r10k 3.14.0 → 3.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da22a28bcd5de19a996ff2c869ba074c402e393d7a3caa2528bb342c75192234
-  data.tar.gz: 9bf7067d8412b9d158f2d47ad96499f90183c5dcade26b97fede2a344b06dca0
+  metadata.gz: c2085c3475000f081d4ff3ff19fd5f009080c9238c5e532449a24f306b2aa107
+  data.tar.gz: fb38a94d17d20cdd75aba6c5817cad33c77ed408307f32aa54bc4f65dabba022
 SHA512:
-  metadata.gz: a2a529ce1b781f858253f1d929e4cf521806a8f11ce9733a4f2dc92dcfd4792d4afcbad9290a814d10a14be645eb0ada9551c542def43f6acc48d28931783bc2
-  data.tar.gz: 31d2a9e5d85f29da1c6f62d77d7bbd83c7ed8c4687bb5035f7185c8b37042e2707e59b623d6603af5d533ee79c44380d4a3a4a1a2a28ddd06af9c723c6f1c1bb
+  metadata.gz: 6de1e925f24ec5edf168c5a4d177030be2d351493ab65274998bbd02b67fa84910d3a28d800bdd03d255e4fb0cceeac1b8d09a615cb181986ee22bd4e155e0fb
+  data.tar.gz: f4294cd171f9665c70d9573ad082003e5cd272aa42b2f949c41bc6874399c92010e1065140544770807444e8cf60b52d0733add89cfbd0b4839381c918932004

data/.github/workflows/docker.yml

@@ -27,6 +27,11 @@ jobs:
         with:
           ruby-version: 2.6.x
       - run: gem install bundler
+      - uses: actions/checkout@v2
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
       - name: Build container
         working-directory: docker
         run: |

data/.github/workflows/rspec_tests.yml

@@ -15,10 +15,11 @@ jobs:
           - {os: ubuntu-18.04, ruby: 2.5}
           - {os: ubuntu-18.04, ruby: 2.6}
           - {os: ubuntu-18.04, ruby: 2.7}
+          - {os: ubuntu-18.04, ruby: 3.1}
           - {os: ubuntu-18.04, ruby: jruby-9.2.10.0}
-          - {os: windows-2016, ruby: 2.5}
-          - {os: windows-2016, ruby: 2.6}
-          - {os: windows-2016, ruby: 2.7}
+          - {os: windows-2019, ruby: 2.5}
+          - {os: windows-2019, ruby: 2.6}
+          - {os: windows-2019, ruby: 2.7}
 
     runs-on: ${{ matrix.cfg.os }}
     steps:

data/.github/workflows/stale.yml

@@ -15,5 +15,7 @@ jobs:
         days-before-close: 7
         stale-issue-message: 'This issue has been marked stale because it has had no activity for 60 days. The Puppet Team is actively prioritizing existing bugs and new features, if this issue is still important to you please comment and we will add this to our backlog to complete. Otherwise, it will be closed in 7 days.'
         stale-issue-label: 'stale'
+        exempt-issue-labels: 'community interest'
         stale-pr-message: "This PR has been marked stale because it has had no activity for 60 days. If you are still interested in getting this merged, please comment and we'll try to move it forward. Otherwise, it will be closed in 7 days."
         stale-pr-label: 'stale'
+        exempt-pr-labels: 'community interest'

data/.gitignore

@@ -7,3 +7,4 @@ coverage
 integration/log
 integration/junit
 integration/configs
+r10k.log

data/CHANGELOG.mkd

@@ -4,6 +4,28 @@ CHANGELOG
 Unreleased
 ----------
 
+3.15.0
+------
+
+- Support and test Ruby 3
+- Allow puppet_forge 3.x & newer versions of fast_gettext/gettext [#1302](https://github.com/puppetlabs/r10k/pull/1302)
+- Allow newer cri versions [#1302](https://github.com/puppetlabs/r10k/pull/1302)
+- Fix error when using install_path from environment module [#1288](https://github.com/puppetlabs/r10k/issues/1288)
+- (RK-399) Do not warn about local modifications in the spec directory when `exclude_spec` is set [#1291](https://github.com/puppetlabs/r10k/pull/1291)
+
+3.14.2
+------
+
+- (RK-397) Ensure `--incremental` does not skip undeployed modules [#1278](https://github.com/puppetlabs/r10k/pull/1278)
+
+3.14.1
+------
+
+- (RK-395) Make `exclude_spec` from a Puppetfile the priority override [#1271](https://github.com/puppetlabs/r10k/issues/1271)
+- (RK-394) Fix `force` always resolving to true for `puppetfile install` [#1269](https://github.com/puppetlabs/r10k/issues/1265)
+- (RK-393) Bug fix: not all spec directories are deleted when :exclude_spec is true [#1267](https://github.com/puppetlabs/r10k/pull/1267)
+- Refactor internal module creation to always expect a hash, even for Forge modules, which can be specified in the Puppetfile with just a version string. [#1170](https://github.com/puppetlabs/r10k/pull/1170)
+
 3.14.0
 ------
 

data/README.mkd

@@ -18,7 +18,7 @@ Requirements
 ------------
 
 R10k supports the Ruby versions `>= 2.4.0`. It's tested on Ruby 2.4.0 up to
-Ruby 2.7.0 + Jruby.
+Ruby 3.1.0 + Jruby.
 
 R10k requires additional components, depending on how you plan on managing
 environments and modules.
@@ -61,7 +61,7 @@ for installation.
 If you have more specific needs or plan on modifying r10k you can run it out of
 a git repository using Bundler for dependencies:
 
-    git clone git://github.com/puppetlabs/r10k
+    git clone https://github.com/puppetlabs/r10k
     cd r10k
     bundle install
     bundle exec r10k help

data/doc/dynamic-environments/configuration.mkd

@@ -128,6 +128,18 @@ git:
   private_key: "/etc/puppetlabs/r10k/ssh/id_rsa"
 ```
 
+#### oauth_token
+
+The oauth_token setting is only used by the Rugged git provider.
+
+The oauth_token option specifies the path to the default access token for Git HTTPS remotes.
+Public git repositories can be accessed via HTTPS without authentication, but the oauth_token setting may be set if any non-public HTTPS remotes are used.
+
+```yaml
+git:
+  oauth_token: "/etc/puppetlabs/r10k/token"
+```
+
 #### repositories
 
 The repositories option allows configuration to be set on a per-remote basis. Each entry is a map of
@@ -145,6 +157,18 @@ git:
       private_key: "/etc/puppetlabs/r10k/ssh/id_rsa-protected-repo-deploy-key"
 ```
 
+##### oauth_token
+
+A repository specific access token to use for HTTPS connections for the given repository URL. This
+overrides the global oauth_token setting.
+
+```yaml
+git:
+  repositories:
+    - remote: "https://tessier-ashpool.freeside/protected-repo.git"
+      oauth_token: "/etc/puppetlabs/r10k/protected-repo-deploy-token"
+```
+
 ##### proxy
 
 The 'proxy' setting allows you to set or override the global proxy setting for a single, specific
@@ -349,12 +373,13 @@ deploy:
 
 #### exclude_spec
 
-During module deployment, r10k's default behavior is to deploy the spec directory.
-This behavior can be configured for all modules using the `exclude_spec` setting in the r10k config.
-This config setting can be overridden in each module definition in the Puppetfile
-or more globally via the CLI for deploys. The following example sets all modules to
-not deploy the spec dir.
-
+During module deployment, r10k's default behavior is to deploy the spec directory. Setting
+`exclude_spec` to true will deploy modules without their spec directory. This behavior
+can be configured for all modules using the `exclude_spec` setting in the r10k config.
+It can also be passed as a CLI argument for `deploy environment/module`, overriding the
+r10k config. Setting this per module in a `Puppetfile` will override the default, r10k config,
+and cli flag for that module. The following example sets all modules to not deploy the spec
+dir via the r10k config.
 
 ```yaml
 deploy:
@@ -373,13 +398,16 @@ specific documentation for more information.
 The 'remote' setting specifies where the source repository should be fetched
 from. It may be any valid URL that the source may check out or clone. The remote
 must be able to be fetched without any interactive input, eg usernames or
-passwords cannot be prompted for in order to fetch the remote.
+passwords cannot be prompted for in order to fetch the remote. We support the
+`git`, `ssh`, and `https` transport protocols. An SSH private key or access
+token must be provided for authentication. Only `https` may be used without
+authentication. See [GitHub's blog on protocol security](https://github.blog/2021-09-01-improving-git-protocol-security-github/) for more info.
 
 ```yaml
 ---
 sources:
   mysource:
-    remote: 'git://git-server.site/my-org/main-modules'
+    remote: 'https://git-server.site/my-org/main-modules'
 ```
 
 ### basedir
@@ -497,7 +525,7 @@ hiera data files are kept. In this case you will specify a single source:
 ---
 sources:
   operations:
-    remote: 'git://git-server.site/my-org/org-modules'
+    remote: 'https://git-server.site/my-org/org-modules'
     basedir: '/etc/puppet/environments'
 ```
 
@@ -510,10 +538,10 @@ repository and your modules in another repository, you can specify two sources:
 ---
 sources:
   operations:
-    remote: 'git://git-server.site/my-org/org-modules'
+    remote: 'https://git-server.site/my-org/org-modules'
     basedir: '/etc/puppet/environments'
   hiera:
-    remote: 'git://git-server.site/my-org/org-hiera-data'
+    remote: 'https://git-server.site/my-org/org-hiera-data'
     basedir: '/etc/puppet/hiera-data'
 ```
 
@@ -528,15 +556,15 @@ not the modules of other groups.
 ---
 sources:
   main:
-    remote: 'git://git-server.site/my-org/main-modules'
+    remote: 'https://git-server.site/my-org/main-modules'
     basedir: '/etc/puppet/environments'
     prefix: false # Prefix defaults to false so this is only here for clarity
   qa:
-    remote: 'git://git-server.site/my-org/qa-puppet-modules'
+    remote: 'https://git-server.site/my-org/qa-puppet-modules'
     basedir: '/etc/puppet/environments'
     prefix: true
   dev:
-    remote: 'git://git-server.site/my-org/dev-puppet-modules'
+    remote: 'https://git-server.site/my-org/dev-puppet-modules'
     basedir: '/etc/puppet/environments'
     prefix: true
 ```
@@ -562,11 +590,11 @@ must override the `prefix` so environment folders line up in both directories:
 ---
 sources:
   app1_data:
-    remote: 'git://git-server.site/my-org/app1-hieradata'
+    remote: 'https://git-server.site/my-org/app1-hieradata'
     basedir: '/etc/puppet/hieradata'
     prefix: "app1"
   app1_modules:
-    remote: 'git://git-server.site/my-org/app1-puppet-modules'
+    remote: 'https://git-server.site/my-org/app1-puppet-modules'
     basedir: '/etc/puppet/environments'
     prefix: "app1"
 ```

data/doc/dynamic-environments/usage.mkd

@@ -84,6 +84,10 @@ explicit, static version. These are released Forge versions, or Git modules usin
 the `:tag`, or `:commit` keys. Git `:ref`s containing only the full 40 character
 commit SHA will also be treated as static versions. Then invoke a deploy with:
 
+There may be issues with deployments apparently successful after an initial errored
+deployment. If this is happening, try running without the `--incremental` flag
+to run a full deployment.
+
     r10k deploy environment production --modules --incremental
 
 - - -

data/doc/dynamic-environments/workflow-guide.mkd

@@ -38,7 +38,7 @@ mod "puppetlabs/ntp"
 
 # Your modules:
 mod "custom_facts",
-  :git => "git://github.com/user/custom_facts"
+  :git => "https://github.com/user/custom_facts"
 ```
 
 For any existing modules that you branched, add a reference to the new branch
@@ -46,7 +46,7 @@ name. Don't forget the comma at the end of the *:git* value.
 
 ```
 mod "other_module",
-  :git => "git://github.com/user/other_module",
+  :git => "https://github.com/user/other_module",
   :ref => "feature"
 ```
 
@@ -159,7 +159,7 @@ the *:git* value.
 
 ```
 mod "other_module",
-  :git => "git://github.com/user/other_module",
+  :git => "https://github.com/user/other_module",
   :ref => "feature"
 ```
 

data/doc/faq.mkd

@@ -17,7 +17,7 @@ modify. For example creating the script:
 
 ```
 $ cat /usr/local/bin/generate-puppet-types.sh
-!#/bin/bash
+#!/bin/bash
 
 for environment in $1; do
   /opt/puppetlabs/bin/puppet generate types --environment $environment

data/doc/git/providers.mkd

@@ -56,6 +56,28 @@ git:
       private_key: '/root/.ssh/private_repo_id'
 ```
 
+### HTTPS Configuration
+
+Public HTTPS based Git repositories can be accessed with no additional settings.
+For repos that do require authentication, the 'oauth_token' option may be provided.
+
+```yaml
+git:
+  oauth_token: '/etc/puppetlabs/r10k/token'
+```
+
+If you have per repository access tokens you can add them with the repositories list.
+
+```yaml
+git:
+  # default access token
+  oauth_token: '/etc/puppetlabs/r10k/token'
+  repositories:
+    - remote: "https://github.com/my_org/private_repo.git"
+      # access token for this repo only
+      oauth_token: '/etc/puppetlabs/r10k/private_repo_token'
+```
+
 #### Supported transports with Rugged
 
 Rugged compiles libgit2 and and the Ruby bindings when the gem is installed. You

data/docker/Makefile

@@ -6,7 +6,11 @@ build_date := $(shell date -u +%FT%T)
 hadolint_available := $(shell hadolint --help > /dev/null 2>&1; echo $$?)
 hadolint_command := hadolint
 hadolint_container := ghcr.io/hadolint/hadolint:latest
-alpine_version := 3.9
+alpine_version := 3.14
+# --load (--output=type=docker) can only be used with a single arch / platform
+# https://github.com/docker/buildx/issues/59
+output_type := docker
+platform := linux/amd64
 export BUNDLE_PATH = $(PWD)/.bundle/gems
 export BUNDLE_BIN = $(PWD)/.bundle/bin
 export GEMFILE = $(PWD)/Gemfile
@@ -32,6 +36,10 @@ else
 	dockerfile_context := $(PWD)/..
 endif
 
+ifeq ($(IS_LATEST),true)
+	latest_tag := --tag $(NAMESPACE)/r10k:$(LATEST_VERSION)
+endif
+
 prep:
 	@git fetch --unshallow 2> /dev/null ||:
 	@git fetch origin 'refs/tags/*:refs/tags/*'
@@ -52,17 +60,15 @@ build: prep
 	docker pull alpine:$(alpine_version)
 	docker buildx build \
 		${DOCKER_BUILD_FLAGS} \
-		--load \
+		--output=type=$(output_type) \
+		--platform $(platform) \
 		--build-arg alpine_version=$(alpine_version) \
 		--build-arg vcs_ref=$(vcs_ref) \
 		--build-arg build_date=$(build_date) \
 		--build-arg version=$(VERSION) \
 		--build-arg pupperware_analytics_stream=$(PUPPERWARE_ANALYTICS_STREAM) \
 		--file r10k/$(dockerfile) \
-		--tag $(NAMESPACE)/r10k:$(VERSION) $(dockerfile_context)
-ifeq ($(IS_LATEST),true)
-	@docker tag $(NAMESPACE)/r10k:$(VERSION) puppet/r10k:$(LATEST_VERSION)
-endif
+		--tag $(NAMESPACE)/r10k:$(VERSION) $(latest_tag) $(dockerfile_context)
 
 test: prep
 	@bundle install --path $$BUNDLE_PATH --gemfile $$GEMFILE --with test
@@ -71,11 +77,12 @@ test: prep
 		bundle exec --gemfile $$GEMFILE \
 		rspec spec
 
-push-image: prep
-	@docker push $(NAMESPACE)/r10k:$(VERSION)
-ifeq ($(IS_LATEST),true)
-	@docker push $(NAMESPACE)/r10k:$(LATEST_VERSION)
-endif
+# call build to produce multiple architectures
+# uses cached output from amd64 build target if it exists
+# registry output is equivalent to --push
+push-image: platform=linux/amd64,linux/arm64
+push-image: output_type=registry
+push-image: prep build
 
 push-readme:
 	@docker pull sheogorath/readme-to-dockerhub

data/docker/r10k/Dockerfile

@@ -1,4 +1,4 @@
-ARG alpine_version=3.9
+ARG alpine_version=3.14
 FROM alpine:${alpine_version} as build
 
 # hadolint ignore=DL3018

data/docker/r10k/release.Dockerfile

@@ -1,4 +1,4 @@
-ARG alpine_version=3.9
+ARG alpine_version=3.14
 FROM alpine:${alpine_version}
 
 ARG vcs_ref

data/integration/tests/git_source/HTTP_proxy_and_git_source.rb

@@ -16,7 +16,7 @@ r10k_config_bak_path = "#{r10k_config_path}.bak"
 
 puppetfile =<<-EOS
 mod 'motd',
-  :git    => 'git://github.com/puppetlabs/puppetlabs-motd'
+  :git    => 'https://github.com/puppetlabs/puppetlabs-motd'
 EOS
 
 proxy_env_value = 'http://cattastic.net:3219'

data/integration/tests/git_source/git_source_repeated_remote.rb

@@ -29,11 +29,11 @@ CONF
 # Install the same module in two different places
 puppetfile = <<-EOS
 mod 'prod_apache',
-  :git => 'git://github.com/puppetlabs/puppetlabs-apache.git',
+  :git => 'https://github.com/puppetlabs/puppetlabs-apache.git',
   :tag => 'v6.0.0'
 
 mod 'test_apache',
-  :git => 'git://github.com/puppetlabs/puppetlabs-apache.git',
+  :git => 'https://github.com/puppetlabs/puppetlabs-apache.git',
   :tag => 'v6.0.0'
 EOS
 

data/integration/tests/purging/content_not_purged_at_root.rb

@@ -30,12 +30,12 @@ CONF
 puppetfile = <<-EOS
 mod 'non_module_object_1',
   :install_path => './',
-  :git => 'git://github.com/puppetlabs/control-repo.git',
+  :git => 'https://github.com/puppetlabs/control-repo.git',
   :branch => 'production'
 
 mod 'non_module_object_2',
  :install_path => '',
- :git => 'git://github.com/puppetlabs/control-repo.git',
+ :git => 'https://github.com/puppetlabs/control-repo.git',
   :branch => 'production'
 EOS
 

data/integration/tests/user_scenario/basic_workflow/multi_env_custom_forge_git_module.rb

@@ -27,7 +27,7 @@ stdlib_notify_message_regex = /The test message is:.*one.*=>.*1.*two.*=>.*bats.*
 puppet_file = <<-PUPPETFILE
 mod "puppetlabs/motd"
 mod 'puppetlabs/stdlib',
-  :git => 'git://github.com/puppetlabs/puppetlabs-stdlib.git',
+  :git => 'https://github.com/puppetlabs/puppetlabs-stdlib.git',
   :tag => 'v7.0.1'
 PUPPETFILE
 

data/integration/tests/user_scenario/basic_workflow/multi_env_custom_forge_git_module_static.rb

@@ -31,7 +31,7 @@ puppet_file = <<-PUPPETFILE
 moduledir '#{@module_path}'
 mod "puppetlabs/motd"
 mod 'puppetlabs/stdlib',
-  :git => 'git://github.com/puppetlabs/puppetlabs-stdlib.git',
+  :git => 'https://github.com/puppetlabs/puppetlabs-stdlib.git',
   :tag => 'v7.0.1'
 PUPPETFILE
 

data/integration/tests/user_scenario/basic_workflow/multi_source_custom_forge_git_module.rb

@@ -65,7 +65,7 @@ env_structs = {:production => GitEnv.new('/git_repos',
                                          '/git_repos_alt/environments_alt.git',
                                          '/root/environments_alt',
                                          '/root/environments_alt/Puppetfile',
-                                         'mod "puppetlabs/stdlib", :git => "git://github.com/puppetlabs/puppetlabs-stdlib.git", :tag => "v7.0.1"',
+                                         'mod "puppetlabs/stdlib", :git => "https://github.com/puppetlabs/puppetlabs-stdlib.git", :tag => "v7.0.1"',
                                          '/root/environments_alt/manifests/site.pp',
                                          create_site_pp(master_certname, stage_env_manifest)
                                         ),

data/integration/tests/user_scenario/basic_workflow/negative/neg_bad_git_module.rb

@@ -15,7 +15,7 @@ r10k_fqp = get_r10k_fqp(master)
 
 #File
 puppet_file = <<-PUPPETFILE
-mod 'broken', :git => 'git://github.com/puppetlabs/puppetlabs-broken'
+mod 'broken', :git => 'https://github.com/puppetlabs/puppetlabs-broken'
 PUPPETFILE
 
 puppet_file_path = File.join(git_environments_path, 'Puppetfile')

data/integration/tests/user_scenario/basic_workflow/negative/neg_bad_git_module_ref.rb

@@ -12,7 +12,7 @@ r10k_fqp = get_r10k_fqp(master)
 #File
 puppet_file = <<-PUPPETFILE
 mod 'broken',
-  :git => 'git://github.com/puppetlabs/puppetlabs-motd',
+  :git => 'https://github.com/puppetlabs/puppetlabs-motd',
   :ref => 'does_not_exist'
 PUPPETFILE
 

data/integration/tests/user_scenario/basic_workflow/single_env_custom_forge_git_module.rb

@@ -28,7 +28,7 @@ notify_message_regex = /I am in the production environment/
 puppet_file = <<-PUPPETFILE
 mod "puppetlabs/motd"
 mod 'puppetlabs/inifile',
-  :git => 'git://github.com/puppetlabs/puppetlabs-inifile',
+  :git => 'https://github.com/puppetlabs/puppetlabs-inifile',
   :tag => 'v5.0.1'
 PUPPETFILE
 

data/integration/tests/user_scenario/basic_workflow/single_env_switch_forge_git_module.rb

@@ -27,7 +27,7 @@ PUPPETFILE
 
 puppet_file_git = <<-PUPPETFILE
 mod "puppetlabs/motd",
-  :git => 'git://github.com/puppetlabs/puppetlabs-motd',
+  :git => 'https://github.com/puppetlabs/puppetlabs-motd',
   :tag => '1.2.0'
 PUPPETFILE
 

data/lib/r10k/environment/with_modules.rb

@@ -96,13 +96,36 @@ class R10K::Environment::WithModules < R10K::Environment::Base
   def load_modules(module_hash)
     module_hash.each do |name, args|
       if !args.is_a?(Hash)
-        args = { version: args }
+        args = { type: 'forge', version: args }
       end
 
       add_module(name, args)
     end
   end
 
+  def resolve_path(base, dirname, path)
+    if Pathname.new(path).absolute?
+      cleanpath(path)
+    else
+      cleanpath(File.join(base, dirname, path))
+    end
+  end
+
+  # .cleanpath is as good as we can do without touching the filesystem.
+  # The .realpath methods will choke if some of the intermediate paths
+  # are missing, even though in some cases we will create them later as
+  # needed.
+  def cleanpath(path)
+    Pathname.new(path).cleanpath.to_s
+  end
+
+  def validate_install_path(path, modname)
+    unless /^#{Regexp.escape(@basedir)}.*/ =~ path
+      raise R10K::Error.new("Environment cannot manage content '#{modname}' outside of containing environment: #{path} is not within #{@basedir}")
+    end
+    true
+  end
+
   # @param [String] name
   # @param [Hash] args
   def add_module(name, args)
@@ -111,7 +134,7 @@ class R10K::Environment::WithModules < R10K::Environment::Base
     args[:overrides] = @overrides
 
     if install_path = args.delete(:install_path)
-      install_path = resolve_install_path(install_path)
+      install_path = resolve_path(@basedir, @dirname, install_path)
       validate_install_path(install_path, name)
     else
       install_path = @moduledir

data/lib/r10k/git/rugged/bare_repository.rb

@@ -64,7 +64,7 @@ class R10K::Git::Rugged::BareRepository < R10K::Git::Rugged::BaseRepository
     results = nil
 
     R10K::Git.with_proxy(proxy) do
-      results = with_repo { |repo| repo.fetch(remote_name, refspecs, options) }
+      results = with_repo { |repo| repo.fetch(remote_name, refspecs, **options) }
     end
 
     report_transfer(results, remote_name)

data/lib/r10k/git/rugged/credentials.rb

@@ -130,7 +130,7 @@ class R10K::Git::Rugged::Credentials
 
     user = nil
 
-    if !username_from_url.nil?
+    if !username_from_url.nil? && !username_from_url.empty?
       user = username_from_url
       logger.debug2 _("URL %{url} includes the username %{username}, using that user for authentication.") % {url: url.inspect, username: username_from_url}
     elsif git_user

data/lib/r10k/git/rugged/thin_repository.rb

@@ -75,6 +75,13 @@ class R10K::Git::Rugged::ThinRepository < R10K::Git::Rugged::WorkingRepository
     end
   end
 
+  def stage_files(files=['.'])
+    with_repo do |repo|
+      index = repo.index
+      files.each { |p| index.add( :path => p ) }
+    end
+  end
+
   private
 
   # Override the parent class repo setup so that we can make sure the alternates file is up to date

data/lib/r10k/git/rugged/working_repository.rb

@@ -93,7 +93,7 @@ class R10K::Git::Rugged::WorkingRepository < R10K::Git::Rugged::BaseRepository
     results = nil
 
     R10K::Git.with_proxy(proxy) do
-      results = with_repo { |repo| repo.fetch(remote_name, refspecs, options) }
+      results = with_repo { |repo| repo.fetch(remote_name, refspecs, **options) }
     end
 
     report_transfer(results, remote)
@@ -117,11 +117,15 @@ class R10K::Git::Rugged::WorkingRepository < R10K::Git::Rugged::BaseRepository
     with_repo { |repo| repo.config['remote.origin.url'] }
   end
 
-  def dirty?
+  def dirty?(exclude_spec=false)
     with_repo do |repo|
-      diff = repo.diff_workdir('HEAD')
+      if exclude_spec
+        diff = repo.diff_workdir('HEAD').select { |d| ! d.delta.old_file[:path].start_with?('spec/') }
+      else
+        diff = repo.diff_workdir('HEAD').to_a
+      end
 
-      diff.each_patch do |p|
+      diff.each do |p|
         logger.debug(_("Found local modifications in %{file_path}" % {file_path: File.join(@path, p.delta.old_file[:path])}))
         logger.debug1(p.to_s)
       end

data/lib/r10k/git/shellgit/thin_repository.rb

@@ -43,6 +43,10 @@ class R10K::Git::ShellGit::ThinRepository < R10K::Git::ShellGit::WorkingReposito
     git(['ls-tree', '-t', '-r', '--name-only', ref], :path => @path.to_s).stdout.split("\n")
   end
 
+  def stage_files(files=['.'])
+    git(['add', files].flatten, :path => @path.to_s)
+  end
+
   private
 
   def setup_cache_remote

data/lib/r10k/git/shellgit/working_repository.rb

@@ -90,11 +90,12 @@ class R10K::Git::ShellGit::WorkingRepository < R10K::Git::ShellGit::BaseReposito
   end
 
   # does the working tree have local modifications to tracked files?
-  def dirty?
+  def dirty?(exclude_spec=false)
     result = git(['diff-index', '--exit-code', '--name-only', 'HEAD'], :path => @path.to_s, :raise_on_fail => false)
 
     if result.exit_code != 0
       dirty_files = result.stdout.split('\n')
+      dirty_files.delete_if { |f| f.start_with?('spec/') } if exclude_spec
 
       dirty_files.each do |file|
         logger.debug(_("Found local modifications in %{file_path}" % {file_path: File.join(@path, file)}))
@@ -103,7 +104,7 @@ class R10K::Git::ShellGit::WorkingRepository < R10K::Git::ShellGit::BaseReposito
         logger.debug1 { git(['diff-index', '-p', 'HEAD', file], :path => @path.to_s, :raise_on_fail => false).stdout }
       end
 
-      return true
+      return dirty_files.size > 0
     else
       return false
     end