kettle-gha-pins 0.3.19 → 0.3.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c38d84aa5916b494617f50b181b8e582cf7dc0b656491b132a52c6358f657c8f
-  data.tar.gz: ec3a9603687dc389313d6fd17898d7ac88e91efb553b4926dbdc22d86e94fdce
+  metadata.gz: 7a6e9332df48eb65706569d35bb7ed9f2fb8074775b0348c8635308dd09cdb58
+  data.tar.gz: 2fccf392bfa9adf038c153d0122c6b99dc200e06e08c8a3d8624009a42071152
 SHA512:
-  metadata.gz: 6cde479667aff09d4ce0e032a41dcc16602a722ef031b1208e48e937dbcca520ca7aa64486456fbd9e35fad133282ad18b9400cfeaabe104b16a56309b792930
-  data.tar.gz: 33b896ec5e450ec732b1117e2688c9ce110bea1479cdaa4d260ead0b93b95a2c54cd633796c752128dae9145a4069cb2ccd056b72f4289a91f1b159a17df8eb6
+  metadata.gz: a18abe0cda784d3981480797268d9cdd858dd320d11d217e1e61d3edd6251f3e5187aaddc51d8ab69b479d71c77e3c971661eb6d886c784223b02675ebec846a
+  data.tar.gz: 7a43763fd9eab50687659b0f16ce023d731fcc3d8433d8831a0a82056eb9a0c27aa41dfe9f4d14de294628d5d968bab7ac610e78b417a46761c3b2cf0ac81d1c

checksums.yaml.gz.sig

@@ -1,4 +1,2 @@
-
-X�d]oK��M�S��i|��p-�hS	�>�:ѝ4ܺy�f��Ƚ`��-��Љ��R�.��߱nf]x�(]���`^�q�LL>�a��\�О����i��K��T�3LU"��&��ifP��XI��
-׫��Jk�������PN��-��DU�
-�J�P��WC�%�y��~�7u��6񩙳��Pw�h��u66�&�׏�$���5Dэ�ȧ���f�ć8�Q�%�C�i ��H��Gd�f�>���� �a�D�"�[�����/R�/?5��X$-ݽE1͒F������EX)n��h�P�:� IGW?tdY�\��i�4T�0��E��Y��>���IU�
�GǗ
+��������7ڄz@�Ԑ���Z7K��h�=$f�|���ES7��2�YFQ4�QX]�r��w.`
+��ڧS!

data/CHANGELOG.md

@@ -30,6 +30,36 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [0.3.21] - 2026-11-08
+
+- TAG: [v0.3.21][0.3.21t]
+- COVERAGE: 95.18% -- 1085/1140 lines in 8 files
+- BRANCH COVERAGE: 84.10% -- 439/522 branches in 8 files
+- 25.89% documented
+
+### Added
+
+- --offline-fallback flag and KETTLE_GHA_PINS_OFFLINE_FALLBACK env switch: with --offline, fetch live from the GitHub API on a cache miss and populate the cache instead of failing with 'offline cache miss' (family pins runs no longer die on newly introduced actions)
+
+## [0.3.20] - 2026-10-28
+
+- TAG: [v0.3.20][0.3.20t]
+- COVERAGE: 95.16% -- 1081/1136 lines in 8 files
+- BRANCH COVERAGE: 83.65% -- 435/520 branches in 8 files
+- 25.89% documented
+
+### Changed
+
+- [kc] kettle-jem/prepare: updated 8 project files:
+  - configuration (1)
+  - dependencies (7)
+
+- [kc] kettle-jem/template: updated 7 project files:
+  - dependencies (2)
+  - documentation (1)
+  - other (2)
+  - workflows (2)
+
 ## [0.3.19] - 2026-10-25
 
 - TAG: [v0.3.19][0.3.19t]
@@ -454,7 +484,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - kettle-jem-template-20260720-005 - Generated README Support & Community rows
   now include a RubyForum help badge.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.19...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.21...HEAD
+[0.3.21]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.20...v0.3.21
+[0.3.21t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.21
+[0.3.20]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.19...v0.3.20
+[0.3.20t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.20
 [0.3.19]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.18...v0.3.19
 [0.3.19t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.19
 [0.3.18]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.17...v0.3.18

data/README.md

@@ -57,12 +57,12 @@ kettle-gha-pins --write --upgrade major
 
 ### Compatibility
 
-Compatible with MRI Ruby 2.4.0+, JRuby, and TruffleRuby.
+The gem's declared runtime compatibility floor is MRI Ruby 2.4.0+, with concordant releases of JRuby and TruffleRuby.
 CI workflows and Appraisals are generated for MRI Ruby 2.4.0+.
 The current MRI CI lane runs on Linux and macOS.
-This test floor is configured by `ruby.test_minimum` in `.kettle-jem.yml` and
-may be higher than the gem's runtime compatibility floor when legacy Rubies are
-not practical for the current toolchain.
+The test floor is configured by `ruby.test_minimum` in `.kettle-jem.yml`.
+When it is higher than the runtime floor, older runtime-compatible Rubies are
+not covered by the generated CI or Appraisal matrix.
 
 <a href="https://github.com/kettle-dev"><img alt="kettle-dev Logo by Aboling0, CC BY-SA 4.0" src="https://logos.galtzo.com/assets/images/kettle-dev/avatar-128px.svg" width="14%" align="right"/></a>
 
@@ -144,7 +144,9 @@ unless a project opts into a warning window.
 The action metadata cache uses a one-day TTL by default. Set `--ttl DAYS` to
 change it; `--ttl 0` forces a refresh. `--offline` trusts the cache without
 checking TTL or contacting GitHub and fails if required repository metadata is
-missing.
+missing. Add `--offline-fallback` (or set `KETTLE_GHA_PINS_OFFLINE_FALLBACK=true`)
+to fetch live from the GitHub API on a cache miss instead of failing; the
+fetched metadata populates the cache, so later offline runs succeed.
 
 For family orchestration, `kettle-gha-pins --list --json` emits the action
 repositories used by a project without network access. A separate
@@ -547,7 +549,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.136-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.140-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-gha-pins/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/gha/pins/cli.rb

@@ -76,6 +76,7 @@ module Kettle
             clock: clock,
             refresh_cache: false,
             offline: false,
+            offline_fallback: %w[true yes 1 on enabled].include?(ENV["KETTLE_GHA_PINS_OFFLINE_FALLBACK"].to_s.strip.downcase),
             mode: :project,
             input: nil,
             reject_patterns: Set.new,
@@ -108,7 +109,7 @@ module Kettle
         private
 
         def build_client
-          @options[:token] ||= gh_auth_token if @options[:api_base] == API_BASE && !@options[:offline]
+          @options[:token] ||= gh_auth_token if @options[:api_base] == API_BASE && (!@options[:offline] || @options[:offline_fallback])
           persistent_cache = if @options[:cache_path].to_s.empty?
             nil
           else
@@ -125,6 +126,7 @@ module Kettle
             persistent_cache: persistent_cache,
             refresh_cache: @options[:refresh_cache],
             offline: @options[:offline],
+            offline_fallback: @options[:offline_fallback],
             fail_on_refresh_error: @options[:mode] == :review
           )
           [client, persistent_cache]
@@ -459,6 +461,9 @@ module Kettle
             opt.on("--offline", "Use only the persistent cache; fail on a cache miss") do
               @options[:offline] = true
             end
+            opt.on("--offline-fallback", "With --offline, fetch live from the GitHub API on a cache miss and populate the cache") do
+              @options[:offline_fallback] = true
+            end
             opt.on("--list", "List project action pins as JSON without network access") do
               raise OptionParser::InvalidOption, "--list cannot be combined with --review" if @options[:mode] == :review
 

data/lib/kettle/gha/pins/github_client.rb

@@ -17,13 +17,14 @@ module Kettle
         class CacheMissError < Error; end
         class RefreshError < Error; end
 
-        def initialize(token:, api_base:, user_agent:, persistent_cache: nil, refresh_cache: false, offline: false, fail_on_refresh_error: false, open_timeout: DEFAULT_HTTP_OPEN_TIMEOUT_SECONDS, read_timeout: DEFAULT_HTTP_READ_TIMEOUT_SECONDS, refresh_timeout: DEFAULT_HTTP_REFRESH_TIMEOUT_SECONDS)
+        def initialize(token:, api_base:, user_agent:, persistent_cache: nil, refresh_cache: false, offline: false, offline_fallback: false, fail_on_refresh_error: false, open_timeout: DEFAULT_HTTP_OPEN_TIMEOUT_SECONDS, read_timeout: DEFAULT_HTTP_READ_TIMEOUT_SECONDS, refresh_timeout: DEFAULT_HTTP_REFRESH_TIMEOUT_SECONDS)
           @token = token
           @api_base = api_base
           @user_agent = user_agent
           @persistent_cache = persistent_cache
           @refresh_cache = refresh_cache
           @offline = offline
+          @offline_fallback = offline_fallback
           @fail_on_refresh_error = fail_on_refresh_error
           @open_timeout = open_timeout
           @read_timeout = read_timeout
@@ -46,15 +47,17 @@ module Kettle
 
           if @offline
             cached = @persistent_cache&.versions_for_repo(repo_ref, fresh: false)
-            raise CacheMissError, "offline cache miss for #{repo_ref}" if cached.nil?
-
-            @last_versions_cache_hit = true
-            @release_cache[repo_ref] = cached
-            return cached
+            if cached.nil?
+              raise CacheMissError, "offline cache miss for #{repo_ref}" unless @offline_fallback
+            else
+              @last_versions_cache_hit = true
+              @release_cache[repo_ref] = cached
+              return cached
+            end
           end
 
           stale = nil
-          unless @refresh_cache
+          unless @refresh_cache || @offline
             cached = @persistent_cache&.versions_for_repo(repo_ref, fresh: true)
             if cached
               @last_versions_cache_hit = true
@@ -98,7 +101,7 @@ module Kettle
             end
           end
 
-          raise CacheMissError, "offline cache miss for #{repo_ref}@#{ref}" if @offline
+          raise CacheMissError, "offline cache miss for #{repo_ref}@#{ref}" if @offline && !@offline_fallback
 
           data = request_json("/repos/#{repo_ref}/commits/#{uri_encode(ref)}")
           sha = if data.is_a?(Hash)

data/lib/kettle/gha/pins/version.rb

@@ -6,7 +6,7 @@ module Kettle
       # Version namespace for this gem.
       module Version
         # Current gem version.
-        VERSION = "0.3.19"
+        VERSION = "0.3.21"
       end
       # Current gem version exposed at the traditional constant location.
       VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-gha-pins
 version: !ruby/object:Gem::Version
-  version: 0.3.19
+  version: 0.3.21
 platform: ruby
 authors:
 - Peter H. Boling
@@ -46,7 +46,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.20
+        version: 0.1.23
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -56,7 +56,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.20
+        version: 0.1.23
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -94,7 +94,7 @@ dependencies:
         version: '1.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.16
+        version: 1.1.17
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -104,7 +104,7 @@ dependencies:
         version: '1.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 1.1.16
+        version: 1.1.17
 - !ruby/object:Gem::Dependency
   name: kettle-dev
   requirement: !ruby/object:Gem::Requirement
@@ -114,7 +114,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.24
+        version: 3.1.28
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -124,7 +124,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.24
+        version: 3.1.28
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
@@ -182,7 +182,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.4
+        version: 0.1.5
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -192,7 +192,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.4
+        version: 0.1.5
 - !ruby/object:Gem::Dependency
   name: appraisal2
   requirement: !ruby/object:Gem::Requirement
@@ -222,7 +222,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.27
+        version: 2.0.29
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -232,7 +232,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.27
+        version: 2.0.29
 - !ruby/object:Gem::Dependency
   name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
@@ -321,10 +321,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/kettle-dev/kettle-gha-pins
-  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.19
-  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.19/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.21
+  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.21/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-gha-pins/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.19
+  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.21
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-gha-pins/wiki
   news_uri: https://www.railsbling.com/tags/kettle-gha-pins
@@ -355,7 +355,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 4.0.24
 specification_version: 4
 summary: "\U0001F4CC Shared GitHub Actions pin version rules for kettle-dev tooling."
 test_files: []