kettle-family 1.2.12 → 1.2.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8ba0934fc9a3cb13405a2d6546e64f6542df7972983eb22b881981c71fde5af4
-  data.tar.gz: dca77905dae036ee7d9ea4a71c6d52fd9ebc7689f4981005bc9b317f278c2d2a
+  metadata.gz: 14997d7ae5a4ba5f2e3ec46f9fe9925a15020a0549fc779d70c57171492edd57
+  data.tar.gz: e9e84f2d92c1b8e2434ddc01a2d275e4b9077b06644b854ec817893a7e4157f1
 SHA512:
-  metadata.gz: a8652fa19d9f51210fd3eef7d206f7299db43e05688f8e1e09b0d5acc6b05969efa1303e4e47ae9fd98cfb31391b5ea1ab48ce506181ae577f4db88e534988f6
-  data.tar.gz: 1f1bb5c5677b5d870114678d5ab569f238e2e00d4ab0c5d713801135bdfd40941596dcd356313ad974c05967b9fe47e47b34c88583b02e2631c36b37c31e60f6
+  metadata.gz: aac3fc439504f17be4685f87f7bd1d4c213f885941f5c7793f1bca2369e92c384c7ae3cc8919fbf8f1023e7d1d812abe29c76d0a7fbef0301a5a8125b42217f3
+  data.tar.gz: 9d4ad335a463968aad4643d36b616f37b5d99b1431c659f2f3ae329017f304e5115dff3be3be72829ca99744a8cdf4b81619949146ce1df6f6ae7516226a12e6

data/CHANGELOG.md

@@ -30,6 +30,73 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.13] - 2026-07-31
+
+- TAG: [v1.2.13][1.2.13t]
+- COVERAGE: 94.09% -- 4043/4297 lines in 28 files
+- BRANCH COVERAGE: 76.48% -- 1538/2011 branches in 28 files
+- 28.84% documented
+
+### Fixed
+
+- Family publish runs now keep release secrets provider interaction in
+  `kettle-family` by default, so `--secrets-provider` no longer gets passed down
+  to child `kettle-release` commands unless the configured publish command
+  explicitly includes it.
+
+- Family release progress now renders child `kettle-release` `secret_provider`
+  events, keeping keepalive and prompt-response activity visible when a release
+  command emits NDJSON.
+
+- `kettle-family state` now queries `kettle-jem` transfer changelog totals
+  outside the active bundle when the root bundle does not include `kettle-jem`,
+  so the transfer lag column header can show the real total instead of `T(?)`.
+
+- `kettle-family` local development bundles now localize `kettle-dev`'s direct
+  sibling runtime dependencies when `KETTLE_DEV_DEV` is enabled, so unreleased
+  floors such as `kettle-ndjson >= 0.1.4` resolve during family development.
+
+- Release dry-runs now stop after planned lockfile normalization when a member
+  has local path remotes, avoiding a false readiness failure on lockfiles that
+  would be normalized under `--execute`.
+
+- Release state now reads kettle-jem transfer changelog replay cursors from
+  `.structuredmerge/kettle-jem.lock`, so `T(n)` reports actual lag instead of
+  treating every member as missing all transfer changelogs.
+
+- `kettle-family state` now labels the transfer changelog column as `T(n)`,
+  where `n` is the total transfer changelog count and row values are the lag
+  after each member's stored replay cursor.
+
+- `kettle-family state` now uses an ASCII `^ / v` ahead/behind column header so
+  terminal table alignment is stable in monospace output.
+
+- Text reports now repeat the command context in the final summary footer so the
+  command, family, mode, config, order, and release target details remain visible
+  after long runs.
+
+- Failed streamed release commands now report the last useful output line when
+  no explicit failure marker is present, avoiding empty `output omitted`
+  summaries for Bundler boot failures.
+
+- Template execution now aligns stale managed `nomono` Gemfile floors and
+  lockfiles before member bundles run, avoiding already-activated `nomono`
+  conflicts during family templating.
+
+- `kettle-family` now loads `kettle-dev` through its public entrypoint instead
+  of direct nested implementation files.
+
+- Command summaries now include total elapsed wall time in the final footer.
+
+- Parent-owned RubyGems MFA lookup failures during release now fall back to
+  manual OTP entry when possible, and otherwise fail the member cleanly instead
+  of escaping from a worker thread with a misleading release summary.
+
+- Dependency-floor CI bundle validation now recognizes workflow `env:
+  BUNDLE_GEMFILE` entries, including `${{ github.workspace }}` paths, so
+  release waves wait for just-published floors before pushing dependent CI
+  workflows that install through setup-ruby-flash.
+
 ## [1.2.12] - 2026-07-30
 
 - TAG: [v1.2.12][1.2.12t]
@@ -1376,7 +1443,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.12...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.13...HEAD
+[1.2.13]: https://github.com/kettle-dev/kettle-family/compare/v1.2.12...v1.2.13
+[1.2.13t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.13
 [1.2.12]: https://github.com/kettle-dev/kettle-family/compare/v1.2.11...v1.2.12
 [1.2.12t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.12
 [1.2.11]: https://github.com/kettle-dev/kettle-family/compare/v1.2.10...v1.2.11

data/README.md

@@ -309,9 +309,11 @@ has a provider configured. Family publish runs pass `--yes` to child
 `kettle-release` commands by default, making release confirmation approval
 explicit instead of relying on terminal prompt detection. Pass `--no-accept` to
 leave child release confirmation prompts interactive. When publishing through
-`kettle-release`, `kettle-family` loads the signing passphrase once and passes
-the cached value to each child process; `kettle-release` still fetches RubyGems
-OTP values directly from 1Password at prompt time.
+`kettle-release`, `kettle-family` owns release secret prompts by default: it
+loads the signing passphrase once, watches child release prompts, and fetches
+RubyGems OTP values from 1Password when each MFA prompt arrives. A child
+`kettle-release` command owns its own secrets provider only when the configured
+publish command explicitly includes `--secrets-provider`.
 
 ## 🔧 Basic Usage
 
@@ -331,12 +333,14 @@ kettle-family state
 
 `state` is an alias for `release-state`. The release-state report lists each
 gem's current `version.rb`, latest versioned `CHANGELOG.md` section, latest
-published RubyGems release, latest GitHub release tag, transfer-changelog lag,
+published RubyGems release, latest GitHub release tag, transfer-changelog count,
 whether pending changelog work exists in either `Unreleased` or an unpublished
 prepared release section, and how many commits the current branch is ahead of or
 behind the latest release tag. The version columns are ordered as `V.rb`,
-`V.ch.md`, `V.rel`, and `GH.rel`; `GH.rel` is prefixed with a red circle when it
-does not match `V.rel`.
+`V.ch.md`, `V.rel`, `GH.rel`, and `T(n)`; `GH.rel` is prefixed with a red circle
+when it does not match `V.rel`. The `T(n)` header shows the total number of
+kettle-jem transfer changelog entries. Each row value in that column shows how
+many entries are after that member's stored replay cursor.
 
 Use release-state tokens with `--only` to select gems by state instead of by
 name. Multiple tokens are combined with logical AND, so this selects only gems
@@ -405,10 +409,11 @@ prompts.
 Executed publish runs can opt in to the local 1Password CLI for unattended
 release credentials. The gem signing passphrase is loaded once and cached only
 in memory for the current `kettle-family` process. When the publish command is
-`kettle-release`, that cached value is passed through an internal environment
-integration so child releases do not query 1Password repeatedly for the same
-passphrase. RubyGems OTP values are loaded by `kettle-release` when each MFA
-prompt arrives, so long releases do not reuse a stale TOTP from release startup.
+`kettle-release`, `kettle-family` watches the child release process and answers
+signing and RubyGems MFA prompts itself, so long releases do not reuse a stale
+TOTP from release startup. If a publish command explicitly includes
+`--secrets-provider`, that child `kettle-release` owns its own provider
+interaction instead.
 
 ```yaml
 release:
@@ -704,8 +709,8 @@ Thanks for RTFM. ☺️
 [✉️discord-invite-img-ftb]: https://img.shields.io/discord/1373797679469170758?style=for-the-badge&logo=discord
 [✉️ruby-friends-img]: https://img.shields.io/badge/daily.dev-%F0%9F%92%8E_Ruby_Friends-0A0A0A?style=for-the-badge&logo=dailydotdev&logoColor=white
 [✉️ruby-friends]: https://app.daily.dev/squads/rubyfriends
-[✉️ruby-forum-top-img]: https://img.shields.io/discourse/topics?server=https://www.rubyforum.org&style=flat&logo=discourse&label=Ruby%20Users%20Forum
-[✉️ruby-forum-img]: https://img.shields.io/discourse/topics?server=https://www.rubyforum.org&style=for-the-badge&logo=discourse&label=Ruby%20Users%20Forum
+[✉️ruby-forum-top-img]: https://img.shields.io/discourse/topics?server=https%3A%2F%2Fwww.rubyforum.org&style=flat&logo=discourse&label=Ruby%20Users%20Forum
+[✉️ruby-forum-img]: https://img.shields.io/discourse/topics?server=https%3A%2F%2Fwww.rubyforum.org&style=for-the-badge&logo=discourse&label=Ruby%20Users%20Forum
 [✉️ruby-forum]: https://www.rubyforum.org/tag/kettle-dev
 
 [✇bundle-group-pattern]: https://gist.github.com/pboling/4564780
@@ -814,7 +819,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.096-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-4.297-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/cli.rb

@@ -591,7 +591,9 @@ module Kettle
         selected = Selection.new(members: ordered, release_state_results: release_state_results).apply(only: effective_only, exclude: options[:exclude], start_at: start_at.member)
         result_members = selected
         print_execution_intent(command: command, config: config, members: result_members, options: options, start_at: start_at)
+        started_at = Process.clock_gettime(Process::CLOCK_MONOTONIC)
         results = command_results(command: command, config: config, members: result_members, options: options, start_at: start_at)
+        elapsed_seconds = Process.clock_gettime(Process::CLOCK_MONOTONIC) - started_at
         Report.new(
           family_name: config.family_name,
           family_mode: config.family_mode,
@@ -605,7 +607,8 @@ module Kettle
           release_mode: release_mode(command: command, options: options),
           command: command,
           results: results,
-          warnings: discovery.warnings
+          warnings: discovery.warnings,
+          elapsed_seconds: elapsed_seconds
         )
       end
 

data/lib/kettle/family/command_runner.rb

@@ -95,7 +95,7 @@ module Kettle
         end
 
         def read_response(chunk:)
-          provided = secrets_provider&.rubygems_otp.to_s
+          provided = read_provider_response
           unless provided.empty?
             @output.puts("RubyGems MFA code loaded from configured secrets provider.")
             return provided
@@ -115,7 +115,26 @@ module Kettle
         def otp_prompt_label(chunk)
           chunk.to_s.lines.last&.strip.to_s.empty? ? "Code:" : chunk.to_s.lines.last.strip
         end
+
+        def read_provider_response
+          return "" unless secrets_provider
+
+          @output.print("\a") if @output.respond_to?(:print)
+          secrets_provider.rubygems_otp.to_s
+        rescue Error => error
+          raise unless @input.respond_to?(:tty?) && @input.tty?
+
+          @output.puts("#{error.message}; falling back to manual OTP entry.")
+          ""
+        end
+      end
+
+      FailureStatus = Struct.new(:exitstatus) do
+        def success?
+          false
+        end
       end
+      private_constant :FailureStatus
 
       def initialize(execute: false, accept: true, gem_signing_password: nil, otp_coordinator: nil)
         @execute = execute
@@ -227,6 +246,7 @@ module Kettle
 
       def run_interactive_pty(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:)
         stdout = +""
+        stderr = +""
         stdout_line_buffer = +""
         status = nil
         PTY.spawn(env, *argv, chdir: chdir, **process_options) do |output, input, pid|
@@ -248,11 +268,15 @@ module Kettle
             end
           rescue Errno::EIO
             # PTY raises EIO when the child process exits after closing the slave.
+          rescue Error => error
+            stderr << "#{error.message}\n"
+            terminate_process(pid)
           end
           flush_interactive_stdout(stdout_line_buffer, stdout_line_handler)
           _, status = Process.wait2(pid)
+          status = failure_status if !stderr.empty? && status.success?
         end
-        [stdout, "", status]
+        [stdout, stderr, status]
       end
 
       def run_interactive_open3(env:, argv:, chdir:, member_name:, process_options:, stdout_line_handler:)
@@ -263,28 +287,35 @@ module Kettle
         Open3.popen3(env, *argv, chdir: chdir, **process_options) do |input, output, error, wait_thread|
           readers = [output, error]
           readers << $stdin if $stdin.tty? && !otp_coordinator
-          until readers.empty?
-            ready = IO.select(readers)
-            ready.first.each do |reader|
-              if reader.equal?($stdin)
-                input.write($stdin.readpartial(1024))
-              else
-                stdout_line_buffer = read_interactive_stream(
-                  reader,
-                  output,
-                  input,
-                  captured_stdout,
-                  captured_stderr,
-                  readers,
-                  member_name: member_name,
-                  stdout_line_buffer: stdout_line_buffer,
-                  stdout_line_handler: stdout_line_handler
-                )
+          begin
+            until readers.empty?
+              ready = IO.select(readers)
+              ready.first.each do |reader|
+                if reader.equal?($stdin)
+                  input.write($stdin.readpartial(1024))
+                else
+                  stdout_line_buffer = read_interactive_stream(
+                    reader,
+                    output,
+                    input,
+                    captured_stdout,
+                    captured_stderr,
+                    readers,
+                    member_name: member_name,
+                    stdout_line_buffer: stdout_line_buffer,
+                    stdout_line_handler: stdout_line_handler
+                  )
+                end
               end
             end
+          rescue Error => error
+            captured_stderr << "#{error.message}\n"
+            terminate_process(wait_thread.pid)
+            status = failure_status
+          else
+            status = wait_thread.value
           end
           flush_interactive_stdout(stdout_line_buffer, stdout_line_handler)
-          status = wait_thread.value
         end
         [captured_stdout, captured_stderr, status]
       end
@@ -415,6 +446,16 @@ module Kettle
         output.to_s.encode("UTF-8", invalid: :replace, undef: :replace, replace: "")
       end
 
+      def failure_status
+        FailureStatus.new(1)
+      end
+
+      def terminate_process(pid)
+        Process.kill("TERM", pid)
+      rescue Errno::ESRCH, Errno::EPERM
+        nil
+      end
+
       def command_argv(member:, command:, env: {})
         argv = normalize_command(command)
         return argv unless mise_configured?(member)

data/lib/kettle/family/nomono_bootstrap.rb

@@ -0,0 +1,117 @@
+# frozen_string_literal: true
+
+require "rubygems"
+require "kettle/dev"
+
+module Kettle
+  module Family
+    class NomonoBootstrap
+      GEM_NAME = "nomono"
+
+      def initialize(latest_version:, mode: :dry_run)
+        @latest_version = Gem::Version.new(latest_version.to_s)
+        @mode = mode
+      end
+
+      attr_reader :latest_version, :mode
+
+      def member_needs_bootstrap?(member)
+        !!(gemfile_floor_outdated?(member) || lockfile_version_outdated?(member))
+      end
+
+      def bootstrap_member(member)
+        edits = gemfile_edits(member)
+        write_edits(edits)
+        CommandResult.new(
+          member.name,
+          "template_bootstrap_dependencies",
+          ["internal", "nomono-bootstrap", latest_version.to_s],
+          member.root,
+          0,
+          true,
+          bootstrap_stdout(member, edits),
+          "",
+          0.0,
+          mode != :execute,
+          (mode == :execute) ? nil : "dry run"
+        )
+      end
+
+      private
+
+      def bootstrap_stdout(member, edits)
+        lines = ["updated nomono bootstrap dependency for #{member.name}"]
+        lines.concat(edits.map { |edit| "updated #{edit.fetch(:path)}" })
+        locked_version = lockfile_nomono_version(member)
+        if locked_version && locked_version < latest_version
+          lines << "lockfile nomono #{locked_version} is below #{latest_version}"
+        end
+        "#{lines.join("\n")}\n"
+      end
+
+      def write_edits(edits)
+        return if mode != :execute || edits.empty?
+
+        Kettle::Dev::VersionBump.write_edits(edits)
+      end
+
+      def gemfile_floor_outdated?(member)
+        gemfile_edits(member).any?
+      end
+
+      def lockfile_version_outdated?(member)
+        locked_version = lockfile_nomono_version(member)
+        locked_version && locked_version < latest_version
+      end
+
+      def lockfile_nomono_version(member)
+        lockfile = File.join(member.root, "Gemfile.lock")
+        return nil unless File.file?(lockfile)
+
+        File.readlines(lockfile).each do |line|
+          match = line.match(/\A {4}nomono \(([^)]+)\)\s*\z/)
+          return Gem::Version.new(match[1]) if match
+        end
+        nil
+      end
+
+      def gemfile_edits(member)
+        gemfile = File.join(member.root, "Gemfile")
+        return [] unless File.file?(gemfile)
+
+        source = File.read(gemfile)
+        parse_result = Kettle::Dev::VersionBump.parse_source(source, gemfile)
+        Kettle::Dev::VersionBump.each_node(parse_result.value).filter_map do |node|
+          nomono_floor_edit(gemfile, source, node)
+        end
+      end
+
+      def nomono_floor_edit(path, source, node)
+        return unless node.is_a?(Prism::CallNode)
+        return unless node.name == :gem
+
+        arguments = node.arguments&.arguments || []
+        gem_name_node = arguments.first
+        return unless gem_name_node.is_a?(Prism::StringNode)
+        return unless gem_name_node.unescaped == GEM_NAME
+
+        floor_node = arguments.drop(1).find do |argument|
+          argument.is_a?(Prism::StringNode) && argument.unescaped.start_with?(">= ")
+        end
+        return unless floor_node
+
+        current_floor = Gem::Version.new(floor_node.unescaped.sub(/\A>=\s*/, ""))
+        return unless current_floor < latest_version
+
+        replacement = Kettle::Dev::VersionBump.quote_like(floor_node.location.slice, ">= #{latest_version}")
+        Kettle::Dev::VersionBump.file_edit(
+          path,
+          source,
+          floor_node.location.start_offset,
+          floor_node.location.end_offset,
+          replacement
+        )
+      end
+    end
+  end
+end

data/lib/kettle/family/release_state_check.rb

@@ -11,13 +11,20 @@ require "yaml"
 module Kettle
   module Family
     class ReleaseStateCheck
-      KETTLE_JEM_CONFIG_PATHS = [".structuredmerge/kettle-jem.yml", ".kettle-jem.yml"].freeze
+      KETTLE_JEM_STATE_PATHS = [
+        ".structuredmerge/kettle-jem.lock",
+        ".kettle-jem.lock",
+        ".structuredmerge/kettle-jem.yml",
+        ".kettle-jem.yml"
+      ].freeze
+      TRANSFER_CHANGELOG_TOTAL_UNSET = Object.new.freeze
 
       def initialize(members:, config: nil)
         @members = members
         @config = config
         @github_latest_release_by_repo = {}
         @transfer_changelog_lag_by_key = {}
+        @transfer_changelog_total_count = TRANSFER_CHANGELOG_TOTAL_UNSET
       end
 
       def results
@@ -329,20 +336,29 @@ module Kettle
         lag = transfer_changelog_lag(last_entry_key)
         return state unless lag
 
-        state.merge("transfer_changelog_lag" => lag.fetch("missing_count", 0).to_i)
+        state.merge(
+          "transfer_changelog_lag" => lag.fetch("missing_count", 0).to_i,
+          "transfer_changelog_total" => transfer_changelog_total_count
+        )
       end
 
       def kettle_jem_config_state(root)
-        path = KETTLE_JEM_CONFIG_PATHS.map { |relative| File.join(root.to_s, relative) }.find { |candidate| File.file?(candidate) }
+        path = KETTLE_JEM_STATE_PATHS.map { |relative| File.join(root.to_s, relative) }.find { |candidate| File.file?(candidate) }
         return nil unless path
 
         data = YAML.safe_load_file(path, permitted_classes: [], aliases: false)
-        state = data.is_a?(Hash) ? data["kettle-jem"] : nil
+        state = kettle_jem_state_from_yaml(data)
         state.is_a?(Hash) ? state : {}
       rescue Psych::Exception, SystemCallError
         nil
       end
 
+      def kettle_jem_state_from_yaml(data)
+        return nil unless data.is_a?(Hash)
+
+        data["template_state"] || data["kettle-jem"]
+      end
+
       def transfer_changelog_lag(last_entry_key)
         cache_key = last_entry_key.to_s
         @transfer_changelog_lag_by_key.fetch(cache_key) do
@@ -352,6 +368,13 @@ module Kettle
         nil
       end
 
+      def transfer_changelog_total_count
+        return @transfer_changelog_total_count unless @transfer_changelog_total_count.equal?(TRANSFER_CHANGELOG_TOTAL_UNSET)
+
+        total_lag = transfer_changelog_lag(nil)
+        @transfer_changelog_total_count = total_lag ? total_lag.fetch("missing_count", 0).to_i : nil
+      end
+
       def in_process_transfer_changelog_lag(last_entry_key)
         return nil unless load_kettle_jem_transfer_api
 
@@ -375,7 +398,12 @@ module Kettle
           last_entry_key = nil if last_entry_key.empty?
           puts JSON.generate(Kettle::Jem.transfer_changelog_lag(last_entry_key))
         RUBY
-        stdout, _stderr, status = Open3.capture3(RbConfig.ruby, "-rjson", "-rkettle/jem", "-e", code, cache_key)
+        command = [RbConfig.ruby, "-rjson", "-rkettle/jem", "-e", code, cache_key]
+        stdout, _stderr, status = if defined?(::Bundler)
+          ::Bundler.with_unbundled_env { Open3.capture3(*command) }
+        else
+          Open3.capture3(*command)
+        end
         status.success? ? normalize_transfer_changelog_lag(JSON.parse(stdout)) : nil
       rescue JSON::ParserError, SystemCallError
         nil

data/lib/kettle/family/report.rb

@@ -31,7 +31,7 @@ module Kettle
 
       attr_reader :family_name, :family_mode, :order_mode, :members, :selected_members, :config_path, :command, :results, :branch_lanes, :release_target_branches, :member_release_target_branches, :release_mode, :warnings
 
-      def initialize(family_name:, order_mode:, members:, selected_members:, config_path:, family_mode: nil, branch_lanes: {}, release_target_branches: [], member_release_target_branches: {}, release_mode: nil, command: nil, results: [], warnings: [])
+      def initialize(family_name:, order_mode:, members:, selected_members:, config_path:, family_mode: nil, branch_lanes: {}, release_target_branches: [], member_release_target_branches: {}, release_mode: nil, command: nil, results: [], warnings: [], elapsed_seconds: nil)
         @family_name = family_name
         @family_mode = family_mode
         @order_mode = order_mode
@@ -45,6 +45,7 @@ module Kettle
         @member_release_target_branches = member_release_target_branches
         @release_mode = release_mode
         @warnings = warnings
+        @elapsed_seconds = elapsed_seconds
       end
 
       def to_h
@@ -72,13 +73,7 @@ module Kettle
       end
 
       def to_text
-        lines = ["kettle-family: #{Kettle::Family::VERSION}", "family: #{family_name}"]
-        lines << "mode: #{family_mode}" if family_mode
-        lines << "config: #{config_path || "none"}"
-        lines << "order: #{order_mode}"
-        lines << "command: #{command}" if command
-        lines << "release mode: #{release_mode}" if release_mode
-        lines << "release targets: #{release_target_branches.join(", ")}" unless release_target_branches.empty?
+        lines = report_context_lines
         append_member_release_targets(lines)
         append_warnings(lines)
         lines << "members:"
@@ -128,8 +123,17 @@ module Kettle
 
       def append_summary(lines)
         data = summary
+        lines << "context:"
+        report_context_lines.each { |line| lines << "  #{line}" }
+        unless member_release_target_branches.empty?
+          lines << "  member release targets:"
+          member_release_target_branches.each do |member_name, branches|
+            lines << "    #{member_name}: #{branches.join(", ")}"
+          end
+        end
         lines << "summary:"
         lines << "  outcome: #{data.fetch("outcome")}"
+        lines << "  elapsed: #{format_elapsed(data.fetch("elapsed_seconds"))}"
         lines << "  selected: #{data.fetch("selected_count")}"
         lines << "  results: #{data.fetch("result_count")}"
         lines << "  succeeded: #{summary_list(data.fetch("succeeded"))}"
@@ -139,9 +143,21 @@ module Kettle
         lines << "  resume: #{data.fetch("resume_hint")}" if data.fetch("resume_hint")
       end
 
+      def report_context_lines
+        lines = ["kettle-family: #{Kettle::Family::VERSION}", "family: #{family_name}"]
+        lines << "mode: #{family_mode}" if family_mode
+        lines << "config: #{config_path || "none"}"
+        lines << "order: #{order_mode}"
+        lines << "command: #{command}" if command
+        lines << "release mode: #{release_mode}" if release_mode
+        lines << "release targets: #{release_target_branches.join(", ")}" unless release_target_branches.empty?
+        lines
+      end
+
       def summary
         {
           "outcome" => success? ? "success" : "failure",
+          "elapsed_seconds" => elapsed_seconds,
           "selected_count" => selected_members.length,
           "result_count" => visible_results.length,
           "succeeded" => summary_succeeded,
@@ -170,6 +186,20 @@ module Kettle
         results.reject { |result| release_wave_result?(result) }
       end
 
+      def elapsed_seconds
+        (@elapsed_seconds || visible_results.sum { |result| result.elapsed_seconds.to_f }).round(3)
+      end
+
+      def format_elapsed(seconds)
+        total = seconds.to_f.round
+        hours = total / 3600
+        minutes = (total % 3600) / 60
+        remaining_seconds = total % 60
+        return format("%d:%02d:%02d", hours, minutes, remaining_seconds) if hours.positive?
+
+        format("%02d:%02d", minutes, remaining_seconds)
+      end
+
       def append_indented_output(lines, output)
         output.to_s.each_line(chomp: true) { |line| lines << "    #{line}" }
       end
@@ -213,9 +243,10 @@ module Kettle
       end
 
       def streamed_output_summary(result)
-        streamed_output_lines(result).reverse.find do |line|
+        lines = streamed_output_lines(result)
+        lines.reverse.find do |line|
           line.match?(/(?:failed|failure|error|exited|aborted)/i) && !line.match?(/\A(?:Files|CI|Actions)/)
-        end
+        end || lines.reverse.find { |line| !line.match?(/\A(?:Files|CI|Actions)/) }
       end
 
       def streamed_recommended_fix(result)
@@ -440,7 +471,8 @@ module Kettle
         lines << "    prep: V.ch.md matches V.rb and is ready to publish"
         lines << "    pend: unrel or prep"
         lines << "    bump: unrel is yes and V.rb matches V.rel"
-        lines << "    T📰: kettle-jem transfer changelog entries not yet replayed"
+        lines << "  count columns:"
+        lines << "    T(n): kettle-jem transfer changelog lag; n is the total transfer changelog entry count with no replay cursor"
         rows = release_state_header
         results.each do |result|
           rows << release_state_row(result)
@@ -478,12 +510,20 @@ module Kettle
       end
 
       def release_state_header
-        header = [["gem", "checkout", "V.rb", "V.ch.md", "V.rel", "GH.rel", "T📰", "🔼 / 🔽", "unrel", "prep", "pend", "bump"]]
+        header = [["gem", "checkout", "V.rb", "V.ch.md", "V.rel", "GH.rel", release_state_transfer_changelog_header, "^ / v", "unrel", "prep", "pend", "bump"]]
         return header unless release_state_has_branches?
 
         [["branch", *header.first]]
       end
 
+      def release_state_transfer_changelog_header
+        total = results.filter_map do |result|
+          value = (result.state || {}).fetch("transfer_changelog_total", nil)
+          value unless value.to_s.empty?
+        end.first
+        "T(#{total || "?"})"
+      end
+
       def release_state_github_release(state)
         github_release = state.fetch("github_latest_release", nil).to_s
         return "unknown" if github_release.empty?

data/lib/kettle/family/secrets.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 begin
-  require "kettle/dev/release_secrets"
+  require "kettle/dev"
 rescue LoadError
   require "open3"
 end

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.12"
+      VERSION = "1.2.13"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -9,7 +9,7 @@ require "pathname"
 require "rbconfig"
 require "shellwords"
 require "yaml"
-require "kettle/dev/ruby_gems_versions"
+require "kettle/dev"
 
 require_relative "workflow_progress"
 
@@ -225,6 +225,9 @@ module Kettle
       end
 
       def template_member_workflow_results(workflow_members)
+        bootstrap_results = template_bootstrap_dependency_results(workflow_members)
+        return bootstrap_results unless bootstrap_results.all?(&:ok?)
+
         queue = Queue.new
         workflow_members.each_with_index { |member, index| queue << [index, member] }
         ordered_results = Array.new(workflow_members.length)
@@ -248,7 +251,85 @@ module Kettle
         end.each(&:join)
         flattened = ordered_results.compact.flatten
         emit_template_progress_summary(flattened, progress: template_progress)
-        flattened
+        bootstrap_results + flattened
+      end
+
+      def template_bootstrap_dependency_results(workflow_members)
+        return [] if workflow_members.empty?
+
+        candidate_members = workflow_members.select { |member| nomono_bootstrap_candidate?(member) }
+        return [] if candidate_members.empty?
+
+        latest_nomono_version = latest_released_nomono_version
+        active_nomono_version = Gem.loaded_specs["nomono"]&.version
+        if active_nomono_version && active_nomono_version < latest_nomono_version
+          return [template_bootstrap_failure_result(
+            candidate_members.first,
+            "activated nomono #{active_nomono_version} is older than latest released #{latest_nomono_version}"
+          )]
+        end
+
+        bootstrap = NomonoBootstrap.new(latest_version: latest_nomono_version, mode: :execute)
+        runner = CommandRunner.new(execute: execute, accept: accept)
+        candidate_members.each_with_object([]) do |member, memo|
+          next unless bootstrap.member_needs_bootstrap?(member)
+
+          memo << bootstrap.bootstrap_member(member)
+          break memo unless memo.last.ok?
+
+          memo << runner.call(
+            member: member,
+            phase: "template_bootstrap_dependencies",
+            command: %w[bundle update nomono --bundler],
+            env: template_bootstrap_dependency_env(member)
+          )
+          break memo unless memo.last.ok?
+        end
+      rescue => error
+        [template_bootstrap_failure_result(workflow_members.first, error.message)]
+      end
+
+      def nomono_bootstrap_candidate?(member)
+        %w[Gemfile Gemfile.lock].any? do |basename|
+          path = File.join(member.root, basename)
+          File.file?(path) && File.read(path).include?(NomonoBootstrap::GEM_NAME)
+        end
+      end
+
+      def template_bootstrap_failure_result(member, message)
+        CommandResult.new(
+          member.name,
+          "template_bootstrap_dependencies",
+          ["internal", "nomono-bootstrap"],
+          member.root,
+          1,
+          false,
+          "",
+          message,
+          0.0,
+          false,
+          "command failed"
+        )
+      end
+
+      def latest_released_nomono_version
+        versions = Kettle::Dev::RubyGemsVersions.fetch(NomonoBootstrap::GEM_NAME).filter_map do |entry|
+          number = entry["number"] || entry[:number]
+          next if number.to_s.empty?
+
+          version = Gem::Version.new(number)
+          version unless version.prerelease?
+        end
+        raise Error, "could not determine latest released nomono version" if versions.empty?
+
+        versions.max
+      end
+
+      def template_bootstrap_dependency_env(member)
+        env = workflow_env.merge(release_lockfile_local_path_env_overrides(member))
+        family_env_name = config.family_local_path_env_name
+        env[family_env_name] = "false" if family_env_name && !env_overrides.key?(family_env_name)
+        env
       end
 
       def template_results_for_member(member, progress: nil)
@@ -584,6 +665,12 @@ module Kettle
               end
             rescue ThreadError
               break
+            rescue => error
+              mutex.synchronize do
+                ordered_results[index] = [release_worker_error_result(member, error)]
+                stop = true
+              end
+              break
             end
           end
         end.each(&:join)
@@ -606,6 +693,22 @@ module Kettle
         )
       end
 
+      def release_worker_error_result(member, error)
+        CommandResult.new(
+          member_name: member.name,
+          phase: release_phase,
+          command: ["internal", "release-worker"],
+          workdir: member.root,
+          status: 1,
+          success: false,
+          stdout: "",
+          stderr: "#{error.class}: #{error.message}\n",
+          elapsed_seconds: 0.0,
+          skipped: false,
+          reason: error.message
+        )
+      end
+
       def release_results_for_member(member, runner:)
         progress = @release_progress
         progress&.start_member(member, total: release_phase_total, status: "check")
@@ -624,6 +727,12 @@ module Kettle
             commit_normalized_lockfiles(branch_members: [member], runner: runner, memo: memo, reason: "release", force: true)
             emit_member_result_progress(member, memo.last, progress: progress)
             return memo unless memo.last&.ok?
+
+            if !execute && release_lockfile_readiness_would_fail?(member)
+              memo << release_skipped_after_lockfile_normalization_result(member)
+              emit_member_result_progress(member, memo.last, progress: progress)
+              return memo
+            end
           end
 
           append_release_internal_checks(member: member, memo: memo)
@@ -675,8 +784,8 @@ module Kettle
         CommandRunner.new(
           execute: execute,
           accept: release_command_uses_kettle_release_yes? ? false : accept,
-          gem_signing_password: release_command_uses_kettle_release_secrets? ? nil : @gem_signing_password,
-          otp_coordinator: release_command_uses_kettle_release_secrets? ? nil : release_otp_coordinator
+          gem_signing_password: release_command_delegates_secrets_to_kettle_release? ? nil : @gem_signing_password,
+          otp_coordinator: release_command_delegates_secrets_to_kettle_release? ? nil : release_otp_coordinator
         )
       end
 
@@ -865,14 +974,17 @@ module Kettle
       def workflow_bundle_gemfiles(member)
         Dir.glob(File.join(member.root, ".github", "workflows", "*.{yml,yaml}")).flat_map do |path|
           workflow_bundle_gemfile_entries(path).map do |entry|
-            File.expand_path(entry, member.root)
+            File.expand_path(normalize_workflow_workspace_path(entry), member.root)
           end
         end
       end
 
       def workflow_bundle_gemfile_entries(path)
         data = YAML.safe_load_file(path, permitted_classes: [], permitted_symbols: [], aliases: true) || {}
-        recursive_values_for_key(data, "bundle_gemfile").map(&:to_s).reject(&:empty?)
+        [
+          *recursive_values_for_key(data, "bundle_gemfile"),
+          *recursive_env_values_for_key(data, "BUNDLE_GEMFILE")
+        ].map(&:to_s).reject(&:empty?)
       rescue Psych::Exception
         []
       end
@@ -891,6 +1003,22 @@ module Kettle
         end
       end
 
+      def recursive_env_values_for_key(value, key)
+        case value
+        when Hash
+          matches = value.fetch("env", nil).is_a?(Hash) ? [value["env"][key]] : []
+          matches.concat(value.flat_map { |_entry_key, entry_value| recursive_env_values_for_key(entry_value, key) })
+        when Array
+          value.flat_map { |entry| recursive_env_values_for_key(entry, key) }
+        else
+          []
+        end
+      end
+
+      def normalize_workflow_workspace_path(path)
+        path.to_s.sub(%r{\A\$\{\{\s*github\.workspace\s*\}\}/?}, "").sub(%r{\A\$GITHUB_WORKSPACE/?}, "")
+      end
+
       def relative_path_from_member_root(member:, path:)
         Pathname.new(path).relative_path_from(Pathname.new(member.root)).to_s
       rescue ArgumentError
@@ -1169,6 +1297,22 @@ module Kettle
         memo << ChangelogCheck.call(member: member, config: config) if memo.last.ok?
       end
 
+      def release_skipped_after_lockfile_normalization_result(member)
+        CommandResult.new(
+          member_name: member.name,
+          phase: release_phase,
+          command: release_command,
+          workdir: member.root,
+          status: nil,
+          success: true,
+          stdout: "",
+          stderr: "",
+          elapsed_seconds: 0.0,
+          skipped: true,
+          reason: "dry-run; release readiness requires lockfile normalization"
+        )
+      end
+
       def append_family_changelog_result(runner:, memo:)
         return unless config.release_family_changelog?
 
@@ -1264,7 +1408,6 @@ module Kettle
         args << "--local-ci" if local_ci
         args << "--skip-bundle-audit" if skip_bundle_audit
         args << "--skip-remotes=#{skip_remotes}" if skip_remotes && !skip_remotes.to_s.empty?
-        args << "--secrets-provider=1password" if release_command_uses_kettle_release_secrets? && !command_includes_arg?(command, "--secrets-provider")
         args << "--yes" if release_command_uses_kettle_release_yes? && !command_includes_arg?(command, "--yes")
         args << "--events" unless command_includes_arg?(command, "--events")
         return command if args.empty?
@@ -1322,7 +1465,7 @@ module Kettle
       end
 
       def kettle_release_secrets_env
-        return {} unless release_command_uses_kettle_release_secrets?
+        return {} unless release_command_delegates_secrets_to_kettle_release?
 
         secrets_config = config.release_secrets
         env = {
@@ -1345,9 +1488,10 @@ module Kettle
         env
       end
 
-      def release_command_uses_kettle_release_secrets?
+      def release_command_delegates_secrets_to_kettle_release?
         kettle_release_supports_direct_secrets? &&
           kettle_release_command?(raw_release_command) &&
+          command_includes_arg?(raw_release_command, "--secrets-provider") &&
           release_secrets_provider_one_password?
       end
 
@@ -1945,6 +2089,8 @@ module Kettle
         when "command_step"
           label = [event["phase"], event["name"]].map(&:to_s).reject(&:empty?).join(":")
           emit_template_event_line(member, template_event_mark(event), label)
+        when "secret_provider"
+          emit_template_event_line(member, release_event_status_mark(event), secret_provider_event_label(event))
         when "diagnostic"
           emit_template_event_line(member, "!", diagnostic_event_label(event))
         when "summary"
@@ -1958,6 +2104,8 @@ module Kettle
           "release"
         when "command_step"
           [event["phase"], event["name"]].map(&:to_s).reject(&:empty?).join(":")
+        when "secret_provider"
+          secret_provider_event_label(event)
         when "diagnostic"
           diagnostic_event_label(event)
         when "summary"
@@ -1973,6 +2121,8 @@ module Kettle
           ">"
         when "command_step"
           template_event_mark(event)
+        when "secret_provider"
+          template_event_mark(event)
         when "diagnostic"
           "!"
         when "summary"
@@ -1995,6 +2145,19 @@ module Kettle
         end
       end
 
+      def secret_provider_event_label(event)
+        action = event["action"].to_s
+        purpose = event["purpose"].to_s
+        label = event["label"].to_s
+        source = event["source"].to_s
+        parts = ["secret"]
+        parts << action unless action.empty?
+        parts << purpose unless purpose.empty?
+        parts << label unless label.empty?
+        parts << source if purpose.empty? && label.empty? && !source.empty?
+        parts.join(":")
+      end
+
       def diagnostic_event_label(event)
         message = event["message"]
         return message.to_s unless message.to_s.empty? || message.is_a?(Hash)
@@ -2240,6 +2403,11 @@ module Kettle
         config.release_normalize_lockfiles? || release_lockfile_has_local_path_remote?(member)
       end
 
+      def release_lockfile_readiness_would_fail?(member)
+        result = ReadinessCheck.call(member: member, config: config, allowed_local_path_roots: release_allowed_local_path_roots)
+        result.stdout.lines.any? { |line| line.start_with?("release lockfile has local path remote at ") }
+      end
+
       def release_lockfile_has_local_path_remote?(member)
         lockfile = File.join(member.root, "Gemfile.lock")
         return false unless File.file?(lockfile)

data/lib/kettle/family.rb

@@ -15,6 +15,7 @@ require_relative "family/branch_target_config"
 require_relative "family/release_state_check"
 require_relative "family/unreleased_gem_cleanup"
 require_relative "family/local_install"
+require_relative "family/nomono_bootstrap"
 require_relative "family/release_waves"
 require_relative "family/workflow"
 require_relative "family/discovery"

data.tar.gz.sig

@@ -1,2 +1 @@
-����F社�M ֥�Z���
r3
-]����.y]��L�f�a�	W�{�k�r!�胆?Ouz�Aw�&�S�W�W��|��i�dv�-˯P�2�=lwN��.(����P=����皑=y>>ԌX��:j`)є�]�:�:����<��b	JfO�K�{H)y�~�(�J���l�o��;K�>!]��xj��u�|/�m���L���=nX�~�}G�`Ž>j'0Ŕ���>�=CDC�nh`߲=~�	��\[I��l.���"���It���]´��⒆[�Ƭ�XA�(Z�.��v
�
+��8�+J�AzфV랱��Q6W�Ky����=E.�������T2;;�c

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.12
+  version: 1.2.13
 platform: ruby
 authors:
 - Peter H. Boling
@@ -74,7 +74,7 @@ dependencies:
         version: '2.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.11
+        version: 2.5.12
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -84,7 +84,7 @@ dependencies:
         version: '2.3'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.11
+        version: 2.5.12
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -321,6 +321,7 @@ files:
 - lib/kettle/family/git_status.rb
 - lib/kettle/family/local_install.rb
 - lib/kettle/family/member.rb
+- lib/kettle/family/nomono_bootstrap.rb
 - lib/kettle/family/orderer.rb
 - lib/kettle/family/readiness_check.rb
 - lib/kettle/family/release_state_check.rb
@@ -341,10 +342,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.12
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.12/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.13
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.13/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.12
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.13
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family