kettle-family 1.3.4 → 1.3.6

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 99e6506531c29efe6259ee3f592eb50d654eeef9f7074a1179f4f61960d7efdd
-  data.tar.gz: d3424e4481d1ced32dbb89228de517e3a0adf30a099883879c16fbb9f6feec8e
+  metadata.gz: 8d912f3b7a33740ace19f7f0568177189b662819bec18bf94312de460f640fd9
+  data.tar.gz: d70a03c67ed0a96ce645d00ff769a920b500b3d1d3b231324a2d8170ea683cf1
 SHA512:
-  metadata.gz: dfe9f450d1c65671d3599bfe3625952dc7106cfbfe896960bc236d0df04c033dd73116a94b49b5dba82502022ff503339e7a1457ff6c507888df0736489b5dd7
-  data.tar.gz: 4fc7889e44bd08e673899b0f3ea040ecec5129e4b90ef2ef166f11c51de0e4a05c2066036a8a600bf9dc9e35fd495f95ac60f603799709ec08e0e74522f22ef8
+  metadata.gz: ca24fe1d3dff219117a561ecd8ff6d45edd6c1a4d4fb6db9172c874f8964676162747de8d3d45fa0caf1aa7707ec2733141eda5a993bbbcbc8d0fd81d5f8543c
+  data.tar.gz: b3f48464d35121fdee21d6d23158e81630ac373676a6581d876f2887e735cc60d5cb70c4a87359090b124a56707b544d13dd1b30f5745ecf93ef81775eb03bed

data/CHANGELOG.md

@@ -30,6 +30,64 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.3.6] - 2026-10-07
+
+- TAG: [v1.3.6][1.3.6t]
+- COVERAGE: 93.25% -- 6743/7231 lines in 38 files
+- BRANCH COVERAGE: 77.82% -- 2740/3521 branches in 38 files
+- 34.02% documented
+
+### Added
+
+- [kc] published-version-check: `Kettle::Family::PublishedVersionCheck` detects lockfile pins that no registry serves — the signature of a locally built and installed gem leaking into a lockfile. Bundler resolves against the local gem dir, so an ordinary `bundle install` can pin such a version, and the entry it writes is a normal GEM-section line carrying a valid checksum taken from the installed spec, so nothing in the lockfile text distinguishes it and there is no offline marker either (installed specs look the same as fetched ones, and `Gem::Specification` has no `#remote`). Only asking the registry can tell. A pinned native gem is compared after splitting off its platform suffix, because a lockfile pins `nokogiri (1.19.4-x86_64-linux-gnu)` while the registry lists bare `1.19.4` once per platform; comparing the pinned string directly reported every native gem as unpublished, adding 10 false positives to one real lockfile. Prerelease versions are unaffected because they are dot-separated (`1.0.0.rc1`) and RubyGems version strings cannot contain a hyphen, so the first hyphen is always the version/platform boundary. Runs in `bup`/`bupb`/`update-bundler` before committing a lockfile update, and in release preflight, where a bad pin previously surfaced much later as an opaque bundler error during lockfile reset.
+
+- [kc] published-version-memo: The published-version check fails open: when a registry cannot be consulted the version counts as unverifiable rather than unpublished, so a registry outage cannot turn every family member into a false failure. Registry answers are memoized per process keyed by gem, remote and version, so members sharing toolchain and sibling dependencies query the registry once for the whole run rather than once each. The memo is subordinate to the on-disk release marker that `kettle-release` writes after confirming a gem is available: a gem published during the current run is always re-queried rather than answered from a pre-publish memo entry, which would otherwise report the just-published version as unpublished and block a legitimate release.
+
+- [kc] dependency-floor-published-version-gate: `kettle-family release` now gates the "Reconcile family dependencies" commit on the lockfile it is about to record. The preceding `bundle install` resolves against the local gem dir, so it can pin a locally built and installed version, and committing that produces a lockfile no isolated environment can resolve. The failure previously surfaced much later as an opaque bundler error during release lockfile reset ("Your bundle is locked to kettle-jem (7.1.29) ... but that version can no longer be found") rather than at the moment the bad pin was introduced; observed live, a release run's own reconcile commit flipped kettle-jem 7.1.28 to 7.1.29 in the tracked `Gemfile.lock` and then aborted at step 0. The existing floor diagnostics do not catch this, because they validate checksums only for released family members, while the pins that break resolution are typically toolchain dependencies that are not members at all and carry a valid checksum. Gems published during the same run are not blocked, since the check consults the on-disk release marker ahead of its process memo.
+
+### Fixed
+
+- [kc] clean-unreleased-batch: `kettle-family clean-unreleased` now removes every unreleased installed version across the family in a single `gem uninstall` invocation instead of one invocation per gem. This is not merely fewer processes: RubyGems' `uninstall_specific` builds a `Gem::DependencyList` from every requested gem and removes them via `strongly_connected_components.flatten.reverse`, a topological sort of the whole set that removes dependents before their dependencies. A per-gem invocation sees only one gem and cannot sort, so it raises `Gem::DependencyRemovalException` ("Uninstallation aborted due to dependent gem(s)") whenever another installed gem still depends on it. Because family members are interdependent and the release order is dependency order, per-gem removal failed on the foundations: observed live, removing tree_haver first failed while ast-merge still required it, and four repeated passes still left two gems installed. One batched invocation removed both. Versions are passed as `name:version` arguments since RubyGems rejects `--version` alongside multiple gems, and `--all` is deliberately omitted because with gem arguments it is redundant while with none it means `uninstall_all`, which would remove every gem in the gem home.
+
+- [kc] clean-unreleased-source-checkouts: `kettle-family clean-unreleased` no longer reports source checkouts as unreleased installed gems. Under `bundle exec`, bundler adds PATH and git sources to the load path, so `Gem::Specification.find_all_by_name` also returns specs whose `full_gem_path` points at a working copy rather than a gem home — for example tree_haver 7.1.10 resolving to `gems/tree_haver`. Those are not installed gems and `gem uninstall` cannot remove them, so the command reported work that could never succeed; after uninstalling all 31 genuinely installed unreleased gems in the structuredmerge family, it still listed all 31. Candidates are now filtered to specs under `Gem.path`.
+
+## [1.3.5] - 2026-10-05
+
+- TAG: [v1.3.5][1.3.5t]
+- COVERAGE: 93.16% -- 6636/7123 lines in 37 files
+- BRANCH COVERAGE: 77.64% -- 2701/3479 branches in 37 files
+- 33.64% documented
+
+### Added
+
+- `Kettle::Family::ReleaseStateCheck` accepts a `branches:` scope, and `Kettle::Family::Selection.branches_matching` reports which of a member branch stack currently satisfies a release-state token. Both are the seams for per-branch release and bump decisions.
+
+### Changed
+
+- A blocked release now reports phase `release_blocked` instead of `release_skip`, so a hard failure is never reported as a skipped member in the progress summary or report.
+
+- [kc] kettle-jem/prepare: updated 12 project files:
+  - dependencies (12)
+
+- [kc] kettle-jem/template: updated 6 project files:
+  - code and tests (1)
+  - dependencies (1)
+  - documentation (1)
+  - other (2)
+  - workflows (1)
+
+### Fixed
+
+- Already-released detection for branch-stack members is now scoped to the branch being released instead of the whole stack, so a clean published branch is no longer reported as having unreleased changes and blocked with a release_skip failure.
+
+- A published version whose release tag is followed only by post-release maintenance commits (checksums, dependency-floor lockfile reconciliation) is now skipped as already released; only changes to the gemspec, version file, or changelog after the tag make the published version stale.
+
+- Release-state status-token selection (`--only unreleased|prepared|pending|bump`) no longer collapses a branch-stack member to whichever branch happened to be evaluated last; a member is selected when any of its branches matches, and multiple tokens are still ANDed within a single branch.
+
+- `kettle-family bump` now bumps each branch of a member branch stack independently: branches with no pending version bump are reported as skipped instead of being bumped, so an already-released branch is no longer given version bumps it never needed. An explicit `--only MEMBER` remains an unconditional request and is not filtered.
+
+- Release-state worktrees orphaned by a killed run are reaped on the next run. Directories are named `worktree-PID-RANDOM`, so only those whose owning PID is no longer running are removed; live worktrees from concurrent runs are left alone.
+
 ## [1.3.4] - 2026-10-02
 
 - TAG: [v1.3.4][1.3.4t]
@@ -2847,7 +2905,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.4...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.3.6...HEAD
+[1.3.6]: https://github.com/kettle-dev/kettle-family/compare/v1.3.5...v1.3.6
+[1.3.6t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.6
+[1.3.5]: https://github.com/kettle-dev/kettle-family/compare/v1.3.4...v1.3.5
+[1.3.5t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.5
 [1.3.4]: https://github.com/kettle-dev/kettle-family/compare/v1.3.3...v1.3.4
 [1.3.4t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.3.4
 [1.3.3]: https://github.com/kettle-dev/kettle-family/compare/v1.3.2...v1.3.3

data/README.md

@@ -1192,7 +1192,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-7.046-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-7.231-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/cli.rb

@@ -28,6 +28,16 @@ module Kettle
         main(argv, stdout: out, stderr: err)
       end
 
+      # Defined as a singleton method above the `private` keyword: a `private`
+      # instance modifier does not apply to `def self.` definitions.
+      def self.default_only_filter(command:, only:)
+        return only unless only.to_s.empty?
+        return "bump" if %w[bump bump-version].include?(command)
+        return "pending" if command == "release"
+
+        only
+      end
+
       module SharedOptions
         def self.included(base)
           base.option :root, value: {type: String, usage: "PATH"}, desc: "Workspace or family root"
@@ -188,7 +198,12 @@ module Kettle
         end
 
         def run_family(command, overrides = {})
-          Kettle::Family::CLI.new(stdout: stdout, stderr: stderr).run_command(command, family_options(overrides))
+          effective = family_options(overrides)
+          # Thread the *effective* --only (including the command's default
+          # release-state token) downstream so per-branch logic sees the same
+          # selection the member selector used.
+          effective[:only] = Kettle::Family::CLI.default_only_filter(command: command, only: effective[:only])
+          Kettle::Family::CLI.new(stdout: stdout, stderr: stderr).run_command(command, effective)
         end
 
         def truthy_option?(name)
@@ -822,11 +837,7 @@ module Kettle
       end
 
       def default_only_filter(command:, only:)
-        return only unless only.to_s.empty?
-        return "bump" if %w[bump bump-version].include?(command)
-        return "pending" if command == "release"
-
-        only
+        self.class.default_only_filter(command: command, only: only)
       end
 
       def direct_member_only_names(only)
@@ -1122,6 +1133,17 @@ module Kettle
             memo.last.branch = branch
             break unless memo.last.ok?
 
+            if (skipped = branch_bump_skip_result(
+              member: member,
+              branch: branch,
+              command: command,
+              options: options,
+              release_state_results: release_state_results
+            ))
+              memo << skipped
+              next
+            end
+
             branch_members = rediscovered_selected_members(config: member_config, selected_names: [member.name], command: command)
             branch_members = [member] if branch_members.empty?
             branch_results = command_results_for_current_branch(
@@ -1140,6 +1162,41 @@ module Kettle
         end
       end
 
+      BUMP_COMMANDS = %w[bump bump-version].freeze
+
+      # Bumping a whole branch stack must be per-branch: a branch already
+      # released with nothing pending has nothing to bump. `--only bump` is a
+      # status-driven selection, so it is filtered by each branch's own
+      # release-state. An explicit `--only MEMBER` is a direct request and is
+      # honored as given.
+      def branch_bump_skip_result(member:, branch:, command:, options:, release_state_results:)
+        return unless BUMP_COMMANDS.include?(command)
+        return unless status_token_only?(options[:only])
+
+        matching = Selection.branches_matching(release_state_results, member_name: member.name, tokens: %w[bump])
+        return if matching.empty? || matching.include?(branch)
+
+        CommandResult.new(
+          member_name: member.name,
+          phase: command,
+          command: ["internal", "branch-bump-skip", branch],
+          workdir: member.root,
+          status: 0,
+          success: true,
+          stdout: "#{member.name}@#{branch} has no unreleased entries at its released version; skipping bump on this branch",
+          stderr: "",
+          elapsed_seconds: 0.0,
+          skipped: true,
+          reason: "no version bump pending on #{branch}",
+          branch: branch
+        )
+      end
+
+      def status_token_only?(only)
+        names = only.to_s.split(",").map(&:strip).reject(&:empty?)
+        !names.empty? && names.all? { |name| Selection.status_token?(name) }
+      end
+
       def rediscovered_selected_members(config:, selected_names:, command:)
         discovered = Discovery.new(config: config).members
         ordered = (command == "install") ? install_order(discovered, config) : Orderer.new(members: discovered, mode: config.order_mode, hints: config.order_hints).ordered

data/lib/kettle/family/published_version_check.rb

@@ -0,0 +1,165 @@
+# frozen_string_literal: true
+
+require "kettle/dev/lockfile_reset"
+require "kettle/dev/ruby_gems_versions"
+
+module Kettle
+  module Family
+    # Detects versions pinned in a release lockfile that no registry actually
+    # serves — the signature of a locally built and installed gem leaking into
+    # a lockfile.
+    #
+    # Why this is needed at all: bundler resolves against the local gem dir, so
+    # an ordinary `bundle install` will happily pin a locally installed version.
+    # The resulting entry is a normal GEM-section line carrying a valid checksum
+    # taken from the installed spec, so it is indistinguishable from a published
+    # gem by inspection. There is also no offline marker for a local build —
+    # installed specs look the same as fetched ones, and Gem::Specification has
+    # no #remote — so the only reliable signal is asking the registry.
+    #
+    # Deliberately NOT applied to templating. Templating injects its own
+    # (often unreleased) version into a destination so it can run itself, and
+    # local templating from unreleased source is a routine workflow; gating that
+    # would break it. So this runs only where a lockfile is about to be
+    # committed or published, and templating's transient local pins get cleaned
+    # up later by a release-mode dependency update.
+    #
+    # Fails open: when the registry cannot be consulted the version counts as
+    # unverifiable rather than unpublished, so offline runs are never blocked by
+    # network conditions.
+    class PublishedVersionCheck
+      PHASE = "published_version_check"
+
+      # Process-local memo of registry answers, keyed by [gem name, remote].
+      #
+      # Two reasons this is safe and desirable:
+      #
+      #   * Family members share almost all their toolchain and sibling
+      #     dependencies, so one member's lookups serve every later member.
+      #     Without this, a 30-member release re-queries the same gems 30
+      #     times.
+      #   * A single command invocation should see one consistent snapshot of
+      #     the registry. Re-querying per member could otherwise report a gem
+      #     as unpublished for early members and published for later ones if it
+      #     lands mid-run.
+      #
+      # The memo is subordinate to the on-disk release marker, never above it.
+      # kettle-release writes ~/.local/state/kettle-dev/rubygems-cache-bust.json
+      # after publishing, so the filesystem is the authority on what this
+      # machine just released. A gem published *during* the current run — say
+      # kettle-dev 3.1.8, released before its dependents' floors are raised to
+      # it — would otherwise be answered from a pre-publish memo entry and
+      # falsely reported unpublished, blocking a legitimate release. So
+      # #published_versions always consults the marker first and skips the memo
+      # when it says that exact gem+version was just released. Verified: a
+      # pre-publish memo entry yields 0 live queries without the marker check
+      # and reports the new version missing.
+      #
+      # nil is memoized too, so an unreachable registry is asked once rather
+      # than once per pin. Lifetime is one process; nothing persists.
+      REGISTRY_MEMO = {}
+
+      def self.call(member:)
+        new(member: member).call
+      end
+
+      def initialize(member:)
+        @member = member
+      end
+
+      def call
+        result(diagnostics)
+      end
+
+      private
+
+      attr_reader :member
+
+      def diagnostics
+        lockfile = File.join(member.root, "Gemfile.lock")
+        return [] unless File.file?(lockfile)
+
+        registry_lockfile_specs(lockfile).filter_map { |spec| diagnostic_for(spec) }
+      end
+
+      def registry_lockfile_specs(lockfile)
+        Kettle::Dev::LockfileReset.registry_gem_specs_from_source(File.read(lockfile))
+      end
+
+      # A message for an unpublished pin, or nil when the version is published
+      # or the registry could not be consulted.
+      def diagnostic_for(spec)
+        return nil unless unpublished?(spec)
+
+        "release lockfile pins #{spec.fetch(:name)} #{spec.fetch(:version)}, " \
+          "which is not published on #{spec.fetch(:remote)} " \
+          "(locally installed but unreleased; run a release-mode dependency update to re-resolve)"
+      end
+
+      def unpublished?(spec)
+        remote = spec.fetch(:remote).to_s
+        return false if remote.empty?
+
+        pinned = version_without_platform(spec.fetch(:version))
+        versions = published_versions(spec.fetch(:name), remote, pinned)
+        return false if versions.nil?
+
+        !versions.include?(pinned)
+      end
+
+      # A lockfile pins a native gem as "1.19.4-x86_64-linux-gnu" while the
+      # registry lists its versions as bare "1.19.4", one entry per platform.
+      # Comparing the pinned string directly would report every native gem as
+      # unpublished, so split off the platform first.
+      #
+      # Splitting on the first "-" matches Bundler::LockfileParser. It is safe
+      # because RubyGems version strings cannot themselves contain a hyphen
+      # (prerelease segments are dot-separated, e.g. "1.0.0.rc1"), so the first
+      # hyphen is always the version/platform boundary.
+      def version_without_platform(pinned)
+        pinned.to_s.split("-", 2).first
+      end
+
+      # nil when the registry could not be consulted. Memoized per process,
+      # except for gems the on-disk release marker says were just published —
+      # see REGISTRY_MEMO for why bypassing the memo there is required.
+      def published_versions(name, remote, version)
+        key = [name, remote, version]
+        unless just_released?(name, version)
+          return REGISTRY_MEMO[key] if REGISTRY_MEMO.key?(key)
+        end
+
+        REGISTRY_MEMO[key] = Kettle::Dev::RubyGemsVersions.published_version_numbers(
+          name,
+          source: remote,
+          version: version
+        )
+      end
+
+      def just_released?(name, version)
+        return false if version.to_s.empty?
+
+        Kettle::Dev::RubyGemsVersions.recently_released?(name, version)
+      rescue
+        false
+      end
+
+      def result(found)
+        clean = found.empty?
+        CommandResult.new(
+          member_name: member.name,
+          phase: PHASE,
+          command: ["internal", PHASE],
+          workdir: member.root,
+          status: clean ? 0 : 1,
+          success: clean,
+          stdout: found.join("\n"),
+          stderr: "",
+          elapsed_seconds: 0.0,
+          skipped: false,
+          reason: clean ? nil : "lockfile pins versions no registry serves"
+        )
+      end
+    end
+  end
+end

data/lib/kettle/family/release_state_check.rb

@@ -25,10 +25,16 @@ module Kettle
       CACHE_MISS = Object.new.freeze
       WORKTREE_ADMIN_MUTEX = Mutex.new
 
-      def initialize(members:, config: nil, jobs: nil)
+      # +branches+ scopes the check to specific release target branches. A
+      # branch-stack member produces one result per branch; a per-branch
+      # decision (is this branch already published? does it need a bump?) must
+      # never consult the whole stack, or every branch inherits the state of
+      # the branch that happens to have unreleased entries.
+      def initialize(members:, config: nil, jobs: nil, branches: nil)
         @members = members
         @config = config
         @jobs = jobs
+        @branches = branches&.map(&:to_s)&.reject(&:empty?)
         @github_latest_release_by_repo = {}
         @transfer_changelog_status_by_root = {}
         @transfer_changelog_lag_by_key = {}
@@ -38,6 +44,7 @@ module Kettle
       end
 
       def results(event_handler: nil)
+        return scoped_checkout_results(event_handler: event_handler) if checked_out_scoped_results?
         return branch_results(event_handler: event_handler) unless release_target_branches.empty?
         if shared_changelog?
           results = parallel_map(members) { |member| check_shared_changelog_member_or_local(member, event_handler: event_handler) }
@@ -53,7 +60,25 @@ module Kettle
 
       private
 
-      attr_reader :members, :config, :jobs
+      attr_reader :members, :config, :jobs, :branches
+
+      # A single-branch scope whose checkout already sits on that branch needs
+      # no worktree: the primary checkout is the branch under test.
+      def checked_out_scoped_results?
+        return false unless branches&.one?
+
+        members.any? { |member| current_branch_for(member) == branches.first }
+      end
+
+      def scoped_checkout_results(event_handler: nil)
+        branch = branches.first
+        results = parallel_map(members) { |member| check_member(member, branch: branch, event_handler: event_handler) }
+        results.flatten
+      end
+
+      def current_branch_for(member)
+        git_output(member.root, "branch", "--show-current")
+      end
 
       def branch_results(event_handler: nil)
         root = git_root
@@ -769,6 +794,7 @@ module Kettle
 
       def release_target_branches
         return [] unless config
+        return @branches if @branches
 
         config.release_target_branches
       end
@@ -840,6 +866,7 @@ module Kettle
         with_worktree_registry_lock(root: root) do
           base = File.join(root, "tmp", "kettle-family-release-state")
           FileUtils.mkdir_p(base)
+          prune_stale_worktrees(root: root)
           entries = branches.map do |branch|
             {branch: branch, worktree_root: File.join(base, "worktree-#{Process.pid}-#{SecureRandom.hex(8)}")}
           end
@@ -869,6 +896,40 @@ module Kettle
         end
       end
 
+      # A killed run (SIGKILL, terminal close) skips the ensure-block cleanup and
+      # leaves registered worktrees behind. Registered-but-ownerless worktrees
+      # are pinned refs that accumulate forever, so reap them on the way in.
+      def prune_stale_worktrees(root:)
+        base = File.join(root, "tmp", "kettle-family-release-state")
+        WORKTREE_ADMIN_MUTEX.synchronize do
+          Open3.capture3("git", "worktree", "prune", chdir: root)
+          orphaned_worktree_paths(base).each do |path|
+            Open3.capture3("git", "worktree", "remove", "--force", path, chdir: root)
+            FileUtils.rm_rf(path)
+          end
+        end
+      end
+
+      # Worktree directories are named worktree-PID-RANDOM. A PID that is no
+      # longer running cannot still own a live worktree.
+      def orphaned_worktree_paths(base)
+        Dir[File.join(base, "worktree-*")].select do |path|
+          pid = File.basename(path)[/worktree-(\d+)-/, 1]
+          next false if pid.nil? || pid == Process.pid.to_s
+
+          !process_alive?(pid)
+        end
+      end
+
+      def process_alive?(pid)
+        Process.kill(0, pid)
+        true
+      rescue Errno::ESRCH
+        false
+      rescue Errno::EPERM
+        true
+      end
+
       def add_branch_worktree(root:, branch:, worktree_root:)
         WORKTREE_ADMIN_MUTEX.synchronize do
           _stdout, stderr, status = Open3.capture3("git", "worktree", "add", "--detach", worktree_root, branch, chdir: root)

data/lib/kettle/family/report.rb

@@ -517,6 +517,7 @@ module Kettle
 
       def release_terminal_result?(result)
         result.phase == "release_skip" ||
+          result.phase == "release_blocked" ||
           result.phase == "release_publish" ||
           result.phase == "release_build"
       end

data/lib/kettle/family/selection.rb

@@ -21,6 +21,21 @@ module Kettle
         STATUS_TOKEN_KEYS.key?(value.to_s)
       end
 
+      # Defined as a singleton method above the `private` keyword: a `private`
+      # instance modifier does not apply to `def self.` definitions.
+      #
+      # Branches of one member that currently satisfy +tokens+. Used to decide
+      # per-branch bump work, so a bump never touches a branch that has nothing
+      # to release.
+      def self.branches_matching(release_state_results, member_name:, tokens:)
+        keys = Array(tokens).map(&:to_s).filter_map { |token| STATUS_TOKEN_KEYS[token] }
+        return [] if keys.empty?
+
+        Array(release_state_results).select do |result|
+          result.member_name == member_name && keys.all? { |key| result.state[key] == true }
+        end.map(&:branch).compact.uniq
+      end
+
       def self.validate_release_state_only_filter!(only)
         names = only.to_s.split(",").map(&:strip).reject(&:empty?)
         status_tokens = names.select { |name| status_token?(name) }
@@ -83,22 +98,29 @@ module Kettle
         selected.drop(index)
       end
 
+      # A branch-stack member yields one release-state result per branch, all
+      # sharing a member_name. Collapsing them by member_name alone would let
+      # whichever branch came last decide selection for every branch, so a
+      # member qualifies when *any* of its branches matches the token.
       def select_release_state_status(selected, status_tokens)
         results_by_member = release_state_results_by_member
-        failed = results_by_member.values.select { |result| !result.ok? }
-        raise Error, "release-state check failed for: #{failed.map(&:member_name).join(", ")}" unless failed.empty?
+        failed = results_by_member.values.flatten.select { |result| !result.ok? }
+        raise Error, "release-state check failed for: #{failed.map(&:member_name).uniq.join(", ")}" unless failed.empty?
 
         selected.select do |candidate|
-          result = results_by_member[candidate.name]
-          result && status_tokens.all? { |token| truthy_state?(result.state[STATUS_TOKEN_KEYS.fetch(token)]) }
+          Array(results_by_member[candidate.name]).any? do |result|
+            status_tokens.all? { |token| truthy_state?(result.state[STATUS_TOKEN_KEYS.fetch(token)]) }
+          end
         end
       end
 
+      # Branch-stack members report one result per branch, all sharing a member
+      # name, so results are grouped per member instead of collapsed to one.
       def release_state_results_by_member
         raise Error, "--only release-state tokens require release-state results" unless release_state_results
 
         release_state_results.each_with_object({}) do |result, memo|
-          memo[result.member_name] = result
+          (memo[result.member_name] ||= []) << result
         end
       end
 

data/lib/kettle/family/unreleased_gem_cleanup.rb

@@ -2,8 +2,49 @@
 
 module Kettle
   module Family
+    # Removes locally installed gem versions that no registry has published.
+    #
+    # Why this exists: bundler resolves against the local gem dir and picks the
+    # highest version satisfying a constraint, so a locally built unreleased
+    # version always wins over the published one. Floor constraints are `>=`, so
+    # there is no ceiling that stops it, and every `bundle install` or
+    # `bundle lock` re-pins the offender. Detection cannot fix resolution — the
+    # offenders have to be removed. Left in place they produce lockfiles that no
+    # isolated environment can resolve, which surfaces much later as an opaque
+    # bundler error ("locked to kettle-jem (7.1.29) ... can no longer be
+    # found").
+    #
+    # All candidates across the whole family are removed in ONE `gem uninstall`
+    # invocation rather than one invocation per gem. That is not merely fewer
+    # processes: RubyGems' `uninstall_specific` builds a Gem::DependencyList from
+    # every requested gem and removes them via
+    # `strongly_connected_components.flatten.reverse`, a topological sort of the
+    # whole set that removes dependents before their dependencies. A per-gem
+    # invocation sees only one gem and cannot sort, so it raises
+    # Gem::DependencyRemovalException ("Uninstallation aborted due to dependent
+    # gem(s)") whenever another installed gem still depends on it. Family
+    # members are heavily interdependent, so per-gem removal fails on the
+    # foundations: observed live, removing tree_haver first failed because
+    # ast-merge still required it, and four iterative passes still left two gems
+    # installed. One batched invocation removed both.
+    #
+    # The single run is still reported per member. Report keys results by member
+    # name for commands in MEMBER_RESULT_COMMANDS, and treats a member with no
+    # result as pending, which fails the whole summary. So attributing the batch
+    # to one synthetic family-level name left every member pending and reported
+    # `outcome: failure` with `failed: none`. Each contributing member instead
+    # receives the shared outcome of the one run.
+    #
+    # `--all` is deliberately not passed. With gem arguments present it is
+    # redundant (RubyGems routes to `uninstall_specific` either way), and with no
+    # arguments it means `uninstall_all`, which removes every gem in the gem
+    # home. Omitting it makes an empty argument list a plain usage error instead
+    # of a wipe. `--version` cannot be used either, because RubyGems rejects it
+    # alongside multiple gems; versions are given as `name:version` arguments,
+    # the form its own error message prescribes.
     class UnreleasedGemCleanup
       PHASE = "clean_unreleased"
+      UNKNOWN_RELEASED_MESSAGE = "latest released version is unknown; no cleanup attempted"
 
       def initialize(config:, members:, execute: false, runner: nil)
         @config = config
@@ -14,9 +55,24 @@ module Kettle
 
       def results
         release_states = release_state_by_member
-        members.flat_map do |member|
-          cleanup_results_for(member: member, release_state: release_states[member.name])
+        # Resolved once per member: candidates and the member's non-uninstall
+        # diagnostics both derive from the same release state and installed spec
+        # scan, so pairing them in one pass keeps installed specs enumerated a
+        # single time and avoids re-reading release_states per member.
+        planned = members.map do |member|
+          release_state = release_states[member.name]
+          candidates = unreleased_candidates(member: member, release_state: release_state)
+          {
+            member: member,
+            candidates: candidates,
+            diagnostics: member_diagnostics(member: member, release_state: release_state, candidates: candidates)
+          }
         end
+        diagnostics = planned.flat_map { |entry| entry.fetch(:diagnostics) }
+        contributors = planned.reject { |entry| entry.fetch(:candidates).empty? }
+        return diagnostics if contributors.empty?
+
+        diagnostics + batched_cleanup_results(contributors)
       end
 
       private
@@ -29,16 +85,40 @@ module Kettle
         end
       end
 
-      def cleanup_results_for(member:, release_state:)
+      # Per-member outcomes that are not an uninstall: a release state that could
+      # not be read, a version that cannot be compared, or nothing to do. These
+      # stay per member so a failure names the member it came from. Members that
+      # do have candidates are reported by the batch result instead.
+      def member_diagnostics(member:, release_state:, candidates:)
         return [release_state_failure(member: member, release_state: release_state)] unless release_state&.ok?
 
         latest_released = latest_released_version(release_state.state)
-        return [informational_result(member: member, message: "latest released version is unknown; no cleanup attempted")] unless latest_released
+        return [informational_result(member: member, message: UNKNOWN_RELEASED_MESSAGE)] unless latest_released
+        return [] unless candidates.empty?
+
+        [informational_result(member: member, message: "no unreleased installed versions found")]
+      end
 
-        candidates = installed_versions(member.name).select { |version| version > latest_released }
-        return [informational_result(member: member, message: "no unreleased installed versions found")] if candidates.empty?
+      # Installed versions newer than anything published, as [name, version] pairs.
+      #
+      # Only genuinely installed gems count. Under `bundle exec`, bundler adds
+      # PATH and git sources to the load path, so
+      # Gem::Specification.find_all_by_name also returns specs whose
+      # full_gem_path points at a source checkout rather than a gem home — e.g.
+      # tree_haver 7.1.10 resolving to gems/tree_haver. Those are not installed
+      # gems and `gem uninstall` cannot remove them, so treating them as
+      # candidates would report work that can never succeed. Filtering on
+      # Gem.path membership excludes them.
+      def unreleased_candidates(member:, release_state:)
+        return [] unless release_state&.ok?
+
+        latest_released = latest_released_version(release_state.state)
+        return [] unless latest_released
 
-        candidates.map { |version| cleanup_result(member: member, version: version) }
+        name = member.name
+        installed_versions(name).filter_map do |version|
+          [name, version] if version > latest_released
+        end
       end
 
       def latest_released_version(state)
@@ -51,21 +131,50 @@ module Kettle
       end
 
       def installed_versions(name)
-        Gem::Specification.find_all_by_name(name).map(&:version).uniq.sort
+        Gem::Specification.find_all_by_name(name)
+          .select { |spec| installed_spec?(spec) }
+          .map(&:version)
+          .uniq
+          .sort
       end
 
-      def cleanup_result(member:, version:)
-        command = ["gem", "uninstall", member.name, "--version", version.to_s, "--executables", "--all"]
-        return runner.call(member: member, phase: PHASE, command: command) if execute
+      def installed_spec?(spec)
+        path = spec.full_gem_path.to_s
+        return false if path.empty?
+
+        Gem.path.any? { |root| path.start_with?("#{root}#{File::SEPARATOR}") }
+      rescue
+        false
+      end
 
+      # Runs the batch once, then reports that one outcome against every member
+      # whose gems were in it. See the class comment for why per-member results
+      # are required even though only one command runs.
+      def batched_cleanup_results(contributors)
+        candidates = contributors.flat_map { |entry| entry.fetch(:candidates) }
+        # Versions are given as `name:version` arguments rather than `--version`,
+        # which RubyGems rejects alongside multiple gems. See the class comment
+        # for why `--all` is omitted.
+        command = ["gem", "uninstall", *candidates.map { |name, version| "#{name}:#{version}" }, "--executables"]
+        # gem uninstall does not depend on the working directory, so the first
+        # contributing member provides a real directory to execute in.
+        host = contributors.first.fetch(:member)
+        outcome = execute ? runner.call(member: host, phase: PHASE, command: command) : dry_run_outcome(command)
+
+        contributors.map do |entry|
+          member_result(entry.fetch(:member), outcome, entry.fetch(:candidates))
+        end
+      end
+
+      def dry_run_outcome(command)
         CommandResult.new(
-          member_name: member.name,
+          member_name: nil,
           phase: PHASE,
           command: command,
-          workdir: member.root,
+          workdir: nil,
           status: nil,
           success: true,
-          stdout: "would uninstall #{member.name} #{version}",
+          stdout: nil,
           stderr: "",
           elapsed_seconds: 0.0,
           skipped: true,
@@ -73,6 +182,32 @@ module Kettle
         )
       end
 
+      # One member's view of the shared batch outcome. The command and exit state
+      # are common to the whole batch, but each member reports only its own gems,
+      # so the per-member report stays readable and a failure names every gem
+      # that member contributed.
+      def member_result(member, outcome, own_candidates)
+        own = describe(own_candidates)
+        outcome_reason = outcome.reason
+        # Equivalent to `ok? ? reason : (own.empty? ? reason : batch message)`,
+        # with outcome.reason read once instead of twice.
+        reason = if outcome.ok? || own_candidates.empty?
+          outcome_reason
+        else
+          "batched gem uninstall including #{own} failed"
+        end
+        outcome.dup.tap do |copy|
+          copy.member_name = member.name
+          copy.workdir = member.root
+          copy.stdout = outcome.skipped ? "would uninstall #{own}" : outcome.stdout
+          copy.reason = reason
+        end
+      end
+
+      def describe(candidates)
+        candidates.map { |name, version| "#{name} #{version}" }.join(", ")
+      end
+
       def informational_result(member:, message:)
         CommandResult.new(
           member_name: member.name,

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.3.4"
+      VERSION = "1.3.6"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -2343,9 +2343,9 @@ module Kettle
             return memo
           end
 
-          append_release_internal_checks(member: member, memo: memo)
-          memo.last(2).each { |result| emit_member_result_progress(original_member, result, progress: progress) }
-          return memo unless memo.last(2).all?(&:ok?)
+          internal_check_results = append_release_internal_checks(member: member, memo: memo)
+          internal_check_results.each { |result| emit_member_result_progress(original_member, result, progress: progress) }
+          return memo unless internal_check_results.all?(&:ok?)
 
           release_event_state = {}
           result = release_command_runner.call(
@@ -2526,9 +2526,9 @@ module Kettle
             end
           end
 
-          append_release_internal_checks(member: member, memo: memo)
-          memo.last(2).each { |result| emit_member_result_progress(member, result, progress: progress) }
-          return memo unless memo.last(2).all?(&:ok?)
+          internal_check_results = append_release_internal_checks(member: member, memo: memo)
+          internal_check_results.each { |result| emit_member_result_progress(member, result, progress: progress) }
+          return memo unless internal_check_results.all?(&:ok?)
 
           release_event_state = {}
           release_result = runner.call(
@@ -2744,7 +2744,38 @@ module Kettle
         end
 
         reconciled_members = (floor_results.map(&:member_name) + lockfile_refresh_members.map { |member, _released_members| member.name }).uniq
-        commit_dependency_floor_changes(dependent_members: reconciled_members, runner: runner, memo: memo) if reconciled_members.any? && execute && commit
+        return unless reconciled_members.any? && execute && commit
+
+        return unless validate_dependency_floor_published_versions(member_names: reconciled_members, memo: memo)
+
+        commit_dependency_floor_changes(dependent_members: reconciled_members, runner: runner, memo: memo)
+      end
+
+      # Gates the "Reconcile family dependencies" commit on the lockfile it is
+      # about to record.
+      #
+      # The preceding bundle install resolves against the local gem dir, so it
+      # happily pins a locally built and installed version. Committing that
+      # produces a lockfile no isolated environment can resolve, and the failure
+      # surfaces much later as an opaque bundler error during release lockfile
+      # reset ("locked to kettle-jem (7.1.29) ... can no longer be found")
+      # rather than at the moment the bad pin was introduced. Observed live: a
+      # release run's own reconcile commit flipped kettle-jem 7.1.28 -> 7.1.29
+      # in the tracked Gemfile.lock and then aborted at step 0.
+      #
+      # Gems published during this very run are not a false positive, because
+      # PublishedVersionCheck consults kettle-release's on-disk release marker
+      # ahead of its process memo, and that marker is written only after the gem
+      # is confirmed available on the registry.
+      def validate_dependency_floor_published_versions(member_names:, memo:)
+        by_name = members.to_h { |member| [member.name, member] }
+        results = member_names.filter_map do |member_name|
+          member = by_name[member_name]
+          next unless member
+
+          PublishedVersionCheck.call(member: member).tap { |result| memo << result }
+        end
+        results.all?(&:ok?)
       end
 
       def dependent_members_depending_on(released_members:, dependent_members:)
@@ -3275,13 +3306,34 @@ module Kettle
         results.each { |result| result.branch = branch if result.respond_to?(:branch=) }
       end
 
+      # Runs the internal pre-release checks for one member, appending each
+      # result to +memo+. Returns the results appended by this call so callers
+      # can inspect exactly them instead of relying on a positional
+      # `memo.last(N)` window.
+      #
+      # Short-circuits on the first failure: a member with a broken lockfile
+      # should not spend a release on its changelog, and the returned array
+      # then holds only the failing result.
       def append_release_internal_checks(member:, memo:)
-        memo << ReadinessCheck.call(
+        appended = []
+        readiness = ReadinessCheck.call(
           member: member,
           config: config,
           allowed_local_path_roots: release_readiness_allowed_local_path_roots(member)
         )
-        memo << ChangelogCheck.call(member: member, config: config) if memo.last.ok?
+        memo << readiness
+        appended << readiness
+        return appended unless readiness.ok?
+
+        published_versions = PublishedVersionCheck.call(member: member)
+        memo << published_versions
+        appended << published_versions
+        return appended unless published_versions.ok?
+
+        changelog = ChangelogCheck.call(member: member, config: config)
+        memo << changelog
+        appended << changelog
+        appended
       end
 
       def release_readiness_allowed_local_path_roots(member)
@@ -3978,28 +4030,38 @@ module Kettle
         @release_progress&.update(member, status: "ci bundle #{relative} #{attempt}/#{REGISTRY_WAIT_ATTEMPTS}", mark: ">")
       end
 
+      # A published version only means "already released" when nothing
+      # releasable landed after its tag. kettle-release commits checksums
+      # (and the family commits dependency-floor lockfiles) *after* tagging,
+      # so comparing HEAD to the tag directly never matches; compare the
+      # release-relevant paths instead.
       def already_released_result(member)
         tag = release_tag_name(member.version)
-        current_release_head = released_version_current_head?(member, tag)
-        if current_release_head
-          stdout = "#{member.name} #{member.version} is already published and current HEAD matches #{tag}; skipping release"
+        branch = current_member_branch(member)
+        scope = branch ? "#{member.name}@#{branch}" : member.name
+        if no_releasable_changes_since_tag?(member, tag)
+          stdout = "#{scope} #{member.version} is already published#{branch_suffix(branch)} and nothing releasable " \
+            "landed after #{tag}; skipping release"
           reason = "already released"
           skipped = true
-        elsif unreleased_changes_pending?(member)
-          stdout = "#{member.name} #{member.version} is already published, but release-state reports unreleased changes. " \
-            "Bump the version with `kettle-family bump patch --execute --only #{member.name}` before releasing."
+        elsif unreleased_changes_pending?(member, branch: branch)
+          stdout = "#{scope} #{member.version} is already published#{branch_suffix(branch)}, but release-state reports " \
+            "unreleased changes on this branch. Bump only this branch with " \
+            "`kettle-family bump patch --execute --only #{member.name}` before releasing."
           reason = "published version has unreleased changes"
           skipped = false
         else
-          stdout = "#{member.name} #{member.version} is already published, current HEAD is newer than #{tag}, " \
-            "and release-state reports no unreleased changes; skipping release"
+          stdout = "#{scope} #{member.version} is already published#{branch_suffix(branch)}, and release-state reports " \
+            "no unreleased changes on this branch; skipping release"
           reason = "already released; no unreleased changes"
           skipped = true
         end
 
         CommandResult.new(
           member_name: member.name,
-          phase: "release_skip",
+          # A blocked release is a distinct terminal phase from a skip: it is a
+          # hard failure and must never be reported as "skipped".
+          phase: skipped ? "release_skip" : "release_blocked",
           command: ["internal", "released-version-check", member.version],
           workdir: member.root,
           status: skipped ? 0 : 1,
@@ -4008,12 +4070,34 @@ module Kettle
           stderr: "",
           elapsed_seconds: 0.0,
           skipped: skipped,
-          reason: reason
+          reason: reason,
+          branch: branch
         )
       end
 
-      def unreleased_changes_pending?(member)
-        results = ReleaseStateCheck.new(members: [member], config: config).results
+      def branch_suffix(branch)
+        branch ? " on #{branch}" : ""
+      end
+
+      def current_member_branch(member)
+        return unless git_work_tree?(member.root)
+
+        stdout, _stderr, status = Open3.capture3("git", "branch", "--show-current", chdir: member.root)
+        return unless status.success?
+
+        branch = stdout.strip
+        branch.empty? ? nil : branch
+      end
+
+      # Scope the check to the branch being released. Consulting the whole
+      # branch stack here would report every already-published branch as
+      # having unreleased changes whenever any other branch in the stack does.
+      def unreleased_changes_pending?(member, branch: nil)
+        results = ReleaseStateCheck.new(
+          members: [member],
+          config: config,
+          branches: branch ? [branch] : nil
+        ).results
         return true unless results.all?(&:ok?)
 
         results.any? { |result| result.state.fetch("unreleased_entries", true) }
@@ -4023,12 +4107,42 @@ module Kettle
         "v#{version}"
       end
 
-      def released_version_current_head?(member, tag)
-        return true unless git_work_tree?(member.root)
+      # Post-release maintenance commits (checksums, lockfile reconciliation,
+      # docs) land after the tag by design, so "HEAD != tag" cannot mean
+      # "needs a release". Only a change to the gemspec, version file, or
+      # changelog between the tag and HEAD makes the published version stale.
+      def no_releasable_changes_since_tag?(member, tag)
+        return false unless git_work_tree?(member.root)
 
         tag_sha = git_rev_parse(member.root, "refs/tags/#{tag}^{}")
-        head_sha = git_rev_parse(member.root, "HEAD")
-        !tag_sha.to_s.empty? && tag_sha == head_sha
+        return false if tag_sha.to_s.empty?
+        return true if tag_sha == git_rev_parse(member.root, "HEAD")
+
+        releasable_changes_since_tag(member, tag).empty?
+      end
+
+      def releasable_changes_since_tag(member, tag)
+        paths = releasable_paths(member)
+        return [] if paths.empty?
+
+        stdout, _stderr, status = Open3.capture3(
+          "git", "diff", "--name-only", "#{tag}^{}", "HEAD", "--", *paths, chdir: member.root
+        )
+        # An unreadable diff is not evidence of "nothing to release".
+        return [tag] unless status.success?
+
+        stdout.lines.map(&:strip).reject(&:empty?)
+      end
+
+      def releasable_paths(member)
+        paths = [member.gemspec_path, member.version_file, config.changelog_full_path(member)]
+        paths.compact.filter_map do |path|
+          next unless File.file?(path)
+
+          Pathname.new(path).relative_path_from(Pathname.new(member.root)).to_s
+        rescue ArgumentError
+          path.to_s
+        end.uniq
       end
 
       def git_work_tree?(root)
@@ -4535,8 +4649,16 @@ module Kettle
         total
       end
 
+      # Progress denominator for one member's release. The base four are
+      # check, published_version_check, release_changelog and release_build.
+      #
+      # This must stay in step with what append_release_internal_checks emits:
+      # Progress#increment_member_count clamps the count to the total, so a
+      # total that is too low silently saturates the progress display instead
+      # of failing. Adding a release-internal phase without raising this base
+      # would leave every member showing its final count early.
       def release_phase_total(member = nil)
-        total = 3
+        total = 4
         if member
           normalize = normalize_release_lockfiles?(member)
           total += 2 if normalize
@@ -4634,7 +4756,9 @@ module Kettle
       def emit_release_progress_summary(results, progress:)
         return unless progress
 
-        release_results = results.select { |result| result.phase == release_phase || result.phase == "release_skip" }
+        release_results = results.select do |result|
+          result.phase == release_phase || result.phase == "release_skip" || result.phase == "release_blocked"
+        end
         progress.stop
         progress.summary("release summary: #{release_results.count(&:ok?)}/#{release_results.length} members ok")
       end
@@ -5659,8 +5783,14 @@ module Kettle
       end
 
       def release_lockfile_readiness_would_fail?(member)
-        result = ReadinessCheck.call(member: member, config: config, allowed_local_path_roots: release_allowed_local_path_roots)
-        result.stdout.lines.any? { |line| line.start_with?("release lockfile has local path remote at ") }
+        readiness = ReadinessCheck.call(
+          member: member,
+          config: config,
+          allowed_local_path_roots: release_allowed_local_path_roots
+        )
+        return true if readiness.stdout.lines.any? { |line| line.start_with?("release lockfile has local path remote at ") }
+
+        !PublishedVersionCheck.call(member: member).ok?
       end
 
       def release_lockfile_has_local_path_remote?(member)
@@ -5911,11 +6041,14 @@ module Kettle
       end
 
       def bundle_update_lockfile_diagnostics(member)
-        ReadinessCheck.call(
+        readiness = ReadinessCheck.call(
           member: member,
           config: config,
           allowed_local_path_roots: bundle_update_allowed_local_path_roots
-        ).stdout.lines.grep(/^release lockfile has local path remote at /).map do |line|
+        ).stdout.lines.grep(/^release lockfile has local path remote at /)
+        unpublished = PublishedVersionCheck.call(member: member).stdout.lines
+
+        (readiness + unpublished).map do |line|
           line.sub("release lockfile", "bundle update lockfile").chomp
         end
       end

data/lib/kettle/family.rb

@@ -5,6 +5,7 @@ require_relative "family/command_result"
 require_relative "family/release_state_result"
 require_relative "family/command_runner"
 require_relative "family/readiness_check"
+require_relative "family/published_version_check"
 require_relative "family/changelog_check"
 require_relative "family/git_status"
 require_relative "family/branch_lane_audit"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.3.4
+  version: 1.3.6
 platform: ruby
 authors:
 - Peter H. Boling
@@ -94,7 +94,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.5
+        version: 3.1.8
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -104,7 +104,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.5
+        version: 3.1.8
 - !ruby/object:Gem::Dependency
   name: kettle-gha-pins
   requirement: !ruby/object:Gem::Requirement
@@ -304,7 +304,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.4
+        version: 3.2.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -314,7 +314,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.4
+        version: 3.2.5
 - !ruby/object:Gem::Dependency
   name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
@@ -324,7 +324,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.11
+        version: 3.2.13
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -334,21 +334,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.11
-- !ruby/object:Gem::Dependency
-  name: webrick
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.9'
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: '1.9'
+        version: 3.2.13
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -392,7 +378,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.13
+        version: 2.0.15
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -402,7 +388,21 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.13
+        version: 2.0.15
+- !ruby/object:Gem::Dependency
+  name: webrick
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
 description: "\U0001F469‍\U0001F469‍\U0001F467‍\U0001F467 Kettle::Family provides
   scripts and conventions for coordinating related Ruby gems as one family."
 email:
@@ -436,6 +436,7 @@ files:
 - lib/kettle/family/nomono_bootstrap.rb
 - lib/kettle/family/orderer.rb
 - lib/kettle/family/paths.rb
+- lib/kettle/family/published_version_check.rb
 - lib/kettle/family/readiness_check.rb
 - lib/kettle/family/release_graph.rb
 - lib/kettle/family/release_reconciler.rb
@@ -459,10 +460,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.3.4
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.3.4/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.3.6
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.3.6/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.3.4
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.3.6
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family