)
-        runner = command_runner
-        results = []
-        if git_upstream_for(member)
-          results << runner.call(member: member, phase: "template_branch_sync", command: ["git", "rebase", "@{upstream}"])
-        end
-        results.concat(template_results_for_member(member, wave_jobs: wave_jobs)) if results.all?(&:ok?)
+        # Bootstrap and upstream synchronization are deliberately performed
+        # for the complete branch set before workers start. The member body is
+        # the same method normal template waves invoke.
+        results = template_results_for_member(member, wave_jobs: wave_jobs)
         tag_branch_results(results, branch)
         emit_template_event_line(member, results.all?(&:ok?) ? "." : "F", "branch #{branch}")
         results
       end
 
+      def template_branch_worktree_sync_results(entries)
+        runner = command_runner
+        entries.filter_map do |entry|
+          member = entry.fetch(:member)
+          upstream = git_upstream_for(member)
+          next unless upstream
+
+          result = runner.call(member: member, phase: "template_branch_sync", command: ["git", "rebase", "@{upstream}"])
+          result.branch = entry.fetch(:branch)
+          result
+        end
+      end
+
+      def tag_template_worktree_results(results, entries)
+        branches_by_root = entries.to_h { |entry| [File.expand_path(entry.fetch(:member).root), entry.fetch(:branch)] }
+        results.each do |result|
+          result.branch = branches_by_root[File.expand_path(result.workdir)] if result.workdir
+        end
+      end
+
       def template_branch_worktree_cleanup_results(entries, runner:, control_member:)
         entries.filter_map do |entry|
           worktree_root = entry[:worktree_root]
@@ -5580,7 +5618,7 @@ module Kettle
           "",
           0.0,
           false,
-          diagnostics.empty? ? nil : "bundle update produced release-invalid lockfile"
+          diagnostics.empty? ? nil : "bundle update produced an unexpected local-path lockfile"
         )
         memo << result
         result.ok?
@@ -5606,8 +5644,35 @@ module Kettle
         ReadinessCheck.call(
           member: member,
           config: config,
-          allowed_local_path_roots: release_allowed_local_path_roots
-        ).stdout.lines.grep(/^release lockfile has local path remote at /).map(&:chomp)
+          allowed_local_path_roots: bundle_update_allowed_local_path_roots
+        ).stdout.lines.grep(/^release lockfile has local path remote at /).map do |line|
+          line.sub("release lockfile", "bundle update lockfile").chomp
+        end
+      end
+
+      # Bundle updates record the graph intentionally selected by the caller.
+      # Release validation remains stricter: it accepts only CI-resident paths.
+      def bundle_update_allowed_local_path_roots
+        explicit = explicit_local_path_env_overrides
+        roots = release_allowed_local_path_roots.dup
+        family_env_name = config.family_local_path_env_name
+
+        explicit.each do |name, value|
+          next unless local_path_env_value?(value)
+
+          if name == family_env_name
+            roots << config.family_local_path_root
+          elsif explicit_local_path_root?(value)
+            roots << File.expand_path(value, config.root)
+          end
+        end
+
+        roots.uniq
+      end
+
+      def explicit_local_path_root?(value)
+        text = value.to_s.strip
+        !%w[true yes 1 on enabled].include?(text.downcase)
       end
 
       def commit_bex_changes(member:, runner:, memo:)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.93
+  version: 1.2.95
 platform: ruby
 authors:
 - Peter H. Boling
@@ -91,7 +91,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.31
+        version: 3.0.32
     - - "<"
       - !ruby/object:Gem::Version
         version: 4.0.0
@@ -101,7 +101,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.31
+        version: 3.0.32
     - - "<"
       - !ruby/object:Gem::Version
         version: 4.0.0
@@ -443,10 +443,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.93
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.93/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.95
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.95/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.93
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.95
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family