puppetlabs-onceover 5.0.4 → 5.0.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e95581c2065fec671dd17a38351cbb3ea0d0a196c83e814c9f3ec1122ba1cbd9
-  data.tar.gz: aaf03ff8479d236f38d53e86199d5787136761c2f6e35da34db4665d56d58fa9
+  metadata.gz: c991dea08d7eb606b8f13d8cd9c270ef3e7fba1ce7b3adb1761f212cecbc1d5c
+  data.tar.gz: ebb53a42b2538e507d1d40db33787efdd33eacf81e4b22ceec03229244c27d40
 SHA512:
-  metadata.gz: 43b88d11469774667a11c9e73549497bf94ffae4180e6bcab33b8dd196cfbd25d76f438ed9d09c6bc496dee3dde39f2465d3db027b84eca75ff63748adbd3056
-  data.tar.gz: c09f20f9eed9c02347dd79857d4ee6018d07370c09f3ba3a4c25c7a0e468cb61863b56d80f929503704f8529ef1a0925ef2f771b16e98f3a0f14672547c67d73
+  metadata.gz: fe347612ab83e67a31f1850db126ce95e9da6e6a4e8dd8ec77cb6f605db8c5ddb3a20e7e1edcee5aa998d42b8f544433ee0d5e400fee636ef7e89dc1004dcf84
+  data.tar.gz: eca5387e7eebb1b790cdabb9917722b44b6312622bf6fae26e3b3ec0593ba917769b190feca48605cb6d12fc85f5a5c2dabbe716eae0aa94c882f9040e53ef44

data/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to this project will be documented in this file.
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org).
 
+## [v5.0.5](https://github.com/puppetlabs/puppetlabs-onceover/tree/v5.0.5) - 2026-09-15
+
+[Full Changelog](https://github.com/puppetlabs/puppetlabs-onceover/compare/v5.0.4...v5.0.5)
+
+### Other
+
+- Replace GitHub REST tag lookups with git ls-remote to fix rate-limit CI failures [#28](https://github.com/puppetlabs/puppetlabs-onceover/pull/28) ([actowery](https://github.com/actowery))
+- Pin json < 3.0 to fix r10k module deploy arity error [#27](https://github.com/puppetlabs/puppetlabs-onceover/pull/27) ([actowery](https://github.com/actowery))
+- Fix ERB.new calls broken on Ruby 4.0 (rake_tasks.rb) [#26](https://github.com/puppetlabs/puppetlabs-onceover/pull/26) ([actowery](https://github.com/actowery))
+- Pin facter to Puppetcore, fix PUPPET_FORGE_TOKEN truthiness bug [#25](https://github.com/puppetlabs/puppetlabs-onceover/pull/25) ([actowery](https://github.com/actowery))
+
 ## [v5.0.4](https://github.com/puppetlabs/puppetlabs-onceover/tree/v5.0.4) - 2026-09-03
 
 [Full Changelog](https://github.com/puppetlabs/puppetlabs-onceover/compare/v5.0.3...v5.0.4)

data/Gemfile

@@ -2,7 +2,7 @@
 gemsource_default = ENV['GEM_SOURCE'] || 'https://rubygems.org'
 gemsource_puppetcore = if ENV['GEM_SOURCE']
                          gemsource_default
-                       elsif ENV['PUPPET_FORGE_TOKEN']
+                       elsif ENV['PUPPET_FORGE_TOKEN'] && !ENV['PUPPET_FORGE_TOKEN'].empty?
                          'https://rubygems-puppetcore.puppet.com'
                        else
                          ENV['GEM_SOURCE_PUPPETCORE'] || gemsource_default
@@ -20,9 +20,28 @@ gem 'pry-coolline', '> 0.0', '< 1.0.0'
 # and no auth is attempted against Puppetcore.
 gem 'puppet', ENV['PUPPET_GEM_VERSION'] || '~> 8', source: gemsource_puppetcore
 
+# facter is a runtime dependency of puppet, but pinning `puppet`'s own source
+# does NOT pin its transitive dependencies to that same source -- bundler
+# still resolves facter from whichever source(s) declare it, so without this
+# explicit pin facter would silently keep resolving from public rubygems.org
+# (built from the public facter repo) even when puppet itself correctly comes
+# from Puppetcore (built from the private facter-private source). Pin it
+# explicitly so both come from the same place.
+gem 'facter', source: gemsource_puppetcore
+
 # Puppet on Ruby 3.3 / 3.4 has some missing dependencies
 gem 'syslog', '~> 0.3' if RUBY_VERSION >= '3.4'
 
+# json 3.0 made JSON.parse keyword-only (dropped the legacy positional-hash
+# opts argument). faraday's JSON response middleware
+# (Faraday::Response::Json#parse) still calls `decoder.public_send(method,
+# body, @parser_options || {})` positionally, so with json ~> 3.0 every
+# Forge/HTTP JSON response r10k parses raises
+# `wrong number of arguments (given 2, expected 1)`. Pin to the last
+# compatible major until faraday releases a fix for json 3.0's new
+# signature.
+gem 'json', '< 3.0'
+
 # Windows platform runtime deps. The published puppet/openvox rubygems.org
 # artefacts are built on Linux and guard `ffi` / `win32ole` with build-host
 # platform checks, so those deps never make it into the Linux-published

data/lib/puppetlabs-onceover/rake_tasks.rb

@@ -40,7 +40,7 @@ task :generate_onceover_yaml do
   repo = PuppetlabsOnceover::Controlrepo.new
   template_dir = File.expand_path('../../templates', File.dirname(__FILE__))
   onceover_yaml_template = File.read(File.expand_path('./controlrepo.yaml.erb', template_dir))
-  puts ERB.new(onceover_yaml_template, nil, '-').result(binding)
+  puts ERB.new(onceover_yaml_template, trim_mode: '-').result(binding)
 end
 
 task :generate_nodesets do
@@ -81,7 +81,7 @@ task :generate_nodesets do
     # Use an ERB template
     template_dir = File.expand_path('../../templates', File.dirname(__FILE__))
     fixtures_template = File.read(File.expand_path('./nodeset.yaml.erb', template_dir))
-    puts ERB.new(fixtures_template, nil, '-').result(binding)
+    puts ERB.new(fixtures_template, trim_mode: '-').result(binding)
   end
 end
 

data/lib/puppetlabs-onceover/vendored_modules.rb

@@ -1,6 +1,5 @@
 require 'puppet/version'
-require 'net/http'
-require 'uri'
+require 'git'
 require 'multi_json'
 require 'r10k/module_loader/puppetfile'
 require 'puppetlabs-onceover/logger'
@@ -69,16 +68,18 @@ class PuppetlabsOnceover
       # any puppet version this gem tests against). Neither is needed: the
       # module list is stable (see CORE_MODULES) and each module's own repo
       # is the authoritative source for its own latest version.
-      # https://docs.github.com/en/rest/repos/repos#list-repository-tags
+      #
+      # Tags are read via the git protocol (git ls-remote) rather than
+      # GitHub's REST API: the REST API's unauthenticated rate limit
+      # (60 req/hr) is shared across every GitHub-hosted Actions runner IP,
+      # so 10 sequential lookups per test run reliably exhausted it in CI.
+      # git's smart-HTTP protocol has no equivalent per-hour cap.
       @vendored_references = CORE_MODULES.map do |mod_name|
-        tags = query_or_cache(
-          "https://api.github.com/repos/puppetlabs/puppetlabs-#{mod_name}/tags",
-          nil,
-          component_cache(mod_name),
-        )
+        repo_url = "https://github.com/puppetlabs/puppetlabs-#{mod_name}.git"
+        tags = query_or_cache(repo_url, component_cache(mod_name))
         latest_tag = tags.first['name']
         {
-          'url' => "https://github.com/puppetlabs/puppetlabs-#{mod_name}.git",
+          'url' => repo_url,
           'ref' => "refs/tags/#{latest_tag}"
         }
       end
@@ -153,40 +154,36 @@ class PuppetlabsOnceover
       end
     end
 
-    # Return json from a query whom caches, or from the cache to avoid spamming github
-    def query_or_cache(url, params, filepath)
+    # Return tag data from a query whom caches, or from the cache to avoid
+    # re-querying the remote on every run
+    def query_or_cache(repo_url, filepath)
       if (File.exist? filepath) && (@force_update == false)
         logger.debug "Using cache: #{filepath}"
         json = read_json_dump(filepath)
       else
-        logger.debug "Making GET request to: #{url}"
-        json = github_get(url, params)
+        logger.debug "Listing tags for: #{repo_url}"
+        json = remote_tags(repo_url)
         logger.debug "Caching response to: #{filepath}"
         write_json_dump(filepath, json)
       end
       json
     end
 
-    # Given a github url and optional query parameters, return the parsed json body
-    def github_get(url, params)
-      uri = URI.parse(url)
-      uri.query = URI.encode_www_form(params) if params
-      http = Net::HTTP.new(uri.host, uri.port)
-      http.use_ssl = (uri.scheme == 'https')
-      request = Net::HTTP::Get.new(uri.request_uri)
-      request['Accept'] = 'application/vnd.github.raw+json'
-      request['X-GitHub-Api-Version'] = '2022-11-28'
-      response = http.request(request)
-
-      case response
-      when Net::HTTPOK # 200
-        MultiJson.load(response.body)
-      else
-        # Expose the ratelimit response headers
-        # https://docs.github.com/en/rest/using-the-rest-api/rate-limits-for-the-rest-api?apiVersion=2022-11-28#checking-the-status-of-your-rate-limit
-        ratelimit_headers = response.to_hash.select { |k, _v| k =~ /x-ratelimit.*/ }
-        raise "#{response.code} #{response.message} #{ratelimit_headers}"
+    # Given a git remote url, return its tags as [{ 'name' => tag }, ...],
+    # sorted newest version first (matches the shape/ordering the old
+    # GitHub REST tags API returned, so callers can keep using .first).
+    def remote_tags(repo_url)
+      refs = Git.ls_remote(repo_url, refs: true)['tags'] || {}
+      versions = refs.keys.filter_map do |name|
+        next if name.end_with?('^{}') # annotated-tag dereference entries
+
+        begin
+          [Gem::Version.new(name.delete_prefix('v')), name]
+        rescue ArgumentError
+          nil # skip non-version-shaped tags
+        end
       end
+      versions.sort_by(&:first).reverse.map { |_version, name| { 'name' => name } }
     end
 
     # Returns parsed json of file

data/lib/puppetlabs-onceover/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 class PuppetlabsOnceover
-  VERSION = '5.0.4'
+  VERSION = '5.0.5'
 end

data/spec/puppetlabs-onceover/rake_tasks_spec.rb

@@ -87,17 +87,19 @@ describe 'rake_tasks.rb' do
   end
 
   describe 'generate_onceover_yaml' do
-    it 'reads the controlrepo and attempts to render the controlrepo.yaml.erb template' do
-      repo = double('repo')
+    it 'reads the controlrepo and renders the controlrepo.yaml.erb template' do
+      repo = double('repo', roles: %w[role::web role::db], facts_files: ['/some/repo/facts/centos7.json', '/some/repo/facts/Windows_Server-2019.json'])
       allow(PuppetlabsOnceover::Controlrepo).to receive(:new).and_return(repo)
 
-      # NOTE: the bundled erb gem (6.0.7, from Ruby 3.3.12) no longer accepts
-      # ERB.new's legacy positional (safe_level, trim_mode) arguments, which
-      # rake_tasks.rb still passes. This is a pre-existing incompatibility in
-      # production code, not something introduced by this test. We assert the
-      # task reaches and exercises that ERB.new call (line coverage), rather
-      # than papering over the ArgumentError it currently raises in this Ruby.
-      expect { Rake::Task['generate_onceover_yaml'].invoke }.to raise_error(ArgumentError)
+      # ERB.new's legacy positional (safe_level, trim_mode) arguments were
+      # removed in the bundled erb gem (6.0.7+, Ruby 4.0) -- rake_tasks.rb
+      # used to pass them positionally, which raised ArgumentError on that
+      # Ruby before this fix. Now that it's fixed (keyword trim_mode:), this
+      # asserts the template actually renders real content from the repo
+      # double, not just that it "reaches" the call.
+      expect { Rake::Task['generate_onceover_yaml'].invoke }.to output(
+        a_string_including('role::web', 'role::db', 'centos7', 'Windows_Server-2019', 'Windows_Server-2019')
+      ).to_stdout
     end
   end
 
@@ -117,12 +119,16 @@ describe 'rake_tasks.rb' do
       allow(Net::HTTP).to receive(:new).and_return(http_double)
       allow(http_double).to receive(:get).and_return(response)
 
-      # See the note in the generate_onceover_yaml spec above: the bundled
-      # erb 6.0.7 no longer accepts ERB.new's legacy positional arguments,
-      # so this task raises ArgumentError once it reaches its own ERB.new
-      # call further down. We assert the "HOSTS:" header and 404 branch
-      # (comment_out = true) execute first, covering those lines.
-      expect { Rake::Task['generate_nodesets'].invoke }.to raise_error(ArgumentError).and output(/HOSTS:/).to_stdout
+      # This deprecated task (Beaker removed) has a second, deeper,
+      # pre-existing bug beyond the ERB.new Ruby-4.0 incompatibility fixed
+      # elsewhere: nodeset.yaml.erb expects a `hosts_hash` local (and a
+      # `prefix` local) that the task body never actually defines -- it
+      # builds flat locals (node_name/boxname/platform/url/comment_out)
+      # instead. Out of scope to redesign a deprecated task here; asserting
+      # the real resulting error (and that execution reaches it, covering
+      # the "HOSTS:" header and 404 branch first) rather than the old,
+      # now-fixed ArgumentError.
+      expect { Rake::Task['generate_nodesets'].invoke }.to raise_error(NameError, /hosts_hash/).and output(/HOSTS:/).to_stdout
     end
 
     it 'writes a nodeset entry using the virtualbox provider url when the box lookup succeeds' do
@@ -150,8 +156,8 @@ describe 'rake_tasks.rb' do
 
       # As above: covers the successful (non-404) lookup branch, including
       # the virtualbox provider url extraction, before hitting the same
-      # pre-existing ERB.new incompatibility.
-      expect { Rake::Task['generate_nodesets'].invoke }.to raise_error(ArgumentError).and output(/HOSTS:/).to_stdout
+      # pre-existing hosts_hash/prefix bug described above.
+      expect { Rake::Task['generate_nodesets'].invoke }.to raise_error(NameError, /hosts_hash/).and output(/HOSTS:/).to_stdout
     end
   end
 

data/spec/puppetlabs-onceover/vendored_modules_spec.rb

@@ -2,7 +2,7 @@ require 'spec_helper'
 require 'tmpdir'
 require 'fileutils'
 require 'multi_json'
-require 'net/http'
+require 'git'
 require 'puppetlabs-onceover/controlrepo' # pulls in `include PuppetlabsOnceover::Logger` at top-level
 require 'puppetlabs-onceover/vendored_modules'
 
@@ -50,7 +50,7 @@ describe PuppetlabsOnceover::VendoredModules do
       it 'creates it via FileUtils.mkdir_p' do
         cachedir = File.join(tempdir, 'vendored_modules')
         expect(File.directory?(cachedir)).to be false
-        allow_any_instance_of(described_class).to receive(:github_get).and_return([{ 'name' => 'v9.9.9' }])
+        allow_any_instance_of(described_class).to receive(:remote_tags).and_return([{ 'name' => 'v9.9.9' }])
         described_class.new(repo: repo_double)
         expect(File.directory?(cachedir)).to be true
       end
@@ -67,9 +67,9 @@ describe PuppetlabsOnceover::VendoredModules do
     end
 
     context 'when opts[:force_update] is true' do
-      it 'always calls github_get, ignoring any existing cache' do
+      it 'always calls remote_tags, ignoring any existing cache' do
         populate_cache(File.join(tempdir, 'vendored_modules'))
-        expect_any_instance_of(described_class).to receive(:github_get).at_least(:once).and_return([{ 'name' => 'v5.0.0' }])
+        expect_any_instance_of(described_class).to receive(:remote_tags).at_least(:once).and_return([{ 'name' => 'v5.0.0' }])
         described_class.new(repo: repo_double, force_update: true)
       end
     end
@@ -223,67 +223,58 @@ describe PuppetlabsOnceover::VendoredModules do
     it 'reads from the cache file when it already exists' do
       cache_file = File.join(Dir.mktmpdir, 'cached.json')
       File.write(cache_file, MultiJson.dump([{ 'name' => 'v1.0.0' }]))
-      expect(vm).not_to receive(:github_get)
-      result = vm.query_or_cache('https://api.github.com/repos/puppetlabs/x/tags', nil, cache_file)
+      expect(vm).not_to receive(:remote_tags)
+      result = vm.query_or_cache('https://github.com/puppetlabs/x.git', cache_file)
       expect(result).to eq([{ 'name' => 'v1.0.0' }])
     end
 
-    it 'calls github_get and writes the cache when the file does not exist' do
+    it 'calls remote_tags and writes the cache when the file does not exist' do
       cache_file = File.join(Dir.mktmpdir, 'missing.json')
-      allow(vm).to receive(:github_get).and_return([{ 'name' => 'v2.0.0' }])
-      result = vm.query_or_cache('https://api.github.com/repos/puppetlabs/x/tags', nil, cache_file)
+      allow(vm).to receive(:remote_tags).and_return([{ 'name' => 'v2.0.0' }])
+      result = vm.query_or_cache('https://github.com/puppetlabs/x.git', cache_file)
       expect(result).to eq([{ 'name' => 'v2.0.0' }])
       expect(File.exist?(cache_file)).to be true
       expect(MultiJson.load(File.read(cache_file))).to eq([{ 'name' => 'v2.0.0' }])
     end
   end
 
-  describe '#github_get' do
+  describe '#remote_tags' do
     subject(:vm) do
       populate_cache(File.join(tempdir, 'vendored_modules'))
       described_class.new(repo: repo_double)
     end
 
-    it 'returns the parsed json body on a 200 response' do
-      response = Net::HTTPOK.new('1.1', '200', 'OK')
-      def response.body
-        MultiJson.dump([{ 'name' => 'v3.0.0' }])
-      end
-      http = instance_double(Net::HTTP)
-      allow(Net::HTTP).to receive(:new).and_return(http)
-      allow(http).to receive(:use_ssl=)
-      allow(http).to receive(:request).and_return(response)
-
-      result = vm.github_get('https://api.github.com/repos/puppetlabs/puppetlabs-augeas_core/tags', nil)
-      expect(result).to eq([{ 'name' => 'v3.0.0' }])
+    it 'returns tags sorted newest version first' do
+      allow(Git).to receive(:ls_remote).and_return(
+        'tags' => {
+          'v1.0.0' => { ref: 'refs/tags/v1.0.0', sha: 'a' },
+          'v2.0.1' => { ref: 'refs/tags/v2.0.1', sha: 'b' },
+          'v2.0.1^{}' => { ref: 'refs/tags/v2.0.1^{}', sha: 'c' },
+          '1.5.0' => { ref: 'refs/tags/1.5.0', sha: 'd' }
+        }
+      )
+
+      result = vm.remote_tags('https://github.com/puppetlabs/puppetlabs-augeas_core.git')
+      expect(result).to eq([{ 'name' => 'v2.0.1' }, { 'name' => '1.5.0' }, { 'name' => 'v1.0.0' }])
     end
 
-    it 'passes along query params when given' do
-      response = Net::HTTPOK.new('1.1', '200', 'OK')
-      def response.body
-        MultiJson.dump([{ 'name' => 'v4.0.0' }])
-      end
-      http = instance_double(Net::HTTP)
-      allow(Net::HTTP).to receive(:new).and_return(http)
-      allow(http).to receive(:use_ssl=)
-      allow(http).to receive(:request).and_return(response)
+    it 'skips non-version-shaped tags' do
+      allow(Git).to receive(:ls_remote).and_return(
+        'tags' => {
+          'v1.0.0' => { ref: 'refs/tags/v1.0.0', sha: 'a' },
+          'not-a-version' => { ref: 'refs/tags/not-a-version', sha: 'b' }
+        }
+      )
 
-      result = vm.github_get('https://api.github.com/repos/puppetlabs/puppetlabs-augeas_core/tags', { 'per_page' => '1' })
-      expect(result).to eq([{ 'name' => 'v4.0.0' }])
+      result = vm.remote_tags('https://github.com/puppetlabs/puppetlabs-augeas_core.git')
+      expect(result).to eq([{ 'name' => 'v1.0.0' }])
     end
 
-    it 'raises with the ratelimit headers on a non-200 response' do
-      response = Net::HTTPForbidden.new('1.1', '403', 'Forbidden')
-      def response.to_hash
-        { 'x-ratelimit-remaining' => ['0'] }
-      end
-      http = instance_double(Net::HTTP)
-      allow(Net::HTTP).to receive(:new).and_return(http)
-      allow(http).to receive(:use_ssl=)
-      allow(http).to receive(:request).and_return(response)
+    it 'returns an empty array when the remote has no tags' do
+      allow(Git).to receive(:ls_remote).and_return({})
 
-      expect { vm.github_get('https://api.github.com/repos/puppetlabs/puppetlabs-augeas_core/tags', nil) }
-        .to raise_error(/403 Forbidden/)
+      result = vm.remote_tags('https://github.com/puppetlabs/puppetlabs-augeas_core.git')
+      expect(result).to eq([])
     end
   end
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: puppetlabs-onceover
 version: !ruby/object:Gem::Version
-  version: 5.0.4
+  version: 5.0.5
 platform: ruby
 authors:
 - Puppet, Inc.
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-09-03 00:00:00.000000000 Z
+date: 2026-09-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: backticks