kettle-family 1.2.63 → 1.2.64

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 82adc3fa76e0f5e3cea98f7a02152627353175b2e0aa2b922eeb4905aee9f1a8
-  data.tar.gz: 70094edc544adbdec3240787de1c2e7c8b22e749fe8dfb9e9dca0d97253d00f3
+  metadata.gz: 8f4a6c96b0c56553af85dc48776c9ef380f6fd5800a1f30a43c9d2248fba4808
+  data.tar.gz: 55e68a0f07097017844c35ba1b071fe6d2bcb989a7e054e6e0ec4e7efed78d32
 SHA512:
-  metadata.gz: 571b5e2c915f5dcfa9e5415b6d4a0762f30c6fe005c248c7dd42285f3960f452b74fa8063c5ee05e9eddb2d116c7e5204c353eaed877428727ad238ba83e2d42
-  data.tar.gz: 7f7f630a5f1b06d17ffe8eeb5bef4a20579788bd0b4cebea30c0468763bdbba72cb8507920fe076396124b3cc91efe5ab30c683864a9d9bc4c523b5738142162
+  metadata.gz: aeab70a0e11ad88e43c23de8b0f408006de80a0e551612d777649c159d8ef869fe711a593d0b19706d12df94e17d6dc15fb532b9043a2f67092acf81e71ffd76
+  data.tar.gz: b23ee38b5cd4e71d766fdbcf8543a5a59fcb8a6b7502014f2daea60d47651f02159f0aecf8632f13f3d428bcc17c26ba6678fcffa073672dd34fc6ed07bbfbc0

data/CHANGELOG.md

@@ -30,6 +30,29 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.64] - 2026-08-29
+
+- TAG: [v1.2.64][1.2.64t]
+- COVERAGE: 93.10% -- 5383/5782 lines in 33 files
+- BRANCH COVERAGE: 76.04% -- 2171/2855 branches in 33 files
+- 30.00% documented
+
+### Changed
+
+- Make temporary CI/Appraisal dependency-bundle validation opt-in with release.validate_ci_bundles or --validate-ci-bundles.
+
+### Fixed
+
+- Avoid refreshing inactive conditional Gemfile dependencies during release lockfile reconciliation.
+
+- Avoid probing inactive conditional Gemfile dependencies before release reconciliation.
+
+- Show dependency-floor reconciliation retries before release waves begin.
+
+- Refresh each CI dependency bundle only for family dependencies declared by that bundle.
+
+- Validate mixed release-state selectors before probing member release state.
+
 ## [1.2.63] - 2026-08-28
 
 - TAG: [v1.2.63][1.2.63t]
@@ -2245,7 +2268,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.63...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.64...HEAD
+[1.2.64]: https://github.com/kettle-dev/kettle-family/compare/v1.2.63...v1.2.64
+[1.2.64t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.64
 [1.2.63]: https://github.com/kettle-dev/kettle-family/compare/v1.2.62...v1.2.63
 [1.2.63t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.63
 [1.2.62]: https://github.com/kettle-dev/kettle-family/compare/v1.2.61...v1.2.62

data/README.md

@@ -284,12 +284,17 @@ bundle lock --update RELEASED_MEMBER_NAMES --add-checksums
 
 It then installs that exact locked bundle before starting the dependent release.
 
-The same targeted refresh is applied to the member's CI/Appraisal bundle
-lockfiles when those files are present. The refreshed lockfiles and dependency
-floor changes are committed before that member's release starts, so later
-waves test and publish against the versions produced by earlier waves rather
-than stale published versions. A resumed `--only pend` publish also reconciles
-family dependencies that were published by an earlier invocation.
+The root lockfile refresh and dependency-floor changes are committed before
+that member's release starts, so later waves test and publish against the
+versions produced by earlier waves rather than stale published versions. A
+resumed `--only pend` publish also reconciles family dependencies that were
+published by an earlier invocation.
+
+Use `--validate-ci-bundles` (or `release.validate_ci_bundles: true`) to also
+resolve each CI/Appraisal Gemfile into a temporary lockfile after the root
+refresh. These temporary lockfiles are not committed; this is an optional
+early registry-resolution gate for coordinated releases where waiting for CI
+would be too late to discover an incompatible dependency floor.
 
 This propagation runs for `kettle-family release --execute --publish` when
 `release.auto_dependency_floors` is enabled (the default). It is distinct from
@@ -975,7 +980,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.729-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.782-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/cli.rb

@@ -547,6 +547,7 @@ module Kettle
         option :no_auto_floors, long: "--no-auto-floors", desc: "Do not raise family dependency floors between member releases" do
           options[:no_auto_floors] = true
         end
+        option :validate_ci_bundles, long: "--validate-ci-bundles", desc: "Validate temporary CI/Appraisal bundle locks after dependency-floor refreshes"
         option :accept, desc: "Answer yes to confirmation prompts in interactive commands"
         option :no_accept, long: "--no-accept", desc: "Wait for user input at confirmation prompts" do
           options[:accept] = false
@@ -573,6 +574,7 @@ module Kettle
             release_required_remotes: options[:required_remotes],
             release_secrets_provider: options[:secrets_provider],
             release_auto_dependency_floors: !truthy_option?(:no_auto_floors),
+            release_validate_ci_bundles: truthy_option?(:validate_ci_bundles),
             accept: !options.key?(:accept) || options[:accept],
             tag: truthy_option?(:tag),
             push: truthy_option?(:push)
@@ -685,6 +687,7 @@ module Kettle
           Orderer.new(members: members, mode: config.order_mode, hints: config.order_hints).ordered
         end
         state_event_tape = release_state_event_tape(command: command, config: config, options: options)
+        Selection.validate_release_state_only_filter!(effective_only)
         release_state_results = release_state_results_for_selection(config: config, members: ordered, only: effective_only, jobs: options[:jobs])
         selected = Selection.new(
           members: ordered,
@@ -849,6 +852,7 @@ module Kettle
           required_remotes: options[:release_required_remotes],
           secrets_provider: release_secrets_provider(command: command, config: config, options: options),
           auto_dependency_floors: options[:release_auto_dependency_floors],
+          validate_ci_bundles: options[:release_validate_ci_bundles],
           gha_sha_pins_upgrade: options[:gha_sha_pins_upgrade],
           gha_sha_pins_check: options[:check],
           gha_sha_pins_ttl_days: options[:gha_sha_pins_ttl_days],

data/lib/kettle/family/config.rb

@@ -284,6 +284,10 @@ module Kettle
         fetch_path("release", "auto_dependency_floors") != false
       end
 
+      def release_validate_ci_bundles?
+        fetch_path("release", "validate_ci_bundles") == true
+      end
+
       def release_family_changelog?
         fetch_path("release", "family_changelog", "enabled") == true
       end

data/lib/kettle/family/selection.rb

@@ -21,6 +21,15 @@ module Kettle
         STATUS_TOKEN_KEYS.key?(value.to_s)
       end
 
+      def self.validate_release_state_only_filter!(only)
+        names = only.to_s.split(",").map(&:strip).reject(&:empty?)
+        status_tokens = names.select { |name| status_token?(name) }
+        return if status_tokens.empty?
+
+        member_names = names - status_tokens
+        raise Error, "--only release-state tokens cannot be combined with member names: #{member_names.join(", ")}" unless member_names.empty?
+      end
+
       def initialize(members:, release_state_results: nil, shared_version: false)
         @members = members
         @release_state_results = release_state_results
@@ -47,8 +56,7 @@ module Kettle
 
         status_tokens = names.select { |name| self.class.status_token?(name) }
         unless status_tokens.empty?
-          member_names = names - status_tokens
-          raise Error, "--only release-state tokens cannot be combined with member names: #{member_names.join(", ")}" unless member_names.empty?
+          self.class.validate_release_state_only_filter!(only)
 
           return select_release_state_status(selected, status_tokens)
         end

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.63"
+      VERSION = "1.2.64"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -106,7 +106,7 @@ module Kettle
       REGISTRY_WAIT_ATTEMPTS = 15
       REGISTRY_WAIT_INTERVAL_SECONDS = 15
 
-      def initialize(command:, config:, members:, family_members: nil, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, template_cleanup: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, fast_recovery: nil, fast_recovery_members: nil, skip_ci: false, skip_changelog: false, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, **options)
+      def initialize(command:, config:, members:, family_members: nil, execute: false, accept: true, commit: true, allow_dirty: false, autostash: true, template_cleanup: true, publish: false, push: false, tag: false, start_step: nil, skip_steps: nil, fast_recovery: nil, fast_recovery_members: nil, skip_ci: false, skip_changelog: false, local_ci: false, continue_ci_failures: false, ci_workflows: nil, skip_bundle_audit: false, skip_remotes: nil, required_remotes: nil, auto_dependency_floors: nil, validate_ci_bundles: nil, gha_sha_pins_upgrade: "patch", gha_sha_pins_check: false, gha_sha_pins_ttl_days: nil, env_overrides: {}, debug: false, verbose: false, gem_signing_password: nil, secrets_provider: nil, jobs: nil, progress_io: nil, reset_target: nil, bup_args: [], bex_args: [], start_member: nil, start_branch: nil, **options)
         @command = command
         @config = config
         @members = members
@@ -143,6 +143,7 @@ module Kettle
         @skip_remotes = validate_remote_list(skip_remotes, "--skip-remotes")
         @required_remotes = validate_remote_list(required_remotes.nil? ? config.release_required_remotes : required_remotes, "--required-remotes")
         @auto_dependency_floors = auto_dependency_floors.nil? ? config.release_auto_dependency_floors? : auto_dependency_floors
+        @validate_ci_bundles = validate_ci_bundles.nil? ? config.release_validate_ci_bundles? : validate_ci_bundles
         @gha_sha_pins_upgrade = gha_sha_pins_upgrade
         @gha_sha_pins_check = gha_sha_pins_check
         @gha_sha_pins_ttl_days = gha_sha_pins_ttl_days.nil? ? 1.0 : gha_sha_pins_ttl_days.to_f
@@ -204,7 +205,7 @@ module Kettle
         execute && release_command_delegates_secrets_to_kettle_release?
       end
 
-      attr_reader :command, :config, :members, :family_members, :execute, :accept, :commit, :allow_dirty, :autostash, :template_cleanup, :publish, :push, :tag, :start_step, :skip_steps, :fast_recovery, :fast_recovery_members, :skip_ci, :skip_changelog, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :required_remotes, :auto_dependency_floors, :gha_sha_pins_upgrade, :gha_sha_pins_check, :gha_sha_pins_ttl_days, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
+      attr_reader :command, :config, :members, :family_members, :execute, :accept, :commit, :allow_dirty, :autostash, :template_cleanup, :publish, :push, :tag, :start_step, :skip_steps, :fast_recovery, :fast_recovery_members, :skip_ci, :skip_changelog, :local_ci, :continue_ci_failures, :ci_workflows, :skip_bundle_audit, :skip_remotes, :required_remotes, :auto_dependency_floors, :validate_ci_bundles, :gha_sha_pins_upgrade, :gha_sha_pins_check, :gha_sha_pins_ttl_days, :env_overrides, :debug, :verbose, :jobs, :progress_io, :reset_target, :bup_args, :bex_args, :start_member, :start_branch
 
       def template_with_worktree_sync_results
         runner = command_runner
@@ -1461,14 +1462,43 @@ module Kettle
         published_members = published_family_dependencies_for(release_members)
         return [] if published_members.empty?
 
-        results = []
-        append_dependency_floor_results(
-          released_members: published_members,
-          dependent_members: release_members,
-          runner: release_command_runner,
-          memo: results
+        with_dependency_floor_progress(release_members) do
+          results = []
+          append_dependency_floor_results(
+            released_members: published_members,
+            dependent_members: release_members,
+            runner: release_command_runner,
+            memo: results
+          )
+          results
+        end
+      end
+
+      # Startup reconciliation happens before release waves initialize their
+      # progress renderer. Give its retrying Bundler work a dedicated renderer
+      # so registry propagation is visible instead of appearing hung.
+      def with_dependency_floor_progress(release_members)
+        return yield if @release_progress
+
+        progress = start_dependency_floor_progress(release_members)
+        @release_progress = progress
+        yield
+      ensure
+        progress&.finish
+        @release_progress = nil if progress
+      end
+
+      def start_dependency_floor_progress(release_members)
+        progress = WorkflowProgress.new(
+          io: progress_io,
+          label: "reconciling dependency floors for",
+          total: release_members.length,
+          jobs: 1,
+          members: release_members
         )
-        results
+        progress.start
+        release_members.each { |member| progress.start_member(member, total: 0, status: "dependency floors") }
+        progress
       end
 
       # A resumed --only pend release no longer includes members that finished
@@ -1476,7 +1506,9 @@ module Kettle
       # next release wave so those already-published versions still update
       # sibling floors and lockfiles.
       def published_family_dependencies_for(release_members)
-        dependency_names = release_members.flat_map { |member| release_dependency_names(member) }.uniq
+        dependency_names = release_members.flat_map do |member|
+          publish ? active_release_dependency_names(member) : release_dependency_names(member)
+        end.uniq
         family_members_by_name = family_members.to_h { |member| [member.name, member] }
         dependency_names.filter_map do |dependency_name|
           member = family_members_by_name[dependency_name]
@@ -1497,6 +1529,14 @@ module Kettle
         lockfile_ready_dependent_members = affected_dependent_members.select do |member|
           dependency_floor_refresh_ready?(member, released_members: released_members)
         end
+        lockfile_refresh_members = if execute && publish
+          lockfile_ready_dependent_members.filter_map do |member|
+            active_released_members = active_release_dependencies_for(member, released_members)
+            [member, active_released_members] unless active_released_members.empty?
+          end
+        else
+          []
+        end
         floor_results = DependencyFloor.new(
           released_members: released_members,
           dependent_members: dependent_members,
@@ -1505,16 +1545,18 @@ module Kettle
         memo.concat(floor_results)
         return if floor_results.any? && !floor_results.all?(&:ok?)
 
-        append_dependency_floor_lockfile_results(released_members: released_members, dependent_members: lockfile_ready_dependent_members, runner: runner, memo: memo)
+        append_dependency_floor_lockfile_results(dependent_members: lockfile_refresh_members, runner: runner, memo: memo)
         return if memo.any? && !memo.last.ok?
 
-        append_dependency_floor_bundle_install_results(dependent_members: lockfile_ready_dependent_members, runner: runner, memo: memo)
+        append_dependency_floor_bundle_install_results(dependent_members: lockfile_refresh_members.map(&:first), runner: runner, memo: memo)
         return if memo.any? && !memo.last.ok?
 
-        append_dependency_floor_ci_bundle_results(released_members: released_members, dependent_members: lockfile_ready_dependent_members, runner: runner, memo: memo)
-        return if memo.any? && !memo.last.ok?
+        if validate_ci_bundles
+          append_dependency_floor_ci_bundle_results(dependent_members: lockfile_refresh_members, runner: runner, memo: memo)
+          return if memo.any? && !memo.last.ok?
+        end
 
-        reconciled_members = (floor_results.map(&:member_name) + lockfile_ready_dependent_members.map(&:name)).uniq
+        reconciled_members = (floor_results.map(&:member_name) + lockfile_refresh_members.map { |member, _released_members| member.name }).uniq
         commit_dependency_floor_changes(dependent_members: reconciled_members, runner: runner, memo: memo) if reconciled_members.any? && execute && commit
       end
 
@@ -1540,23 +1582,72 @@ module Kettle
         Array(member.release_dependencies || member.dependencies).map(&:to_s)
       end
 
-      def append_dependency_floor_lockfile_results(released_members:, dependent_members:, runner:, memo:)
+      # Prism-based discovery intentionally includes every literal Gemfile
+      # declaration so release ordering is conservative. Lockfile refreshes
+      # must instead use the Gemfile as evaluated in the release environment:
+      # optional local/template declarations are not valid --update targets.
+      def active_release_dependencies_for(member, released_members)
+        runtime_names = Array(member.dependencies).map(&:to_s)
+        gemfile_candidates = released_members.reject { |released_member| runtime_names.include?(released_member.name) }
+        return released_members if gemfile_candidates.empty?
+
+        active_names = active_release_dependency_names(member)
+        released_members.select { |released_member| active_names.include?(released_member.name) }
+      end
+
+      def active_release_dependency_names(member)
+        active_release_dependency_names_for_gemfile(member, File.join(member.root, "Gemfile"))
+      end
+
+      def active_release_dependency_names_for_gemfile(member, gemfile)
+        (Array(member.dependencies).map(&:to_s) + active_release_gemfile_dependency_names(member, gemfile)).reject do |name|
+          name == member.name
+        end
+      end
+
+      def active_release_gemfile_dependency_names(member, gemfile = File.join(member.root, "Gemfile"))
+        return [] unless File.file?(gemfile)
+
+        script = <<~RUBY
+          require "bundler"
+          dsl = Bundler::Dsl.evaluate(ARGV.fetch(0), nil, {})
+          puts dsl.dependencies.map(&:name)
+        RUBY
+        stdout, stderr, status = Open3.capture3(
+          release_lockfile_env(member).compact,
+          RbConfig.ruby,
+          "-e",
+          script,
+          gemfile,
+          chdir: member.root
+        )
+        unless status.success?
+          raise Error, "could not evaluate release Gemfile for #{member.name}: #{stderr.strip}"
+        end
+
+        stdout.lines.map(&:strip).reject(&:empty?).uniq
+      end
+
+      def append_dependency_floor_lockfile_results(dependent_members:, runner:, memo:)
         return unless execute && publish
         return if dependent_members.empty?
 
-        dependent_members.each do |member|
+        dependent_members.each do |member, released_members|
           memo << wait_for_dependency_floor_lockfiles_result(member: member, released_members: released_members, runner: runner)
           break unless memo.last.ok?
         end
       end
 
-      def append_dependency_floor_ci_bundle_results(released_members:, dependent_members:, runner:, memo:)
+      def append_dependency_floor_ci_bundle_results(dependent_members:, runner:, memo:)
         return unless execute && publish
         return if dependent_members.empty?
 
-        dependent_members.each do |member|
+        dependent_members.each do |member, released_members|
           dependency_floor_ci_bundle_gemfiles(member).each do |gemfile|
-            memo << wait_for_dependency_floor_ci_bundle_result(member: member, gemfile: gemfile, released_members: released_members, runner: runner)
+            gemfile_released_members = active_release_dependencies_for_gemfile(member, gemfile, released_members)
+            next if gemfile_released_members.empty?
+
+            memo << wait_for_dependency_floor_ci_bundle_result(member: member, gemfile: gemfile, released_members: gemfile_released_members, runner: runner)
             break unless memo.last.ok?
           end
           break if memo.any? && !memo.last.ok?
@@ -1686,6 +1777,11 @@ module Kettle
         end.uniq.sort
       end
 
+      def active_release_dependencies_for_gemfile(member, gemfile, released_members)
+        active_names = active_release_dependency_names_for_gemfile(member, gemfile)
+        released_members.select { |released_member| active_names.include?(released_member.name) }
+      end
+
       def workflow_bundle_gemfiles(member)
         Dir.glob(File.join(member.root, ".github", "workflows", "*.{yml,yaml}")).flat_map do |path|
           workflow_bundle_gemfile_entries(path).map do |entry|

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.63
+  version: 1.2.64
 platform: ruby
 authors:
 - Peter H. Boling
@@ -74,7 +74,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.4
+        version: 1.0.5
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -84,7 +84,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.4
+        version: 1.0.5
 - !ruby/object:Gem::Dependency
   name: kettle-dev
   requirement: !ruby/object:Gem::Requirement
@@ -441,10 +441,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.63
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.63/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.64
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.64/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.63
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.64
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family