kettle-family 1.2.65 → 1.2.66

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 91689a2523f60872d8bf698271affca29c3a9149510543f87b3df956300527a2
-  data.tar.gz: cab4664fe55f396532f46d0f808398d43880830baa824d41da9ffeb55a3d2659
+  metadata.gz: 2a19cf5604af70e74e9f7b12803c1d4fceb80f5ec66975c4f6ebc418a20b950f
+  data.tar.gz: 40529c2035a5896477c17d34eb7ac1d38904acbfddb831220ffd9b68c301f112
 SHA512:
-  metadata.gz: 1efb4bbb117cba0494d53461f06b3921eef031dec347f905ada977116335c1f65d980e0909906f8d6bcf78e42a4902332fa4f28ab57d0c8a5634f5310d5c3a93
-  data.tar.gz: d3098d0dbe835bd746a7b0e93f524d22bf2007e19cb6968ef09a3a0f34486893edb84385fb6deaf8d8eb1984d0d8974ec273ea2f3b2d99fccb08e6e05f19497b
+  metadata.gz: 2e0c056d35770de260972bb0e7a17177292dbb8574f40a20aa7fbc37807a26d75e0aa888bacebc490fce9266b5cd99ed463e5d43e307912affa787cae6a62620
+  data.tar.gz: 581fb42e3f2e7c40ffbf05b5e0725a8c7807606e2ca7787c02258dc277ac98fe9e1ecd0971925780e7bd1df259fef119b82d44d93d75636d4108bff4040ea156

data/CHANGELOG.md

@@ -30,6 +30,17 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.66] - 2026-08-30
+
+- TAG: [v1.2.66][1.2.66t]
+- COVERAGE: 93.11% -- 5404/5804 lines in 33 files
+- BRANCH COVERAGE: 76.06% -- 2179/2865 branches in 33 files
+- 30.03% documented
+
+### Fixed
+
+- Derive monorepo release lockfile path policy from family configuration and keep sibling tool paths opt-in.
+
 ## [1.2.65] - 2026-08-30
 
 - TAG: [v1.2.65][1.2.65t]
@@ -2279,7 +2290,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.65...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.66...HEAD
+[1.2.66]: https://github.com/kettle-dev/kettle-family/compare/v1.2.65...v1.2.66
+[1.2.66t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.66
 [1.2.65]: https://github.com/kettle-dev/kettle-family/compare/v1.2.64...v1.2.65
 [1.2.65t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.65
 [1.2.64]: https://github.com/kettle-dev/kettle-family/compare/v1.2.63...v1.2.64

data/README.md

@@ -252,21 +252,30 @@ release:
 ```
 
 `family.local_path_env` names the environment variable that activates local
-path dependencies for this family. It is the family identity used by other
-families when they scan lockfile `PATH` remotes and need to disable local
-resolution before writing CI-facing release lockfiles. Configure it when the
-env name is not the default derived from `family.name`.
+path dependencies for this family. For an explicitly configured
+`family.mode: monorepo`, `kettle-family` derives a release-lock policy that
+allows only `family.members_root` (or the configured member root) and passes
+that policy to each `kettle-release` child. Those paths are valid because the
+same monorepo checkout exists in CI. The tracked `Gemfile.lock` remains a
+development lockfile and may retain those member `PATH` sources.
+
+Sibling-repository families do not receive this exception. Their canonical
+lockfiles must use released dependencies: a local Kettle Dev workspace, or
+any other sibling workspace, is never allowed merely because its `*_DEV`
+variable is set. Use `release.allowed_local_path_roots` together with
+`release.allowed_local_path_env` only for an intentionally CI-available path
+layout that cannot be inferred from a monorepo configuration.
 
 `release.disable_local_path_env` is different: it is an extra release-lockfile
 normalization shutoff list for path-injecting env vars that are not themselves
 discoverable as family roots, such as vendored parser/tooling paths.
 
-`release.local_path_strategy: waves` allows a release task to provide the
-family local-path environment as its default. Member release commands keep
-that path only while they have a selected sibling dependency that has not
-completed an earlier release wave; once the dependency is available, the
-member resolves it from the registry. Release lockfile normalization always
-disables local paths regardless of this strategy.
+`release.local_path_strategy: waves` is for sibling families that explicitly
+choose wave-local development resolution. An explicit monorepo instead keeps
+its configured member-root path available throughout its waves, because its
+canonical development lockfile and CI checkout share that path graph. In both
+cases, release normalization rejects every path outside the configured allow
+list.
 
 ### Release waves and dependency refresh
 
@@ -986,7 +995,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.782-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-5.804-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/config.rb

@@ -266,6 +266,23 @@ module Kettle
         fetch_path("release", "local_path_strategy").to_s
       end
 
+      def release_allowed_local_path_roots
+        inferred = configured_monorepo_release? ? [family_local_path_root] : []
+        configured = Array(fetch_path("release", "allowed_local_path_roots"))
+          .map { |path| expand_config_relative_path(path) }
+        (inferred + configured).uniq
+      end
+
+      def release_allowed_local_path_env_names
+        inferred = configured_monorepo_release? ? [family_local_path_env_name] : []
+        configured = Array(fetch_path("release", "allowed_local_path_env"))
+        (inferred + configured).compact.map(&:to_s).reject(&:empty?).uniq
+      end
+
+      def configured_monorepo_release?
+        fetch_path("family", "mode") == "monorepo"
+      end
+
       def release_secrets
         stringify_keys(fetch_path("release", "secrets") || {})
       end

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.65"
+      VERSION = "1.2.66"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -2349,6 +2349,7 @@ module Kettle
       def release_env_for_member(member)
         env = release_env
         env.merge!(release_wave_local_path_env_for(member))
+        env.merge!(release_local_path_policy_env)
         # Family release performs one live pin review before member releases.
         # Child kettle-release must consume that reviewed cache instead of
         # repeating the GitHub API lookup for every member.
@@ -2412,6 +2413,14 @@ module Kettle
       # already treated as registry dependencies; this is what makes resume
       # runs work after an earlier wave has been published.
       def release_wave_local_path_env_for(member)
+        # Monorepo members and their sibling dependencies share the same CI
+        # checkout, so their canonical development lockfile may keep those
+        # paths throughout every release wave.
+        if config.configured_monorepo_release?
+          env_name = config.family_local_path_env_name
+          return env_name ? {env_name => config.family_local_path_root} : {}
+        end
+
         return {} unless config.release_local_path_strategy == "waves"
 
         env_name = config.family_local_path_env_name
@@ -4034,15 +4043,22 @@ module Kettle
       end
 
       def release_allowed_local_path_roots
-        # Release env disables are passed to Bundler normalization, but they
-        # must not hide the active workspace roots from readiness diagnostics.
-        release_local_path_env_detection_sources.filter_map do |key, value|
-          next unless key.end_with?("_LOCAL", "_DEV")
-          next unless local_path_env_value?(value)
-          next unless value.to_s.strip.start_with?("/", "./", "../", "~")
+        config.release_allowed_local_path_roots
+      end
 
-          value
-        end
+      def release_allowed_local_path_env_names
+        config.release_allowed_local_path_env_names
+      end
+
+      def release_local_path_policy_env
+        roots = release_allowed_local_path_roots
+        env_names = release_allowed_local_path_env_names
+        return {} if roots.empty? && env_names.empty?
+
+        {
+          "KETTLE_RELEASE_ALLOWED_LOCAL_PATH_ROOTS" => roots.join(File::PATH_SEPARATOR),
+          "KETTLE_RELEASE_ALLOWED_LOCAL_PATH_ENVS" => env_names.join(",")
+        }
       end
 
       def release_lockfile_local_path_env_overrides(member = nil)
@@ -4051,11 +4067,18 @@ module Kettle
           key = key.to_s
           next unless key.end_with?("_LOCAL", "_DEV")
           next unless local_path_env_value?(value)
+          next if release_allowed_local_path_env_names.include?(key)
 
           memo[key] = "false"
         end
         inferred = member ? release_lockfile_inferred_local_path_env(member).to_h { |key| [key, "false"] } : {}
-        explicit.merge(derived).merge(inferred)
+        explicit.merge(derived).merge(inferred).merge(release_member_local_path_env(member))
+      end
+
+      def release_member_local_path_env(member)
+        return {} unless config.configured_monorepo_release?
+
+        release_wave_local_path_env_for(member)
       end
 
       def release_lockfile_inferred_local_path_env(member)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.65
+  version: 1.2.66
 platform: ruby
 authors:
 - Peter H. Boling
@@ -74,7 +74,7 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.6
+        version: 1.0.7
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -84,14 +84,14 @@ dependencies:
         version: '1.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.0.6
+        version: 1.0.7
 - !ruby/object:Gem::Dependency
   name: kettle-dev
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.18
+        version: 3.0.20
     - - "<"
       - !ruby/object:Gem::Version
         version: 4.0.0
@@ -101,7 +101,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.0.18
+        version: 3.0.20
     - - "<"
       - !ruby/object:Gem::Version
         version: 4.0.0
@@ -441,10 +441,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.65
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.65/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.66
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.66/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.65
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.66
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family