kettle-family 1.2.11 → 1.2.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1f0da4c8794762df47df980870cdafa4ccbe25e6e1e0faae8b1b2ab13e512097
-  data.tar.gz: a8ad81e87f95aa544d51a21b3ba8b3cfa875d413939560ae603678e1ae9f64a1
+  metadata.gz: 8ba0934fc9a3cb13405a2d6546e64f6542df7972983eb22b881981c71fde5af4
+  data.tar.gz: dca77905dae036ee7d9ea4a71c6d52fd9ebc7689f4981005bc9b317f278c2d2a
 SHA512:
-  metadata.gz: d48cba6cd03e39932c805252a16d2f60bae16130b4ef2b3bba0ed650d35fea4a628e6be48a0ca33d6a8f625ef3f81e074aca43d16587f4a97ff2da2cb3533d0b
-  data.tar.gz: 577b907ce129337f155bfb0d498f00d14d8dcfb70ac3835ba57c62cf0d69431ba70e4cd81ce6a04463724e420ed36c7580e27fb08474752ca4e7eeb140cfce34
+  metadata.gz: a8652fa19d9f51210fd3eef7d206f7299db43e05688f8e1e09b0d5acc6b05969efa1303e4e47ae9fd98cfb31391b5ea1ab48ce506181ae577f4db88e534988f6
+  data.tar.gz: 1f1bb5c5677b5d870114678d5ab569f238e2e00d4ab0c5d713801135bdfd40941596dcd356313ad974c05967b9fe47e47b34c88583b02e2631c36b37c31e60f6

data/CHANGELOG.md

@@ -30,6 +30,24 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.12] - 2026-07-30
+
+- TAG: [v1.2.12][1.2.12t]
+- COVERAGE: 93.90% -- 3846/4096 lines in 27 files
+- BRANCH COVERAGE: 76.54% -- 1475/1927 branches in 27 files
+- 27.83% documented
+
+### Fixed
+
+- Publish release skip checks now use `kettle-dev`'s shared RubyGems version
+  cache instead of a direct `gem.coop` HTTP request, matching the cached
+  release-state path used by `kettle-family state`.
+
+- Family release dependency-floor readiness now validates CI-facing direct
+  appraisal Gemfiles, so generated workflows such as `dep-heads.yml` cannot fail
+  after a just-published family dependency was only checked through release
+  lockfiles.
+
 ## [1.2.11] - 2026-07-30
 
 - TAG: [v1.2.11][1.2.11t]
@@ -1358,7 +1376,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.11...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.12...HEAD
+[1.2.12]: https://github.com/kettle-dev/kettle-family/compare/v1.2.11...v1.2.12
+[1.2.12t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.12
 [1.2.11]: https://github.com/kettle-dev/kettle-family/compare/v1.2.10...v1.2.11
 [1.2.11t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.11
 [1.2.10]: https://github.com/kettle-dev/kettle-family/compare/v1.2.9...v1.2.10

data/README.md

@@ -814,7 +814,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.035-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.096-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.11"
+      VERSION = "1.2.12"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -3,13 +3,13 @@
 require "io/console"
 require "fileutils"
 require "json"
-require "net/http"
 require "etc"
 require "open3"
+require "pathname"
 require "rbconfig"
 require "shellwords"
-require "uri"
 require "yaml"
+require "kettle/dev/ruby_gems_versions"
 
 require_relative "workflow_progress"
 
@@ -729,6 +729,9 @@ module Kettle
         append_dependency_floor_lockfile_results(released_members: released_members, dependent_members: affected_dependent_members, runner: runner, memo: memo)
         return if memo.any? && !memo.last.ok?
 
+        append_dependency_floor_ci_bundle_results(released_members: released_members, dependent_members: affected_dependent_members, runner: runner, memo: memo)
+        return if memo.any? && !memo.last.ok?
+
         commit_dependency_floor_changes(dependent_members: floor_results.map(&:member_name), runner: runner, memo: memo) if floor_results.any? && execute && commit
       end
 
@@ -753,6 +756,19 @@ module Kettle
         end
       end
 
+      def append_dependency_floor_ci_bundle_results(released_members:, dependent_members:, runner:, memo:)
+        return unless execute && publish
+        return if dependent_members.empty?
+
+        dependent_members.each do |member|
+          dependency_floor_ci_bundle_gemfiles(member).each do |gemfile|
+            memo << wait_for_dependency_floor_ci_bundle_result(member: member, gemfile: gemfile, released_members: released_members, runner: runner)
+            break unless memo.last.ok?
+          end
+          break if memo.any? && !memo.last.ok?
+        end
+      end
+
       def wait_for_dependency_floor_lockfiles_result(member:, released_members:, runner:)
         result = nil
         REGISTRY_WAIT_ATTEMPTS.times do |index|
@@ -772,6 +788,25 @@ module Kettle
         result
       end
 
+      def wait_for_dependency_floor_ci_bundle_result(member:, gemfile:, released_members:, runner:)
+        result = nil
+        REGISTRY_WAIT_ATTEMPTS.times do |index|
+          emit_dependency_floor_ci_bundle_progress(member: member, gemfile: gemfile, attempt: index + 1)
+          FileUtils.mkdir_p(File.dirname(dependency_floor_ci_bundle_lockfile_path(member: member, gemfile: gemfile)))
+          result = runner.call(
+            member: member,
+            phase: "dependency_floor_ci_bundle",
+            command: dependency_floor_ci_bundle_command(released_members),
+            env: dependency_floor_ci_bundle_env(member: member, gemfile: gemfile)
+          )
+          annotate_dependency_floor_ci_bundle_result(result, index + 1, gemfile: gemfile)
+          break if result.ok?
+
+          sleep(REGISTRY_WAIT_INTERVAL_SECONDS) if index + 1 < REGISTRY_WAIT_ATTEMPTS
+        end
+        result
+      end
+
       def validate_dependency_floor_lockfile_result(result:, member:, released_members:)
         diagnostics = dependency_floor_lockfile_diagnostics(member: member, released_members: released_members)
         return if diagnostics.empty?
@@ -804,6 +839,64 @@ module Kettle
         ["bundle", "lock", "--update", *released_members.map(&:name), "--add-checksums"]
       end
 
+      def dependency_floor_ci_bundle_command(released_members)
+        ["bundle", "lock", "--update", *released_members.map(&:name), "--add-checksums"]
+      end
+
+      def dependency_floor_ci_bundle_env(member:, gemfile:)
+        release_lockfile_env(member).merge(
+          "BUNDLE_GEMFILE" => gemfile,
+          "BUNDLE_LOCKFILE" => dependency_floor_ci_bundle_lockfile_path(member: member, gemfile: gemfile)
+        )
+      end
+
+      def dependency_floor_ci_bundle_lockfile_path(member:, gemfile:)
+        relative = relative_path_from_member_root(member: member, path: gemfile)
+        safe_name = relative.gsub(%r{[^A-Za-z0-9_.-]+}, "_")
+        File.join(member.root, "tmp", "kettle-family", "dependency-floor-ci-bundles", "#{safe_name}.lock")
+      end
+
+      def dependency_floor_ci_bundle_gemfiles(member)
+        workflow_bundle_gemfiles(member).select do |gemfile|
+          File.file?(gemfile)
+        end.uniq.sort
+      end
+
+      def workflow_bundle_gemfiles(member)
+        Dir.glob(File.join(member.root, ".github", "workflows", "*.{yml,yaml}")).flat_map do |path|
+          workflow_bundle_gemfile_entries(path).map do |entry|
+            File.expand_path(entry, member.root)
+          end
+        end
+      end
+
+      def workflow_bundle_gemfile_entries(path)
+        data = YAML.safe_load_file(path, permitted_classes: [], permitted_symbols: [], aliases: true) || {}
+        recursive_values_for_key(data, "bundle_gemfile").map(&:to_s).reject(&:empty?)
+      rescue Psych::Exception
+        []
+      end
+
+      def recursive_values_for_key(value, key)
+        case value
+        when Hash
+          value.flat_map do |entry_key, entry_value|
+            matches = (entry_key.to_s == key) ? [entry_value] : []
+            matches.concat(recursive_values_for_key(entry_value, key))
+          end
+        when Array
+          value.flat_map { |entry| recursive_values_for_key(entry, key) }
+        else
+          []
+        end
+      end
+
+      def relative_path_from_member_root(member:, path:)
+        Pathname.new(path).relative_path_from(Pathname.new(member.root)).to_s
+      rescue ArgumentError
+        path.to_s
+      end
+
       def reset_gemfile_lock(member:, runner:, memo:)
         result = runner.call(
           member: member,
@@ -987,6 +1080,18 @@ module Kettle
         end
       end
 
+      def annotate_dependency_floor_ci_bundle_result(result, attempts, gemfile:)
+        return unless result
+
+        relative = File.basename(gemfile)
+        if result.ok?
+          message = "validated CI bundle #{relative} after #{attempts} attempt(s)"
+          result.stdout = [result.stdout, message].reject(&:empty?).join("\n")
+        else
+          result.reason = "dependency floor CI bundle validation failed for #{relative} after #{attempts} attempt(s)"
+        end
+      end
+
       def commit_dependency_floor_changes(dependent_members:, runner:, memo:)
         by_name = members.to_h { |member| [member.name, member] }
         dependent_members.each do |member_name|
@@ -1283,19 +1388,25 @@ module Kettle
       end
 
       def released_version?(gem_name, version)
-        uri = URI("https://gem.coop/api/v1/versions/#{gem_name}.json")
-        response = Net::HTTP.get_response(uri)
-        raise Error, "could not check published versions for #{gem_name}: HTTP #{response.code}" unless response.is_a?(Net::HTTPSuccess)
+        data = Kettle::Dev::RubyGemsVersions.fetch(gem_name, version_hint: version)
+        raise Error, "could not check published versions for #{gem_name}" unless data.is_a?(Array)
 
-        JSON.parse(response.body).any? { |entry| entry["number"].to_s == version.to_s }
+        data.any? { |entry| entry["number"].to_s == version.to_s }
       rescue JSON::ParserError => error
         raise Error, "could not parse published versions for #{gem_name}: #{error.message}"
+      rescue => error
+        raise Error, "could not check published versions for #{gem_name}: #{error.message}"
       end
 
       def emit_dependency_floor_lockfile_progress(member:, attempt:)
         @release_progress&.update(member, status: "lockfiles #{attempt}/#{REGISTRY_WAIT_ATTEMPTS}", mark: ">")
       end
 
+      def emit_dependency_floor_ci_bundle_progress(member:, gemfile:, attempt:)
+        relative = relative_path_from_member_root(member: member, path: gemfile)
+        @release_progress&.update(member, status: "ci bundle #{relative} #{attempt}/#{REGISTRY_WAIT_ATTEMPTS}", mark: ">")
+      end
+
       def already_released_result(member)
         tag = release_tag_name(member.version)
         current_release_head = released_version_current_head?(member, tag)
@@ -2140,10 +2251,18 @@ module Kettle
 
       def release_lockfile_env(member = nil)
         base_release_env
+          .merge(release_lockfile_bundler_env_resets)
           .merge(env_overrides)
           .merge(release_lockfile_local_path_env_overrides(member))
       end
 
+      def release_lockfile_bundler_env_resets
+        {
+          "BUNDLE_GEMFILE" => nil,
+          "BUNDLE_LOCKFILE" => nil
+        }
+      end
+
       def release_allowed_local_path_roots
         release_local_path_env_sources.filter_map do |key, value|
           next unless key.end_with?("_LOCAL", "_DEV")

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.11
+  version: 1.2.12
 platform: ruby
 authors:
 - Peter H. Boling
@@ -74,7 +74,7 @@ dependencies:
         version: '2.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.8
+        version: 2.5.11
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -84,7 +84,7 @@ dependencies:
         version: '2.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.8
+        version: 2.5.11
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -341,10 +341,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.11
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.11/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.12
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.12/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.11
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.12
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family