kettle-family 1.3.28 → 1.3.30

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 367d63bb92d37a073b9f7bfd89c81dd888abc3096ea0f40a38a84420676baa1b
-  data.tar.gz: f90a8ff1e68e5906b016813c2b7f9b1bb863e22df3a217ac18aac97820b05b14
+  metadata.gz: e1834021ad7c719f89aee9e9c7408bb2fd772797bf85087620e913f2d0b5cbc5
+  data.tar.gz: abcb663c3eaffcebd396befa0443c3d5eb331cfdbcce6de417881cbda9e15679
 SHA512:
-  metadata.gz: 2475a71506fa039212ababd06370f8fe2472147324f9d928e33fe5857e88bdf370fb63b24ffa70f08fe0d0d0bc632ac227bc146878160b26eae6d64f958010a3
-  data.tar.gz: 7bb3b6df1a83fed732d8b6dcf43004efb5f1a00ff21dbd51ba084b7336292d4d1b6a3a2ffdbad5504e6a007265ec23fd8623fd9972c5a5cdb21aea994837f43c
+  metadata.gz: fd431e1b40c4c7b7119461eabb4cf55625a2ebea4f37e9c553ee96f3fb7f66af690441f063a33b2118a1d60ed7fdd48be98e9a6c85016cbbc106946206a152b8
+  data.tar.gz: b91b8eeb298ec02137d844df600e1ac2fe8ffefc5ff3c94fd055c8f10f57c162499deb1118a2c4034cd7ced3e2b0154b005255f2d95cdafe74744323ae9e6fb1

data/CHANGELOG.md

@@ -30,6 +30,31 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.3.30] - 2026-10-22
+
+- TAG: [v1.3.30][1.3.30t]
+- COVERAGE: 93.05% -- 7526/8088 lines in 45 files
+- BRANCH COVERAGE: 77.62% -- 3020/3891 branches in 45 files
+- 38.45% documented
+
+### Fixed
+
+- Family templating and mise-tasks now refresh the generated family task suite and migrate standard task definitions out of mise.toml, preserving custom tasks and family release settings. Generated lint/template commands execute their workflows, and dependency-task env wrappers use valid shell syntax.
+
+- Family templating no longer crashes with Errno::ENOENT when the mise executable is unavailable to the spawned command environment: CommandRunner resolves mise to an absolute PATH-derived path for the `mise exec -C` wrapper prefix and the post-template family root trust step (spawned envs strip the orchestrator's Ruby/gem bin dirs from PATH), runs commands UNWRAPPED when mise cannot be resolved at all (no member runtime exists to activate), and skips the trust step when mise is absent (it only enables subsequent nested mise runs).
++ Mise is now optional everywhere the template flow can reach: the new `Kettle::Family::MiseAdapter` seam resolves the binary at runtime, wraps member commands in `mise exec` when available, and passes them through UNWRAPPED (with `env(1)` injection preserved) when absent — no ENOENT on mise-less CI. The post-template family root trust step and worktree bootstraps skip when unresolvable. The adapter is injectable via `mise_adapter:` kwarg on `CommandRunner` and `Workflow`, with a module-level `Kettle::Family.mise_adapter` default for deep CLI construction. All eight `CommandRunner.new` sites, the family-root trust phase, `worktree_mise_trust_results`, and `CLI.mise_trust_results` delegate to it. Specs default to the nil flavor (hermetic, identical locally and in CI); examples asserting wrapped argv shapes opt into an available adapter locally.
+
+## [1.3.29] - 2026-10-21
+
+- TAG: [v1.3.29][1.3.29t]
+- COVERAGE: 93.07% -- 7464/8020 lines in 44 files
+- BRANCH COVERAGE: 77.56% -- 2996/3863 branches in 44 files
+- 37.45% documented
+
+### Fixed
+
+- Release: the closing full-cohort aggregate GitHub Release now runs on execute runs, not only dry-runs. Per-member finalization appends only cover members published in the current run, so a resumed wave (--only on the unpublished remainder) previously never contributed artifacts published by earlier interrupted waves to the shared release. kettle-gh-release skips existing assets, so the full-cohort pass stays cheap on complete waves
+
 ## [1.3.28] - 2026-10-21
 
 - TAG: [v1.3.28][1.3.28t]
@@ -3189,7 +3214,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.28...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.30...HEAD
+[1.3.30]: https://github.com/kettle-dev/kettle-family/compare/v1.3.29...v1.3.30
+[1.3.30t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.30
+[1.3.29]: https://github.com/kettle-dev/kettle-family/compare/v1.3.28...v1.3.29
+[1.3.29t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.29
 [1.3.28]: https://github.com/kettle-dev/kettle-family/compare/v1.3.27...v1.3.28
 [1.3.28t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.28
 [1.3.27]: https://github.com/kettle-dev/kettle-family/compare/v1.3.26...v1.3.27

data/README.md

@@ -1225,7 +1225,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-8.019-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-8.088-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/cli.rb

@@ -267,7 +267,7 @@ module Kettle
       class MiseTasks < BaseCommand
         command_name "mise-tasks"
         usage "[options]"
-        description "Ensure the root mise.toml includes the kettle-family managed task file; warn on redefinitions."
+        description "Refresh managed family tasks and migrate standard root definitions; ensure the task-file include."
 
         option :task_file, long: "--task-file", value: {type: String, usage: "PATH"},
           desc: "Managed TOML task file name, relative to the root (default: mise-family.tasks.toml)"
@@ -288,6 +288,13 @@ module Kettle
             return 1
           end
 
+          if File.file?(File.join(root, ".kettle-family.yml"))
+            Kettle::Family::MiseTasks.materialize_managed_suite(
+              context: {project_root: root}, task_file_name: task_file_name
+            )
+            stdout.puts("refreshed managed family tasks and migrated standard root definitions")
+          end
+
           unless File.file?(task_file_path)
             baseline = File.join(__dir__, "templates", "mise-family.tasks.toml")
             FileUtils.cp(baseline, task_file_path)
@@ -1065,11 +1072,28 @@ module Kettle
       end
 
       def mise_trust_results(config:, members:)
+        adapter = Kettle::Family.mise_adapter
         roots = [config.root, *members.map(&:root)].uniq
         runner = CommandRunner.new(execute: true, accept: true)
         roots.map.with_index do |root, index|
           member = members.find { |candidate| candidate.root == root } || Member.new("family", root, nil, nil, nil, [], [], nil, [], [])
-          runner.call(member: member, phase: "mise_trust", command: ["mise", "trust", "-C", root], env: {})
+          trust_argv = adapter.trust_argv(root)
+          unless trust_argv
+            next CommandResult.new(
+              member_name: member.name,
+              phase: "mise_trust",
+              command: [],
+              workdir: root,
+              status: nil,
+              success: true,
+              stdout: "",
+              stderr: "",
+              elapsed_seconds: 0.0,
+              skipped: true,
+              reason: "mise executable not available"
+            )
+          end
+          runner.call(member: member, phase: "mise_trust", command: trust_argv, env: {}, raw: true)
         end
       end
 

data/lib/kettle/family/command_runner.rb

@@ -11,17 +11,7 @@ module Kettle
         "KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE"
       ].freeze
       MISE_SESSION_ENV_PREFIX = "__MISE_"
-      WINDOWS_ENV_EXEC_SCRIPT = <<~RUBY
-        unset_count = Integer(ARGV.shift)
-        unset_count.times { ENV.delete(ARGV.shift) }
-        assignment_count = Integer(ARGV.shift)
-        assignment_count.times do
-          key, value = ARGV.shift.split("=", 2)
-          ENV[key] = value
-        end
-        abort "missing command after environment arguments" if ARGV.shift != "--"
-        exec(*ARGV)
-      RUBY
+      WINDOWS_ENV_EXEC_SCRIPT = MiseAdapter::WINDOWS_ENV_EXEC_SCRIPT
 
       class OtpCoordinator
         def initialize(input: $stdin, output: $stdout, queue_total: nil, secrets_provider: nil, event_handler: nil)
@@ -235,11 +225,12 @@ module Kettle
       end
       private_constant :FailureStatus
 
-      def initialize(execute: false, accept: true, gem_signing_password: nil, otp_coordinator: nil)
+      def initialize(execute: false, accept: true, gem_signing_password: nil, otp_coordinator: nil, mise_adapter: nil)
         @execute = execute
         @accept = accept
         @gem_signing_password = gem_signing_password
         @otp_coordinator = otp_coordinator
+        @mise_adapter = mise_adapter || Kettle::Family.mise_adapter
       end
 
       def call(member:, phase:, command:, env: {}, interactive: false, raw: false, stdout_line_handler: nil, log_path: nil, passthrough_output: true)
@@ -688,31 +679,12 @@ module Kettle
 
         command_env = nonsensitive_env(env)
         unset_env, set_env = command_env.partition { |_key, value| value.nil? }
-        injected_env = [
-          *unset_env.flat_map { |key, _value| ["-u", key.to_s] },
-          *set_env.map { |key, value| "#{key}=#{value}" }
-        ]
-        mise_argv = ["mise", "exec", "-C", member.root, "--"]
-        return [*mise_argv, *argv] if injected_env.empty?
-
-        if Gem.win_platform?
-          return [
-            *mise_argv,
-            "ruby",
-            "--disable=rubyopt",
-            "-e",
-            WINDOWS_ENV_EXEC_SCRIPT,
-            "--",
-            unset_env.length.to_s,
-            *unset_env.map { |key, _value| key.to_s },
-            set_env.length.to_s,
-            *set_env.map { |key, value| "#{key}=#{value}" },
-            "--",
-            *argv
-          ]
-        end
-
-        [*mise_argv, "env", *injected_env, *argv]
+        @mise_adapter.exec_argv(
+          member_root: member.root,
+          argv: argv,
+          unset_env: unset_env.map { |key, _value| key },
+          set_env: set_env.to_h
+        )
       end
 
       def process_env(member:, env:)

data/lib/kettle/family/mise_adapter.rb

@@ -0,0 +1,123 @@
+# frozen_string_literal: true
+
+module Kettle
+  module Family
+    # Adapter seam around the mise binary.
+    #
+    # Mise is operational glue, not a code dependency: family tooling uses it
+    # for `mise trust -C <root>` after materializing managed task files, and
+    # for `mise exec -C <member.root> -- <cmd>` when running member commands
+    # under the member's declared runtime. It is absent in CI and on mise-less
+    # hosts, so every use degrades deliberately:
+    #
+    # - `trust_argv` returns nil when mise is unavailable (callers skip the
+    #   trust phase — it only enables subsequent nested mise runs).
+    # - `exec_argv` passes the command through unwrapped when mise is
+    #   unavailable (there is no member runtime to activate), preserving env
+    #   injection via env(1) (or the portable ruby script on Windows).
+    #
+    # Specs inject a fake or stubbed adapter rather than spawning the real
+    # binary; only these adapter specs exercise the real PATH scan.
+    class MiseAdapter
+      # Portable env-manipulation wrapper used when commands must run with env
+      # changes on Windows (no env(1) there).
+      WINDOWS_ENV_EXEC_SCRIPT = <<~RUBY
+        unset_count = Integer(ARGV.shift)
+        unset_count.times { ENV.delete(ARGV.shift) }
+        assignment_count = Integer(ARGV.shift)
+        assignment_count.times do
+          key, value = ARGV.shift.split("=", 2)
+          ENV[key] = value
+        end
+        abort "missing command after environment arguments" if ARGV.shift != "--"
+        exec(*ARGV)
+      RUBY
+
+      # Absolute path to the mise executable resolved from the current PATH,
+      # or nil when mise is not installed. The absolute path is required for
+      # real spawns: CommandRunner's child env strips the orchestrator's
+      # Ruby/gem bin dirs from PATH, so a bare "mise" argv is unresolvable
+      # whenever the binary lives in one of those directories.
+      #
+      # @return [String, nil]
+      def executable
+        ENV.fetch("PATH", "").split(File::PATH_SEPARATOR).each do |dir|
+          path = File.join(dir, "mise")
+          return path if File.file?(path) && File.executable?(path)
+        end
+        nil
+      end
+
+      # @return [Boolean] whether mise-wrapping and trust are possible
+      def available?
+        !executable.nil?
+      end
+
+      # argv for `mise trust -C <root>`, or nil when mise is unavailable.
+      #
+      # @param root [String]
+      # @return [Array<String>, nil]
+      def trust_argv(root)
+        exe = executable
+        return nil unless exe
+
+        [exe, "trust", "-C", root]
+      end
+
+      # Build the argv for running a member command under the member's
+      # mise-declared runtime. Passes through unwrapped (preserving env
+      # injection) when mise is unavailable.
+      #
+      # @param member_root [String]
+      # @param argv [Array<String>] the normalized command
+      # @param unset_env [Array<String>] env keys to unset in the child
+      # @param set_env [Hash{String => String}] env assignments for the child
+      # @return [Array<String>]
+      def exec_argv(member_root:, argv:, unset_env: [], set_env: {})
+        injected_env = [
+          *unset_env.flat_map { |key| ["-u", key.to_s] },
+          *set_env.map { |key, value| "#{key}=#{value}" }
+        ]
+
+        exe = executable
+        unless exe
+          # No mise executable: there is no member runtime to activate, and a
+          # wrapped spawn would be an unresolvable bare "mise" (ENOENT under
+          # the filtered child PATH). Run unwrapped, preserving env injection.
+          return argv if injected_env.empty?
+
+          return windows_env_argv(unset_env: unset_env, set_env: set_env, argv: argv) if Gem.win_platform?
+
+          return ["env", *injected_env, *argv]
+        end
+
+        mise_argv = [exe, "exec", "-C", member_root, "--"]
+        return [*mise_argv, *argv] if injected_env.empty?
+
+        if Gem.win_platform?
+          return [*mise_argv, *windows_env_argv(unset_env: unset_env, set_env: set_env, argv: argv)]
+        end
+
+        [*mise_argv, "env", *injected_env, *argv]
+      end
+
+      private
+
+      def windows_env_argv(unset_env:, set_env:, argv:)
+        [
+          "ruby",
+          "--disable=rubyopt",
+          "-e",
+          WINDOWS_ENV_EXEC_SCRIPT,
+          "--",
+          unset_env.length.to_s,
+          *unset_env.map { |key| key.to_s },
+          set_env.length.to_s,
+          *set_env.map { |key, value| "#{key}=#{value}" },
+          "--",
+          *argv
+        ]
+      end
+    end
+  end
+end

data/lib/kettle/family/mise_tasks.rb

@@ -9,11 +9,9 @@ module Kettle
     # Slice-1044 family mise tasks primitive: ensure a destination root
     # `mise.toml` references the kettle-family-managed TOML task file via
     # `[task_config] includes`, and report (optionally clean) task
-    # redefinitions between the root file and the managed file.
-    #
-    # Precedence contract (mise): a task defined in the root `mise.toml` wins
-    # over the same name from a task file. Redefinition is therefore allowed
-    # and only reported; `clean` is always opt-in.
+    # redefinitions between the root file and the managed file. Family
+    # refreshes migrate managed task names out of the root so old commands
+    # cannot shadow generated fixes. Other tasks and settings remain local.
     #
     # All edits go through ast-crispr Actors with the ast-crispr-toml adapter.
     module MiseTasks
@@ -168,7 +166,7 @@ module Kettle
       end
 
       # Remove duplicate task definitions from the root mise.toml.
-      # Opt-in (`--clean`); never runs implicitly.
+      # Used by family refreshes and the explicit non-family `--clean` path.
       #
       # @param root_content [String] the destination's mise.toml content
       # @param task_file_content [String] managed task file content
@@ -180,10 +178,11 @@ module Kettle
         redefs.each do |name|
           # A task can be defined as a `[tasks.<name>]` table block or as a
           # trivial `name = "…"` pair inside `[tasks]`; try both owners.
-          [
-            TomlSelectors.table(path: "tasks.#{name}"),
-            TomlSelectors.pair(path: "tasks.#{name}")
-          ].each do |target|
+          tables = document_context(content).structural_owners(owner_scope: :tables)
+          paths = tables.map(&:name).select { |path| path == "tasks.#{name}" || path.start_with?("tasks.#{name}.") }
+          targets = paths.reverse.map { |path| TomlSelectors.table(path: path) }
+          targets << TomlSelectors.pair(path: "tasks.#{name}")
+          targets.each do |target|
             result = Ast::Crispr::Delete.result(
               content: content,
               target: target,
@@ -261,6 +260,16 @@ module Kettle
           end
 
           pairs = table.wrapper.pairs
+          if pairs.any? { |pair| pair.key_name.to_s == "includes" }
+            entries = includes_entries(context) + [task_file_name]
+            result = Ast::Crispr::Replace.result(
+              content: content,
+              target: TomlSelectors.pair(path: "task_config.includes"),
+              replacement: "includes = [#{entries.map(&:inspect).join(", ")}]\n",
+              source_label: "mise.toml"
+            )
+            return fail_or(result)
+          end
           result =
             if pairs.empty?
               Ast::Crispr::Replace.result(
@@ -295,31 +304,30 @@ module Kettle
       # .kettle-family.yml).
       #
       # @param context [Hash] kettle-jem plugin context (:project_root)
-      def self.materialize_managed_suite(context:)
+      def self.materialize_managed_suite(context:, task_file_name: DEFAULT_TASK_FILE_NAME, **options)
         root = context[:project_root].to_s
         return if root.empty?
 
         root = File.expand_path(root)
         return unless File.file?(File.join(root, ".kettle-family.yml"))
 
+        root_mise = File.join(root, "mise.toml")
+        return unless File.file?(root_mise)
+
         config = Config.load(root: root)
         content = ManagedSuite.new(config).content
         content += "\n" unless content.end_with?("\n")
 
-        task_file_path = File.join(root, DEFAULT_TASK_FILE_NAME)
-        File.write(task_file_path, content) unless File.exist?(task_file_path) && File.read(task_file_path) == content
-
-        root_mise = File.join(root, "mise.toml")
-        return unless File.file?(root_mise)
-
-        result = ensure_include(
-          root_content: File.read(root_mise),
-          task_file_name: DEFAULT_TASK_FILE_NAME,
+        task_file_path = File.join(root, task_file_name)
+        original = File.read(root_mise)
+        included = ensure_include(root_content: original, task_file_name: task_file_name)
+        result = clean_redefinitions(
+          root_content: included.content,
+          task_file_name: task_file_name,
           task_file_content: content
         )
-        File.write(root_mise, result.content) if result.changed
-      rescue Error, SystemCallError => e
-        warn("kettle-family: could not materialize managed mise tasks: #{e.class}: #{e.message}")
+        File.write(task_file_path, content) unless File.exist?(task_file_path) && File.read(task_file_path) == content
+        File.write(root_mise, result.content) unless result.content == original
       end
 
       # Comprehensive managed family mise task suite, generated from family
@@ -352,16 +360,25 @@ module Kettle
         def content
           tasks = {
             "test" => "bundle exec kettle-family test --execute",
-            "lint" => "bundle exec kettle-family lint",
+            "lint" => "bundle exec kettle-family lint --execute",
             "state" => "bundle exec kettle-family release-state",
             "release-state" => "bundle exec kettle-family release-state",
-            "template" => "bundle exec kettle-family template",
+            "template" => "bundle exec kettle-family template --execute",
             "bump" => "bundle exec kettle-family bump --execute",
             # Targeting is resolved by kettle-family from the family config:
             # shared-changelog families write the root changelog, member-local
             # families write each member's own.
             "changelog" => "bundle exec kettle-family add-changelog --execute"
           }
+          %w[install docs clean-unreleased gha-sha-pins bex branch-lanes discover metadata report pull push up sync reset mise-trust reconcile-releases].each do |command|
+            name = {"clean-unreleased" => "clean", "gha-sha-pins" => "pins"}.fetch(command, command)
+            flags = %w[branch-lanes discover metadata report mise-trust].include?(command) ? "" : " --execute"
+            flags += " --upgrade major" if name == "pins"
+            tasks[name] = "bundle exec kettle-family #{command}#{flags}"
+          end
+          tasks["readiness"] = "bundle exec kettle-family check --execute"
+          tasks["deps"] = "bundle exec kettle-family bup --execute --no-commit"
+          tasks["lint-fix"] = "bundle exec kettle-family bex --execute --no-commit -- bin/rake rubocop_gradual:autocorrect"
           tasks["bup"] = "bundle exec kettle-family bup --execute --commit"
           tasks["bupb"] = "bundle exec kettle-family update-bundler --execute --commit"
           tasks["update-bundler"] = tasks["bupb"]
@@ -369,7 +386,7 @@ module Kettle
           neutral = neutralize_assignments
           wiring = env_wiring_flags
           %w[bup bupb].each do |name|
-            prefix = neutral.empty? ? "" : "env #{neutral} -- "
+            prefix = neutral.empty? ? "" : "env -- #{neutral} "
             tasks[name] = "#{prefix}#{tasks[name]}#{wiring}"
           end
           tasks["update-bundler"] = tasks["bupb"]
@@ -422,11 +439,13 @@ module Kettle
             #
             # Family-specific tasks (for example a release task with the
             # family's publish flags and secrets provider) belong in the root
-            # mise.toml, where they shadow the managed definitions.
+            # mise.toml. Standard task names are managed here and migrated out
+            # of that file during refreshes.
           HEADER
+          out << "\n[check]\ndescription = \"Run readiness, lint, and tests\"\ndepends = [\"readiness\", \"lint\", \"test\"]\nrun = \"true\"\n"
           tasks.each do |name, run|
             out << "\n[#{name}]\n"
-            out << "description = #{TASK_DESCRIPTIONS.fetch(name).inspect}\n"
+            out << "description = #{TASK_DESCRIPTIONS.fetch(name) { "Run family #{name}" }.inspect}\n"
             out << "raw = true\n"
             out << "run = #{run.inspect}\n"
           end

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.3.28"
+      VERSION = "1.3.30"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -109,7 +109,7 @@ module Kettle
       REGISTRY_WAIT_INTERVAL_SECONDS = 15
       TEMPLATE_GEMSPEC_RETRY_DELAY_SECONDS = 0.25
 
-      def initialize(command:, config:, members:, family_members: nil, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, template_cleanup: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, fast_recovery: nil, fast_recovery_members: nil, skip_ci: false, skip_changelog: false, skip_appraisals: false, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, validate_ci_bundles: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, template_branch_selection: {}, release_state_results: nil, event_tape: nil, **options)
+      def initialize(command:, config:, members:, family_members: nil, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, template_cleanup: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, fast_recovery: nil, fast_recovery_members: nil, skip_ci: false, skip_changelog: false, skip_appraisals: false, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, validate_ci_bundles: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, template_branch_selection: {}, release_state_results: nil, event_tape: nil, mise_adapter: nil, **options)
         @command = command
         @config = config
         @members = members
@@ -156,6 +156,7 @@ module Kettle
         @verbose = verbose
         @gem_signing_password = gem_signing_password
         @secrets_provider = secrets_provider || Secrets::Provider.new
+        @mise_adapter = mise_adapter || Kettle::Family.mise_adapter
         @jobs = jobs
         @progress_io = progress_io
         @reset_target = reset_target
@@ -256,7 +257,30 @@ module Kettle
           runner: runner,
           preserve_members: template_cleanup ? [] : failed_members
         )
-        checkout_preflight + sync_results + workflow_results + rollback_results + restore_results
+        results = checkout_preflight + sync_results + workflow_results + rollback_results + restore_results
+        if results.all?(&:ok?)
+          MiseTasks.materialize_managed_suite(context: {project_root: config.root})
+          # `mise trust` requires the mise executable; spec environments and
+          # minimal CI images may not have it installed. Trust is only an
+          # enabler for subsequent nested mise runs, so skip when absent.
+          trust_argv = @mise_adapter.trust_argv(config.root)
+          if trust_argv && File.file?(File.join(config.root, "mise.toml"))
+            results << runner.call(
+              member: family_member, phase: "family_mise_trust",
+              command: trust_argv, raw: true
+            )
+          end
+          if results.all?(&:ok?) && family_root_bundle_commit? && File.file?(File.join(config.root, "mise.toml"))
+            results << runner.call(
+              member: family_member,
+              phase: "commit_family_mise_tasks",
+              command: ["sh", "-lc", "files=$(git ls-files --modified --others --exclude-standard -- mise.toml mise-family.tasks.toml); " \
+                "if [ -n \"$files\" ]; then git add -- mise.toml mise-family.tasks.toml && " \
+                "git commit --only -m '🔧 Refresh managed family mise tasks' -- mise.toml mise-family.tasks.toml; fi"]
+            )
+          end
+        end
+        results
       end
 
       def template_worktree_sync_results(runner:)
@@ -535,10 +559,18 @@ module Kettle
           return results unless results.all?(&:ok?)
 
           results.concat(release_member_results(workflow_members, include_family_changelog: !skip_changelog))
-          return results unless !execute && explicit_monorepo_mode? && results.all?(&:ok?)
-
+          return results unless explicit_monorepo_mode? && results.all?(&:ok?)
+
+          # Per-member appends during finalization only cover members published
+          # in THIS run. A resumed wave selects only the unpublished remainder,
+          # so the closing aggregate must always span the full shared-version
+          # cohort to contribute artifacts published by earlier interrupted
+          # waves. Existing assets are skipped by kettle-gh-release, so the
+          # full-cohort pass is cheap on a complete wave.
           selected_aggregate_members = aggregate_release_members(workflow_members)
-          results << aggregate_monorepo_github_release(aggregate_github_release_members) unless selected_aggregate_members.empty?
+          if selected_aggregate_members.any? && (!execute || publish)
+            results << aggregate_monorepo_github_release(aggregate_github_release_members)
+          end
           return results
         end
         return git_sync_results(workflow_members) if GIT_SYNC_COMMANDS.key?(command)
@@ -548,7 +580,7 @@ module Kettle
 
       def reset_member_results(workflow_members)
         target = normalized_reset_target
-        runner = CommandRunner.new(execute: execute, accept: accept)
+        runner = CommandRunner.new(execute: execute, accept: accept, mise_adapter: @mise_adapter)
         workflow_members.each_with_object([]) do |member, memo|
           case target
           when "Gemfile.lock"
@@ -575,7 +607,7 @@ module Kettle
         return template_member_workflow_results(workflow_members) if command == "template" && execute
         return test_member_workflow_results(workflow_members) if command == "test" && execute
 
-        runner = CommandRunner.new(execute: execute, accept: accept)
+        runner = CommandRunner.new(execute: execute, accept: accept, mise_adapter: @mise_adapter)
         results = []
         update_family_root_bundle(runner: runner, memo: results) if %w[bup bupb update-bundler].include?(command)
         return results unless results.all?(&:ok?)
@@ -682,7 +714,7 @@ module Kettle
 
         Array.new(wave_jobs) do
           Thread.new do # rubocop:disable ThreadSafety/NewThread -- sibling test suites run in isolated project roots.
-            runner = CommandRunner.new(execute: execute, accept: accept)
+            runner = CommandRunner.new(execute: execute, accept: accept, mise_adapter: @mise_adapter)
             loop do
               break if mutex.synchronize { stop }
 
@@ -796,7 +828,7 @@ module Kettle
 
               index, entry = queue.pop(true)
               member = entry.fetch(:member)
-              result = CommandRunner.new(execute: execute, accept: accept).call(
+              result = CommandRunner.new(execute: execute, accept: accept, mise_adapter: @mise_adapter).call(
                 member: member,
                 phase: command,
                 command: workflow_command(member),
@@ -1437,7 +1469,7 @@ module Kettle
         end
 
         bootstrap = NomonoBootstrap.new(latest_version: latest_nomono_version, mode: :execute)
-        runner = CommandRunner.new(execute: execute, accept: accept)
+        runner = CommandRunner.new(execute: execute, accept: accept, mise_adapter: @mise_adapter)
         candidate_members.each_with_object([]) do |member, memo|
           next unless bootstrap.member_needs_bootstrap?(member)
 
@@ -1517,7 +1549,7 @@ module Kettle
         progress_key ||= member.name
         progress_label ||= member.name
         start_template_member_progress(progress, member, progress_key: progress_key, progress_label: progress_label) unless progress_started
-        runner = CommandRunner.new(execute: execute, accept: accept)
+        runner = CommandRunner.new(execute: execute, accept: accept, mise_adapter: @mise_adapter)
         [].tap do |memo|
           if config.normalize_lockfiles?
             normalize_lockfiles(member: member, runner: runner, memo: memo, phase: "prepare_lockfiles", commit_changes: commit_changes)
@@ -1738,16 +1770,20 @@ module Kettle
       # tracks trust by config path. Trust every active config between the
       # worktree root and the member command directory before invoking a
       # command there. This bootstrap must run raw: wrapping it in `mise exec`
-      # would require the trust it is establishing.
+      # would require the trust it is establishing. Roots are skipped when the
+      # mise executable is unavailable (mise is operational glue, absent in CI).
       def worktree_mise_trust_results(entry, runner:, phase:)
         member = entry.fetch(:member)
         original_member = entry.fetch(:original_member, member)
         worktree_root = entry.fetch(:worktree_root)
-        mise_config_roots_in_worktree(worktree_root, member.root).map do |root|
+        mise_config_roots_in_worktree(worktree_root, member.root).filter_map do |root|
+          trust_argv = @mise_adapter.trust_argv(root)
+          next unless trust_argv
+
           result = runner.call(
             member: member,
             phase: phase,
-            command: ["mise", "trust", "-C", root],
+            command: trust_argv,
             raw: true
           )
           result.member_name = original_member.name
@@ -2693,7 +2729,7 @@ module Kettle
       end
 
       def command_runner
-        CommandRunner.new(execute: execute, accept: accept, gem_signing_password: @gem_signing_password)
+        CommandRunner.new(execute: execute, accept: accept, gem_signing_password: @gem_signing_password, mise_adapter: @mise_adapter)
       end
 
       def release_command_runner
@@ -2704,7 +2740,8 @@ module Kettle
           # RubyGems MFA belongs to the child release command. Keeping an OTP
           # coordinator here can make a family-level gem retry look successful
           # while skipping the child's checksums and GitHub release steps.
-          otp_coordinator: nil
+          otp_coordinator: nil,
+          mise_adapter: @mise_adapter
         )
       end
 

data/lib/kettle/family.rb

@@ -3,6 +3,7 @@
 require_relative "family/member"
 require_relative "family/command_result"
 require_relative "family/release_state_result"
+require_relative "family/mise_adapter"
 require_relative "family/command_runner"
 require_relative "family/readiness_check"
 require_relative "family/published_version_check"
@@ -43,6 +44,25 @@ module Kettle
   module Family
     class Error < StandardError; end
 
+    # Default MiseAdapter for the whole family stack. CommandRunner, Workflow,
+    # and CLI use this when no adapter is injected; specs swap it to control
+    # mise availability without spawning the real binary (mise is operational
+    # glue, absent in CI).
+    #
+    # @return [MiseAdapter]
+    # rubocop:disable ThreadSafety/ClassInstanceVariable
+    def self.mise_adapter
+      @mise_adapter ||= MiseAdapter.new
+    end
+    # rubocop:enable ThreadSafety/ClassInstanceVariable
+
+    # @param adapter [MiseAdapter]
+    # rubocop:disable ThreadSafety/ClassInstanceVariable
+    def self.mise_adapter=(adapter)
+      @mise_adapter = adapter
+    end
+    # rubocop:enable ThreadSafety/ClassInstanceVariable
+
     # kettle-jem plugin registration (kettle-jem-appraisals pattern). The gem
     # name "kettle-family" resolves to this module as the plugin handle, and
     # kettle-jem calls +register_kettle_jem_plugin(registrar)+ on it when the

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.3.28
+  version: 1.3.30
 platform: ruby
 authors:
 - Peter H. Boling
@@ -134,7 +134,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.20
+        version: 3.1.23
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -144,7 +144,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.20
+        version: 3.1.23
 - !ruby/object:Gem::Dependency
   name: kettle-gha-pins
   requirement: !ruby/object:Gem::Requirement
@@ -537,6 +537,7 @@ files:
 - lib/kettle/family/local_install.rb
 - lib/kettle/family/member.rb
 - lib/kettle/family/member_loader.rb
+- lib/kettle/family/mise_adapter.rb
 - lib/kettle/family/mise_tasks.rb
 - lib/kettle/family/nomono_bootstrap.rb
 - lib/kettle/family/orderer.rb
@@ -567,10 +568,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.3.28
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.3.28/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.3.30
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.3.30/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.3.28
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.3.30
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family