kettle-family 1.2.46 → 1.2.47

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 927dd8ea2185b00cfff68f01eb09a93d0a1b7f48fcb2fc3c2a9c52b0c76898aa
-  data.tar.gz: a2d7f81ebc0e07a395bfefbf72685c6dff5951e5440c7f4f6e53904a16dace28
+  metadata.gz: c628becd2f2b6b83516a9e8a4eaca11802e8080cb0bbbd38eede2cc609d5ef3f
+  data.tar.gz: bb7cb06c355256f93d0acceef553ac25b2ccc6a42c2890c3beb094bd2be4a795
 SHA512:
-  metadata.gz: ff77a0078c229e82e5d04952006502e188f26df36621079af986af2807dd2117988f7dbd0e8d5159f67669198fd275860e757ac3f3f0b4b558a7697a619e6e03
-  data.tar.gz: 75eca26e357b3570335ac16bd3668c01b3ab8482f6813431ad22e550b47bc5961432bcc1e88f7f83b57411c75fa55983e25ca1c77d0b1d4f8c754c52bf3f1b31
+  metadata.gz: 2e439b1c7f07dff944bf25a14c4827c4ca82645324cd84cce424ebb3cb0070080c647fb8571aa3f4666e1e05d91d4edfc634300eef70c5a990386428fc2bc20b
+  data.tar.gz: 419731e66a639aa39874168a2defa4a49b18c0cfa0decd07252c464dbddc85838c84169e668cc5897de61374ef6c831e2f163900167c1e06cd46fd247f2b8e7b

data/CHANGELOG.md

@@ -30,6 +30,23 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.47] - 2026-08-10
+
+- TAG: [v1.2.47][1.2.47t]
+- COVERAGE: 93.58% -- 5161/5515 lines in 33 files
+- BRANCH COVERAGE: 76.15% -- 2066/2713 branches in 33 files
+- 29.86% documented
+
+### Fixed
+
+- Share one authenticated release secret session with member kettle-release processes without repeating 1Password authorization prompts.
+
+- Review GitHub Actions pins once during family releases and run member pre-release pin checks from the reviewed cache.
+
+- Keep centralized GitHub Actions pin review payloads in release logs instead of replaying verbose JSON in terminal reports.
+
+- Continue release preflight after successful GitHub Actions pin review.
+
 ## [1.2.46] - 2026-08-10
 
 - TAG: [v1.2.46][1.2.46t]
@@ -2003,7 +2020,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.46...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.47...HEAD
+[1.2.47]: https://github.com/kettle-dev/kettle-family/compare/v1.2.46...v1.2.47
+[1.2.47t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.47
 [1.2.46]: https://github.com/kettle-dev/kettle-family/compare/v1.2.45...v1.2.46
 [1.2.46t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.46
 [1.2.45]: https://github.com/kettle-dev/kettle-family/compare/v1.2.44...v1.2.45

data/README.md

@@ -850,7 +850,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.429-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.515-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/report.rb

@@ -220,6 +220,11 @@ module Kettle
       end
 
       def append_result_stdout(lines, result)
+        if machine_readable_result?(result)
+          append_result_log_path(lines, result) unless result.ok?
+          return
+        end
+
         if suppress_success_output?(result)
           append_result_log_path(lines, result) unless result.ok?
           return
@@ -245,6 +250,10 @@ module Kettle
         result.stdout.to_s.empty? || (command == "template" && result.ok?)
       end
 
+      def machine_readable_result?(result)
+        command == "release" && %w[gha_sha_pins_list gha_sha_pins_review].include?(result.phase.to_s)
+      end
+
       def template_event_stdout?(result)
         command == "template" && template_events(result.stdout).any?
       end

data/lib/kettle/family/secrets_broker.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "json"
+require "securerandom"
+require "socket"
+
+module Kettle
+  module Family
+    module Secrets
+      # Serves release secret requests from member kettle-release processes.
+      # The family owns the configured provider and serializes all requests so
+      # one release session is shared across sequential and parallel waves.
+      class Broker
+        OPERATIONS = %w[gem_signing_passphrase rubygems_otp].freeze
+
+        attr_reader :path
+
+        def initialize(provider:, root:)
+          @provider = provider
+          directory = File.join(root, "tmp", "kettle-family")
+          FileUtils.mkdir_p(directory, mode: 0o700)
+          @path = File.join(directory, "secrets-#{SecureRandom.hex(8)}.sock")
+          @mutex = Mutex.new
+          @closed = false
+        end
+
+        def start
+          @server = UNIXServer.new(@path)
+          File.chmod(0o600, @path)
+          @thread = Thread.new { serve } # rubocop:disable ThreadSafety/NewThread -- Broker owns one listener for the family release session.
+          self
+        rescue
+          close
+          raise
+        end
+
+        def close
+          @closed = true
+          @server&.close
+          @thread&.join(1)
+        ensure
+          @thread&.kill if @thread&.alive?
+          FileUtils.rm_f(@path)
+        end
+
+        private
+
+        attr_reader :provider
+
+        def serve
+          loop do
+            break if @closed
+
+            client = @server.accept
+            Thread.new(client) { |connection| handle(connection) } # rubocop:disable ThreadSafety/NewThread -- Each socket request is isolated from the listener.
+          end
+        rescue IOError, Errno::EBADF
+          return if @closed
+
+          raise
+        end
+
+        def handle(connection)
+          request = JSON.parse(connection.gets.to_s)
+          operation = request.fetch("operation")
+          raise Error, "unsupported release secrets broker operation #{operation.inspect}" unless OPERATIONS.include?(operation)
+
+          value = @mutex.synchronize { provider.public_send(operation) }
+          connection.write(JSON.generate("ok" => true, "value" => value.to_s))
+          connection.write("\n")
+        rescue => error
+          connection.write(JSON.generate("ok" => false, "error" => error.message))
+          connection.write("\n")
+        ensure
+          connection&.close
+        end
+      end
+    end
+  end
+end

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.46"
+      VERSION = "1.2.47"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -143,13 +143,7 @@ module Kettle
 
       def results
         if command == "release" && execute
-          release_preflight = release_preflight_results
-          return release_preflight unless release_preflight.empty?
-
-          return branch_target_results unless config.release_target_branches.empty?
-          return member_local_branch_target_results if member_local_branch_targets?
-
-          return current_branch_results(members)
+          return with_release_secrets_broker { release_results }
         end
 
         return template_with_worktree_sync_results if command == "template" && execute
@@ -166,6 +160,30 @@ module Kettle
 
       private
 
+      def release_results
+        release_preflight = release_preflight_results
+        return release_preflight unless release_preflight.empty?
+
+        return branch_target_results unless config.release_target_branches.empty?
+        return member_local_branch_target_results if member_local_branch_targets?
+
+        current_branch_results(members)
+      end
+
+      def with_release_secrets_broker
+        return yield unless release_secrets_broker_required?
+
+        @release_secrets_broker = Secrets::Broker.new(provider: @secrets_provider, root: config.root).start
+        yield
+      ensure
+        @release_secrets_broker&.close
+        @release_secrets_broker = nil
+      end
+
+      def release_secrets_broker_required?
+        execute && release_command_delegates_secrets_to_kettle_release?
+      end
+
       attr_reader :command, :config, :members, :execute, :accept, :commit, :allow_dirty, :autostash, :publish, :push, :tag, :start_step, :skip_steps, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :required_remotes, :auto_dependency_floors, :gha_sha_pins_upgrade, :gha_sha_pins_check, :gha_sha_pins_ttl_days, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
 
       def template_with_worktree_sync_results
@@ -485,7 +503,7 @@ module Kettle
         results
       end
 
-      def review_gha_sha_pins(workflow_members, runner:, memo:)
+      def review_gha_sha_pins(workflow_members, runner:, memo:, env: command_env)
         return true if workflow_members.empty?
 
         repositories = []
@@ -493,8 +511,9 @@ module Kettle
           result = runner.call(
             member: member,
             phase: "gha_sha_pins_list",
-            command: gha_sha_pins_command(mode: :list),
-            env: command_env
+            command: gha_sha_pins_command(mode: :list, command_text: command_for("gha-sha-pins")),
+            env: env,
+            log_path: gha_sha_pins_log_path(member, phase: "list")
           )
           memo << result
           return false unless result.ok?
@@ -505,7 +524,7 @@ module Kettle
           memo << CommandResult.new(
             member_name: member.name,
             phase: "gha_sha_pins_list",
-            command: gha_sha_pins_command(mode: :list),
+            command: gha_sha_pins_command(mode: :list, command_text: command_for("gha-sha-pins")),
             workdir: member.root,
             status: 1,
             success: false,
@@ -513,7 +532,8 @@ module Kettle
             stderr: "invalid kettle-gha-pins list JSON: #{error.message}",
             elapsed_seconds: 0.0,
             skipped: false,
-            reason: "invalid list output"
+            reason: "invalid list output",
+            log_path: result&.log_path
           )
           return false
         end
@@ -528,8 +548,9 @@ module Kettle
         review_result = runner.call(
           member: workflow_members.first,
           phase: "gha_sha_pins_review",
-          command: gha_sha_pins_command(mode: :review, input: review_path),
-          env: command_env
+          command: gha_sha_pins_command(mode: :review, input: review_path, command_text: command_for("gha-sha-pins")),
+          env: env,
+          log_path: gha_sha_pins_log_path(workflow_members.first, phase: "review")
         )
         memo << review_result
         review_result.ok?
@@ -537,6 +558,16 @@ module Kettle
         File.delete(review_path) if review_path && File.file?(review_path)
       end
 
+      def gha_sha_pins_log_path(member, phase:)
+        safe_name = member.name.to_s.gsub(/[^A-Za-z0-9_.-]+/, "_")
+        File.join(
+          config.root,
+          "tmp",
+          "kettle-family",
+          "gha-sha-pins-#{Process.pid}-#{object_id}-#{safe_name}-#{phase}.log"
+        )
+      end
+
       def template_member_workflow_results(workflow_members)
         debugger_results = template_debugger_bootstrap_results(workflow_members)
         return debugger_results unless debugger_results.all?(&:ok?)
@@ -867,12 +898,13 @@ module Kettle
           label = phase.fetch(:label)
           progress&.update(preflight_member, status: label, mark: ">")
           result = send(phase.fetch(:method))
-          progress&.advance(preflight_member, status: label, success: result.empty?, mark: result.empty? ? "." : "F")
-          unless result.empty?
+          failed = result.any? { |entry| !entry.ok? }
+          progress&.advance(preflight_member, status: label, success: !failed, mark: failed ? "F" : ".")
+          if failed
             progress&.finish_member(preflight_member, success: false, status: label)
             progress&.stop
+            return result
           end
-          return result unless result.empty?
         end
         progress&.finish_member(preflight_member, success: true, status: "ok")
         progress&.stop
@@ -883,12 +915,27 @@ module Kettle
         dirty_phase = {label: "branch checkout readiness", method: :release_preflight_branch_checkout_dirty_results}
         signing_phase = {label: "gem signing password", method: :release_preflight_signing_password_results}
         secrets_phase = release_secrets_authorization_required? ? {label: "secrets provider authorization", method: :release_preflight_secrets_authorization_results} : nil
+        gha_sha_pins_phase = release_gha_sha_pins_review_required? ? {label: "GitHub Actions SHA pins", method: :release_preflight_gha_sha_pins_results} : nil
 
-        if secrets_phase
-          [secrets_phase, dirty_phase, signing_phase]
-        else
-          [dirty_phase, signing_phase]
-        end
+        [secrets_phase, gha_sha_pins_phase, dirty_phase, signing_phase].compact
+      end
+
+      def release_preflight_gha_sha_pins_results
+        results = []
+        review_gha_sha_pins(members, runner: command_runner, memo: results, env: command_env)
+        results
+      end
+
+      def release_gha_sha_pins_review_required?
+        execute && kettle_release_command?(raw_release_command) && !release_gha_sha_pins_offline_requested?
+      end
+
+      def release_gha_sha_pins_offline_requested?
+        value = env_overrides.fetch(
+          "KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE",
+          ENV.fetch("KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE", "")
+        )
+        %w[true yes 1 on enabled].include?(value.to_s.strip.downcase)
       end
 
       def release_preflight_branch_checkout_dirty_results
@@ -1919,6 +1966,7 @@ module Kettle
       end
 
       def append_kettle_release_args(command)
+        command = replace_kettle_release_provider(command) if @release_secrets_broker
         args = []
         args << "start_step=#{start_step}" if start_step
         args << "skip_steps=#{skip_steps}" if skip_steps && !skip_steps.to_s.empty?
@@ -1928,7 +1976,8 @@ module Kettle
         args << "--skip-remotes=#{skip_remotes}" if skip_remotes && !skip_remotes.to_s.empty?
         args << "--required-remotes=#{required_remotes}" if required_remotes && !required_remotes.to_s.empty?
         if release_command_delegates_secrets_to_kettle_release? && !command_includes_arg?(command, "--secrets-provider")
-          args << "--secrets-provider=1password"
+          args << "--secrets-provider=family" if @release_secrets_broker
+          args << "--secrets-provider=1password" unless @release_secrets_broker
         end
         args << "--yes" if release_command_uses_kettle_release_yes? && !command_includes_arg?(command, "--yes")
         args << "--events" unless command_includes_arg?(command, "--events")
@@ -1937,6 +1986,15 @@ module Kettle
         command.is_a?(Array) ? [*command, *args] : "#{command} #{args.join(" ")}"
       end
 
+      def replace_kettle_release_provider(command)
+        case command
+        when Array
+          command.map { |part| part.to_s.gsub(/--secrets-provider(?:=|\s+)\S+/, "--secrets-provider=family") }
+        else
+          command.to_s.gsub(/--secrets-provider(?:=|\s+)\S+/, "--secrets-provider=family")
+        end
+      end
+
       def release_command_uses_kettle_release_yes?
         accept && kettle_release_command?(raw_release_command)
       end
@@ -1982,6 +2040,12 @@ module Kettle
       def release_env_for_member(member)
         env = release_env
         env.merge!(release_wave_local_path_env_for(member))
+        # Family release performs one live pin review before member releases.
+        # Child kettle-release must consume that reviewed cache instead of
+        # repeating the GitHub API lookup for every member.
+        if release_gha_sha_pins_review_required? || release_gha_sha_pins_offline_requested?
+          env["KETTLE_PRE_RELEASE_GHA_SHA_PINS_OFFLINE"] = "true"
+        end
         # Run the member's kettle-release from the local kettle-dev checkout
         # when the family workflow itself is using local release tooling. The
         # child release commands disable local dependency paths explicitly;
@@ -2151,10 +2215,11 @@ module Kettle
 
         secrets_config = config.release_secrets
         env = {
-          "KETTLE_RELEASE_SECRETS_PROVIDER" => "1password",
+          "KETTLE_RELEASE_SECRETS_PROVIDER" => @release_secrets_broker ? "family" : "1password",
           "KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE_SOURCE" => "cached",
           "KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE" => @gem_signing_password.to_s
         }
+        env["KETTLE_RELEASE_SECRETS_BROKER"] = @release_secrets_broker.path if @release_secrets_broker
         {
           "account" => "KETTLE_RELEASE_1PASSWORD_ACCOUNT",
           "cli" => "KETTLE_RELEASE_1PASSWORD_CLI",
@@ -2372,8 +2437,8 @@ module Kettle
         ["bundle", "exec", *Array(bex_args).map(&:to_s)]
       end
 
-      def gha_sha_pins_command(mode: nil, input: nil)
-        command_text = command_for(command)
+      def gha_sha_pins_command(mode: nil, input: nil, command_text: nil)
+        command_text ||= command_for(command)
         args = []
         if mode == :list
           return append_command_args(command_text, ["--list", "--json"])

data/lib/kettle/family.rb

@@ -10,6 +10,7 @@ require_relative "family/git_status"
 require_relative "family/branch_lane_audit"
 require_relative "family/config"
 require_relative "family/secrets"
+require_relative "family/secrets_broker"
 require_relative "family/branch_target_config"
 require_relative "family/release_state_event_tape"
 require_relative "family/release_state_check"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.46
+  version: 1.2.47
 platform: ruby
 authors:
 - Peter H. Boling
@@ -71,7 +71,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.26
+        version: 3.0.2
     - - "<"
       - !ruby/object:Gem::Version
         version: 4.0.0
@@ -81,7 +81,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.26
+        version: 3.0.2
     - - "<"
       - !ruby/object:Gem::Version
         version: 4.0.0
@@ -347,6 +347,7 @@ files:
 - lib/kettle/family/release_waves.rb
 - lib/kettle/family/report.rb
 - lib/kettle/family/secrets.rb
+- lib/kettle/family/secrets_broker.rb
 - lib/kettle/family/selection.rb
 - lib/kettle/family/unreleased_gem_cleanup.rb
 - lib/kettle/family/version.rb
@@ -360,10 +361,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.46
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.46/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.47
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.47/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.46
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.47
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family