kettle-gha-pins 0.3.6 → 0.3.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b985aaa740f2f6f46ff9c0e71c7b51cc69cb23b2a1e8786258c46c34ee08be2e
-  data.tar.gz: 5a9c0fe7c26efe095e2e138a15ab9233e513f3dfb514818642b8c148f623940f
+  metadata.gz: 0a1c43269ba88dfec876d3107fb7883511cbcec7456353a8e239d74071d0d94e
+  data.tar.gz: 7499e3b722b86736e91a8a1dfde9ea53ab4f261428e5ec6816a83db73f428ece
 SHA512:
-  metadata.gz: a06b224317f385390101c1b69648cc3a87345a016376643b8b17bd398823534e692942c57a12c6036665231e2233e00c85ce2374aa4c46df8e79467572480761
-  data.tar.gz: a62ad7ef161155e77688213c211d69a5b283a7825f0aed524f8c0ac1dfcda67c489b36310ac6f27b9c68c9127b018eff63658648a8eb68d8690141ff65662629
+  metadata.gz: d05a9abcb27812e5db10f60e44e3eb9b2e40cd9747476078a22008dab208a578ed816a93255093255ee86f24ccb5856f2ae1fda212659cd97f005d12a5b6bbfb
+  data.tar.gz: 06bf550cb1113a1acb1363307d6dc4faa902c8d283aae15ecdfffaba658b9391d09606cb8005bb6071a30031bcd72b3046aae3674f2b359789793b78c2e82f59

data/CHANGELOG.md

@@ -30,6 +30,24 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [0.3.8] - 2026-08-05
+
+- TAG: [v0.3.8][0.3.8t]
+- COVERAGE: 98.34% -- 945/961 lines in 8 files
+- BRANCH COVERAGE: 89.81% -- 388/432 branches in 8 files
+- 25.71% documented
+
+### Fixed
+
+- Refresh cached GitHub Action release data when a newer release tag is detected.
+
+## [0.3.7] - 2026-08-05
+
+- TAG: [v0.3.7][0.3.7t]
+- COVERAGE: 98.94% -- 931/941 lines in 8 files
+- BRANCH COVERAGE: 90.87% -- 378/416 branches in 8 files
+- 25.96% documented
+
 ## [0.3.6] - 2026-08-03
 
 - TAG: [v0.3.6][0.3.6t]
@@ -253,7 +271,11 @@ Please file a bug if you notice a violation of semantic versioning.
 - kettle-jem-template-20260720-005 - Generated README Support & Community rows
   now include a RubyForum help badge.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.6...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.8...HEAD
+[0.3.8]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.7...v0.3.8
+[0.3.8t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.8
+[0.3.7]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.6...v0.3.7
+[0.3.7t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.7
 [0.3.6]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.5...v0.3.6
 [0.3.6t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.6
 [0.3.5]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.4...v0.3.5

data/README.md

@@ -563,7 +563,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.945-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-0.961-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-gha-pins/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/gha/pins/action_resolver.rb

@@ -115,7 +115,8 @@ module Kettle
             reason: reason,
             current_version: current_version,
             versions: available_versions,
-            latest_outdated: latest_outdated
+            latest_outdated: latest_outdated,
+            current_sha: current_sha
           }
         end
 

data/lib/kettle/gha/pins/cli.rb

@@ -154,7 +154,8 @@ module Kettle
                   comment_update_version = VersionRubric.comment_update_version(
                     comment_version,
                     upgrade_plan[:current_version],
-                    known_versions: upgrade_plan.fetch(:versions, [])
+                    known_versions: upgrade_plan.fetch(:versions, []),
+                    resolved_sha: upgrade_plan[:current_sha]
                   )
                   if comment_update_version
                     updates = {

data/lib/kettle/gha/pins/github_client.rb

@@ -38,9 +38,11 @@ module Kettle
           unless @refresh_cache
             cached = @persistent_cache&.versions_for_repo(repo_ref, fresh: true)
             if cached
-              @last_versions_cache_hit = true
-              @release_cache[repo_ref] = cached
-              return cached
+              unless cache_requires_refresh?(repo_ref, cached)
+                @last_versions_cache_hit = true
+                @release_cache[repo_ref] = cached
+                return cached
+              end
             end
             stale = @persistent_cache&.versions_for_repo(repo_ref, fresh: false)
           end
@@ -62,13 +64,13 @@ module Kettle
           cached_versions(repo_ref, stale)
         end
 
-        def commit_sha(repo_ref, ref)
+        def commit_sha(repo_ref, ref, refresh: false)
           return nil if repo_ref.to_s.empty? || ref.to_s.empty?
 
           cache_key = "commit:#{repo_ref}:#{ref}"
-          return @commit_cache[cache_key] if @commit_cache.key?(cache_key)
+          return @commit_cache[cache_key] if @commit_cache.key?(cache_key) && !refresh
 
-          unless @refresh_cache
+          unless @refresh_cache || refresh
             cached = @persistent_cache&.ref_sha(repo_ref, ref, fresh: true)
             if cached
               @commit_cache[cache_key] = cached
@@ -104,6 +106,26 @@ module Kettle
           versions
         end
 
+        # Release tags can be added or retargeted inside the cache TTL. Probe
+        # the latest release before trusting a cached inventory, and refresh
+        # only when that probe identifies a tag or target the cache lacks.
+        def cache_requires_refresh?(repo_ref, cached)
+          latest = request_json("/repos/#{repo_ref}/releases/latest")
+          return false unless latest.is_a?(Hash)
+
+          tag = latest["tag_name"].to_s
+          return false unless VersionRubric.parse(tag)
+
+          cached_entry = cached.find { |entry| entry[:tag].to_s == tag }
+          return true unless cached_entry
+
+          latest_sha = commit_sha(repo_ref, tag, refresh: true)
+          cached_sha = cached_entry[:sha].to_s
+          return !latest_sha.to_s.empty? if cached_sha.empty?
+
+          !latest_sha.to_s.empty? && latest_sha != cached_sha
+        end
+
         def build_release_versions(data, tag_shas)
           release_dates = {}
           release_tags = data.each_with_object([]) do |release, memo|
@@ -143,7 +165,7 @@ module Kettle
             when "commit"
               memo[tag] = sha
             when "tag"
-              memo[tag] = nil
+              memo[tag] = annotated_tag_commit_sha(repo_ref, sha)
             end
           end
         end

data/lib/kettle/gha/pins/version.rb

@@ -6,7 +6,7 @@ module Kettle
       # Version namespace for this gem.
       module Version
         # Current gem version.
-        VERSION = "0.3.6"
+        VERSION = "0.3.8"
       end
       # Current gem version exposed at the traditional constant location.
       VERSION = Version::VERSION # Traditional Constant Location

data/lib/kettle/gha/pins/version_rubric.rb

@@ -106,37 +106,64 @@ module Kettle
           end.max_by { |entry| sort_key(entry) }
         end
 
-        def comment_update_version(comment_version, resolved_version, known_versions: [])
+        # The comment on `uses:` is a cached record that needs to do two things:
+        #
+        # 1. Track the currently resolved target (if the target changes, update
+        #    the comment even when both values parse to version objects).
+        # 2. Normalize equivalent spellings (v2, v2.0, v2.0.0...) to the most
+        #    specific canonical form available for that SHA in known_versions.
+        def comment_update_version(comment_version, resolved_version, resolved_sha: nil, known_versions: [])
           comment = parse(comment_version)
           resolved = parse(resolved_version)
           return nil unless comment && resolved
 
-          resolved_entry = exact_entry_for_version(known_versions, resolved_version)
-          comment_entry = exact_entry_for_version(known_versions, comment_version)
+          canonical = canonical_version_for(
+            resolved_version,
+            known_versions,
+            resolved_sha: resolved_sha,
+            comment_version: comment_version
+          )
+          return nil if comment_version.to_s == canonical
 
-          if comment == resolved && resolved_entry && comment_entry
-            preferred = entries_for_semantic_version(known_versions, comment).max_by { |known_entry| sort_key(known_entry) }
-            preferred_version = preferred.fetch(:version)
-            (preferred_version == comment_version.to_s) ? nil : preferred_version
-          else
-            return nil if comment_version.to_s == resolved_version.to_s
-
-            resolved_version
-          end
+          canonical
         end
 
-        def exact_entry_for_version(versions, version)
-          parsed = parse(version)
-          return nil unless parsed
+        def entries_for_semantic_version(versions, version_obj)
+          versions.select { |entry| entry.fetch(:version_obj, nil) == version_obj }
+        end
 
-          versions.find do |entry|
-            entry.fetch(:version_obj, nil) == parsed &&
-              entry.fetch(:version, nil).to_s == parsed.to_s
+        # Canonical spellings are version-specific and SHA-aware.
+        #
+        # - For SHA-tracked tags, prefer the most explicit spelling that resolves
+        #   to the same SHA as the currently resolved target.
+        # - If the resolved SHA is known but the currently-commented spellings
+        #   are tied to a different SHA, keep the in-file spelling when the
+        #   semantic version is unchanged, so we don't rewrite between aliases that
+        #   no longer represent the same object.
+        # - Otherwise fall back to the resolved version form.
+        def canonical_version_for(resolved_version, known_versions, resolved_sha: nil, comment_version: nil)
+          resolved = parse(resolved_version)
+          return resolved_version.to_s unless resolved
+
+          equivalents = entries_for_semantic_version(known_versions, resolved)
+          if !resolved_sha.to_s.empty?
+            sha_matched_equivalents = equivalents.select do |entry|
+              entry.fetch(:sha).to_s == resolved_sha.to_s
+            end
+            equivalents = sha_matched_equivalents unless sha_matched_equivalents.empty?
+
+            if sha_matched_equivalents.empty? &&
+                comment_version &&
+                parse(comment_version) == resolved
+              return strip_leading_v(comment_version)
+            end
           end
+          preferred = equivalents.max_by { |entry| sort_key(entry) }
+          preferred ? preferred[:version] : resolved.to_s
         end
 
-        def entries_for_semantic_version(versions, version_obj)
-          versions.select { |entry| entry.fetch(:version_obj, nil) == version_obj }
+        def strip_leading_v(text)
+          text.to_s.sub(/\A[vV]/, "")
         end
 
         def normalize_upgrade_level(level)

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-gha-pins
 version: !ruby/object:Gem::Version
-  version: 0.3.6
+  version: 0.3.8
 platform: ruby
 authors:
 - Peter H. Boling
@@ -301,10 +301,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/kettle-dev/kettle-gha-pins
-  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.6
-  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.6/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.8
+  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.8/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-gha-pins/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.6
+  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.8
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-gha-pins/wiki
   news_uri: https://www.railsbling.com/tags/kettle-gha-pins