kettle-gha-pins 0.3.10 → 0.3.11

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e39d2df910b12d4b40d0978f63481a73d87a5efcdf6ea58c4966b397d3319470
-  data.tar.gz: 584ac1b59952635a279806c03aba51460a757e9edd2dbcafc5b7f158b8a302dd
+  metadata.gz: e6eef00386a5fa9f57acdf295331f68f11293cf9d90ef09adbb666aac6a97d0c
+  data.tar.gz: 6b433ddcef3d0599c12e8496aa5a80df31f6bcaee358634fb04c167a5c36ac24
 SHA512:
-  metadata.gz: 43c208e30cd0c6501479f4cf52a48a3e4df4b9192ada22b05017681a4761ffe01ca4abdb0398cf8c523828a32814ef9fcd51cf57f2be46f7ff55b81c89e05237
-  data.tar.gz: a47e19be556a73215a786b4e9fe23b50ac1890e5087ed0b5eea1a14e8e7f9dd1ce8da62d8e95a329949a6e339aacda9c1b8e12cabd0debe167e301ed12ca96f9
+  metadata.gz: 7c6fa524d51f68f4ffb392195d77cb44f782b9ec65e05940915b4ac595e036768a7ed647eca7d7aefbd9da30adebb462fc3e5860f138e783559054257d215982
+  data.tar.gz: d7097d6af75ffc23901d1e9fa6208f7704c9f5d12e54aab125438b61088418056ccab1730ad06643945f1fd82052f62d2c315e555769e33535eb7cdd07fbcb50

data/CHANGELOG.md

@@ -30,6 +30,19 @@ Please file a bug if you notice a violation of semantic versioning.
 
 ### Security
 
+## [0.3.11] - 2026-08-10
+
+- TAG: [v0.3.11][0.3.11t]
+- COVERAGE: 97.00% -- 1033/1065 lines in 8 files
+- BRANCH COVERAGE: 85.60% -- 416/486 branches in 8 files
+- 25.93% documented
+
+### Fixed
+
+- Resolve large GitHub Actions annotated-tag inventories through a single Git exchange so stale cache reviews do not time out on repositories such as codecov/codecov-action.
+
+- Replace refreshed GitHub Actions cache inventories instead of retaining obsolete versions and forcing repeated refreshes.
+
 ## [0.3.10] - 2026-08-09
 
 - TAG: [v0.3.10][0.3.10t]
@@ -297,7 +310,9 @@ Please file a bug if you notice a violation of semantic versioning.
 - kettle-jem-template-20260720-005 - Generated README Support & Community rows
   now include a RubyForum help badge.
 
-[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.10...HEAD
+[Unreleased]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.11...HEAD
+[0.3.11]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.10...v0.3.11
+[0.3.11t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.11
 [0.3.10]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.9...v0.3.10
 [0.3.10t]: https://github.com/kettle-dev/kettle-gha-pins/releases/tag/v0.3.10
 [0.3.9]: https://github.com/kettle-dev/kettle-gha-pins/compare/v0.3.8...v0.3.9

data/README.md

@@ -582,7 +582,7 @@ Thanks for RTFM. ☺️
 [📌gitmoji]: https://gitmoji.dev
 [📌gitmoji-img]: https://img.shields.io/badge/gitmoji_commits-%20%F0%9F%98%9C%20%F0%9F%98%8D-34495e.svg?style=flat-square
 [🧮kloc]: https://www.youtube.com/watch?v=dQw4w9WgXcQ
-[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.042-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
+[🧮kloc-img]: https://img.shields.io/badge/KLOC-1.065-FFDD67.svg?style=for-the-badge&logo=YouTube&logoColor=blue
 [🔐security]: https://github.com/kettle-dev/kettle-gha-pins/blob/main/SECURITY.md
 [🔐security-img]: https://img.shields.io/badge/security-policy-259D6C.svg?style=flat
 [📄copyright-notice-explainer]: https://opensource.stackexchange.com/questions/5778/why-do-licenses-such-as-the-mit-license-specify-a-single-year

data/lib/kettle/gha/pins/github_client.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "net/http"
+require "open3"
 require "timeout"
 require "uri"
 
@@ -10,6 +11,7 @@ module Kettle
     module Pins
       # Lightweight GitHub API client for commit and release SHA resolution.
       class GitHubClient
+        ANNOTATED_TAG_GIT_FALLBACK_THRESHOLD = 4
         class CacheMissError < Error; end
         class RefreshError < Error; end
 
@@ -150,7 +152,7 @@ module Kettle
           data = request_json("/repos/#{repo_ref}/git/matching-refs/tags/")
           return nil unless data.is_a?(Array)
 
-          data.each_with_object({}) do |entry, memo|
+          entries = data.each_with_object([]) do |entry, memo|
             ref = entry["ref"].to_s
             next unless ref.start_with?("refs/tags/")
 
@@ -160,16 +162,51 @@ module Kettle
             object = entry["object"]
             next unless object.is_a?(Hash)
 
-            sha = object["sha"].to_s[0, 40]
-            case object["type"]
+            memo << [tag, object["type"].to_s, object["sha"].to_s[0, 40]]
+          end
+          annotated_tag_shas = git_tag_ref_shas(repo_ref) if entries.count { |_, type, _| type == "tag" } > ANNOTATED_TAG_GIT_FALLBACK_THRESHOLD
+
+          entries.each_with_object({}) do |(tag, type, sha), memo|
+            case type
             when "commit"
               memo[tag] = sha
             when "tag"
-              memo[tag] = annotated_tag_commit_sha(repo_ref, sha)
+              memo[tag] = annotated_tag_shas&.fetch(tag, nil) || annotated_tag_commit_sha(repo_ref, sha)
             end
           end
         end
 
+        # The REST API exposes annotated tags as tag objects, requiring one
+        # additional request per tag to reach the commit. A single Git
+        # protocol exchange returns both tag objects and peeled commit refs,
+        # avoiding a refresh timeout for repositories with large tag histories.
+        def git_tag_ref_shas(repo_ref)
+          return unless @api_base.to_s.sub(%r{/\z}, "") == API_BASE
+
+          stdout, _stderr, status = Open3.capture3(
+            {"GIT_TERMINAL_PROMPT" => "0"},
+            "git",
+            "ls-remote",
+            "--tags",
+            "https://github.com/#{repo_ref}.git"
+          )
+          return unless status.success?
+
+          stdout.each_line.each_with_object({}) do |line, memo|
+            sha, ref = line.split
+            next unless SHA_RE.match?(sha.to_s)
+            next unless ref.to_s.start_with?("refs/tags/")
+
+            peeled = ref.end_with?("^{}")
+            tag = ref.sub(%r{\Arefs/tags/}, "").sub(/\^\{\}\z/, "")
+            next unless VersionRubric.parse(tag)
+
+            memo[tag] = sha if peeled || !memo.key?(tag)
+          end
+        rescue IOError, SystemCallError
+          nil
+        end
+
         def annotated_tag_commit_sha(repo_ref, tag_sha)
           return nil if tag_sha.to_s.empty?
 

data/lib/kettle/gha/pins/persistent_action_cache.rb

@@ -54,8 +54,15 @@ module Kettle
           return if repo_ref.to_s.empty?
 
           action = data.fetch("actions")[repo_ref] ||= {}
-          stored_versions = action["versions"] ||= {}
-          refs = action["refs"] ||= {}
+          previous_versions = action["versions"] || {}
+          previous_tags = previous_versions.values.each_with_object([]) do |entry, tags|
+            tag = entry["tag"].to_s
+            tags << tag unless tag.empty?
+          end
+          stored_versions = {}
+          refs = (action["refs"] || {}).reject { |ref, _entry| previous_tags.include?(ref) }
+          action["versions"] = stored_versions
+          action["refs"] = refs
           timestamp = @clock.call.utc.iso8601
 
           versions.each do |entry|

data/lib/kettle/gha/pins/version.rb

@@ -6,7 +6,7 @@ module Kettle
       # Version namespace for this gem.
       module Version
         # Current gem version.
-        VERSION = "0.3.10"
+        VERSION = "0.3.11"
       end
       # Current gem version exposed at the traditional constant location.
       VERSION = Version::VERSION # Traditional Constant Location

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kettle-gha-pins
 version: !ruby/object:Gem::Version
-  version: 0.3.10
+  version: 0.3.11
 platform: ruby
 authors:
 - Peter H. Boling
@@ -301,10 +301,10 @@ licenses:
 - MIT
 metadata:
   homepage_uri: https://github.com/kettle-dev/kettle-gha-pins
-  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.10
-  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.10/CHANGELOG.md
+  source_code_uri: https://github.com/kettle-dev/kettle-gha-pins/tree/v0.3.11
+  changelog_uri: https://github.com/kettle-dev/kettle-gha-pins/blob/v0.3.11/CHANGELOG.md
   bug_tracker_uri: https://github.com/kettle-dev/kettle-gha-pins/issues
-  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.10
+  documentation_uri: https://www.rubydoc.info/gems/kettle-gha-pins/0.3.11
   funding_uri: https://github.com/sponsors/pboling
   wiki_uri: https://github.com/kettle-dev/kettle-gha-pins/wiki
   news_uri: https://www.railsbling.com/tags/kettle-gha-pins