kettle-gha-pins 0.3.20 → 0.3.21

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b9905dfbde804dd5dfc5722ab134b52c02edded39701caf0d058e4d557f44dc7
-  data.tar.gz: 8de770c94f6772d01dffb88530400a91ab111ae9fd380ff49a6c3be780c0ab42
+  metadata.gz: 7a6e9332df48eb65706569d35bb7ed9f2fb8074775b0348c8635308dd09cdb58
+  data.tar.gz: 2fccf392bfa9adf038c153d0122c6b99dc200e06e08c8a3d8624009a42071152
 SHA512:
-  metadata.gz: 3796fc440478ca1780105e0066f5cbd4f76d6931fad51dd548e128a760fe79ad66520863e55a0865feabb45cc0e7ff678cfb074e3a51a4df52db0d03b77a8b22
-  data.tar.gz: fe85c5a5c2255bbc0b557d02a8da7d7eebe06dac0f3ffbf05fb3f17811ab2ba7e99399047b5252bca8ed185132728b1ed7c6059a076d9975fc7f67af82e8009c
+  metadata.gz: a18abe0cda784d3981480797268d9cdd858dd320d11d217e1e61d3edd6251f3e5187aaddc51d8ab69b479d71c77e3c971661eb6d886c784223b02675ebec846a
+  data.tar.gz: 7a43763fd9eab50687659b0f16ce023d731fcc3d8433d8831a0a82056eb9a0c27aa41dfe9f4d14de294628d5d968bab7ac610e78b417a46761c3b2cf0ac81d1c

checksums.yaml.gz.sig

@@ -1,2 +1,2 @@
-��'����A=�lm�Bd���9��:����N29�5�(���E���U�6ٺxFmߙ*�_�����s�u����j���7��'a���k<o����69�!K�.[�7xE8p�R����@�'|��Fj5��g{i��k���9\{ld�!�D�d~��:%[1��3�_&TPꗴ�E�!{S�%=��!��7�<���__�;9�`���w�n�����1
-�ܳy�-��)�
+��������7ڄz@�Ԑ���Z7K��h�=$f�|���ES7��2�YFQ4�QX]�r��w.`
+��ڧS!

data/CHANGELOG.md

@@ -30,6 +30,17 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [0.3.21] - 2026-11-08
+
+- TAG: [v0.3.21][0.3.21t]
+- COVERAGE: 95.18% -- 1085/1140 lines in 8 files
+- BRANCH COVERAGE: 84.10% -- 439/522 branches in 8 files
+- 25.89% documented
+
+### Added
+
+- --offline-fallback flag and KETTLE_GHA_PINS_OFFLINE_FALLBACK env switch: with --offline, fetch live from the GitHub API on a cache miss and populate the cache instead of failing with 'offline cache miss' (family pins runs no longer die on newly introduced actions)
+
 ## [0.3.20] - 2026-10-28
 
 - TAG: [v0.3.20][0.3.20t]
@@ -473,7 +484,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - kettle-jem-template-20260720-005 - Generated README Support & Community rows
   now include a RubyForum help badge.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.20...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.21...HEAD
+[0.3.21]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.20...v0.3.21
+[0.3.21t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.21
 [0.3.20]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.19...v0.3.20
 [0.3.20t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.20
 [0.3.19]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.18...v0.3.19

data/README.md

@@ -144,7 +144,9 @@ unless a project opts into a warning window.
 The action metadata cache uses a one-day TTL by default. Set `--ttl DAYS` to
 change it; `--ttl 0` forces a refresh. `--offline` trusts the cache without
 checking TTL or contacting GitHub and fails if required repository metadata is
-missing.
+missing. Add `--offline-fallback` (or set `KETTLE_GHA_PINS_OFFLINE_FALLBACK=true`)
+to fetch live from the GitHub API on a cache miss instead of failing; the
+fetched metadata populates the cache, so later offline runs succeed.
 
 For family orchestration, `kettle-gha-pins --list --json` emits the action
 repositories used by a project without network access. A separate
@@ -547,7 +549,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.136-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.140-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-gha-pins/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/gha/pins/cli.rb

@@ -76,6 +76,7 @@ module Kettle
             clock: clock,
             refresh_cache: false,
             offline: false,
+            offline_fallback: %w[true yes 1 on enabled].include?(ENV["KETTLE_GHA_PINS_OFFLINE_FALLBACK"].to_s.strip.downcase),
             mode: :project,
             input: nil,
             reject_patterns: Set.new,
@@ -108,7 +109,7 @@ module Kettle
         private
 
         def build_client
-          @options[:token] ||= gh_auth_token if @options[:api_base] == API_BASE && !@options[:offline]
+          @options[:token] ||= gh_auth_token if @options[:api_base] == API_BASE && (!@options[:offline] || @options[:offline_fallback])
           persistent_cache = if @options[:cache_path].to_s.empty?
             nil
           else
@@ -125,6 +126,7 @@ module Kettle
             persistent_cache: persistent_cache,
             refresh_cache: @options[:refresh_cache],
             offline: @options[:offline],
+            offline_fallback: @options[:offline_fallback],
             fail_on_refresh_error: @options[:mode] == :review
           )
           [client, persistent_cache]
@@ -459,6 +461,9 @@ module Kettle
             opt.on("--offline", "Use only the persistent cache; fail on a cache miss") do
               @options[:offline] = true
             end
+            opt.on("--offline-fallback", "With --offline, fetch live from the GitHub API on a cache miss and populate the cache") do
+              @options[:offline_fallback] = true
+            end
             opt.on("--list", "List project action pins as JSON without network access") do
               raise OptionParser::InvalidOption, "--list cannot be combined with --review" if @options[:mode] == :review
 

data/lib/kettle/gha/pins/github_client.rb

@@ -17,13 +17,14 @@ module Kettle
         class CacheMissError < Error; end
         class RefreshError < Error; end
 
-        def initialize(token:, api_base:, user_agent:, persistent_cache: nil, refresh_cache: false, offline: false, fail_on_refresh_error: false, open_timeout: DEFAULT_HTTP_OPEN_TIMEOUT_SECONDS, read_timeout: DEFAULT_HTTP_READ_TIMEOUT_SECONDS, refresh_timeout: DEFAULT_HTTP_REFRESH_TIMEOUT_SECONDS)
+        def initialize(token:, api_base:, user_agent:, persistent_cache: nil, refresh_cache: false, offline: false, offline_fallback: false, fail_on_refresh_error: false, open_timeout: DEFAULT_HTTP_OPEN_TIMEOUT_SECONDS, read_timeout: DEFAULT_HTTP_READ_TIMEOUT_SECONDS, refresh_timeout: DEFAULT_HTTP_REFRESH_TIMEOUT_SECONDS)
           @token = token
           @api_base = api_base
           @user_agent = user_agent
           @persistent_cache = persistent_cache
           @refresh_cache = refresh_cache
           @offline = offline
+          @offline_fallback = offline_fallback
           @fail_on_refresh_error = fail_on_refresh_error
           @open_timeout = open_timeout
           @read_timeout = read_timeout
@@ -46,15 +47,17 @@ module Kettle
 
           if @offline
             cached = @persistent_cache&.versions_for_repo(repo_ref, fresh: false)
-            raise CacheMissError, "offline cache miss for #{repo_ref}" if cached.nil?
-
-            @last_versions_cache_hit = true
-            @release_cache[repo_ref] = cached
-            return cached
+            if cached.nil?
+              raise CacheMissError, "offline cache miss for #{repo_ref}" unless @offline_fallback
+            else
+              @last_versions_cache_hit = true
+              @release_cache[repo_ref] = cached
+              return cached
+            end
           end
 
           stale = nil
-          unless @refresh_cache
+          unless @refresh_cache || @offline
             cached = @persistent_cache&.versions_for_repo(repo_ref, fresh: true)
             if cached
               @last_versions_cache_hit = true
@@ -98,7 +101,7 @@ module Kettle
             end
           end
 
-          raise CacheMissError, "offline cache miss for #{repo_ref}@#{ref}" if @offline
+          raise CacheMissError, "offline cache miss for #{repo_ref}@#{ref}" if @offline && !@offline_fallback
 
           data = request_json("/repos/#{repo_ref}/commits/#{uri_encode(ref)}")
           sha = if data.is_a?(Hash)

data/lib/kettle/gha/pins/version.rb

@@ -6,7 +6,7 @@ module Kettle
       # Version namespace for this gem.
       module Version
         # Current gem version.
-        VERSION = "0.3.20"
+        VERSION = "0.3.21"
       end
       # Current gem version exposed at the traditional constant location.
       VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-gha-pins
 version: !ruby/object:Gem::Version
-  version: 0.3.20
+  version: 0.3.21
 platform: ruby
 authors:
 - Peter H. Boling
@@ -46,7 +46,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.20
+        version: 0.1.23
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -56,7 +56,7 @@ dependencies:
         version: '0.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 0.1.20
+        version: 0.1.23
 - !ruby/object:Gem::Dependency
   name: ruby-progressbar
   requirement: !ruby/object:Gem::Requirement
@@ -114,7 +114,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.25
+        version: 3.1.28
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -124,7 +124,7 @@ dependencies:
         version: '3.1'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 3.1.25
+        version: 3.1.28
 - !ruby/object:Gem::Dependency
   name: bundler-audit
   requirement: !ruby/object:Gem::Requirement
@@ -222,7 +222,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.28
+        version: 2.0.29
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
@@ -232,7 +232,7 @@ dependencies:
         version: '2.0'
     - - ">="
       - !ruby/object:Gem::Version
-        version: 2.0.28
+        version: 2.0.29
 - !ruby/object:Gem::Dependency
   name: turbo_tests2
   requirement: !ruby/object:Gem::Requirement
@@ -321,10 +321,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/kettle-dev/kettle-gha-pins
-  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.20
-  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.20/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.21
+  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.21/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-gha-pins/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.20
+  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.21
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-gha-pins/wiki
   news_uri: https://www.railsbling.com/tags/kettle-gha-pins
@@ -355,7 +355,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.20
+rubygems_version: 4.0.24
 specification_version: 4
 summary: "\U0001F4CC Shared GitHub Actions pin version rules for kettle-dev tooling."
 test_files: []