kettle-family 1.1.9 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a7a1fef6a9376e6ea7f3d4f2ecd61bf5a610fdb1585037ce63631ef106ec6e24
-  data.tar.gz: aa9c89f697651bf26926575dde900f6ab070b487191f2ca6436ce04a3ad231c6
+  metadata.gz: aefb679d0cc2bdabed07ed294dfe6a270a2c8739bcb11b80c1eb1a367a8c72c9
+  data.tar.gz: c77c800317e98d86444d28ef032956d57dcfa187cb79a39b622ef266502a5a34
 SHA512:
-  metadata.gz: 11993355cf52d83e6bbbdae954983f7e10233968fece69a812c62ea5c1787112ba825e2eed207c12a06d44abb3af6199af5f3a11647733845abd8ba76ed25335
-  data.tar.gz: 7abbd03f4c8f434c8a069dc92d6c4eb66b06b81adb73d2454cf5fc0be9dbcb5335201b248173c15d91fcff699761e408303be2c7887fdabd1a07b2dd63e38ec8
+  metadata.gz: 77f54999801132c906f45e29b377c088e6459fa4103649a06f4e1679fee57ffa99f43c38d5af5af9dae12c9352ef027e896775c897ba077a28057122f700aa5f
+  data.tar.gz: a213bee6bf3d05686cfe38957c47a8554190283b944037532426097a1d23285c5132a9aef20f71637305aba02421d9761ac5ae0605f8fcd59d43418d673150e8

data/CHANGELOG.md

@@ -30,6 +30,97 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.0] - 2026-07-27
+
+- TAG: [v1.2.0][1.2.0t]
+- COVERAGE: 93.85% -- 3557/3790 lines in 27 files
+- BRANCH COVERAGE: 76.15% -- 1338/1757 branches in 27 files
+- 28.20% documented
+
+### Added
+
+- `kettle-family reset Gemfile.lock` now resets selected member lockfiles with
+  local sibling paths disabled and repairs missing checksum entries by updating
+  the affected released gems.
+
+- `kettle-family release` can now use an opt-in `1password` release secrets
+  provider to load the gem signing passphrase and RubyGems MFA OTP from the
+  local `op` CLI during executed publish flows.
+
+- `kettle-family clean-unreleased` now scans installed versions of selected
+  family gems and can uninstall local versions newer than each gem's latest
+  released version, helping recover from failed local release attempts that
+  leave unpublished gems installed.
+
+- kettle-jem-template-20260726-001 - Projects now include YARD lint
+  configuration and documentation dependencies so documentation issues fail
+  before generated docs are refreshed.
+
+- kettle-jem-template-20260727-001 - Spec harness documentation now lists the
+  RSpec helpers provided by `kettle-test`.
+
+### Changed
+
+- Templating and release progress rows now show a scheduled family-step counter
+  and per-member elapsed timer, making parallel family runs easier to scan.
+
+- `kettle-family reset Gemfile.lock` now delegates to each member's
+  `kettle-reset release-lockfiles`, keeping `Gemfile.lock` and
+  `Appraisal.root.gemfile.lock` reset semantics aligned with `kettle-release`.
+
+- Explicit `members.roots` lists now remain open to member discovery by default:
+  newly discovered gems are included in family operations and reported as
+  unlisted until the config is updated. Set `members.discover: false` to operate
+  only on configured members.
+- The `kettle-family` executable startup header is now shown only when
+  `--verbose` is passed; `-v` and `--version` still print just the executable
+  version and exit.
+- README release guidance now documents release secrets provider overrides,
+  release-state columns, default `--only` filters, JSON reports, and
+  unreleased-gem cleanup recovery.
+- Release secrets now use the shared `kettle-dev` provider implementation;
+  family publish runs cache the signing passphrase once and let child
+  `kettle-release` processes fetch RubyGems OTP values directly.
+- Family publish runs now pass `--yes` to child `kettle-release` commands by
+  default, so release-owned confirmation prompts are approved explicitly instead
+  of being answered by terminal prompt detection.
+
+- GitHub workflows now use the setup-ruby-flash revision that supports
+  appraisal-only setup without installing the main Gemfile bundle.
+
+- kettle-jem-template-20260728-001 - Generated Ruby workflows now use clearer
+  setup-ruby-flash planning and can prepare appraisal-only jobs without
+  installing the main Gemfile bundle.
+
+### Fixed
+
+- RuboCop Gradual now ignores gems installed under `gemfiles/vendor/bundle`,
+  preventing vendored dependency source from being treated as project lint debt.
+
+- Family releases now pass configured 1Password CLI paths through to child
+  `kettle-release` processes and derive direct secret handoff from normalized
+  provider config instead of parsing equivalent command-line spellings.
+
+- Family release secrets now preserve `Kettle::Family::Error` failures when the
+  shared `kettle-dev` provider reports 1Password lookup errors.
+
+- Template summaries now count unique changed files from kettle-jem event
+  streams instead of adding duplicate per-phase summary counts.
+- Family release lockfile refreshes now disable the generated local-path
+  toggles used by member Gemfiles, reject lockfile refreshes that still write
+  path sources, and re-normalize lockfiles before family-managed release pushes.
+
+- kettle-jem-template-20260726-002 - Generated version files now document their
+  version namespace and constants, reducing warning-only YARD lint output.
+
+- kettle-jem-template-20260726-003 - Coverage upload steps now treat Coveralls,
+  QLTY, and Codecov as optional, so provider outages do not fail CI when local
+  coverage thresholds still pass.
+
+- kettle-jem-template-20260728-002 - Generated RuboCop configs now ignore the
+  same `gemfiles/vendor/bundle` tree as `.gitignore`, so vendored dependency
+  installs are not reported as project lint debt.
+
 ## [1.1.9] - 2026-07-25
 
 - TAG: [v1.1.9][1.1.9t]
@@ -1072,7 +1163,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.1.9...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.0...HEAD
+[1.2.0]: https://github.com/kettle-dev/kettle-family/compare/v1.1.9...v1.2.0
+[1.2.0t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.0
 [1.1.9]: https://github.com/kettle-dev/kettle-family/compare/v1.1.8...v1.1.9
 [1.1.9t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.1.9
 [1.1.8]: https://github.com/kettle-dev/kettle-family/compare/v1.1.7...v1.1.8

data/README.md

@@ -38,7 +38,8 @@ is, avoiding duplicate release-prep commits after a failure/fix/retry cycle.
 `kettle-release` runs its own `kettle-pre-release` gate for full publish flows;
 options such as `start_step=N` and `--local-ci` pass through, CI failures still
 abort by default, and gem signing passphrases are cached once per family run
-while RubyGems MFA prompts remain interactive.
+while RubyGems MFA prompts remain interactive unless an opt-in release secrets
+provider supplies them.
 
 ## 💡 Info you can shake a stick at
 
@@ -139,17 +140,34 @@ gem install kettle-family
 `kettle-family` reads `.kettle-family.yml` from the family root by default.
 Use `--config PATH` to load a different file.
 
-Member discovery is recursive under the configured member roots. Discovery skips
-gemspecs ignored by git and any configured `members.exclude` glob patterns before
-loading gemspec metadata, so fixture or temporary gemspecs do not create duplicate
-members. Exclude patterns are matched relative to the family root and to each
-member root.
+Member discovery is recursive under the family member search roots. Discovery
+skips gemspecs ignored by git and any configured `members.exclude` glob patterns
+before loading gemspec metadata, so fixture or temporary gemspecs do not create
+duplicate members. Exclude patterns are matched relative to the family root and
+to each member root.
+
+Use `members.roots` as the normal configured member list. Each root is a member
+directory with one primary gemspec. When `members.roots` is present,
+`kettle-family` still discovers additional matching gems by default, includes
+them in the operative member set, and reports warnings so the config can be
+updated. Set `members.discover: false` when a family must operate only on the
+configured roots.
+
+Use `members.explicit` only when the member directory and gemspec cannot be
+resolved by the one-gemspec rule. For example, use it when a member directory has
+multiple gemspecs or the intended gemspec filename does not match the directory.
 
 ```yaml
 family:
   members_root: gems
 
 members:
+  roots:
+    - gems/alpha
+    - gems/beta
+  explicit:
+    - root: gems/compat
+      gemspec: compat-runtime.gemspec
   exclude:
     - "**/tmp/**"
     - "**/vendor/**"
@@ -191,6 +209,10 @@ Monorepo families whose member gems share release metadata from the repository
 root can configure readiness and changelog ownership explicitly:
 
 ```yaml
+family:
+  name: structuredmerge-ruby
+  local_path_env: STRUCTUREDMERGE_DEV
+
 check:
   required_files:
     - Gemfile
@@ -212,11 +234,23 @@ changelog:
 release:
   env:
     KETTLE_DEV_DEV: false
+  disable_local_path_env:
+    - TSLP_DEV
   family_changelog:
     enabled: true
     command: bundle exec kettle-changelog
 ```
 
+`family.local_path_env` names the environment variable that activates local
+path dependencies for this family. It is the family identity used by other
+families when they scan lockfile `PATH` remotes and need to disable local
+resolution before writing CI-facing release lockfiles. Configure it when the
+env name is not the default derived from `family.name`.
+
+`release.disable_local_path_env` is different: it is an extra release-lockfile
+normalization shutoff list for path-injecting env vars that are not themselves
+discoverable as family roots, such as vendored parser/tooling paths.
+
 For `changelog.mode: root`, release commands pass `K_CHANGELOG_GEM_NAME` as the
 configured family name and `K_CHANGELOG_VERSION_FILE` when `version_file` is
 configured, so `kettle-changelog` can operate from a repository root without a
@@ -257,6 +291,30 @@ Executed publish runs skip versions that are already published. CI failures
 abort by default; pass `--continue-ci-failures` to set
 `K_RELEASE_CI_CONTINUE=true` for the underlying `kettle-release` process.
 
+Executed publish runs can also use a release secrets provider. The default
+provider is `interactive`. The `1password` provider is supplied by
+`kettle-dev`, uses the local `op` CLI, and expects that `op` is installed,
+unlocked, and signed in before the release starts.
+
+```yaml
+release:
+  secrets:
+    provider: 1password
+    item: Rubygems
+    gem_signing_passphrase_field: GEM-SIGN-PASSPHRASE
+    rubygems_otp_field: one-time password
+```
+
+Use `--secrets-provider 1password` to opt in explicitly for a release run, or
+`--secrets-provider interactive` to force prompts even when the family config
+has a provider configured. Family publish runs pass `--yes` to child
+`kettle-release` commands by default, making release confirmation approval
+explicit instead of relying on terminal prompt detection. Pass `--no-accept` to
+leave child release confirmation prompts interactive. When publishing through
+`kettle-release`, `kettle-family` loads the signing passphrase once and passes
+the cached value to each child process; `kettle-release` still fetches RubyGems
+OTP values directly from 1Password at prompt time.
+
 ## 🔧 Basic Usage
 
 Inspect discovery and release plans before executing them:
@@ -270,12 +328,17 @@ Audit changelog release state across the selected family members:
 
 ```console
 kettle-family release-state
+kettle-family state
 ```
 
-The release-state report lists each gem's current `version.rb`, latest published
-release, latest versioned `CHANGELOG.md` section, whether pending changelog work
-exists in either `Unreleased` or an unpublished prepared release section, and
-how many commits the current branch is ahead of the latest release tag.
+`state` is an alias for `release-state`. The release-state report lists each
+gem's current `version.rb`, latest versioned `CHANGELOG.md` section, latest
+published RubyGems release, latest GitHub release tag, transfer-changelog lag,
+whether pending changelog work exists in either `Unreleased` or an unpublished
+prepared release section, and how many commits the current branch is ahead of or
+behind the latest release tag. The version columns are ordered as `V.rb`,
+`V.ch.md`, `V.rel`, and `GH.rel`; `GH.rel` is prefixed with a red circle when it
+does not match `V.rel`.
 
 Use release-state tokens with `--only` to select gems by state instead of by
 name. Multiple tokens are combined with logical AND, so this selects only gems
@@ -295,6 +358,14 @@ The supported release-state tokens are:
 | `unreleased` | The current `version.rb` is not the latest published gem version. |
 | `prepared` | The changelog already has a versioned section for the current `version.rb`. |
 | `pending` | The member has unreleased changelog work or an unpublished prepared release. |
+| `bump` | The member has unreleased changelog work and still needs a version bump. |
+
+When `--only` is omitted, `kettle-family bump` defaults to `--only bump` and
+`kettle-family release` defaults to `--only pending`.
+
+Most commands accept `--json` to print a machine-readable report instead of the
+text report, and `--report PATH` to write that JSON report while still printing
+the normal text report.
 
 Plan or update GitHub Actions workflow SHA pins across the selected family
 members:
@@ -322,12 +393,78 @@ kettle-family release --execute --publish --skip-remotes cb,mirror2
 
 Publish through `kettle-release`. A full publish first runs the
 `kettle-pre-release` gate, then prompts once for the gem signing key password
-and leaves RubyGems MFA prompts interactive:
+and leaves RubyGems MFA prompts interactive by default:
 
 ```console
 kettle-family release --publish --execute
 ```
 
+By default, family publish runs pass `--yes` to child `kettle-release`
+commands. Use `--no-accept` when you want each child release command to ask its
+own confirmation prompts.
+
+Executed publish runs can opt in to the local 1Password CLI for unattended
+release credentials. The gem signing passphrase is loaded once and cached only
+in memory for the current `kettle-family` process. When the publish command is
+`kettle-release`, that cached value is passed through an internal environment
+integration so child releases do not query 1Password repeatedly for the same
+passphrase. RubyGems OTP values are loaded by `kettle-release` when each MFA
+prompt arrives, so long releases do not reuse a stale TOTP from release startup.
+
+```yaml
+release:
+  secrets:
+    provider: 1password
+    item: Rubygems
+    gem_signing_passphrase_field: GEM-SIGN-PASSPHRASE
+    rubygems_otp_field: one-time password
+```
+
+```console
+kettle-family release --publish --execute --secrets-provider 1password
+```
+
+For vault-specific or field-specific references, configure explicit 1Password
+secret references. `rubygems_otp_reference` is read with `op read`; otherwise
+the OTP path uses `op item get ITEM --otp`.
+
+```yaml
+release:
+  secrets:
+    provider: 1password
+    account: my.1password.com
+    gem_signing_passphrase_reference: op://Private/Rubygems/GEM-SIGN-PASSPHRASE
+    rubygems_otp_reference: op://Private/Rubygems/one-time password?attribute=otp
+```
+
+If an old failed release left local unpublished versions installed and Bundler
+keeps selecting them, clean selected family members before retrying:
+
+```console
+kettle-family clean-unreleased --execute
+```
+
+The cleanup command compares installed local gem versions with each member's
+latest released version and uninstalls only versions newer than the release
+state reports.
+
+If a member lockfile has captured local sibling paths or checksum-less gem
+versions from local development, reset the selected members' `Gemfile.lock`
+files:
+
+```console
+kettle-family reset Gemfile.lock
+kettle-family reset Gemfile.lock --execute
+```
+
+`reset Gemfile.lock` runs each member's `bundle exec kettle-reset release-lockfiles`
+with configured, inferred, and path-like local `*_DEV`/`*_LOCAL` environment
+variables disabled. The member-level reset rewrites local sibling paths and
+checksum-less local gem versions back to released registry versions with
+`sha256=` checksums in `Gemfile.lock` and `Appraisal.root.gemfile.lock`.
+Executed family resets fail if the resulting lockfiles still contain sibling
+path remotes or checksum gaps.
+
 Resume a failed family publish after fixing the failure. Already published
 versions are skipped automatically; `start_step` is passed to `kettle-release`
 for unreleased members that still need work. Use `--start-step` only after the
@@ -371,7 +508,9 @@ kettle-family template --execute --only kettle-family
 
 Templating uses `kettle-jem --events` as the default child interface, so
 executed runs stream member-prefixed progress while still keeping the final
-family report. Progress marks include:
+family report. Each member line includes a scheduled family-step counter and a
+per-member elapsed timer. Child `kettle-jem` events can still add progress marks,
+but only completed family steps advance the counter. Progress marks include:
 
 | Mark | Meaning |
 |------|---------|
@@ -386,10 +525,12 @@ Example progress:
 
 ```text
 templating 1 member with 1 job:
-[kettle-family] > recipes
-[kettle-family] * Gemfile
-[kettle-family] * post_apply:git_hooks_executable
-[kettle-family] done 2 files changed
+[kettle-family]   (0/4)   00:00 > prepare_lockfiles
+[kettle-family]   (1/4)   00:01 . prepare_lockfiles
+[kettle-family]   (2/4)   00:05 . prepare_template_dependencies
+[kettle-family]   (3/4)   00:12 . template
+[kettle-family]   (4/4)   00:13 . normalize_lockfiles
+[kettle-family]   (4/4)   00:13 done 2 files changed
 .
 template summary: 1/1 members ok, 2 files changed
 ```
@@ -669,7 +810,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-3.357-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-3.790-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/exe/kettle-family

@@ -13,6 +13,7 @@ end
 
 require "kettle/family"
 
-puts "== #{script_basename} v#{Kettle::Family::Version::VERSION} ==" unless ARGV.include?("--json")
+verbose_header = ARGV.delete("--verbose")
+puts "== #{script_basename} v#{Kettle::Family::Version::VERSION} ==" if verbose_header && !ARGV.include?("--json")
 
 exit(Kettle::Family::CLI.call(ARGV))

data/lib/kettle/family/cli.rb

@@ -10,8 +10,8 @@ module Kettle
     class CLI < CommandKit::Command
       include CommandKit::Commands
 
-      COMMANDS = %w[discover plan report metadata check test lint docs template gha-sha-pins bup bupb bex install bump bump-version add-changelog release push pull sync up branch-lanes release-state state].freeze
-      WORKFLOW_COMMANDS = %w[check test lint docs template gha-sha-pins bup bupb bex release push pull sync up].freeze
+      COMMANDS = %w[discover plan report metadata check clean-unreleased reset test lint docs template gha-sha-pins bup bupb bex install bump bump-version add-changelog release push pull sync up branch-lanes release-state state].freeze
+      WORKFLOW_COMMANDS = %w[check reset test lint docs template gha-sha-pins bup bupb bex release push pull sync up].freeze
 
       command_name "kettle-family"
       usage "[options] COMMAND [ARGS...]"
@@ -151,12 +151,14 @@ module Kettle
             release_ci_workflows: nil,
             release_skip_bundle_audit: false,
             release_skip_remotes: nil,
+            release_secrets_provider: nil,
             accept: true,
             tag: false,
             push: false,
             commit: !options.key?(:commit) || options[:commit],
             allow_dirty: truthy_option?(:allow_dirty),
             target_version: nil,
+            reset_target: nil,
             bup_args: [],
             bex_args: []
           }.merge(overrides)
@@ -281,6 +283,25 @@ module Kettle
         description "Run internal read-only readiness checks."
       end
 
+      class CleanUnreleased < WorkflowCommand
+        command_name "clean-unreleased"
+        usage "[options]"
+        description "Uninstall locally installed family gem versions newer than the latest released version."
+      end
+
+      class Reset < WorkflowCommand
+        command_name "reset"
+        usage "[options] TARGET"
+        description "Reset a managed family artifact. Initially supports Gemfile.lock."
+        argument :target, required: true, usage: "TARGET", desc: "Artifact to reset"
+
+        def run(target = nil)
+          raise Error, "reset requires TARGET" if target.to_s.empty?
+
+          run_family("reset", reset_target: target)
+        end
+      end
+
       class Test < WorkflowCommand
         command_name "test"
         usage "[options]"
@@ -443,6 +464,7 @@ module Kettle
         option :ci_workflows, long: "--ci-workflows", value: {type: String, usage: "LIST"}, desc: "Pass a comma-separated CI workflow monitor subset through to kettle-release commands"
         option :skip_bundle_audit, long: "--skip-bundle-audit", desc: "Skip bundle:audit/update during release rake checks"
         option :skip_remotes, long: "--skip-remotes", value: {type: String, usage: "LIST"}, desc: "Pass a comma-separated git remote skip list through to kettle-release commands"
+        option :secrets_provider, long: "--secrets-provider", value: {type: String, usage: "NAME"}, desc: "Release secrets provider: interactive, 1password"
         option :no_auto_floors, long: "--no-auto-floors", desc: "Do not raise family dependency floors between member releases" do
           options[:no_auto_floors] = true
         end
@@ -465,6 +487,7 @@ module Kettle
             release_ci_workflows: options[:ci_workflows],
             release_skip_bundle_audit: truthy_option?(:skip_bundle_audit),
             release_skip_remotes: options[:skip_remotes],
+            release_secrets_provider: options[:secrets_provider],
             release_auto_dependency_floors: !truthy_option?(:no_auto_floors),
             accept: !options.key?(:accept) || options[:accept],
             tag: truthy_option?(:tag),
@@ -502,6 +525,8 @@ module Kettle
       command "report", ReportCommand
       command Metadata
       command Check
+      command CleanUnreleased
+      command Reset
       command Test
       command Lint
       command Docs
@@ -552,7 +577,8 @@ module Kettle
       def build_report(command, options)
         config = Config.load(root: options[:root], path: options[:config])
         start_at = parse_start_at(options[:start_at])
-        members = Discovery.new(config: config).members
+        discovery = Discovery.new(config: config)
+        members = discovery.members
         ordered = if command == "install"
           install_order(members, config)
         elsif %w[metadata release-state].include?(command)
@@ -577,7 +603,8 @@ module Kettle
           member_release_target_branches: member_release_target_branches(command: command, members: selected, config: config, start_at: start_at),
           release_mode: release_mode(command: command, options: options),
           command: command,
-          results: results
+          results: results,
+          warnings: discovery.warnings
         )
       end
 
@@ -607,6 +634,7 @@ module Kettle
       def command_results_for_current_branch(command:, config:, members:, options:, start_at: StartAt.new(nil, nil))
         return bump_version_results(members: members, options: options, phase: command) if %w[bump bump-version].include?(command)
         return add_changelog_results(members: members, options: options) if command == "add-changelog"
+        return clean_unreleased_results(config: config, members: members, options: options) if command == "clean-unreleased"
         return branch_lane_results(config: config, members: members) if command == "branch-lanes"
         return release_state_results(config: config, members: members) if command == "release-state"
         return install_results(config: config, members: members, options: options) if command == "install"
@@ -630,6 +658,7 @@ module Kettle
           ci_workflows: options[:release_ci_workflows],
           skip_bundle_audit: options[:release_skip_bundle_audit],
           skip_remotes: options[:release_skip_remotes],
+          secrets_provider: release_secrets_provider(command: command, config: config, options: options),
           auto_dependency_floors: options[:release_auto_dependency_floors],
           gha_sha_pins_upgrade: options[:gha_sha_pins_upgrade],
           gha_sha_pins_check: options[:check],
@@ -638,6 +667,7 @@ module Kettle
           verbose: options[:verbose],
           jobs: options[:jobs],
           progress_io: progress_io(command, options),
+          reset_target: options[:reset_target],
           bup_args: options[:bup_args],
           bex_args: options[:bex_args],
           start_member: start_at.member,
@@ -653,6 +683,12 @@ module Kettle
         stdout
       end
 
+      def release_secrets_provider(command:, config:, options:)
+        return nil unless command == "release"
+
+        Secrets::Factory.build(config: config, override_provider: options[:release_secrets_provider])
+      end
+
       def branch_target_command?(command, config)
         return false if config.release_target_branches.empty?
         return false if command == "release-state"
@@ -727,6 +763,8 @@ module Kettle
         discovered = Discovery.new(config: config).members
         ordered = (command == "install") ? install_order(discovered, config) : Orderer.new(members: discovered, mode: config.order_mode, hints: config.order_hints).ordered
         ordered.select { |member| selected_names.include?(member.name) }
+      rescue Error
+        []
       end
 
       def family_member(config)
@@ -836,6 +874,10 @@ module Kettle
         BranchLaneAudit.new(config: config, members: members).results
       end
 
+      def clean_unreleased_results(config:, members:, options:)
+        UnreleasedGemCleanup.new(config: config, members: members, execute: options[:execute]).results
+      end
+
       def install_results(config:, members:, options:)
         LocalInstall.new(config: config, members: members, execute: options[:execute], jobs: options[:jobs]).results
       end

data/lib/kettle/family/command_runner.rb

@@ -6,10 +6,15 @@ require "io/console"
 module Kettle
   module Family
     class CommandRunner
+      SENSITIVE_ENV_KEYS = [
+        "KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE"
+      ].freeze
+
       class OtpCoordinator
-        def initialize(input: $stdin, output: $stdout, queue_total: nil)
+        def initialize(input: $stdin, output: $stdout, queue_total: nil, secrets_provider: nil)
           @input = input
           @output = output
+          @secrets_provider = secrets_provider
           @mutex = Mutex.new
           @condition = ConditionVariable.new
           @prompting = false
@@ -61,6 +66,8 @@ module Kettle
 
         private
 
+        attr_reader :secrets_provider
+
         def wait_for_response(generation)
           @condition.wait(@mutex) while @prompting
           return @response if @completed_generation == generation
@@ -88,6 +95,12 @@ module Kettle
         end
 
         def read_response(chunk:)
+          provided = secrets_provider&.rubygems_otp.to_s
+          unless provided.empty?
+            @output.puts("RubyGems MFA code loaded from configured secrets provider.")
+            return provided
+          end
+
           @output.print("#{otp_prompt_label(chunk)} ")
           @output.flush if @output.respond_to?(:flush)
           if @input.respond_to?(:noecho) && @input.tty?
@@ -406,7 +419,8 @@ module Kettle
         argv = normalize_command(command)
         return argv unless mise_configured?(member)
 
-        unset_env, set_env = env.partition { |_key, value| value.nil? }
+        command_env = nonsensitive_env(env)
+        unset_env, set_env = command_env.partition { |_key, value| value.nil? }
         injected_env = [
           *unset_env.flat_map { |key, _value| ["-u", key.to_s] },
           *set_env.map { |key, value| "#{key}=#{value}" }
@@ -421,7 +435,19 @@ module Kettle
         base_env = unbundled_process_env
         return base_env.merge(env) unless mise_configured?(member)
 
-        base_env
+        base_env.merge(sensitive_env(env))
+      end
+
+      def nonsensitive_env(env)
+        env.reject { |key, _value| sensitive_env_key?(key) }
+      end
+
+      def sensitive_env(env)
+        env.select { |key, value| sensitive_env_key?(key) && !value.nil? }
+      end
+
+      def sensitive_env_key?(key)
+        SENSITIVE_ENV_KEYS.include?(key.to_s)
       end
 
       def unbundled_process_env