kettle-gha-pins 0.3.10 → 0.3.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e39d2df910b12d4b40d0978f63481a73d87a5efcdf6ea58c4966b397d3319470
-  data.tar.gz: 584ac1b59952635a279806c03aba51460a757e9edd2dbcafc5b7f158b8a302dd
+  metadata.gz: bbd722b090d367d80e40c34de0df0f3abc00fff51e411a8c0676e45d556eb7ef
+  data.tar.gz: 80aa6f0f24d4c5473a6e78d5b487ce34ae3e200a032503b652b9ca37aacfc0ae
 SHA512:
-  metadata.gz: 43c208e30cd0c6501479f4cf52a48a3e4df4b9192ada22b05017681a4761ffe01ca4abdb0398cf8c523828a32814ef9fcd51cf57f2be46f7ff55b81c89e05237
-  data.tar.gz: a47e19be556a73215a786b4e9fe23b50ac1890e5087ed0b5eea1a14e8e7f9dd1ce8da62d8e95a329949a6e339aacda9c1b8e12cabd0debe167e301ed12ca96f9
+  metadata.gz: 9ad84fb8c23112d1dd16bdf9226f101daf0d685e1e8d59378118c941a4129b6b274552ca9397bbb6b6c0c3c3a96a85ad1394490421fccb1ff76920f484688266
+  data.tar.gz: 49b0370d149323a8a4735afbec6e49f29b34ce939b84b71c9d55980e94918961cf66f6b8edd591572b395bf5def8a3ddea27b1e04a803870cd6619d51c4d6094

data/CHANGELOG.md

@@ -30,6 +30,32 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [0.3.12] - 2026-08-12
+
+- TAG: [v0.3.12][0.3.12t]
+- COVERAGE: 97.00% -- 1033/1065 lines in 8 files
+- BRANCH COVERAGE: 85.60% -- 416/486 branches in 8 files
+- 25.93% documented
+
+### Changed
+
+- Prepare project for kettle-jem templates: updated 7 project files across dependencies (7).
+
+- Apply kettle-jem templates: updated 7 project files across configuration (1), dependencies (1), documentation (1), other (4).
+
+## [0.3.11] - 2026-08-10
+
+- TAG: [v0.3.11][0.3.11t]
+- COVERAGE: 97.00% -- 1033/1065 lines in 8 files
+- BRANCH COVERAGE: 85.60% -- 416/486 branches in 8 files
+- 25.93% documented
+
+### Fixed
+
+- Resolve large GitHub Actions annotated-tag inventories through a single Git exchange so stale cache reviews do not time out on repositories such as codecov/codecov-action.
+
+- Replace refreshed GitHub Actions cache inventories instead of retaining obsolete versions and forcing repeated refreshes.
+
 ## [0.3.10] - 2026-08-09
 
 - TAG: [v0.3.10][0.3.10t]
@@ -297,7 +323,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - kettle-jem-template-20260720-005 - Generated README Support & Community rows
   now include a RubyForum help badge.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.10...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.12...HEAD
+[0.3.12]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.11...v0.3.12
+[0.3.12t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.12
+[0.3.11]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.10...v0.3.11
+[0.3.11t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.11
 [0.3.10]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.9...v0.3.10
 [0.3.10t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.10
 [0.3.9]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.8...v0.3.9

data/README.md

@@ -57,7 +57,7 @@ kettle-gha-pins --write --upgrade major
 
 ### Compatibility
 
-Compatible with MRI Ruby 2.4.0+, and concordant releases of JRuby, and TruffleRuby.
+Compatible with MRI Ruby 2.4.0+, JRuby, and TruffleRuby.
 CI workflows and Appraisals are generated for MRI Ruby 2.4.0+.
 This test floor is configured by `ruby.test_minimum` in `.kettle-jem.yml` and
 may be higher than the gem's runtime compatibility floor when legacy Rubies are
@@ -277,8 +277,7 @@ See [SECURITY.md][🔐security].
 ## 🤝 Contributing
 
 If you need some ideas of where to help, you could work on adding more code coverage,
-or if it is already 💯 (see [below](#code-coverage)) check [issues][🤝gh-issues] or [PRs][🤝gh-pulls],
-or use the gem and think about how it could be better.
+check [issues][🤝gh-issues] or [PRs][🤝gh-pulls], or use the gem and think about how it could be better.
 
 We [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] so if you make changes, remember to update it.
 
@@ -314,19 +313,6 @@ Made with [contributors-img][🖐contrib-rocks].
 
 Also see GitLab Contributors: [https://gitlab.com/kettle-dev/kettle-gha-pins/-/graphs/main][🚎contributors-gl]
 
-<details markdown="1">
- <summary>⭐️ Star History</summary>
-
-<a href="https://star-history.com/kettle-dev/kettle-gha-pins&Date">
- <picture>
- <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=kettle-dev/kettle-gha-pins&type=Date&theme=dark" />
- <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=kettle-dev/kettle-gha-pins&type=Date" />
- <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=kettle-dev/kettle-gha-pins&type=Date" />
- </picture>
-</a>
-
-</details>
-
 ## 📌 Versioning
 
 This library follows [![Semantic Versioning 2.0.0][📌semver-img]][📌semver] for its public API where practical.
@@ -582,7 +568,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.042-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.065-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-gha-pins/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/gha/pins/github_client.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "net/http"
+require "open3"
 require "timeout"
 require "uri"
 
@@ -10,6 +11,7 @@ module Kettle
     module Pins
       # Lightweight GitHub API client for commit and release SHA resolution.
       class GitHubClient
+        ANNOTATED_TAG_GIT_FALLBACK_THRESHOLD = 4
         class CacheMissError < Error; end
         class RefreshError < Error; end
 
@@ -150,7 +152,7 @@ module Kettle
           data = request_json("/repos/#{repo_ref}/git/matching-refs/tags/")
           return nil unless data.is_a?(Array)
 
-          data.each_with_object({}) do |entry, memo|
+          entries = data.each_with_object([]) do |entry, memo|
             ref = entry["ref"].to_s
             next unless ref.start_with?("refs/tags/")
 
@@ -160,16 +162,51 @@ module Kettle
             object = entry["object"]
             next unless object.is_a?(Hash)
 
-            sha = object["sha"].to_s[0, 40]
-            case object["type"]
+            memo << [tag, object["type"].to_s, object["sha"].to_s[0, 40]]
+          end
+          annotated_tag_shas = git_tag_ref_shas(repo_ref) if entries.count { |_, type, _| type == "tag" } > ANNOTATED_TAG_GIT_FALLBACK_THRESHOLD
+
+          entries.each_with_object({}) do |(tag, type, sha), memo|
+            case type
             when "commit"
               memo[tag] = sha
             when "tag"
-              memo[tag] = annotated_tag_commit_sha(repo_ref, sha)
+              memo[tag] = annotated_tag_shas&.fetch(tag, nil) || annotated_tag_commit_sha(repo_ref, sha)
             end
           end
         end
 
+        # The REST API exposes annotated tags as tag objects, requiring one
+        # additional request per tag to reach the commit. A single Git
+        # protocol exchange returns both tag objects and peeled commit refs,
+        # avoiding a refresh timeout for repositories with large tag histories.
+        def git_tag_ref_shas(repo_ref)
+          return unless @api_base.to_s.sub(%r{/\z}, "") == API_BASE
+
+          stdout, _stderr, status = Open3.capture3(
+            {"GIT_TERMINAL_PROMPT" => "0"},
+            "git",
+            "ls-remote",
+            "--tags",
+            "https://github.com/#{repo_ref}.git"
+          )
+          return unless status.success?
+
+          stdout.each_line.each_with_object({}) do |line, memo|
+            sha, ref = line.split
+            next unless SHA_RE.match?(sha.to_s)
+            next unless ref.to_s.start_with?("refs/tags/")
+
+            peeled = ref.end_with?("^{}")
+            tag = ref.sub(%r{\Arefs/tags/}, "").sub(/\^\{\}\z/, "")
+            next unless VersionRubric.parse(tag)
+
+            memo[tag] = sha if peeled || !memo.key?(tag)
+          end
+        rescue IOError, SystemCallError
+          nil
+        end
+
         def annotated_tag_commit_sha(repo_ref, tag_sha)
           return nil if tag_sha.to_s.empty?
 

data/lib/kettle/gha/pins/persistent_action_cache.rb

@@ -54,8 +54,15 @@ module Kettle
           return if repo_ref.to_s.empty?
 
           action = data.fetch("actions")[repo_ref] ||= {}
-          stored_versions = action["versions"] ||= {}
-          refs = action["refs"] ||= {}
+          previous_versions = action["versions"] || {}
+          previous_tags = previous_versions.values.each_with_object([]) do |entry, tags|
+            tag = entry["tag"].to_s
+            tags << tag unless tag.empty?
+          end
+          stored_versions = {}
+          refs = (action["refs"] || {}).reject { |ref, _entry| previous_tags.include?(ref) }
+          action["versions"] = stored_versions
+          action["refs"] = refs
           timestamp = @clock.call.utc.iso8601
 
           versions.each do |entry|

data/lib/kettle/gha/pins/version.rb

@@ -6,7 +6,7 @@ module Kettle
       # Version namespace for this gem.
       module Version
         # Current gem version.
-        VERSION = "0.3.10"
+        VERSION = "0.3.12"
       end
       # Current gem version exposed at the traditional constant location.
       VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-gha-pins
 version: !ruby/object:Gem::Version
-  version: 0.3.10
+  version: 0.3.12
 platform: ruby
 authors:
 - Peter H. Boling
@@ -91,20 +91,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '3.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.18
+        version: 3.0.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '3.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.18
+        version: 3.0.6
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
@@ -182,7 +182,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.0
+        version: 3.2.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -192,7 +192,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.0
+        version: 3.2.2
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -222,7 +222,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.4
+        version: 3.2.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -232,7 +232,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.4
+        version: 3.2.5
 - !ruby/object:Gem::Dependency
   name: stone_checksums
   requirement: !ruby/object:Gem::Requirement
@@ -301,10 +301,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/kettle-dev/kettle-gha-pins
-  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.10
-  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.10/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.12
+  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.12/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-gha-pins/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.10
+  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.12
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-gha-pins/wiki
   news_uri: https://www.railsbling.com/tags/kettle-gha-pins