kettle-family 1.2.43 → 1.2.44

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 7523326b5f3b8b9054549b7165c52239703ac08777908b191f9f52cc83b0bd1c
-  data.tar.gz: aa023d785f2ca0ebe7b5ac28618e0a286f906ae0f14afd7f11e500148ab1ee83
+  metadata.gz: 58ad6d307a8fcb8dc7a2911a7b1cb1c62928e130af9df80e13466158b5dc0441
+  data.tar.gz: 0e296343ddab05057267fc2f698cc0c9292d491bfd20c300dcc117d89b3b9346
 SHA512:
-  metadata.gz: dd3e08b8bfe3630ad23053bf62c1b45daa94e3e2b662997745f03356dd83c1e8dd1d8432cb450fed2b38f520243f729b497f43daa20fc51607a1cadea67df807
-  data.tar.gz: 04a575545f930613a4eed5b39991949143acf9718c41eb2c764e73a884e253364ab16cec68ba4c606aaefb29653d523bc643d4057f04adeacfd9c102cf578c61
+  metadata.gz: 3d6ffcef4f61673a66ad8c3dc816a8fcc37c09c8b07a3ef0f2fa8b3a777517f110689922edce9c9b7f76cc5f5d9a9c64409df30e73f9c5f49df4bdd0bf10b5e0
+  data.tar.gz: 58d68a7bc24ef399531c17f42fb3e6b6f8d3bc03db7dd5b18049721b0c9d4372c0f1ac4209d587f28d63e2665e7ee9c7a092cbfb1ae0ca7974b8146c4843ab22

data/CHANGELOG.md

@@ -30,6 +30,21 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.44] - 2026-08-09
+
+- TAG: [v1.2.44][1.2.44t]
+- COVERAGE: 93.57% -- 5091/5441 lines in 32 files
+- BRANCH COVERAGE: 76.05% -- 2042/2685 branches in 32 files
+- 29.72% documented
+
+### Changed
+
+- Review deduplicated GitHub Actions metadata once per family, then run member pin updates in strict offline mode with configurable cache TTL.
+
+### Fixed
+
+- Buffer interactive release prompts across PTY reads so split RubyGems MFA prompts are answered and surfaced through the dedicated notification line.
+
 ## [1.2.43] - 2026-08-08
 
 - TAG: [v1.2.43][1.2.43t]
@@ -1962,7 +1977,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.43...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.44...HEAD
+[1.2.44]: https://github.com/kettle-dev/kettle-family/compare/v1.2.43...v1.2.44
+[1.2.44t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.44
 [1.2.43]: https://github.com/kettle-dev/kettle-family/compare/v1.2.42...v1.2.43
 [1.2.43t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.43
 [1.2.42]: https://github.com/kettle-dev/kettle-family/compare/v1.2.41...v1.2.42

data/README.md

@@ -398,11 +398,16 @@ members:
 kettle-family gha-sha-pins
 kettle-family gha-sha-pins --execute
 kettle-family gha-sha-pins --execute --upgrade minor
+kettle-family gha-sha-pins --execute --upgrade major --ttl 0
 ```
 
-The family command name is retained for compatibility, but it delegates to
-the current `kettle-gha-pins` executable for each selected member. The older
-`kettle-gha-sha-pins` executable is a legacy direct entrypoint.
+The family command inventories action repositories across the selected members,
+reviews the deduplicated set once using the shared cache, and then runs each
+member's pin update in strict offline mode. `--ttl DAYS` controls when the
+family review refreshes cached action metadata; `--ttl 0` forces a refresh. The
+member-level `--upgrade` and `--check --cooldown-days DAYS` options remain
+responsible for deciding whether individual pins need changes or should block a
+release. The older `kettle-gha-sha-pins` executable is a legacy direct entrypoint.
 
 Run release prep/build phases without publishing:
 
@@ -845,7 +850,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.402-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.441-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/cli.rb

@@ -156,6 +156,7 @@ module Kettle
             check: truthy_option?(:check),
             from_version: nil,
             gha_sha_pins_upgrade: "patch",
+            gha_sha_pins_ttl_days: options[:ttl],
             publish: false,
             release_start_step: nil,
             release_skip_steps: nil,
@@ -389,10 +390,15 @@ module Kettle
         option :upgrade, value: {type: String, usage: "LEVEL"}, desc: "SHA pin upgrade strategy: major, minor, patch" do |value|
           options[:upgrade] = parse_gha_sha_pins_upgrade(value)
         end
+        option :ttl, value: {type: Float, usage: "DAYS"}, desc: "Cache TTL for action metadata review (default: 1 day)" do |value|
+          raise OptionParser::InvalidArgument, "--ttl must be non-negative" if value.negative?
+
+          options[:ttl] = value
+        end
 
         def run(*args)
           unexpected_arguments!(args)
-          run_family("gha-sha-pins", gha_sha_pins_upgrade: options[:upgrade] || "patch")
+          run_family("gha-sha-pins", gha_sha_pins_upgrade: options[:upgrade] || "patch", gha_sha_pins_ttl_days: options[:ttl])
         end
       end
 
@@ -783,6 +789,7 @@ module Kettle
           auto_dependency_floors: options[:release_auto_dependency_floors],
           gha_sha_pins_upgrade: options[:gha_sha_pins_upgrade],
           gha_sha_pins_check: options[:check],
+          gha_sha_pins_ttl_days: options[:gha_sha_pins_ttl_days],
           env_overrides: options[:workflow_env],
           debug: options[:debug],
           verbose: options[:verbose],

data/lib/kettle/family/command_runner.rb

@@ -349,6 +349,7 @@ module Kettle
         stdout = +""
         stderr = +""
         stdout_line_buffer = +""
+        prompt_buffer = +""
         status = nil
         PTY.spawn(env, *argv, chdir: chdir, **process_options) do |output, input, pid|
           begin
@@ -362,7 +363,7 @@ module Kettle
                   stdout << chunk
                   transcript_write(log_io, chunk)
                   stdout_line_buffer = print_interactive_stdout(stdout_line_buffer, chunk, stdout_line_handler, passthrough_output: passthrough_output)
-                  handle_interactive_prompt(input, chunk, member_name: member_name)
+                  prompt_buffer = handle_interactive_prompt(input, chunk, member_name: member_name, prompt_buffer: prompt_buffer)
                 else
                   chunk = $stdin.readpartial(1024)
                   input.write(chunk)
@@ -387,6 +388,7 @@ module Kettle
         captured_stdout = +""
         captured_stderr = +""
         stdout_line_buffer = +""
+        prompt_buffer = +""
         status = nil
         Open3.popen3(env, *argv, chdir: chdir, **process_options) do |input, output, error, wait_thread|
           readers = [output, error]
@@ -398,7 +400,7 @@ module Kettle
                 if reader.equal?($stdin)
                   input.write($stdin.readpartial(1024))
                 else
-                  stdout_line_buffer = read_interactive_stream(
+                  stdout_line_buffer, prompt_buffer = read_interactive_stream(
                     reader,
                     output,
                     input,
@@ -409,7 +411,8 @@ module Kettle
                     stdout_line_buffer: stdout_line_buffer,
                     stdout_line_handler: stdout_line_handler,
                     log_io: log_io,
-                    passthrough_output: passthrough_output
+                    passthrough_output: passthrough_output,
+                    prompt_buffer: prompt_buffer
                   )
                 end
               end
@@ -437,6 +440,7 @@ module Kettle
         member_name:,
         stdout_line_buffer:,
         stdout_line_handler:,
+        prompt_buffer:,
         log_io: nil,
         passthrough_output: true
       )
@@ -450,11 +454,11 @@ module Kettle
           transcript_write(log_io, chunk)
           $stderr.print(chunk) if passthrough_output
         end
-        handle_interactive_prompt(input, chunk, member_name: member_name)
-        stdout_line_buffer
+        prompt_buffer = handle_interactive_prompt(input, chunk, member_name: member_name, prompt_buffer: prompt_buffer)
+        [stdout_line_buffer, prompt_buffer]
       rescue EOFError
         readers.delete(reader)
-        stdout_line_buffer
+        [stdout_line_buffer, prompt_buffer]
       end
 
       def with_transcript(log_path, argv:, chdir:)
@@ -528,18 +532,26 @@ module Kettle
         input.flush
       end
 
-      def handle_interactive_prompt(input, chunk, member_name: nil)
-        if otp_prompt?(chunk)
-          write_otp_response(input, chunk, member_name: member_name) if otp_coordinator && otp_response_prompt?(chunk)
-          return
+      def handle_interactive_prompt(input, chunk, member_name: nil, prompt_buffer: nil)
+        prompt_buffer = prompt_buffer.to_s.dup
+        prompt_buffer << chunk.to_s
+        prompt_buffer = prompt_buffer.byteslice([prompt_buffer.bytesize - 4096, 0].max, 4096).to_s
+
+        if otp_prompt?(prompt_buffer)
+          if otp_coordinator && otp_response_prompt?(prompt_buffer)
+            write_otp_response(input, prompt_buffer, member_name: member_name)
+            return +""
+          end
+          return prompt_buffer
         end
 
-        if accept_confirmation_prompt?(chunk)
+        if accept_confirmation_prompt?(prompt_buffer)
           write_accept_response(input) if accept
-          return
+          return +""
         end
 
-        write_signing_password(input, chunk)
+        write_signing_password(input, prompt_buffer)
+        prompt_buffer
       end
 
       def write_accept_response(input)

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.43"
+      VERSION = "1.2.44"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -102,7 +102,7 @@ module Kettle
       REGISTRY_WAIT_ATTEMPTS = 15
       REGISTRY_WAIT_INTERVAL_SECONDS = 15
 
-      def initialize(command:, config:, members:, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, **options)
+      def initialize(command:, config:, members:, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, **options)
         @command = command
         @config = config
         @members = members
@@ -125,6 +125,7 @@ module Kettle
         @auto_dependency_floors = auto_dependency_floors.nil? ? config.release_auto_dependency_floors? : auto_dependency_floors
         @gha_sha_pins_upgrade = gha_sha_pins_upgrade
         @gha_sha_pins_check = gha_sha_pins_check
+        @gha_sha_pins_ttl_days = gha_sha_pins_ttl_days.nil? ? 1.0 : gha_sha_pins_ttl_days.to_f
         @env_overrides = env_overrides
         @debug = debug
         @verbose = verbose
@@ -165,7 +166,7 @@ module Kettle
 
       private
 
-      attr_reader :command, :config, :members, :execute, :accept, :commit, :allow_dirty, :autostash, :publish, :push, :tag, :start_step, :skip_steps, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :required_remotes, :auto_dependency_floors, :gha_sha_pins_upgrade, :gha_sha_pins_check, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
+      attr_reader :command, :config, :members, :execute, :accept, :commit, :allow_dirty, :autostash, :publish, :push, :tag, :start_step, :skip_steps, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :required_remotes, :auto_dependency_floors, :gha_sha_pins_upgrade, :gha_sha_pins_check, :gha_sha_pins_ttl_days, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
 
       def template_with_worktree_sync_results
         runner = command_runner
@@ -441,8 +442,12 @@ module Kettle
         return template_member_workflow_results(workflow_members) if command == "template" && execute
 
         runner = CommandRunner.new(execute: execute, accept: accept)
+        results = []
+        if command == "gha-sha-pins" && execute
+          return results unless review_gha_sha_pins(workflow_members, runner: runner, memo: results)
+        end
         gha_progress = (command == "gha-sha-pins") ? start_gha_sha_pins_progress(workflow_members) : nil
-        results = workflow_members.each_with_object([]) do |member, memo|
+        workflow_members.each_with_object(results) do |member, memo|
           if command == "template" && config.normalize_lockfiles?
             normalize_lockfiles(member: member, runner: runner, memo: memo, phase: "prepare_lockfiles")
             break memo unless memo.last.ok?
@@ -480,6 +485,58 @@ module Kettle
         results
       end
 
+      def review_gha_sha_pins(workflow_members, runner:, memo:)
+        return true if workflow_members.empty?
+
+        repositories = []
+        workflow_members.each do |member|
+          result = runner.call(
+            member: member,
+            phase: "gha_sha_pins_list",
+            command: gha_sha_pins_command(mode: :list),
+            env: command_env
+          )
+          memo << result
+          return false unless result.ok?
+
+          payload = JSON.parse(result.stdout.to_s)
+          repositories.concat(Array(payload["repositories"]))
+        rescue JSON::ParserError => error
+          memo << CommandResult.new(
+            member_name: member.name,
+            phase: "gha_sha_pins_list",
+            command: gha_sha_pins_command(mode: :list),
+            workdir: member.root,
+            status: 1,
+            success: false,
+            stdout: result&.stdout.to_s,
+            stderr: "invalid kettle-gha-pins list JSON: #{error.message}",
+            elapsed_seconds: 0.0,
+            skipped: false,
+            reason: "invalid list output"
+          )
+          return false
+        end
+
+        review_dir = File.join(config.root, "tmp", "kettle-family")
+        FileUtils.mkdir_p(review_dir)
+        review_path = File.join(
+          review_dir,
+          "gha-sha-pins-review-#{Process.pid}-#{object_id}.json"
+        )
+        File.write(review_path, JSON.pretty_generate("schema_version" => 1, "repositories" => repositories.uniq.sort))
+        review_result = runner.call(
+          member: workflow_members.first,
+          phase: "gha_sha_pins_review",
+          command: gha_sha_pins_command(mode: :review, input: review_path),
+          env: command_env
+        )
+        memo << review_result
+        review_result.ok?
+      ensure
+        File.delete(review_path) if review_path && File.file?(review_path)
+      end
+
       def template_member_workflow_results(workflow_members)
         debugger_results = template_debugger_bootstrap_results(workflow_members)
         return debugger_results unless debugger_results.all?(&:ok?)
@@ -2341,11 +2398,18 @@ module Kettle
         ["bundle", "exec", *Array(bex_args).map(&:to_s)]
       end
 
-      def gha_sha_pins_command
+      def gha_sha_pins_command(mode: nil, input: nil)
         command_text = command_for(command)
         args = []
+        if mode == :list
+          return append_command_args(command_text, ["--list", "--json"])
+        end
+        if mode == :review
+          return append_command_args(command_text, ["--review", "--input", input.to_s, "--ttl", gha_sha_pins_ttl_days.to_s, "--json"])
+        end
         args << (gha_sha_pins_check ? "--check" : "--write") unless command_includes_any?(command_text, %w[--check --write])
         args.concat(["--upgrade", gha_sha_pins_upgrade]) unless command_includes_arg?(command_text, "--upgrade")
+        args << "--offline" if execute && !command_includes_arg?(command_text, "--offline")
         args << "--events" unless command_includes_arg?(command_text, "--events")
         append_command_args(command_text, args)
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.43
+  version: 1.2.44
 platform: ruby
 authors:
 - Peter H. Boling
@@ -360,10 +360,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.43
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.43/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.44
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.44/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.43
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.44
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family