kettle-family 0.1.15 → 0.1.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f34f86e4bbc4ff6d79503e62d90a5f5942f2cf5ca71889d28e9580467e1cbf62
-  data.tar.gz: 5b930341c10d8dbd8f254cfdd1cd38ffd553ce42801e43bc7d53be1feb794127
+  metadata.gz: 927846e1574bcad8790c8cabb3a7c06cd9afbf8e0637354cd52bd8d5c08e959b
+  data.tar.gz: 958338770647aabe0a916d81a9ec7ed76fac09feec4670d53a25c57120b1e59b
 SHA512:
-  metadata.gz: 4728fe4ae1ee4c04ab01034ccc2443b7d77379912ec38aa0838c63f1ee08c902ce0db06c4d4753521a5461a34bd62a97715b4f3594eac960f4b4e0d3c0ea32b8
-  data.tar.gz: e51a4793bb4b96ac610165217d143cba66976ef4e0ac2c106e87c9c7197ba5a238af032b3e9b5f360e67134668a11f9fce70e70ac9d6fa4cc545e2fd7b2689ac
+  metadata.gz: b750b13b10b5433d06d79a35a62bc7169e9321a3ca44b0af45bffb30b5fa713a12e4f026612c336a2bb761ef66f92abef17c66f35d0ebeceaf2ff3b75d9d8f6a
+  data.tar.gz: f36e586239ca4a3560dbae7d79357ac0ee2d6482e40b375c9e8c262849424b97395a230afc27f97d2770788cc81bc2a69b9ae5142670162c4abc66caea7d9709

data/CHANGELOG.md

@@ -22,6 +22,9 @@ Please file a bug if you notice a violation of semantic versioning.
 
 - `kettle-family push`, `kettle-family pull`, and `kettle-family up` now plan
   or execute family-wide git synchronization commands.
+- `kettle-family gha-sha-pins` now plans or executes
+  `kettle-gha-sha-pins` across family members, including branch stacks that
+  include `main`.
 - `kettle-family bump-version` now accepts the same relative bump targets as
   `kettle-bump` (`major`, `minor`, `patch`, and `pre`) and applies them per
   member from each member's current version.

data/README.md

@@ -242,6 +242,15 @@ The release-state report lists each gem's current `version.rb`, latest published
 release, latest versioned `CHANGELOG.md` section, and whether pending changelog
 work exists in either `Unreleased` or an unpublished prepared release section.
 
+Plan or update GitHub Actions workflow SHA pins across the selected family
+members:
+
+```console
+kettle-family gha-sha-pins
+kettle-family gha-sha-pins --execute
+kettle-family gha-sha-pins --execute --upgrade minor
+```
+
 Run release prep/build phases without publishing:
 
 ```console

data/lib/kettle/family/cli.rb

@@ -6,8 +6,8 @@ require "optparse"
 module Kettle
   module Family
     class CLI
-      COMMANDS = %w[discover plan report metadata check test lint docs template install bump-version add-changelog release push pull up branch-lanes release-state].freeze
-      WORKFLOW_COMMANDS = %w[check test lint docs template release push pull up].freeze
+      COMMANDS = %w[discover plan report metadata check test lint docs template gha-sha-pins install bump-version add-changelog release push pull up branch-lanes release-state].freeze
+      WORKFLOW_COMMANDS = %w[check test lint docs template gha-sha-pins release push pull up].freeze
       MAIN_BRANCH_SKIPPING_COMMANDS = %w[install release].freeze
 
       def self.call(argv, out: $stdout, err: $stderr)
@@ -61,6 +61,7 @@ module Kettle
               lint            Plan or execute configured lint command per member
               docs            Plan or execute configured docs command per member
               template        Plan or execute kettle-jem templating per member
+              gha-sha-pins    Plan or execute kettle-gha-sha-pins per member
               install         Build and install selected local family gems
               bump-version    Check, plan, or execute family version alignment
               add-changelog   Add an entry to an existing Unreleased changelog section
@@ -83,8 +84,9 @@ module Kettle
               --env KEY=VALUE  Override an environment variable for each member workflow command
               --section NAME   Changelog section for add-changelog
               --entry TEXT     Changelog entry for add-changelog
-              --check          Check whether bump-version would need edits
+              --check          Check whether bump-version or gha-sha-pins would need edits
               --from VERSION   Require selected members to currently match VERSION
+              --upgrade LEVEL  GitHub Actions SHA pin upgrade strategy: major, minor, patch
               --publish        Use publish release command instead of build command
               --build-only      Use build release command (default)
               --start-step N    Pass start_step=N through to kettle-release commands
@@ -115,6 +117,7 @@ module Kettle
           changelog_entry: nil,
           check: false,
           from_version: nil,
+          gha_sha_pins_upgrade: "patch",
           publish: false,
           release_start_step: nil,
           release_local_ci: false,
@@ -138,6 +141,7 @@ module Kettle
           parser.on("--entry TEXT") { |value| options[:changelog_entry] = value }
           parser.on("--check") { options[:check] = true }
           parser.on("--from VERSION") { |value| options[:from_version] = value }
+          parser.on("--upgrade LEVEL") { |value| options[:gha_sha_pins_upgrade] = parse_gha_sha_pins_upgrade(value) }
           parser.on("--publish") { options[:publish] = true }
           parser.on("--build-only") { options[:publish] = false }
           parser.on("--start-step N", Integer) { |value| options[:release_start_step] = value }
@@ -216,6 +220,8 @@ module Kettle
           start_step: options[:release_start_step],
           local_ci: options[:release_local_ci],
           continue_ci_failures: options[:release_continue_ci_failures],
+          gha_sha_pins_upgrade: options[:gha_sha_pins_upgrade],
+          gha_sha_pins_check: options[:check],
           env_overrides: options[:workflow_env]
         ).results
       end
@@ -309,6 +315,13 @@ module Kettle
         env[key] = env_value
       end
 
+      def parse_gha_sha_pins_upgrade(value)
+        normalized = value.to_s.downcase
+        return normalized if %w[major minor patch].include?(normalized)
+
+        raise OptionParser::InvalidArgument, "--upgrade must be one of: major, minor, patch"
+      end
+
       def bump_version_results(members:, options:)
         results = VersionBump.new(
           members: members,

data/lib/kettle/family/version.rb

@@ -3,7 +3,7 @@
 module Kettle
   module Family
     module Version
-      VERSION = "0.1.15"
+      VERSION = "0.1.16"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

data/lib/kettle/family/workflow.rb

@@ -12,7 +12,8 @@ module Kettle
         "template" => "bundle exec kettle-jem install",
         "test" => "bundle exec kettle-test",
         "lint" => "bundle exec rake rubocop_gradual",
-        "docs" => "bundle exec rake yard"
+        "docs" => "bundle exec rake yard",
+        "gha-sha-pins" => "bundle exec kettle-gha-sha-pins"
       }.freeze
       GIT_SYNC_COMMANDS = {
         "push" => [["push", %w[git push]]],
@@ -21,7 +22,7 @@ module Kettle
       }.freeze
       MAIN_BRANCH_SKIPPING_COMMANDS = %w[release].freeze
 
-      def initialize(command:, config:, members:, execute: false, commit: true, allow_dirty: false, publish: false, push: false, tag: false, start_step: nil, local_ci: false, continue_ci_failures: false, env_overrides: {}, gem_signing_password: nil)
+      def initialize(command:, config:, members:, execute: false, commit: true, allow_dirty: false, publish: false, push: false, tag: false, start_step: nil, local_ci: false, continue_ci_failures: false, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, env_overrides: {}, gem_signing_password: nil)
         @command = command
         @config = config
         @members = members
@@ -34,6 +35,8 @@ module Kettle
         @start_step = start_step
         @local_ci = local_ci
         @continue_ci_failures = continue_ci_failures
+        @gha_sha_pins_upgrade = gha_sha_pins_upgrade
+        @gha_sha_pins_check = gha_sha_pins_check
         @env_overrides = env_overrides
         @gem_signing_password = gem_signing_password
       end
@@ -48,7 +51,7 @@ module Kettle
 
       private
 
-      attr_reader :command, :config, :members, :execute, :commit, :allow_dirty, :publish, :push, :tag, :start_step, :local_ci, :continue_ci_failures, :env_overrides
+      attr_reader :command, :config, :members, :execute, :commit, :allow_dirty, :publish, :push, :tag, :start_step, :local_ci, :continue_ci_failures, :gha_sha_pins_upgrade, :gha_sha_pins_check, :env_overrides
 
       def current_branch_results(workflow_members)
         return check_results(workflow_members) if command == "check"
@@ -72,6 +75,7 @@ module Kettle
           break memo unless result.ok?
 
           normalize_lockfiles(member: member, runner: runner, memo: memo, phase: "normalize_lockfiles") if command == "template"
+          commit_gha_sha_pins(member: member, runner: runner, memo: memo) if command == "gha-sha-pins"
         end
       end
 
@@ -141,6 +145,8 @@ module Kettle
           start_step: start_step,
           local_ci: local_ci,
           continue_ci_failures: continue_ci_failures,
+          gha_sha_pins_upgrade: gha_sha_pins_upgrade,
+          gha_sha_pins_check: gha_sha_pins_check,
           env_overrides: env_overrides,
           gem_signing_password: @gem_signing_password
         )
@@ -358,10 +364,34 @@ module Kettle
 
       def workflow_command(member = nil)
         return template_command(member) if command == "template"
+        return gha_sha_pins_command if command == "gha-sha-pins"
 
         command_for(command)
       end
 
+      def gha_sha_pins_command
+        command_text = command_for(command)
+        args = []
+        args << (gha_sha_pins_check ? "--check" : "--write") unless command_includes_any?(command_text, %w[--check --write])
+        args.concat(["--upgrade", gha_sha_pins_upgrade]) unless command_includes_arg?(command_text, "--upgrade")
+        append_command_args(command_text, args)
+      end
+
+      def append_command_args(command_text, args)
+        return command_text if args.empty?
+        return [*command_text, *args] if command_text.is_a?(Array)
+
+        "#{command_text} #{args.join(" ")}"
+      end
+
+      def command_includes_any?(command_text, args)
+        args.any? { |arg| command_includes_arg?(command_text, arg) }
+      end
+
+      def command_includes_arg?(command_text, arg)
+        command_text.is_a?(Array) ? command_text.map(&:to_s).include?(arg) : command_text.to_s.include?(arg)
+      end
+
       def command_for(name)
         configured = config.command_for(name)
         configured || DEFAULT_COMMANDS.fetch(name)
@@ -457,6 +487,21 @@ module Kettle
         end
       end
 
+      def commit_gha_sha_pins(member:, runner:, memo:)
+        return if gha_sha_pins_check || !commit
+
+        result = runner.call(
+          member: member,
+          phase: "commit_gha_sha_pins",
+          command: [
+            "sh",
+            "-lc",
+            "if ! git diff --quiet -- .github/workflows; then git add -- .github/workflows && git commit -m '🔒 Pin GitHub Actions SHAs'; fi"
+          ]
+        )
+        memo << result
+      end
+
       def family_member
         Member.new(
           name: config.family_name,

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 0.1.15
+  version: 0.1.16
 platform: ruby
 authors:
 - Peter H. Boling
@@ -309,10 +309,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v0.1.15
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v0.1.15/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v0.1.16
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v0.1.16/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/0.1.15
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/0.1.16
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family