kettle-gha-pins 0.3.11 → 0.3.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6eef00386a5fa9f57acdf295331f68f11293cf9d90ef09adbb666aac6a97d0c
-  data.tar.gz: 6b433ddcef3d0599c12e8496aa5a80df31f6bcaee358634fb04c167a5c36ac24
+  metadata.gz: dd7079aed4ef058846c17830bf396357d912f70228c310c91ab9c4cdec617f1d
+  data.tar.gz: 911ae0a3199007441d6e41f06ededaa3c8150babae9f88e0ed5ca5a616b21336
 SHA512:
-  metadata.gz: 7c6fa524d51f68f4ffb392195d77cb44f782b9ec65e05940915b4ac595e036768a7ed647eca7d7aefbd9da30adebb462fc3e5860f138e783559054257d215982
-  data.tar.gz: d7097d6af75ffc23901d1e9fa6208f7704c9f5d12e54aab125438b61088418056ccab1730ad06643945f1fd82052f62d2c315e555769e33535eb7cdd07fbcb50
+  metadata.gz: 16ea373fc56f23764e4cda2ab6e56695d92fc5296665c95dd5e166879be4136a3a491cb96ec6d96433e1ef90975227ebe11674ecb7479c9ba36fec56adf9c52d
+  data.tar.gz: 302ab92e5d76c6046ecfbaba990eb495408f4843ca4dd029033a9dd49455eb1291b93eb8a474ad6a81a4714ed886724a1ae81e1271f14adbae2f4e12bf53d5f1

data/CHANGELOG.md

@@ -30,6 +30,30 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [0.3.13] - 2026-08-15
+
+- TAG: [v0.3.13][0.3.13t]
+- COVERAGE: 97.09% -- 1067/1099 lines in 8 files
+- BRANCH COVERAGE: 85.66% -- 430/502 branches in 8 files
+- 26.13% documented
+
+### Fixed
+
+- Retry transient GitHub Action metadata failures and report API response details during strict pin reviews.
+
+## [0.3.12] - 2026-08-12
+
+- TAG: [v0.3.12][0.3.12t]
+- COVERAGE: 97.00% -- 1033/1065 lines in 8 files
+- BRANCH COVERAGE: 85.60% -- 416/486 branches in 8 files
+- 25.93% documented
+
+### Changed
+
+- Prepare project for kettle-jem templates: updated 7 project files across dependencies (7).
+
+- Apply kettle-jem templates: updated 7 project files across configuration (1), dependencies (1), documentation (1), other (4).
+
 ## [0.3.11] - 2026-08-10
 
 - TAG: [v0.3.11][0.3.11t]
@@ -310,7 +334,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - kettle-jem-template-20260720-005 - Generated README Support & Community rows
   now include a RubyForum help badge.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.11...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.13...HEAD
+[0.3.13]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.12...v0.3.13
+[0.3.13t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.13
+[0.3.12]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.11...v0.3.12
+[0.3.12t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.12
 [0.3.11]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.10...v0.3.11
 [0.3.11t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.11
 [0.3.10]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.9...v0.3.10

data/README.md

@@ -57,7 +57,7 @@ kettle-gha-pins --write --upgrade major
 
 ### Compatibility
 
-Compatible with MRI Ruby 2.4.0+, and concordant releases of JRuby, and TruffleRuby.
+Compatible with MRI Ruby 2.4.0+, JRuby, and TruffleRuby.
 CI workflows and Appraisals are generated for MRI Ruby 2.4.0+.
 This test floor is configured by `ruby.test_minimum` in `.kettle-jem.yml` and
 may be higher than the gem's runtime compatibility floor when legacy Rubies are
@@ -277,8 +277,7 @@ See [SECURITY.md][🔐security].
 ## 🤝 Contributing
 
 If you need some ideas of where to help, you could work on adding more code coverage,
-or if it is already 💯 (see [below](#code-coverage)) check [issues][🤝gh-issues] or [PRs][🤝gh-pulls],
-or use the gem and think about how it could be better.
+check [issues][🤝gh-issues] or [PRs][🤝gh-pulls], or use the gem and think about how it could be better.
 
 We [![Keep A Changelog][📗keep-changelog-img]][📗keep-changelog] so if you make changes, remember to update it.
 
@@ -314,19 +313,6 @@ Made with [contributors-img][🖐contrib-rocks].
 
 Also see GitLab Contributors: [https://gitlab.com/kettle-dev/kettle-gha-pins/-/graphs/main][🚎contributors-gl]
 
-<details markdown="1">
- <summary>⭐️ Star History</summary>
-
-<a href="https://star-history.com/kettle-dev/kettle-gha-pins&Date">
- <picture>
- <source media="(prefers-color-scheme: dark)" srcset="https://api.star-history.com/svg?repos=kettle-dev/kettle-gha-pins&type=Date&theme=dark" />
- <source media="(prefers-color-scheme: light)" srcset="https://api.star-history.com/svg?repos=kettle-dev/kettle-gha-pins&type=Date" />
- <img alt="Star History Chart" src="https://api.star-history.com/svg?repos=kettle-dev/kettle-gha-pins&type=Date" />
- </picture>
-</a>
-
-</details>
-
 ## 📌 Versioning
 
 This library follows [![Semantic Versioning 2.0.0][📌semver-img]][📌semver] for its public API where practical.
@@ -582,7 +568,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.065-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.099-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-gha-pins/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/gha/pins/github_client.rb

@@ -12,6 +12,8 @@ module Kettle
       # Lightweight GitHub API client for commit and release SHA resolution.
       class GitHubClient
         ANNOTATED_TAG_GIT_FALLBACK_THRESHOLD = 4
+        HTTP_RETRY_LIMIT = 2
+        RETRYABLE_HTTP_STATUS_CODES = [408, 425, 429, 500, 502, 503, 504].freeze
         class CacheMissError < Error; end
         class RefreshError < Error; end
 
@@ -29,9 +31,10 @@ module Kettle
           @commit_cache = {}
           @release_cache = {}
           @last_versions_cache_hit = false
+          @last_request_error = nil
         end
 
-        attr_reader :last_versions_cache_hit
+        attr_reader :last_request_error, :last_versions_cache_hit
 
         def versions_for_repo(repo_ref)
           @last_versions_cache_hit = false
@@ -64,7 +67,10 @@ module Kettle
           releases = nil
           Timeout.timeout(@refresh_timeout) do
             data = request_json("/repos/#{repo_ref}/releases?per_page=100")
-            return refresh_failed!(repo_ref, stale, "invalid releases response") unless data.is_a?(Array)
+            unless data.is_a?(Array)
+              detail = data.nil? ? nil : "expected an array, got #{data.class}"
+              return refresh_failed!(repo_ref, stale, "invalid releases response", detail: detail)
+            end
 
             tag_shas = tag_ref_shas(repo_ref)
             return refresh_failed!(repo_ref, stale, "invalid tag response") unless tag_shas
@@ -122,10 +128,12 @@ module Kettle
           versions
         end
 
-        def refresh_failed!(repo_ref, stale, message)
+        def refresh_failed!(repo_ref, stale, message, detail: nil)
           return cached_versions(repo_ref, stale) unless @fail_on_refresh_error
 
-          raise RefreshError, "#{message} for #{repo_ref}"
+          detail ||= @last_request_error
+          suffix = detail.to_s.empty? ? "" : ": #{detail}"
+          raise RefreshError, "#{message} for #{repo_ref}#{suffix}"
         end
 
         def build_release_versions(data, tag_shas)
@@ -222,8 +230,10 @@ module Kettle
 
         def request_json(path, redirects: 3)
           uri = URI.join(@api_base + "/", path)
+          @last_request_error = nil
 
           response = nil
+          retries = 0
           loop do
             request = Net::HTTP::Get.new(uri)
             request["Accept"] = "application/vnd.github+json"
@@ -231,27 +241,68 @@ module Kettle
             request["X-GitHub-Api-Version"] = "2022-11-28"
             request["Authorization"] = "Bearer #{@token}" if @token && !@token.empty?
 
-            response = http_request(uri, request)
+            begin
+              response = http_request(uri, request)
+            rescue IOError, SystemCallError, Net::OpenTimeout, Net::ReadTimeout => error
+              if retries < HTTP_RETRY_LIMIT
+                retries += 1
+                sleep(retry_delay(nil, retries))
+                next
+              end
+
+              @last_request_error = "GitHub request failed for #{path}: #{error.class}: #{error.message}"
+              return nil
+            end
+
+            if response.code.to_i.between?(300, 399)
+              redirects -= 1
+              return nil if redirects.negative?
+
+              location = response["location"].to_s
+              return nil if location.empty?
+
+              uri = URI.join(uri.to_s, location)
+              next
+            end
 
-            break unless response.code.to_i.between?(300, 399)
-            redirects -= 1
-            return nil if redirects.negative?
+            status = response.code.to_i
+            unless status == 200
+              if RETRYABLE_HTTP_STATUS_CODES.include?(status) && retries < HTTP_RETRY_LIMIT
+                retries += 1
+                sleep(retry_delay(response, retries))
+                next
+              end
 
-            location = response["location"].to_s
-            return nil if location.empty?
+              @last_request_error = response_error(response, path)
+              return nil
+            end
 
-            uri = URI.join(uri.to_s, location)
+            begin
+              return JSON.parse(response.body)
+            rescue JSON::ParserError
+              @last_request_error = "GitHub returned invalid JSON for #{path}"
+              return nil
+            end
           end
+        end
 
-          return nil unless response.code.to_i == 200
+        def retry_delay(response, attempt)
+          retry_after = response ? response["retry-after"].to_f : 0.0
+          return retry_after.clamp(0.0, 2.0) if retry_after.positive?
 
-          begin
-            JSON.parse(response.body)
+          0.25 * (2**(attempt - 1))
+        end
+
+        def response_error(response, path)
+          status = response.code.to_i
+          body = begin
+            JSON.parse(response.body.to_s)
           rescue JSON::ParserError
             nil
           end
-        rescue IOError, SystemCallError, Net::OpenTimeout, Net::ReadTimeout
-          nil
+          message = body.is_a?(Hash) ? body["message"].to_s : ""
+          detail = message.empty? ? "response body was not a GitHub API error object" : message
+          "GitHub API returned HTTP #{status} for #{path}: #{detail}"
         end
 
         def http_request(uri, request)

data/lib/kettle/gha/pins/version.rb

@@ -6,7 +6,7 @@ module Kettle
       # Version namespace for this gem.
       module Version
         # Current gem version.
-        VERSION = "0.3.11"
+        VERSION = "0.3.13"
       end
       # Current gem version exposed at the traditional constant location.
       VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-gha-pins
 version: !ruby/object:Gem::Version
-  version: 0.3.11
+  version: 0.3.13
 platform: ruby
 authors:
 - Peter H. Boling
@@ -91,20 +91,20 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '3.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.18
+        version: 3.0.6
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '2.5'
+        version: '3.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.5.18
+        version: 3.0.6
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
@@ -182,7 +182,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.0
+        version: 3.2.2
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -192,7 +192,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.0
+        version: 3.2.2
 - !ruby/object:Gem::Dependency
   name: kettle-test
   requirement: !ruby/object:Gem::Requirement
@@ -202,7 +202,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.19
+        version: 2.0.20
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -212,7 +212,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.19
+        version: 2.0.20
 - !ruby/object:Gem::Dependency
   name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
@@ -222,7 +222,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.4
+        version: 3.2.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -232,7 +232,7 @@ dependencies:
         version: '3.2'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.2.4
+        version: 3.2.5
 - !ruby/object:Gem::Dependency
   name: stone_checksums
   requirement: !ruby/object:Gem::Requirement
@@ -301,10 +301,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/kettle-dev/kettle-gha-pins
-  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.11
-  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.11/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.13
+  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.13/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-gha-pins/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.11
+  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.13
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-gha-pins/wiki
   news_uri: https://www.railsbling.com/tags/kettle-gha-pins