pray-cli 1.17.0 → 1.18.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f7499680372bceb27c55d6d182225ea43870e4bfd94a431a085e42198ff90557
-  data.tar.gz: 32af3f08b8ea05718970b3283f04e81552ff8355ad0ca260d3b1c61b3ab05619
+  metadata.gz: 91a549f989bb5872cf7307c16101a89c479bda9f919dd4f969917a80f4bf5958
+  data.tar.gz: 01a7042cad4e383a95ca2b15d698b9e00a46707d27b2885381ce57f6775cb15b
 SHA512:
-  metadata.gz: 1ea412c96b4c0d3cb766f75bec70dcd9e29c368594bf67d4438f8464703dbe4cd781dff6b093eefa8f46269de3886d09ff4bf27c8c02503a6e61650413439667
-  data.tar.gz: 389eb906dbdae17bf789290a450e10c5a6ccae9064f707d4f494e444e4efdaf62283103adf3f0bc335d705a99292efb1885c87da4c1daab40677a6a0fbd9e0d0
+  metadata.gz: 52f904573df3f97eb3ad240388db1ac7d81d36cd66fe24b43be8cf32f392d59abf6283fc496a92b9844e40cec4d7058bf8db54fb97716164635c395c95a27796
+  data.tar.gz: ccc7110154721dbc019d02c37ecdbeaaac225ccf702e8d1007cfe3af4b3f54f35627876fb78f15eb5617e691c7c7ca7016c9c05853b1719655545a087baf8eef

data/CHANGELOG.md

@@ -1,5 +1,20 @@
 # CHANGELOG
 
+## 1.18.1 (2026-09-17)
+
+- Fix `pray package` and `pray publish` when the CLI cannot create a staging directory.
+
+## 1.18.0 (2026-09-17)
+
+- Clone a git catalog without unused package blobs, and fetch a used package file when install needs it.
+- Skip cloning a git catalog when no package uses that source.
+- Fetch a used git catalog once on `pray update` instead of fetching it twice.
+- Keep packages from two git sources that share a clone URL when each source names a different `subdir`.
+- Share one git object store for those subdirectory checkouts.
+- Import signing keys with `pray trust import-repo` after a catalog was cloned only through `subdir` sources.
+- Reuse registry package metadata during one command so `pray update --latest` does not download the same package JSON twice.
+- Skip a second resolve when `pray update --latest` does not rewrite constraints or upstream pins, and still refresh path-fork files when needed.
+
 ## 1.17.0 (2026-09-16)
 
 - Locate local prayers through a path source of any directory name (RFC 0117). `pray prayer init` adds `source "local"` when needed and declares `pray "local/project"` once. Version is optional until `pray package` or `pray publish`. `.agents/project.md` remains a compose shortcut for one local file.

data/lib/pray/archive.rb

@@ -3,6 +3,7 @@
 require "json"
 require "open3"
 require "fileutils"
+require "tmpdir"
 require_relative "archive_unpack"
 require_relative "path_safety"
 

data/lib/pray/cli/commands/trust.rb

@@ -28,10 +28,10 @@ module Pray
 
     def trust_import_repo_command(source_url, match_prefix: nil)
       clone_url = source_url.delete_prefix("git+")
-      repository = GitSources.git_source_cache_directory(Dir.pwd, clone_url)
-      unless File.directory?(File.join(repository, ".git"))
+      repository = GitSources.git_source_cached_repository(Dir.pwd, clone_url)
+      unless repository
         raise Error.resolution(
-          "no cached git repository for #{clone_url} at #{repository}"
+          "no cached git repository for #{clone_url}"
         )
       end
 

data/lib/pray/cli/commands/update_latest.rb

@@ -6,13 +6,15 @@ module Pray
       path = manifest_path
       original_text = Pray.read_manifest_text(path)
       manifest_text = original_text
-      preview_options = ResolveOptions.new(
+      unlocked = package ? Set[package] : Set.new
+      options = ResolveOptions.new(
         offline: offline,
         refresh: true,
         refresh_source_revisions: true,
-        ignore_locked_versions: true
+        ignore_locked_versions: package.nil?,
+        unlocked_packages: unlocked
       )
-      project = resolve_current_project(preview_options)
+      project = resolve_current_project(options)
       if package && project.manifest.packages.none? { |entry| entry.name == package }
         raise Error.manifest("package #{package} not found")
       end
@@ -46,24 +48,20 @@ module Pray
 
       previous = File.exist?(lockfile_path) ? Pray.read_lockfile(lockfile_path) : nil
       upstream_plans = Upstream.plan_path_upstream_latest_constraints(
-        project, previous, package, preview_options
+        project, previous, package, options
       )
       print_latest_constraint_plans(manifest_updates, upstream_plans)
 
       return if dry_run
 
-      Upstream.apply_path_upstream_latest_constraints(upstream_plans)
-      Transaction.write_file(path, manifest_text) if manifest_text != original_text
-      unlocked = package ? Set[package] : Set.new
-      options = ResolveOptions.new(
-        offline: offline,
-        refresh: true,
-        refresh_source_revisions: true,
-        ignore_locked_versions: package.nil?,
-        unlocked_packages: unlocked
-      )
-      current = resolve_current_project(options)
-      Upstream.apply_path_upstream_refreshes(current, previous, package, options)
+      if !manifest_updates.empty? || !upstream_plans.empty?
+        Upstream.apply_path_upstream_latest_constraints(upstream_plans)
+        Transaction.write_file(path, manifest_text) if manifest_text != original_text
+        current = resolve_current_project(options)
+        Upstream.apply_path_upstream_refreshes(current, previous, package, options)
+      else
+        Upstream.apply_path_upstream_refreshes(project, previous, package, options)
+      end
       install_command(
         {
           locked: false,

data/lib/pray/git_cache.rb

@@ -0,0 +1,192 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "pathname"
+require_relative "error"
+require_relative "hashing"
+require_relative "git_run"
+require_relative "git_clone"
+
+module Pray
+  module GitCache
+    module_function
+
+    def ensure_git_repository(project_root, clone_url, refresh:, pinned_revision:, sparse_subdir:)
+      shared = git_source_cache_directory(project_root, clone_url)
+      ensure_shared_git_repository(project_root, clone_url, shared, refresh: refresh, pinned_revision: pinned_revision)
+      checkout = git_source_cache_directory(project_root, clone_url, sparse_subdir)
+      if checkout != shared
+        ensure_linked_worktree(shared, checkout)
+        GitClone.apply_sparse_checkout(checkout, sparse_subdir)
+        if pinned_revision
+          checkout_git_revision(checkout, clone_url, pinned_revision, refresh)
+        elsif refresh
+          GitRun.run_git(checkout, "reset", "--hard", git_head_revision(shared))
+        end
+        return [checkout, git_head_revision(checkout)]
+      end
+
+      GitClone.apply_sparse_checkout(shared)
+      [shared, git_head_revision(shared)]
+    end
+
+    def git_source_cache_directory(project_root, clone_url, subdir = nil)
+      identity = (subdir && !subdir.empty?) ? "#{clone_url}\n#{subdir}" : clone_url
+      File.join(project_root, ".pray", "cache", "git", cache_key(identity))
+    end
+
+    def git_source_cached_repository(project_root, clone_url)
+      shared = git_source_cache_directory(project_root, clone_url)
+      return shared if git_checkout?(shared)
+
+      cache_root = File.join(project_root, ".pray", "cache", "git")
+      return nil unless File.directory?(cache_root)
+
+      Dir.children(cache_root).each do |name|
+        path = File.join(cache_root, name)
+        return path if git_checkout?(path) && origin_matches?(path, clone_url)
+      end
+      nil
+    end
+
+    def git_checkout?(path)
+      File.exist?(File.join(path, ".git"))
+    end
+
+    def cache_key(text)
+      Hashing.sha256_prefixed(text)[7, 16]
+    end
+
+    def ensure_shared_git_repository(project_root, clone_url, shared, refresh:, pinned_revision:)
+      if File.directory?(File.join(shared, ".git"))
+        if pinned_revision
+          checkout_git_revision(shared, clone_url, pinned_revision, refresh)
+        elsif refresh
+          refresh_git_worktree(shared, clone_url)
+        end
+        refresh_global_from_project(clone_url, shared) if refresh
+        return
+      end
+
+      FileUtils.rm_rf(shared) if File.exist?(shared)
+      FileUtils.mkdir_p(File.dirname(shared))
+      seeded = seed_git_cache_from_global(clone_url, shared, project_root)
+      if seeded
+        GitRun.run_git(shared, "remote", "set-url", "origin", clone_url)
+      else
+        GitClone.clone_git_cache(project_root, clone_url, shared, quiet: false)
+        mirror_git_cache_to_global(clone_url, shared)
+      end
+      GitClone.apply_sparse_checkout(shared)
+      if pinned_revision
+        checkout_git_revision(shared, clone_url, pinned_revision, true)
+      elsif refresh && seeded
+        refresh_git_worktree(shared, clone_url)
+      end
+      refresh_global_from_project(clone_url, shared) if refresh && seeded
+    end
+
+    def ensure_linked_worktree(shared, checkout)
+      return if same_object_store?(shared, checkout)
+
+      FileUtils.rm_rf(checkout) if File.exist?(checkout)
+      FileUtils.mkdir_p(File.dirname(checkout))
+      return if GitRun.try_run_git(shared, "worktree", "add", "--detach", "--no-checkout", checkout)
+
+      GitRun.run_git(shared, "worktree", "add", "--detach", checkout)
+    end
+
+    def same_object_store?(shared, checkout)
+      return false unless git_checkout?(checkout)
+
+      git_common_dir(shared) == git_common_dir(checkout)
+    end
+
+    def git_common_dir(repository)
+      output, status = GitRun.capture_git(repository, "rev-parse", "--git-common-dir")
+      raise Error.resolution(GitRun.command_error("git rev-parse --git-common-dir", output)) unless status.success?
+
+      reported = output.strip
+      path = Pathname.new(reported).absolute? ? reported : File.expand_path(reported, repository)
+      File.realpath(path)
+    end
+
+    def origin_matches?(repository, clone_url)
+      output, status = GitRun.capture_git(repository, "remote", "get-url", "origin")
+      return false unless status.success?
+
+      origin = output.strip.delete_prefix("git+")
+      origin == clone_url
+    end
+
+    def global_cache_root
+      return ENV["PRAY_CACHE"] if ENV["PRAY_CACHE"]
+      return File.join(ENV["PRAY_HOME"], "cache") if ENV["PRAY_HOME"]
+
+      home = ENV["HOME"]
+      home ? File.join(home, ".cache", "pray") : nil
+    end
+
+    def global_git_cache_directory(clone_url)
+      root = global_cache_root
+      root ? File.join(root, "git", cache_key(clone_url)) : nil
+    end
+
+    def global_git_cache_ready?(global_cache)
+      File.directory?(File.join(global_cache, ".git")) || File.file?(File.join(global_cache, "HEAD"))
+    end
+
+    def seed_git_cache_from_global(clone_url, destination, working_directory)
+      global_cache = global_git_cache_directory(clone_url)
+      return false unless global_cache && global_git_cache_ready?(global_cache)
+
+      GitClone.clone_git_cache(working_directory, global_cache, destination, quiet: true)
+      true
+    end
+
+    def mirror_git_cache_to_global(clone_url, project_cache)
+      global_cache = global_git_cache_directory(clone_url)
+      return unless global_cache
+      return if global_git_cache_ready?(global_cache)
+
+      FileUtils.mkdir_p(File.dirname(global_cache))
+      FileUtils.rm_rf(global_cache) if File.exist?(global_cache)
+      GitRun.run_git(File.dirname(project_cache), "clone", "--bare", "--quiet", File.basename(project_cache), global_cache)
+    end
+
+    def fetch_origin(repository, revision = nil)
+      extra = revision ? [revision] : []
+      return if GitRun.try_run_git(repository, "fetch", "--depth", "1", "--filter=blob:none", "origin", *extra)
+
+      GitRun.run_git(repository, "fetch", "--depth", "1", "origin", *extra)
+    end
+
+    def checkout_git_revision(repository, _clone_url, revision, refresh)
+      fetch_origin(repository, revision) if refresh
+      GitRun.run_git(repository, "checkout", "--force", revision)
+    end
+
+    def refresh_git_worktree(repository, _clone_url)
+      fetch_origin(repository)
+      GitRun.run_git(repository, "reset", "--hard", "origin/HEAD")
+    end
+
+    def refresh_global_from_project(clone_url, project_cache)
+      global_cache = global_git_cache_directory(clone_url)
+      return unless global_cache
+
+      FileUtils.rm_rf(global_cache) if global_git_cache_ready?(global_cache) || File.exist?(global_cache)
+      mirror_git_cache_to_global(clone_url, project_cache)
+    end
+
+    def git_head_revision(repository)
+      output, status = GitRun.capture_git(repository, "rev-parse", "HEAD")
+      raise Error.resolution(GitRun.command_error("git rev-parse HEAD", output)) unless status.success?
+
+      revision = output.strip
+      raise Error.resolution("git repository has no HEAD revision") if revision.empty?
+
+      revision
+    end
+  end
+end

data/lib/pray/git_clone.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+require_relative "git_run"
+
+module Pray
+  module GitClone
+    module_function
+
+    def clone_git_cache(working_directory, source, destination, quiet:)
+      filtered = ["clone", "--depth", "1", "--filter=blob:none", "--sparse", source, destination]
+      filtered.insert(1, "--quiet") if quiet
+      return if GitRun.try_run_git(working_directory, *filtered)
+
+      full = ["clone", "--depth", "1", source, destination]
+      full.insert(1, "--quiet") if quiet
+      GitRun.run_git(working_directory, *full)
+    end
+
+    def apply_sparse_checkout(repository, subdir = nil)
+      GitRun.run_git(repository, "sparse-checkout", "init", "--cone")
+      GitRun.run_git(repository, "sparse-checkout", "set", *catalog_sparse_cones(subdir))
+    end
+
+    def catalog_sparse_cones(subdir)
+      if subdir && !subdir.empty?
+        ["#{subdir}/v1/packages"]
+      else
+        ["v1/packages", "prayers/v1/packages"]
+      end
+    end
+  end
+end

data/lib/pray/git_materialize.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require_relative "git_run"
+require_relative "error"
+require_relative "path_safety"
+
+module Pray
+  module GitMaterialize
+    module_function
+
+    def read_local_artifact_bytes(source_root, artifact)
+      if artifact.start_with?("file://")
+        path = PathSafety.join_under_root(source_root, artifact.delete_prefix("file://"))
+        raise Error.resolution("package artifact path escapes distribution root") unless path
+
+        return File.binread(path)
+      end
+      if artifact.match?(%r{\A[a-z][a-z0-9+.-]*:}i)
+        raise Error.integrity("remote artifact path must be relative: #{artifact}")
+      end
+
+      path = PathSafety.join_under_root(source_root, artifact)
+      raise Error.resolution("package artifact path escapes distribution root") unless path
+
+      materialize_catalog_file(source_root, artifact) unless File.exist?(path)
+      raise Error.resolution("package artifact missing at #{path}") unless File.exist?(path)
+
+      File.binread(path)
+    end
+
+    def materialize_catalog_file(source_root, relative)
+      return if File.file?(File.join(source_root, relative))
+      return unless sparse_checkout_enabled?(source_root)
+
+      toplevel = git_toplevel(source_root)
+      return unless toplevel
+
+      repo_relative = repo_relative_text(source_root, relative)
+      return unless repo_relative
+
+      cone = artifact_sparse_cone(repo_relative)
+      GitRun.run_git(toplevel, "sparse-checkout", "add", cone) if cone
+      GitRun.run_git(toplevel, "checkout", "HEAD", "--", repo_relative)
+    end
+
+    def sparse_checkout_enabled?(source_root)
+      output, status = GitRun.capture_git(source_root, "config", "--get", "core.sparseCheckout")
+      status.success? && output.strip == "true"
+    end
+
+    def git_toplevel(source_root)
+      output, status = GitRun.capture_git(source_root, "rev-parse", "--show-toplevel")
+      return unless status.success?
+
+      text = output.strip
+      text.empty? ? nil : text
+    end
+
+    def repo_relative_text(source_root, relative)
+      output, status = GitRun.capture_git(source_root, "rev-parse", "--show-prefix")
+      return unless status.success?
+
+      prefix = output.strip
+      prefix.empty? ? relative : File.join(prefix, relative)
+    end
+
+    def artifact_sparse_cone(repo_relative)
+      parts = repo_relative.split("/").reject(&:empty?)
+      return repo_relative if parts.length < 2
+
+      parts.pop
+      parts.pop if parts.last != "artifacts" && parts.length > 3
+      parts.join("/")
+    end
+  end
+end

data/lib/pray/git_run.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require "open3"
+require_relative "error"
+
+module Pray
+  module GitRun
+    module_function
+
+    def run_git(cwd, *arguments)
+      output, status = capture_git(cwd, *arguments)
+      return if status.success?
+
+      raise Error.resolution(command_error("git #{arguments.join(" ")}", output))
+    end
+
+    def try_run_git(cwd, *arguments)
+      _output, status = capture_git(cwd, *arguments)
+      status.success?
+    end
+
+    def capture_git(cwd, *arguments)
+      env = ENV.to_h.merge("GIT_TERMINAL_PROMPT" => "0")
+      Open3.capture2e(
+        env,
+        "git",
+        "-c",
+        "protocol.file.allow=always",
+        "-C",
+        cwd,
+        *arguments,
+        stdin_data: ""
+      )
+    end
+
+    def command_error(program, output)
+      message = output.strip
+      message.empty? ? "#{program} failed" : "#{program} failed: #{message}"
+    end
+  end
+end

data/lib/pray/git_sources.rb

@@ -1,48 +1,73 @@
 # frozen_string_literal: true
 
-require "open3"
-require "fileutils"
 require "pathname"
+require_relative "git_cache"
 
 module Pray
   GitSourceCheckout = Struct.new(:cache_directory, :revision, :subdir)
 
+  class GitSourceSet
+    def initialize(project_root, sources, lockfile, refresh:)
+      @project_root = project_root
+      @lockfile = lockfile
+      @refresh = refresh
+      @sources = sources.select { |source| source.kind == "git" }.to_h { |source| [source.name, source] }
+      @checkouts = {}
+    end
+
+    def [](name)
+      return @checkouts[name] if @checkouts.key?(name)
+
+      source = @sources[name]
+      return nil unless source
+
+      checkout = GitSources.prepare_one_git_source(@project_root, source, @lockfile, refresh: @refresh)
+      @checkouts[name] = checkout if checkout
+      checkout
+    end
+
+    def revisions
+      @checkouts.each_with_object({}) do |(name, checkout), collected|
+        next if checkout.revision.to_s.empty?
+
+        collected[name] = checkout.revision
+      end
+    end
+  end
+
   module GitSources
     module_function
 
     def prepare_git_sources(project_root, sources, lockfile, refresh: false)
-      checkouts = {}
-      sources.each do |source|
-        next unless source.kind == "git"
-
-        clone_url = source.url.delete_prefix("git+")
-        if local_filesystem_source?(clone_url) && !local_git_repo_path(project_root, clone_url)
-          source_root = local_git_source_root(project_root, clone_url)
-          if source_root
-            checkouts[source.name] = GitSourceCheckout.new(
-              cache_directory: source_root,
-              revision: "",
-              subdir: source.subdir
-            )
-          end
-          next
-        end
-
-        pinned_revision = refresh ? nil : pinned_revision_for_source(lockfile, source)
-        cache_directory, revision = ensure_git_repository(
-          project_root,
-          clone_url,
-          refresh: refresh,
-          pinned_revision: pinned_revision,
-          sparse_subdir: source.subdir
-        )
-        checkouts[source.name] = GitSourceCheckout.new(
-          cache_directory: cache_directory,
-          revision: revision,
+      GitSourceSet.new(project_root, sources, lockfile, refresh: refresh)
+    end
+
+    def prepare_one_git_source(project_root, source, lockfile, refresh:)
+      clone_url = source.url.delete_prefix("git+")
+      if local_filesystem_source?(clone_url) && !local_git_repo_path(project_root, clone_url)
+        source_root = local_git_source_root(project_root, clone_url)
+        return unless source_root
+
+        return GitSourceCheckout.new(
+          cache_directory: source_root,
+          revision: "",
           subdir: source.subdir
         )
       end
-      checkouts
+
+      pinned_revision = refresh ? nil : pinned_revision_for_source(lockfile, source)
+      cache_directory, revision = GitCache.ensure_git_repository(
+        project_root,
+        clone_url,
+        refresh: refresh,
+        pinned_revision: pinned_revision,
+        sparse_subdir: source.subdir
+      )
+      GitSourceCheckout.new(
+        cache_directory: cache_directory,
+        revision: revision,
+        subdir: source.subdir
+      )
     end
 
     def resolve_distribution_root(repo_root, subdir)
@@ -83,39 +108,12 @@ module Pray
       discover_distribution_root(path)
     end
 
-    def ensure_git_repository(project_root, clone_url, refresh:, pinned_revision:, sparse_subdir:)
-      cache_directory = git_source_cache_directory(project_root, clone_url)
-      if File.directory?(File.join(cache_directory, ".git"))
-        refresh_global_git_cache(clone_url) if refresh
-        if pinned_revision
-          checkout_git_revision(cache_directory, clone_url, pinned_revision, refresh)
-        elsif refresh
-          refresh_git_worktree(cache_directory, clone_url)
-        end
-        apply_sparse_checkout(cache_directory, sparse_subdir) if sparse_subdir
-        revision = git_head_revision(cache_directory)
-        return [cache_directory, revision]
-      end
-
-      FileUtils.rm_rf(cache_directory) if File.exist?(cache_directory)
-      FileUtils.mkdir_p(File.dirname(cache_directory))
-      if seed_git_cache_from_global(clone_url, cache_directory, project_root)
-        run_git_in_repo(cache_directory, "remote", "set-url", "origin", clone_url)
-      else
-        run_git(project_root, "clone", "--depth", "1", clone_url, cache_directory)
-        mirror_git_cache_to_global(clone_url, cache_directory)
-      end
-      checkout_git_revision(cache_directory, clone_url, pinned_revision, true) if pinned_revision
-      apply_sparse_checkout(cache_directory, sparse_subdir) if sparse_subdir
-      [cache_directory, git_head_revision(cache_directory)]
-    end
-
-    def git_source_cache_directory(project_root, clone_url)
-      File.join(project_root, ".pray", "cache", "git", cache_key(clone_url))
+    def git_source_cache_directory(project_root, clone_url, subdir = nil)
+      GitCache.git_source_cache_directory(project_root, clone_url, subdir)
     end
 
-    def cache_key(text)
-      Hashing.sha256_prefixed(text)[7, 16]
+    def git_source_cached_repository(project_root, clone_url)
+      GitCache.git_source_cached_repository(project_root, clone_url)
     end
 
     def pinned_revision_for_source(lockfile, source)
@@ -142,88 +140,5 @@ module Pray
       path = clone_url.delete_prefix("file://")
       Pathname.new(path).absolute? ? path : File.expand_path(path, project_root)
     end
-
-    def global_cache_root
-      return ENV["PRAY_CACHE"] if ENV["PRAY_CACHE"]
-      return File.join(ENV["PRAY_HOME"], "cache") if ENV["PRAY_HOME"]
-
-      home = ENV["HOME"]
-      home ? File.join(home, ".cache", "pray") : nil
-    end
-
-    def global_git_cache_directory(clone_url)
-      root = global_cache_root
-      root ? File.join(root, "git", cache_key(clone_url)) : nil
-    end
-
-    def global_git_cache_ready?(global_cache)
-      File.directory?(File.join(global_cache, ".git")) || File.file?(File.join(global_cache, "HEAD"))
-    end
-
-    def seed_git_cache_from_global(clone_url, destination, working_directory)
-      global_cache = global_git_cache_directory(clone_url)
-      return false unless global_cache && global_git_cache_ready?(global_cache)
-
-      run_git(working_directory, "clone", "--depth", "1", "--quiet", global_cache, destination)
-      true
-    end
-
-    def mirror_git_cache_to_global(clone_url, project_cache)
-      global_cache = global_git_cache_directory(clone_url)
-      return unless global_cache
-      return if global_git_cache_ready?(global_cache)
-
-      FileUtils.mkdir_p(File.dirname(global_cache))
-      FileUtils.rm_rf(global_cache) if File.exist?(global_cache)
-      run_git(File.dirname(project_cache), "clone", "--bare", "--quiet", File.basename(project_cache), global_cache)
-    end
-
-    def apply_sparse_checkout(repository, subdir)
-      run_git_in_repo(repository, "sparse-checkout", "init", "--cone")
-      run_git_in_repo(repository, "sparse-checkout", "set", subdir)
-    end
-
-    def checkout_git_revision(repository, _clone_url, revision, refresh)
-      run_git_in_repo(repository, "fetch", "--depth", "1", "origin", revision) if refresh
-      run_git_in_repo(repository, "checkout", "--force", revision)
-    end
-
-    def refresh_git_worktree(repository, _clone_url)
-      run_git_in_repo(repository, "fetch", "--depth", "1", "origin")
-      run_git_in_repo(repository, "reset", "--hard", "origin/HEAD")
-    end
-
-    def refresh_global_git_cache(clone_url)
-      global_cache = global_git_cache_directory(clone_url)
-      return unless global_cache && global_git_cache_ready?(global_cache)
-
-      run_git_in_repo(global_cache, "fetch", "--depth", "1", "origin")
-    end
-
-    def git_head_revision(repository)
-      output, status = Open3.capture2e("git", "-C", repository, "rev-parse", "HEAD")
-      raise Error.resolution(command_error("git rev-parse HEAD", output)) unless status.success?
-
-      revision = output.strip
-      raise Error.resolution("git repository has no HEAD revision") if revision.empty?
-
-      revision
-    end
-
-    def run_git(cwd, *arguments)
-      output, status = Open3.capture2e("git", "-C", cwd, *arguments)
-      return if status.success?
-
-      raise Error.resolution(command_error("git #{arguments.join(" ")}", output))
-    end
-
-    def run_git_in_repo(repository, *arguments)
-      run_git(repository, *arguments)
-    end
-
-    def command_error(program, output)
-      message = output.strip
-      message.empty? ? "#{program} failed" : "#{program} failed: #{message}"
-    end
   end
 end

data/lib/pray/publish.rb

@@ -3,6 +3,7 @@
 require "json"
 require "fileutils"
 require "time"
+require "tmpdir"
 
 module Pray
   RegistryIndex = Struct.new(:spec, :packages) do

data/lib/pray/registry.rb

@@ -9,6 +9,8 @@ require "time"
 require_relative "path_safety"
 require_relative "http_body"
 require_relative "registry_paths"
+require_relative "registry_http_cache"
+require_relative "git_materialize"
 
 module Pray
   RegistryPackageVersion = Struct.new(
@@ -134,9 +136,7 @@ module Pray
         return parse_metadata(File.read(metadata_path, encoding: "UTF-8"))
       end
 
-      PathSafety.reject_unsafe_package_name!(package_name)
-      response = http_get(join_url(source_url, "v1/packages/#{package_name}.json"))
-      parse_metadata(response)
+      RegistryHttpCache.fetch_package_metadata(source_url, package_name)
     end
 
     def parse_metadata(text)
@@ -207,18 +207,7 @@ module Pray
     end
 
     def read_local_artifact_bytes(source_root, artifact)
-      if artifact.start_with?("file://")
-        path = PathSafety.join_under_root(source_root, artifact.delete_prefix("file://"))
-        raise Error.resolution("package artifact path escapes distribution root") unless path
-        return File.binread(path)
-      end
-      reject_absolute_artifact!(artifact)
-
-      path = PathSafety.join_under_root(source_root, artifact)
-      raise Error.resolution("package artifact path escapes distribution root") unless path
-      raise Error.resolution("package artifact missing at #{path}") unless File.exist?(path)
-
-      File.binread(path)
+      GitMaterialize.read_local_artifact_bytes(source_root, artifact)
     end
 
     def read_artifact_bytes(source_url, artifact)

data/lib/pray/registry_http_cache.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Pray
+  module RegistryHttpCache
+    module_function
+
+    def fetch_package_metadata(source_url, package_name)
+      @cache ||= {}
+      key = [source_url, package_name]
+      return @cache[key] if @cache.key?(key)
+
+      PathSafety.reject_unsafe_package_name!(package_name)
+      response = Registry.http_get(Registry.join_url(source_url, "v1/packages/#{package_name}.json"))
+      @cache[key] = Registry.parse_metadata(response)
+    end
+  end
+end

data/lib/pray/resolve.rb

@@ -61,7 +61,6 @@ module Pray
         lockfile_hints,
         refresh: options.refresh || options.refresh_source_revisions
       )
-      source_revisions = git_sources.transform_values(&:revision)
       source_host_keys = Trust.prepare_source_host_keys(manifest.sources)
 
       packages = []
@@ -100,6 +99,7 @@ module Pray
       raise Error.resolution(local_errors.join("\n")) unless local_errors.empty?
 
       ResolveDeps.reject_dependency_cycles(packages)
+      source_revisions = git_sources.revisions
 
       ResolvedProject.new(
         manifest_path: manifest_path,

data/lib/pray/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
 module Pray
-  VERSION = "1.17.0"
-  GENERATED_BY = "pray 1.17.0"
+  VERSION = "1.18.1"
+  GENERATED_BY = "pray 1.18.1"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: pray-cli
 version: !ruby/object:Gem::Version
-  version: 1.17.0
+  version: 1.18.1
 platform: ruby
 authors:
 - Andrei Makarov
@@ -136,7 +136,11 @@ files:
 - lib/pray/error.rb
 - lib/pray/format_manifest.rb
 - lib/pray/format_serialize.rb
+- lib/pray/git_cache.rb
+- lib/pray/git_clone.rb
+- lib/pray/git_materialize.rb
 - lib/pray/git_refresh.rb
+- lib/pray/git_run.rb
 - lib/pray/git_sources.rb
 - lib/pray/hashing.rb
 - lib/pray/http_body.rb
@@ -161,6 +165,7 @@ files:
 - lib/pray/project_context.rb
 - lib/pray/publish.rb
 - lib/pray/registry.rb
+- lib/pray/registry_http_cache.rb
 - lib/pray/registry_install.rb
 - lib/pray/registry_integrity.rb
 - lib/pray/registry_paths.rb