kettle-family 1.1.0 → 1.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2aaa5d7e3543091f4cc86ed298afe481609e4c57bd85a3b4d69e0e0ec587bc80
-  data.tar.gz: 36524c2f96f04ccd148048cbbaee7222e844f78e1fa5b5dd85dcd49c53975123
+  metadata.gz: 79a8b618e9d39c7c69bc77f133632dfd7b0802f44422cb29adde2f9a7d126259
+  data.tar.gz: 6f180a77144dd9df55d92ea0941ac68307ef38d51e207968f10af4627c85365e
 SHA512:
-  metadata.gz: b9efc18d3efbcfa9e16aaa867a22a8b9e59fc337f9eb41f03f02829a88c6a4707eee5ff00c5c0b24931ea428d46841bf649af572a3a1fd84416b06aa46417d7d
-  data.tar.gz: fe0e3717d364977801a8272976d2e22ae41ae3b5fdf4d4066fe57b698a28ec45089b4b88fd0b1645d57402fd427a9b8bb457439c49352b8e39bb3aac62be660e
+  metadata.gz: 4fe28d382aade9ae9406e4958afadf6f07e10231ca655f4973f5c2711fb5bac7559353cd517cda5e84ecb674e0ebc66e83788328d770481eabb1606b658f5f4f
+  data.tar.gz: 42f1aab38fee3ed2703dd37e9faaee14101f209174a0a3561b5820cd6e2ce52e698425722de106c849274aac9c053a01dde344490443b9bcbd396d99cde16d7d

data/CHANGELOG.md

@@ -30,6 +30,18 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.1.1] - 2026-07-23
+
+- TAG: [v1.1.1][1.1.1t]
+- COVERAGE: 94.41% -- 2954/3129 lines in 25 files
+- BRANCH COVERAGE: 76.28% -- 1058/1387 branches in 25 files
+- 28.68% documented
+
+### Fixed
+
+- `bup` / `bupb` now run bundle updates with local sibling path environments
+  disabled and refuse to auto-commit lockfiles containing local path remotes.
+
 ## [1.1.0] - 2026-07-23
 
 - TAG: [v1.1.0][1.1.0t]
@@ -41,7 +53,7 @@ Please file a bug if you notice a violation of semantic versioning.
 
 - `kettle-family state` now includes a `bump` boolean column, documents the
   boolean release-state columns above the table, and accepts `--only bump` to
-  select members with unreleased changes whose `V.rb` differs from `V.rel`.
+  select members with unreleased changes whose `V.rb` still matches `V.rel`.
 - `--only` release-state filters now accept the short table column names
   `unrel`, `prep`, and `pend` in addition to `unreleased`, `prepared`, and
   `pending`.
@@ -911,7 +923,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.1.0...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.1.1...HEAD
+[1.1.1]: https://github.com/kettle-dev/kettle-family/compare/v1.1.0...v1.1.1
+[1.1.1t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.1.1
 [1.1.0]: https://github.com/kettle-dev/kettle-family/compare/v1.0.6...v1.1.0
 [1.1.0t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.1.0
 [1.0.6]: https://github.com/kettle-dev/kettle-family/compare/v1.0.5...v1.0.6

data/README.md

@@ -669,7 +669,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-3.109-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-3.129-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/release_state_check.rb

@@ -299,7 +299,7 @@ module Kettle
       end
 
       def bump_release_pending?(state)
-        state["unreleased_entries"] == true && state["version"].to_s != state["latest_released"].to_s
+        state["unreleased_entries"] == true && state["version"].to_s == state["latest_released"].to_s
       end
 
       def root_changelog_version(root)

data/lib/kettle/family/report.rb

@@ -371,7 +371,7 @@ module Kettle
         lines << "    unrel: unreleased changelog entries are present"
         lines << "    prep: V.ch.md matches V.rb and is ready to publish"
         lines << "    pend: unrel or prep"
-        lines << "    bump: unrel is yes and V.rb differs from V.rel"
+        lines << "    bump: unrel is yes and V.rb matches V.rel"
         rows = release_state_header
         results.each do |result|
           rows << release_state_row(result)

data/lib/kettle/family/version.rb

@@ -3,7 +3,7 @@
 module Kettle
   module Family
     module Version
-      VERSION = "1.1.0"
+      VERSION = "1.1.1"
     end
     VERSION = Version::VERSION # Traditional Constant Location
   end

data/lib/kettle/family/workflow.rb

@@ -150,13 +150,15 @@ module Kettle
           end
 
           command_text = workflow_command(member)
-          result = runner.call(member: member, phase: command, command: command_text, env: workflow_env)
+          result = runner.call(member: member, phase: command, command: command_text, env: command_env)
           memo << result
           break memo unless result.ok?
 
           normalize_lockfiles(member: member, runner: runner, memo: memo, phase: "normalize_lockfiles") if command == "template"
           commit_gha_sha_pins(member: member, runner: runner, memo: memo) if command == "gha-sha-pins"
-          commit_bundle_update(member: member, runner: runner, memo: memo) if %w[bup bupb].include?(command)
+          if %w[bup bupb].include?(command) && validate_bundle_update_lockfile(member: member, memo: memo)
+            commit_bundle_update(member: member, runner: runner, memo: memo)
+          end
           commit_bex_changes(member: member, runner: runner, memo: memo) if command == "bex"
         end
       end
@@ -1113,6 +1115,16 @@ module Kettle
         end
       end
 
+      def command_env
+        return bundle_update_env if %w[bup bupb].include?(command)
+
+        workflow_env
+      end
+
+      def bundle_update_env
+        workflow_env.merge(config.release_disable_local_path_env.to_h { |key| [key, "false"] })
+      end
+
       def monorepo_template?
         command == "template" && config.family_mode == "monorepo"
       end
@@ -1474,6 +1486,38 @@ module Kettle
         memo << result
       end
 
+      def validate_bundle_update_lockfile(member:, memo:)
+        return true unless execute && commit
+
+        diagnostics = bundle_update_lockfile_diagnostics(member)
+        result = CommandResult.new(
+          member.name,
+          "bundle_update_readiness",
+          ["internal", "bundle-update-readiness"],
+          member.root,
+          diagnostics.empty? ? 0 : 1,
+          diagnostics.empty?,
+          diagnostics.join("\n"),
+          "",
+          0.0,
+          false,
+          diagnostics.empty? ? nil : "bundle update produced release-invalid lockfile"
+        )
+        memo << result
+        result.ok?
+      end
+
+      def bundle_update_lockfile_diagnostics(member)
+        lockfile = File.join(member.root, "Gemfile.lock")
+        return [] unless File.file?(lockfile)
+
+        File.readlines(lockfile).filter_map.with_index(1) do |line, index|
+          next unless line.start_with?("  remote: /", "  remote: ./", "  remote: ../")
+
+          "release lockfile has local path remote at Gemfile.lock:#{index}"
+        end
+      end
+
       def commit_bex_changes(member:, runner:, memo:)
         return unless commit
 

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.1.0
+  version: 1.1.1
 platform: ruby
 authors:
 - Peter H. Boling
@@ -319,10 +319,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.1.0
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.1.0/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.1.1
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.1.1/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.1.0
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.1.1
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family