kettle-family 1.2.93 → 1.2.94

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: a1a24d4a7f560730b58dea502aa74c1f7c2b6b5821c92bc565ee5d0eff79d8be
-  data.tar.gz: 58f47810263c6279e727419acb896abb959ccac76bff444c83b19c88c85f64f5
+  metadata.gz: 60682b3f2d2f1017624cc67b428ff954b71f03eca4fdb6034cbe229183cba970
+  data.tar.gz: ea873857902fa44d2b2051e6449f21d84515139f005e1a9c148dfedf5062ce2f
 SHA512:
-  metadata.gz: 7bb4085cb68b1d1ee1592ad1ab43d55afbc08a4c12a341ffffb6f1b3d712f43e51e0b8b4f59095fdd8402e1fa7c21822d6b43da8c8bd4caf340e102418d2974c
-  data.tar.gz: c12db5ebfea5489500b221fbc39f8d638fc6f4ad119eb73a210e195b779804325be2effad8970a78b65f7a5f0b837a9d324bb12242ab33c61b782877de5d6343
+  metadata.gz: a14c847688ce762dbf03be0229b1c5ac0da23d3892e2e803467b8dc6efe73df4ede2b43d64a6ffedbccaf38f11da162bfad6bbf574a44b29739dafe8b8d70cba
+  data.tar.gz: 8ad7d29e783dace84ef807339b81907fe9e6e7c7f35ee60c4ac95b412a0972983c6eb7d9e8dad708801b270eda6ee0bb87d8759a22e3d4e29d6f254d4bfa6ff3

checksums.yaml.gz.sig

@@ -1,3 +1,6 @@
-:��H+>��|L̖��~�̃���c:���j�yIs�0���ٛ-I��W~i��E����fb�؃G�~�fl�X<�� $��u��"��7���/���v����]���# q,�/�2o��|.bM���xv.yA!�z�����xH�����0�=���g%r7�Sʶ!�X_���K����ei��V>Cu��
-� �,�M�pye�	��`�+
-63`o�L���nW	��I��V"��[)Zg�%�d���'50���]�Ǖ�}A���J�b��<���}(�_[[��{Q��5����g���)/�2�ܓ�Τ�J
+y;�"Ĕs$�5�U[G*W8M�}q?�x���eI��ݞaWf��<.�ePF��`���9@�
+A��~ON��3��1��ݎ��[�#
z
+�Ѫ�
N�#F�a΃��[�D�Ͽ���ҷHj��鼊c�/���{��������ʇ��p��
+�{���>pp�L۹F|�^ҡ8��QS"����ch�m<�=Pn�P�qK
+I�j��97���H	��f�V*�<�zۗ��H�>���f�.���rFi�c�e��6�	����MM�?�s��c������|���l}�����"���q1K�����j/Cx�8<0F�3$��6��"ā���{�md�Kǩ֫�¡!�8lr;
+��ƿ�H4cXKXF5�[;@�v@Oz�

data/CHANGELOG.md

@@ -30,6 +30,19 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [1.2.94] - 2026-09-07
+
+- TAG: [v1.2.94][1.2.94t]
+- COVERAGE: 93.50% -- 6183/6613 lines in 35 files
+- BRANCH COVERAGE: 78.04% -- 2512/3219 branches in 35 files
+- 32.58% documented
+
+### Fixed
+
+- Restrict inferred monorepo release path allowances to CI-resident paths, preserving external development overrides for local-only dependency work.
+
+- Allow bup and bupb to commit explicitly selected development path graphs while continuing to reject unrequested local lockfile paths.
+
 ## [1.2.93] - 2026-09-07
 
 - TAG: [v1.2.93][1.2.93t]
@@ -2627,7 +2640,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - Fixed CI load failures on engines without compatible `pty` support by falling back to Open3 for interactive release commands.
 - Fixed Ruby 3.2 version-bump support by loading Prism lazily and wiring the Prism gem only for MRI versions that need it.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.93...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-family/compare/v1.2.94...HEAD
+[1.2.94]: https://github.com/kettle-dev/kettle-family/compare/v1.2.93...v1.2.94
+[1.2.94t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.94
 [1.2.93]: https://github.com/kettle-dev/kettle-family/compare/v1.2.92...v1.2.93
 [1.2.93t]: https://github.com/kettle-dev/kettle-family/releases/tag/v1.2.93
 [1.2.92]: https://github.com/kettle-dev/kettle-family/compare/v1.2.91...v1.2.92

data/README.md

@@ -255,13 +255,19 @@ release:
       - kettle-jem
 ```
 
-`family.local_path_env` names the environment variable that activates local
-path dependencies for this family. For an explicitly configured
-`family.mode: monorepo`, `kettle-family` derives a release-lock policy that
-allows only `family.members_root` (or the configured member root) and passes
-that policy to each `kettle-release` child. Those paths are valid because the
-same monorepo checkout exists in CI. The tracked `Gemfile.lock` remains a
-development lockfile and may retain those member `PATH` sources.
+`family.local_path_env` names the environment variable that activates the
+family's development path graph. It does not, by itself, make a path valid in
+CI or safe to retain in a release lockfile. For an explicitly configured
+`family.mode: monorepo`, `kettle-family` derives a release-lock policy only
+when that path is contained by the family repository; this is the case when
+the CI checkout contains the same member graph. The tracked `Gemfile.lock`
+may then retain those member `PATH` sources.
+
+A monorepo can also reference a separate checkout, for example a shared base
+gem in its parent workspace. That is an external development override, not an
+internal monorepo path: it is removed for release unless
+`release.allowed_local_path_roots` and `release.allowed_local_path_env`
+explicitly describe matching CI checkout provisioning.
 
 Sibling-repository families do not receive this exception. Their canonical
 lockfiles must use released dependencies: a local Kettle Dev workspace, or
@@ -607,9 +613,13 @@ family-root lockfile is also validated and committed for monorepos, where the
 root and members share one Git repository. A sibling-repository family root is
 updated for its orchestration bundle but is not included in any member commit.
 Use `--no-commit` for a working-tree-only refresh, or `--commit` to state the
-default explicitly. Local dependency environment variables are preserved when
-explicitly supplied, so use the family's local or released dependency mode
-deliberately before running it.
+default explicitly. `bup` and `bupb` validate the development graph selected
+by their explicit local-path environment and commit it by default; this keeps
+template synchronization from being blocked by expected local-path lockfile
+changes. Release workflows separately normalize and validate their
+CI/release graph. A normal family-local graph and an unreleased external
+Kettle toolchain are separate choices; project task wrappers should not
+silently enable the latter for ordinary `bup` or `bupb` runs.
 
 Plan or update GitHub Actions workflow SHA pins across the selected family
 members:
@@ -1144,7 +1154,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.591-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-6.613-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-family/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/family/config.rb

@@ -285,18 +285,29 @@ module Kettle
       end
 
       def release_allowed_local_path_roots
-        inferred = configured_monorepo_release? ? [family_local_path_root] : []
+        inferred = ci_resident_monorepo_local_path_graph? ? [family_local_path_root] : []
         configured = Array(fetch_path("release", "allowed_local_path_roots"))
           .map { |path| expand_config_relative_path(path) }
         (inferred + configured).uniq
       end
 
       def release_allowed_local_path_env_names
-        inferred = configured_monorepo_release? ? [family_local_path_env_name] : []
+        inferred = ci_resident_monorepo_local_path_graph? ? [family_local_path_env_name] : []
         configured = Array(fetch_path("release", "allowed_local_path_env"))
         (inferred + configured).compact.map(&:to_s).reject(&:empty?).uniq
       end
 
+      # A monorepo may still use an environment switch to reach a separate
+      # sibling checkout. Only a path contained by this repository can be
+      # inferred as CI-resident and retained in release lockfiles.
+      def ci_resident_monorepo_local_path_graph?
+        return false unless fetch_path("family", "mode") == "monorepo"
+
+        path_within_root?(family_local_path_root)
+      end
+
+      # This remains the repository-topology predicate used by release
+      # scheduling. CI-safe local path inference is deliberately narrower.
       def configured_monorepo_release?
         fetch_path("family", "mode") == "monorepo"
       end
@@ -371,6 +382,12 @@ module Kettle
 
       private
 
+      def path_within_root?(path)
+        expanded_path = File.expand_path(path)
+        expanded_root = File.expand_path(root)
+        expanded_path == expanded_root || expanded_path.start_with?("#{expanded_root}/")
+      end
+
       def expand_config_relative_path(value)
         text = value.to_s
         return text if text.start_with?("/")

data/lib/kettle/family/version.rb

@@ -5,7 +5,7 @@ module Kettle
     # Version namespace for this gem.
     module Version
       # Current gem version.
-      VERSION = "1.2.93"
+      VERSION = "1.2.94"
     end
     # Current gem version exposed at the traditional constant location.
     VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/family/workflow.rb

@@ -5580,7 +5580,7 @@ module Kettle
           "",
           0.0,
           false,
-          diagnostics.empty? ? nil : "bundle update produced release-invalid lockfile"
+          diagnostics.empty? ? nil : "bundle update produced an unexpected local-path lockfile"
         )
         memo << result
         result.ok?
@@ -5606,8 +5606,35 @@ module Kettle
         ReadinessCheck.call(
           member: member,
           config: config,
-          allowed_local_path_roots: release_allowed_local_path_roots
-        ).stdout.lines.grep(/^release lockfile has local path remote at /).map(&:chomp)
+          allowed_local_path_roots: bundle_update_allowed_local_path_roots
+        ).stdout.lines.grep(/^release lockfile has local path remote at /).map do |line|
+          line.sub("release lockfile", "bundle update lockfile").chomp
+        end
+      end
+
+      # Bundle updates record the graph intentionally selected by the caller.
+      # Release validation remains stricter: it accepts only CI-resident paths.
+      def bundle_update_allowed_local_path_roots
+        explicit = explicit_local_path_env_overrides
+        roots = release_allowed_local_path_roots.dup
+        family_env_name = config.family_local_path_env_name
+
+        explicit.each do |name, value|
+          next unless local_path_env_value?(value)
+
+          if name == family_env_name
+            roots << config.family_local_path_root
+          elsif explicit_local_path_root?(value)
+            roots << File.expand_path(value, config.root)
+          end
+        end
+
+        roots.uniq
+      end
+
+      def explicit_local_path_root?(value)
+        text = value.to_s.strip
+        !%w[true yes 1 on enabled].include?(text.downcase)
       end
 
       def commit_bex_changes(member:, runner:, memo:)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-family
 version: !ruby/object:Gem::Version
-  version: 1.2.93
+  version: 1.2.94
 platform: ruby
 authors:
 - Peter H. Boling
@@ -443,10 +443,10 @@ licenses:
 - AGPL-3.0-only
 metadata:
   homepage_uri: https://kettle-family.galtzo.com
-  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.93
-  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.93/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-family/tree/v1.2.94
+  changelog_uri: https://github.com/kettle-dev/kettle-family/blob/v1.2.94/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-family/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.93
+  documentation_uri: https://www.rubydoc.info/gems/kettle-family/1.2.94
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-family/wiki
   news_uri: https://www.railsbling.com/tags/kettle-family