modulesync 4.5.0 → 4.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8ccf6e8a41d6921a17a4171187f6ee1a63478ac231125c5bede16e52e9a2082
-  data.tar.gz: 5e65db0d1e4c83cdcaa4bd6537bb2080f5318551ae6ce10cbb62c1897217910d
+  metadata.gz: b2b460c8084356169de564afc59efed808706c5a08aa3501f8fe1f6f3930fbd3
+  data.tar.gz: 637c12c11b80a3545949cb8e28e3c941e522d9b41fb2a7ba180a9a51e832b223
 SHA512:
-  metadata.gz: c16e333b6556c1141385a8d3e17c7a53c74b9fc74d648cdab58a655d8f055155c33ed37cb89d90ea16905b3b28ac9bb3fb98b520748ace87bd4a5dca85c33beb
-  data.tar.gz: fa3990dfd4ea5c958146832effa2292c5388b8100897a28d7548c3954c385da17fdb16cf1daf7c96aece91c951b69624106c4dcf487b36d17ab06cae67b6a775
+  metadata.gz: 431a276bdaa1fef73a7cc9d670d5c7ee398c7eb82a84e32dd9ce14959d7f001656f7b8bada9d906f76d42ae51affa9298e9b03d629c54ae497b03485d63cc4c1
+  data.tar.gz: e9a0a7842ff1f908a7ffc81f99045186068919b052c5ffd0f4ed886d50ae1e6fd4338726db141333e0326221b79077b837e7e65da0f93bd032677f20c218e8ee

data/.github/workflows/ci.yml

@@ -16,16 +16,16 @@ jobs:
     outputs:
       ruby: ${{ steps.ruby.outputs.versions }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup ruby
-        uses: ruby/setup-ruby@6e5d382445ae5590b7449d8b3bc8cb1c2c27f617 # v1.317.0
+        uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1.325.0
         with:
           ruby-version: "3.4"
           bundler-cache: true
       - name: Run linter
         run: bundle exec rake rubocop
       - id: ruby
-        uses: voxpupuli/ruby-version@656370e339050da63b86b1c631f5f88a3f4c0803 # 1.0.1
+        uses: voxpupuli/ruby-version@be0467ce7366d206b2e87f5b7a032a030120b7cb # 2.0.0
 
   test:
     name: "Ruby ${{ matrix.ruby }}"
@@ -36,9 +36,9 @@ jobs:
       matrix:
         ruby: ${{ fromJSON(needs.rubocop_and_matrix.outputs.ruby) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Ruby ${{ matrix.ruby }}
-        uses: ruby/setup-ruby@6e5d382445ae5590b7449d8b3bc8cb1c2c27f617 # v1.317.0
+        uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1.325.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true

data/.github/workflows/labeler.yml

@@ -14,4 +14,4 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0

data/.github/workflows/release.yml

@@ -15,9 +15,9 @@ jobs:
     name: Build the gem
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Ruby
-        uses: ruby/setup-ruby@6e5d382445ae5590b7449d8b3bc8cb1c2c27f617 # v1.317.0
+        uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1.325.0
         with:
           ruby-version: 'ruby'
       - name: Build gem
@@ -96,7 +96,7 @@ jobs:
         with:
           name: gem-artifact
       - name: Install Ruby
-        uses: ruby/setup-ruby@6e5d382445ae5590b7449d8b3bc8cb1c2c27f617 # v1.317.0
+        uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1.325.0
         with:
           ruby-version: 'ruby'
       - name: Wait for release to propagate

data/CHANGELOG.md

@@ -2,9 +2,25 @@
 
 All notable changes to this project will be documented in this file.
 
-## [4.5.0](https://github.com/voxpupuli/modulesync/tree/4.5.0) (2026-07-15)
+## [4.6.1](https://github.com/voxpupuli/modulesync/tree/4.6.1) (2026-09-25)
 
-[Full Changelog](https://github.com/voxpupuli/modulesync/compare/v4.4.0...4.5.0)
+[Full Changelog](https://github.com/voxpupuli/modulesync/compare/v4.6.0...4.6.1)
+
+**Fixed bugs:**
+
+- fix: rebase existing remote branches after a fresh clone [\#376](https://github.com/voxpupuli/modulesync/pull/376) ([rwaffen](https://github.com/rwaffen))
+
+## [v4.6.0](https://github.com/voxpupuli/modulesync/tree/v4.6.0) (2026-07-31)
+
+[Full Changelog](https://github.com/voxpupuli/modulesync/compare/v4.5.0...v4.6.0)
+
+**Implemented enhancements:**
+
+- feat: add support for cryptographic signing and signoff options in commits and tags [\#368](https://github.com/voxpupuli/modulesync/pull/368) ([rwaffen](https://github.com/rwaffen))
+
+## [v4.5.0](https://github.com/voxpupuli/modulesync/tree/v4.5.0) (2026-07-15)
+
+[Full Changelog](https://github.com/voxpupuli/modulesync/compare/v4.4.0...v4.5.0)
 
 **Implemented enhancements:**
 

data/README.md

@@ -166,6 +166,17 @@ Not required for gerrit.
 msync update --amend --force
 ```
 
+Use `--sign` to cryptographically sign commits and tags with Git's configured signing key and backend.
+ModuleSync only passes Git's signing flags (`git commit --gpg-sign` and `git tag --sign`).
+It does not configure the signing key, format, or backend; users must configure these settings in their Git configuration.
+Use `--signoff` to add Git's `Signed-off-by` trailer.
+The options can be combined and also apply to the release commit created by `--bump`.
+When combined with `--tag`, `--sign` creates signed annotated tags using `git tag --sign`.
+
+```shell
+msync update -m "Commit message" --sign --signoff
+```
+
 #### Automating Updates
 
 You can install a pre-push git hook to automatically clone, update, and push modules upon pushing changes to the configuration directory.
@@ -365,6 +376,12 @@ If you wish to tag the modified repositories with the newly bumped version, you
 msync update -m "Commit message" --bump --tag
 ```
 
+Add `--sign` to cryptographically sign both the release commit and tag:
+
+```shell
+msync update -m "Commit message" --bump --tag --sign
+```
+
 #### Setting the tag pattern
 
 You can also set the format of the tag to be used (`printf`-formatted) by setting the `tag_pattern` option:

data/features/cli.feature

@@ -28,6 +28,11 @@ Feature: CLI
       msync clone
     """
 
+  Scenario: Update help lists commit signing options
+    When I successfully run `msync update --help`
+    Then the output should match /--sign/
+    And the output should match /--signoff/
+
   Scenario: When overriding a setting from the config file on the command line
     Given a puppet module "puppet-test" from "fakenamespace"
     And a file named "managed_modules.yml" with:

data/lib/modulesync/cli.rb

@@ -88,6 +88,14 @@ module ModuleSync
              type: :boolean,
              desc: 'Amend previous commit',
              default: false
+      option :sign,
+             type: :boolean,
+             desc: 'Cryptographically sign commits and tags',
+             default: false
+      option :signoff,
+             type: :boolean,
+             desc: 'Add a Signed-off-by trailer to commits',
+             default: false
       option :force,
              type: :boolean,
              desc: 'Force push amended commit',

data/lib/modulesync/puppet_module.rb

@@ -25,13 +25,13 @@ module ModuleSync
       end
     end
 
-    def bump(message, changelog = false)
+    def bump(message, changelog = false, signing_options = {})
       m = Blacksmith::Modulefile.new path('metadata.json')
       new = m.bump!
       puts "Bumped to version #{new}"
       repository.git.add('metadata.json')
       update_changelog(new, message) if changelog
-      repository.git.commit("Release version #{new}")
+      repository.commit_changes("Release version #{new}", signing_options)
       repository.git.push
       new
     end

data/lib/modulesync/repository.rb

@@ -105,16 +105,17 @@ module ModuleSync
         puts "Overriding any local changes to repository in '#{@directory}'"
         git.fetch 'origin', prune: true unless operate_offline
         git.reset_hard
-        rebase_target = remote_default_branch if rebase && !operate_offline
         switch(branch: branch)
         git.pull('origin', branch) if !operate_offline && remote_branch_exists?(branch)
-        rebase_onto(rebase_target) if rebase_target
       else
         raise ModuleSync::Error, 'Unable to clone in offline mode.' if operate_offline
 
         clone
         switch(branch: branch)
       end
+
+      rebase_target = remote_default_branch if rebase && !operate_offline
+      rebase_onto(rebase_target) if rebase_target
     end
 
     def rebase_onto(branch)
@@ -165,10 +166,10 @@ module ModuleSync
       end
     end
 
-    def tag(version, tag_pattern)
+    def tag(version, tag_pattern, sign: false)
       tag = tag_pattern % version
       puts "Tagging with #{tag}"
-      repo.add_tag(tag)
+      repo.add_tag(tag, sign: sign)
       repo.push('origin', tag)
     end
 
@@ -178,6 +179,19 @@ module ModuleSync
       selected_branch
     end
 
+    def commit_changes(message, options)
+      commit_options = {}
+      commit_options[:amend] = true if options[:amend]
+      commit_options[:gpg_sign] = true if options[:sign]
+      return repo.commit(message, commit_options) unless options[:signoff]
+
+      arguments = ["--message=#{message}"]
+      arguments.push('--amend', '--no-edit') if options[:amend]
+      arguments << '--gpg-sign' if options[:sign]
+      arguments << '--signoff'
+      repo.lib.send(:command, 'commit', *arguments)
+    end
+
     # Git add/rm, git commit, git push
     def submit_changes(files, options)
       message = options[:message]
@@ -190,8 +204,6 @@ module ModuleSync
         end
       end
       begin
-        opts_commit = {}
-        opts_commit = { amend: true } if options[:amend]
         if options[:pre_commit_script]
           script = "#{File.dirname(__FILE__, 3)}/contrib/#{options[:pre_commit_script]}"
           system(script, @directory)
@@ -200,7 +212,7 @@ module ModuleSync
           puts "There were no changes in '#{@directory}'. Not committing."
           return false unless @rebased
         else
-          repo.commit(message, opts_commit)
+          commit_changes(message, options)
         end
         if options[:remote_branch]
           if @rebased || remote_branch_differ?(branch, options[:remote_branch])

data/lib/modulesync/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ModuleSync
-  VERSION = '4.5.0'
+  VERSION = '4.6.1'
 end

data/lib/modulesync.rb

@@ -151,8 +151,9 @@ module ModuleSync
       pushed = puppet_module.repository.submit_changes(files_to_manage, options)
       # Only bump/tag if pushing didn't fail (i.e. there were changes)
       if pushed && options[:bump]
-        new = puppet_module.bump(options[:message], options[:changelog])
-        puppet_module.repository.tag(new, options[:tag_pattern]) if options[:tag]
+        signing_options = { sign: options[:sign], signoff: options[:signoff] }
+        new = puppet_module.bump(options[:message], options[:changelog], signing_options)
+        puppet_module.repository.tag(new, options[:tag_pattern], sign: options[:sign]) if options[:tag]
       end
       options[:pr] && (pushed || puppet_module.pull_request_branch_ready?) && puppet_module.open_pull_request
     end

data/spec/unit/module_sync/repository_spec.rb

@@ -73,6 +73,50 @@ describe ModuleSync::Repository do
   end
 
   describe '#prepare_workspace' do
+    context 'with a fresh clone and an existing remote modulesync branch' do
+      before do
+        allow(Dir).to receive(:exist?).with('/tmp/example/.git').and_return(false)
+        allow(Git).to receive(:clone).with('https://github.com/example/repository.git', '/tmp/example').and_return(git)
+        allow(Git).to receive(:default_branch).with('https://github.com/example/repository.git').and_return('main')
+        allow(git).to receive(:current_branch).and_return('main', 'modulesync')
+        allow(branches).to receive(:local).and_return([])
+        allow(git).to receive(:checkout).with('origin/modulesync')
+        allow(git).to receive(:branch).with('modulesync').and_return(instance_double(Git::Branch, checkout: true))
+        allow(log).to receive(:between).with('modulesync', 'origin/main').and_return(log)
+        allow(log).to receive(:execute).and_return([instance_double(Git::Object::Commit)])
+      end
+
+      it 'rebases and pushes the existing branch even when rendering makes no file changes' do
+        allow(git).to receive(:status).and_return(instance_double(Git::Status, added: {}, changed: {}, deleted: {}))
+        expect(git).to receive(:checkout).with('origin/modulesync').ordered
+        expect(git_lib).to receive(:send).with(:command, 'rebase', 'origin/main').ordered
+        expect(git_lib).to receive(:send).with(:command, 'push', '--force-with-lease', 'origin', 'modulesync').ordered
+
+        repository.prepare_workspace(branch: 'modulesync', operate_offline: false, rebase: true)
+
+        expect(repository.submit_changes([], branch: 'modulesync', message: 'Update', force: false)).to be true
+      end
+
+      it 'does not rebase unless requested' do
+        expect(Git).not_to receive(:default_branch)
+        expect(git_lib).not_to receive(:send)
+
+        repository.prepare_workspace(branch: 'modulesync', operate_offline: false)
+      end
+    end
+
+    it 'does not rebase an existing workspace in offline mode' do
+      allow(Dir).to receive(:exist?).with('/tmp/example/.git').and_return(true)
+      allow(git).to receive(:current_branch).and_return('modulesync')
+      expect(git).to receive(:reset_hard)
+      expect(git).not_to receive(:fetch)
+      expect(git).not_to receive(:pull)
+      expect(Git).not_to receive(:default_branch)
+      expect(git_lib).not_to receive(:send)
+
+      repository.prepare_workspace(branch: 'modulesync', operate_offline: true, rebase: true)
+    end
+
     it 'fetches and rebases the selected branch onto the remote default branch when requested' do
       allow(Dir).to receive(:exist?).with('/tmp/example/.git').and_return(true)
       allow(Git).to receive(:default_branch).with('https://github.com/example/repository.git').and_return('main')
@@ -116,4 +160,35 @@ describe ModuleSync::Repository do
       expect(result).to be true
     end
   end
+
+  describe '#commit_changes' do
+    it 'signs the commit when requested' do
+      expect(git).to receive(:commit).with('Update', { gpg_sign: true })
+
+      repository.commit_changes('Update', sign: true, signoff: false)
+    end
+
+    it 'uses the Git signoff option when requested' do
+      expect(git_lib).to receive(:send)
+        .with(:command, 'commit', '--message=Update', '--signoff')
+
+      repository.commit_changes('Update', sign: false, signoff: true)
+    end
+
+    it 'combines amend, signing, and signoff options' do
+      expect(git_lib).to receive(:send)
+        .with(:command, 'commit', '--message=Update', '--amend', '--no-edit', '--gpg-sign', '--signoff')
+
+      repository.commit_changes('Update', amend: true, sign: true, signoff: true)
+    end
+  end
+
+  describe '#tag' do
+    it 'signs and pushes the tag when requested' do
+      expect(git).to receive(:add_tag).with('v1.2.3', sign: true)
+      expect(git).to receive(:push).with('origin', 'v1.2.3')
+
+      repository.tag('1.2.3', 'v%s', sign: true)
+    end
+  end
 end

data/spec/unit/module_sync_spec.rb

@@ -70,5 +70,17 @@ describe ModuleSync do
 
       described_class.manage_module(puppet_module, [], {})
     end
+
+    it 'passes signing options to a release commit and tag' do
+      options = described_class.config_defaults.merge(message: 'Update', bump: true, tag: true, sign: true, signoff: true)
+      described_class.instance_variable_set(:@options, options)
+      allow(repository).to receive(:submit_changes).and_return(true)
+      expect(puppet_module).to receive(:bump)
+        .with('Update', nil, { sign: true, signoff: true })
+        .and_return('1.2.3')
+      expect(repository).to receive(:tag).with('1.2.3', '%s', sign: true)
+
+      described_class.manage_module(puppet_module, [], {})
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: modulesync
 version: !ruby/object:Gem::Version
-  version: 4.5.0
+  version: 4.6.1
 platform: ruby
 authors:
 - Vox Pupuli
@@ -266,7 +266,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.16
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Puppet Module Synchronizer
 test_files: []