ra10ke 4.5.0 → 4.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea18d86c034c89c78111ffadc6f2a3612332c9a8715275b957e3367d5c4a3d06
-  data.tar.gz: d7e12ba7bbc9a444c5a94d95c2e7421e0e632316ad6ce920a0152397510504c9
+  metadata.gz: a77b7170e6dfb723d530dc22553a16ca198a0b361ca3a2aac5169b05fb0e4c89
+  data.tar.gz: b8025d8e38a8051a8a3cf4baa8b214e74b96c8ea5230364a37b23ac22f210a61
 SHA512:
-  metadata.gz: 862eff9a48ac411815d92e71c01f12448d8d2b8d348ec0de709a8026d6617a8f7688161a15f294bb08dad75325853884fea3abd0e847d13a16129593f8438149
-  data.tar.gz: 756ad73f768fdd94ef42268769fbb4fe37b47e342e3ecfa811ceda820276bd787aaaaf381131f49e54961562fcade747f7e1784e209933ff569a96060ff5e462
+  metadata.gz: 0047a09a069462ef4d25e9778b83558aa29e9c282106e1f32eafd1fcc87df65d25e31fb9becccfa4d4ae47e4b61d930dafc15fcd56cd56b4669801675c3c415f
+  data.tar.gz: 4d809b1fa050a40ab3e1a265999eb47c1eb337609586b06c87b7fa3537303e42721a6d8ad8c84bd3264d2b0a183e3f2a91334054520730b39bde47193fc346de

data/.github/labeler.yml

@@ -0,0 +1,5 @@
+---
+skip-changelog:
+  - head-branch:
+    - '^release-*'
+    - '^rel[0-9]+'

data/.github/workflows/labeler.yml

@@ -0,0 +1,17 @@
+---
+name: 🏷️ Pull Request Labeler
+
+on:
+  - pull_request_target
+
+permissions: {}
+
+jobs:
+  labeler:
+    name: Labeler
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'voxpupuli' || github.repository_owner == 'OpenVoxProject'
+    permissions:
+      pull-requests: write
+    steps:
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0

data/.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     name: Build the gem
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Install Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -24,7 +24,7 @@ jobs:
         shell: bash
         run: gem build --verbose *.gemspec
       - name: Upload gem to GitHub cache
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: gem-artifact
           path: '*.gem'
@@ -39,7 +39,7 @@ jobs:
       contents: write # clone repo and create release
     steps:
       - name: Download gem from GitHub cache
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: gem-artifact
       - name: Create Release
@@ -56,7 +56,7 @@ jobs:
       packages: write # publish to rubygems.pkg.github.com
     steps:
       - name: Download gem from GitHub cache
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: gem-artifact
       - name: Publish gem to GitHub packages
@@ -73,10 +73,10 @@ jobs:
       id-token: write # rubygems.org authentication
     steps:
       - name: Download gem from GitHub cache
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: gem-artifact
-      - uses: rubygems/configure-rubygems-credentials@v1.0.0
+      - uses: rubygems/configure-rubygems-credentials@v2.1.0
       - name: Publish gem to rubygems.org
         shell: bash
         run: gem push *.gem
@@ -92,7 +92,7 @@ jobs:
       - release-to-rubygems
     steps:
       - name: Download gem from GitHub cache
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: gem-artifact
       - name: Install Ruby

data/.github/workflows/test.yml

@@ -16,7 +16,7 @@ jobs:
     outputs:
       ruby: ${{ steps.ruby.outputs.versions }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Install Ruby ${{ matrix.ruby }}
         uses: ruby/setup-ruby@v1
         with:
@@ -25,7 +25,7 @@ jobs:
       - name: Run Rubocop
         run: bundle exec rake rubocop
       - id: ruby
-        uses: voxpupuli/ruby-version@v1
+        uses: voxpupuli/ruby-version@v2
   test:
     runs-on: ubuntu-latest
     needs: rubocop_and_matrix
@@ -35,7 +35,7 @@ jobs:
         ruby: ${{ fromJSON(needs.rubocop_and_matrix.outputs.ruby) }}
     name: Ruby ${{ matrix.ruby }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v7
       - name: Install Ruby ${{ matrix.ruby }}
         uses: ruby/setup-ruby@v1
         with:

data/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 All notable changes to this project will be documented in this file.
 
+## [v4.6.0](https://github.com/voxpupuli/ra10ke/tree/v4.6.0) (2026-10-13)
+
+[Full Changelog](https://github.com/voxpupuli/ra10ke/compare/v4.5.1...v4.6.0)
+
+**Implemented enhancements:**
+
+- feat: use git-gem in git\_repo class; drop support for git-gem version v1.x [\#152](https://github.com/voxpupuli/ra10ke/pull/152) ([rwaffen](https://github.com/rwaffen))
+
+## [v4.5.1](https://github.com/voxpupuli/ra10ke/tree/v4.5.1) (2026-05-11)
+
+[Full Changelog](https://github.com/voxpupuli/ra10ke/compare/v4.5.0...v4.5.1)
+
+**Fixed bugs:**
+
+- fix: process git modules before Forge modules to prevent dependency conflicts [\#145](https://github.com/voxpupuli/ra10ke/pull/145) ([bastelfreak](https://github.com/bastelfreak))
+
+**Closed issues:**
+
+- r10k:solve\_dependencies pulls in outdated constraints from last forge release as implicit dependency instead of explicit git module [\#128](https://github.com/voxpupuli/ra10ke/issues/128)
+
 ## [v4.5.0](https://github.com/voxpupuli/ra10ke/tree/v4.5.0) (2025-10-16)
 
 [Full Changelog](https://github.com/voxpupuli/ra10ke/compare/v4.4.0...v4.5.0)

data/Gemfile

@@ -5,5 +5,5 @@ gemspec
 
 group :release, optional: true do
   gem 'faraday-retry', '~> 2.1', require: false
-  gem 'github_changelog_generator', '~> 1.16.4', require: false
+  gem 'github_changelog_generator', '~> 1.18', require: false
 end

data/lib/ra10ke/dependencies.rb

@@ -165,8 +165,7 @@ module Ra10ke::Dependencies
             "https://#{::Regexp.last_match(1)}/#{::Regexp.last_match(2)}"
           end
           repo = ::Ra10ke::GitRepo.new(source_url)
-          ref = repo.get_ref_like(mod.expected_version)
-          ref_name = ref ? ref[:name] : "bad url or tag #{mod.expected_version} is missing"
+          ref_name = repo.get_ref_like(mod.expected_version) || "bad url or tag #{mod.expected_version} is missing"
           <<~EOF
             mod '#{mod.name}',
               :git => '#{source_url}',

data/lib/ra10ke/git_repo.rb

@@ -1,16 +1,12 @@
 # frozen_string_literal: true
 
-require 'tempfile'
+require 'git'
+require 'tmpdir'
 
 module Ra10ke
   class GitRepo
     attr_reader :url
 
-    REMOTE_REFS_CMD = 'git ls-remote --symref'
-    CLONE_CMD = 'git clone --no-tags'
-    CURRENT_BRANCH_CMD = 'git symbolic-ref --short HEAD'
-    SHOW_CMD = 'git show'
-
     def initialize(url)
       @url = url
     end
@@ -19,18 +15,19 @@ module Ra10ke
     # @param path [String] - The path to the repository to check
     # @return [String] - The current active branch of the Git repo
     def self.current_branch(path)
-      Dir.chdir(path) do
-        data, success = run_command(CURRENT_BRANCH_CMD)
-        return success ? data.strip : nil
-      end
+      branch = Git.open(path).current_branch
+      branch unless branch == 'HEAD' || branch.to_s.empty?
+    rescue Git::Error, ArgumentError
+      nil
     end
 
-    # @return [Array] - the raw data from the git ls-remote command as lines array
-    # return empty array if url or command failed
+    # @return [Hash] - remote refs grouped by the git gem
+    # return empty hash if the command failed
     def remote_refs
       @remote_refs ||= begin
-        data, success = run_command("#{REMOTE_REFS_CMD} #{url}")
-        success ? data.lines : []
+        Git.ls_remote(url)
+      rescue Git::Error
+        {}
       end
     end
 
@@ -39,89 +36,55 @@ module Ra10ke
       !remote_refs.empty?
     end
 
-    # @return [Boolean] - return true if the commit sha is valid
-    # @param url [String] - the git string either https or ssh url
-    # @param ref [String] - the sha id
-    def valid_commit?(sha)
-      return false if sha.nil? || sha.empty?
-      return true if valid_ref?(sha)
+    def valid_commit?(ref)
+      return false if ref.nil? || ref.empty?
+      return true if valid_ref?(ref)
+      return false unless valid_url?
 
-      # cloning is a last resort if for some reason we cannot
-      # remotely get via ls-remote
       Dir.mktmpdir do |dir|
-        run_command("#{CLONE_CMD} #{url} #{dir}", silent: true)
-        Dir.chdir(dir) do
-          _, status = run_command("#{SHOW_CMD} #{sha}", silent: true)
-          status
-        end
+        repo = Git.clone(url, dir, bare: true)
+        repo.rev_parse("#{ref}^{commit}")
+        true
       end
+    rescue Git::Error
+      false
     end
 
-    # @return [Boolean] - return true if the ref is valid
-    # @param url [String] - the git string either https or ssh url
-    # @param ref [String] - the ref object, branch name, tag name, or commit sha, defaults to HEAD
+    # @param ref [String] branch name, tag name, HEAD, or a full/abbreviated SHA
+    # @return [Boolean]
     def valid_ref?(ref = 'HEAD')
-      return false if ref.nil?
+      return false if ref.nil? || ref.empty?
 
-      found = all_refs.find do |data|
-        # we don't need to bother with these types
-        next if %i[pull merge_request].include?(data[:type])
-
-        # is the name equal to the tag or branch?  Is the commit sha equal?
-        data[:name].eql?(ref) || data[:sha].slice(0, 8).eql?(ref.slice(0, 8))
-      end
-      !found.nil?
-    end
+      head = remote_refs.fetch('head', {})
+      return true if ref == 'HEAD' && !head.empty?
+      return true if sha_match?(head[:sha], ref)
 
-    # @return [Array] - an array of all the refs associated with the remote repository
-    # @param url [String] - the git string either https or ssh url
-    # @example
-    #   [{:sha=>"0ec707e431367bbe2752966be8ab915b6f0da754", :ref=>"refs/heads/74110ac", :type=>:branch, :subtype=>nil, :name=>"74110ac"},
-    #     :sha=>"07bb5d2d94db222dca5860eb29c184e8970f36f4", :ref=>"refs/pull/74/head", :type=>:pull, :subtype=>:head, :name=>"74"},
-    #     :sha=>"156ca9a8ea69e056e86355b27d944e59d1b3a1e1", :ref=>"refs/heads/master", :type=>:branch, :subtype=>nil, :name=>"master"},
-    #     :sha=>"fcc0532bbc5a5b65f3941738339e9cc7e3d767ce", :ref=>"refs/pull/249/head", :type=>:pull, :subtype=>:head, :name=>"249"},
-    #     :sha=>"8d54891fa5df75890ee15d53080c2a81b4960f92", :ref=>"refs/pull/267/head", :type=>:pull, :subtype=>:head, :name=>"267"}]
-    def all_refs
-      @all_refs ||= remote_refs.each_with_object([]) do |line, refs|
-        sha, ref = line.split("\t")
-        next refs if line.include?('redirecting')
-        next refs if sha.eql?('ref: refs/heads/master')
-
-        _, type, name, subtype = ref.chomp.split('/')
-        next refs unless name
-
-        type = :tag if type.eql?('tags')
-        type = type.to_sym
-        subtype = subtype.to_sym if subtype
-        type = :branch if type.eql?(:heads)
-        refs << { sha: sha, ref: ref.chomp, type: type, subtype: subtype, name: name }
+      %w[branches tags].any? do |type|
+        refs = remote_refs.fetch(type, {})
+        refs.key?(ref) || refs.values.any? { |data| sha_match?(data[:sha], ref) }
       end
     end
 
-    # @summary searches all the refs for a ref similar to the name provided
-    #          This is useful when looking for tags if a v or not a v
-    # @param ref_name [String]
-    # @return [String] the matching ref_name or nil
+    # @param ref_name [String] substring to find in a tag name
+    # @return [String, nil] matching tag name
     def get_ref_like(ref_name)
-      return nil unless valid_url?
+      return nil if ref_name.nil? || ref_name.empty?
 
-      all_refs.find do |ref|
-        ref[:name].include?(ref_name)
+      remote_refs.fetch('tags', {}).each_key.find do |name|
+        !name.end_with?('^{}') && name.include?(ref_name)
       end
     end
 
-    # useful for mocking easily
-    # @param cmd [String]
-    # @param silent [Boolean] set to true if you wish to send output to /dev/null, false by default
-    # @return [Array]
-    def self.run_command(cmd, silent: false)
-      out_args = silent ? '2>&1 > /dev/null' : '2>&1'
-      out = `#{cmd} #{out_args}`
-      [out, $CHILD_STATUS.success?]
-    end
+    private
+
+    def sha_match?(sha, ref)
+      return false unless sha
+
+      # \A and \z anchor the entire string; [0-9a-f] allows only hexadecimal digits.
+      # {8,64} accepts abbreviations of at least 8 digits up to a full SHA-256; i allows uppercase.
+      return false unless ref.match?(/\A[0-9a-f]{8,64}\z/i)
 
-    def run_command(cmd, silent: false)
-      self.class.run_command(cmd, silent: silent)
+      sha.start_with?(ref.downcase)
     end
   end
 end

data/lib/ra10ke/solve.rb

@@ -50,38 +50,26 @@ module Ra10ke::Solve
       # List of modules we have in the Puppetfile, as [name, version] pairs
       @current_modules = []
 
+      # Single pass: partition modules into git/Forge arrays and simultaneously seed
+      # @processed_modules with all git module names. Seeding upfront prevents
+      # add_reqs_to_graph from fetching Forge releases for any git module encountered
+      # as a transitive dependency, regardless of declaration order in the Puppetfile.
+      git_modules = []
+      forge_modules = []
       puppetfile.modules.each do |puppet_module|
         next if ignore_modules.include? puppet_module.title
 
         if puppet_module.instance_of?(R10K::Module::Forge)
-          module_name = puppet_module.title.tr('/', '-')
-          installed_version = puppet_module.expected_version
-          puts "Processing Forge module #{module_name}-#{installed_version}"
-          @current_modules << [module_name, installed_version]
-          @graph.artifact(module_name, installed_version)
-          constraint = '>=0.0.0'
-          unless allow_major_bump
-            ver = Semverse::Version.new installed_version
-            if ver.major.zero?
-              constraint = "~>#{installed_version}"
-            else
-              nver = Semverse::Version.new([ver.major + 1, 0, 0])
-              constraint = "<#{nver}"
-            end
-          end
-          puts "...Adding a demand: #{module_name} #{constraint}"
-
-          @demands.add([module_name, constraint])
-          puts '...Fetching latest release version information'
-          forge_rel = PuppetForge::Module.find(module_name).current_release
-          mod = @graph.artifact(module_name, forge_rel.version)
-          puts '...Adding its requirements to the graph'
-          meta = get_release_metadata(module_name, forge_rel)
-          add_reqs_to_graph(mod, meta)
+          forge_modules << puppet_module
+        elsif puppet_module.instance_of?(R10K::Module::Git)
+          @processed_modules.add(puppet_module.title.tr('/', '-'))
+          git_modules << puppet_module
         end
+      end
 
-        next unless puppet_module.instance_of?(R10K::Module::Git)
-
+      # Process git modules first so their metadata populates the graph before
+      # any Forge module's transitive dependencies are resolved.
+      git_modules.each do |puppet_module|
         # This downloads the git module to modules/modulename
         meta = fetch_git_metadata(puppet_module)
         version = get_key_or_sym(meta, :version)
@@ -95,6 +83,35 @@ module Ra10ke::Solve
         puts "...Adding requirements for git module #{module_name}-#{version}"
         add_reqs_to_graph(mod, meta)
       end
+
+      # Process Forge modules. Any git module already in @processed_modules will
+      # be skipped by add_reqs_to_graph when encountered as a transitive dependency.
+      forge_modules.each do |puppet_module|
+        module_name = puppet_module.title.tr('/', '-')
+        installed_version = puppet_module.expected_version
+        puts "Processing Forge module #{module_name}-#{installed_version}"
+        @current_modules << [module_name, installed_version]
+        @graph.artifact(module_name, installed_version)
+        constraint = '>=0.0.0'
+        unless allow_major_bump
+          ver = Semverse::Version.new installed_version
+          if ver.major.zero?
+            constraint = "~>#{installed_version}"
+          else
+            nver = Semverse::Version.new([ver.major + 1, 0, 0])
+            constraint = "<#{nver}"
+          end
+        end
+        puts "...Adding a demand: #{module_name} #{constraint}"
+
+        @demands.add([module_name, constraint])
+        puts '...Fetching latest release version information'
+        forge_rel = PuppetForge::Module.find(module_name).current_release
+        mod = @graph.artifact(module_name, forge_rel.version)
+        puts '...Adding its requirements to the graph'
+        meta = get_release_metadata(module_name, forge_rel)
+        add_reqs_to_graph(mod, meta)
+      end
       puts
       puts 'Resolving dependencies...'
       puts 'WARNING:  Potentially breaking updates are allowed for this resolution' if allow_major_bump

data/lib/ra10ke/version.rb

@@ -1,3 +1,3 @@
 module Ra10ke
-  VERSION = '4.5.0'
+  VERSION = '4.6.0'
 end

data/ra10ke.gemspec

@@ -16,7 +16,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ['lib']
   spec.required_ruby_version = '>= 3.1.0'
 
-  spec.add_dependency 'git', '>= 1.18', '< 5.0'
+  spec.add_dependency 'git', '>= 2.0', '< 5.0'
   spec.add_dependency 'puppet_forge', '~> 6.0'
   spec.add_dependency 'r10k', '~> 5.0'
   spec.add_dependency 'rake', '~> 13.0', '>= 13.0.6'

data/spec/ra10ke/dependencies_git_conversion_spec.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'ra10ke'
+
+RSpec.describe Ra10ke::Dependencies do
+  let(:url) { 'https://example.invalid/module.git' }
+  let(:metadata) do
+    PuppetForge::V3::Module.new(homepage_url: url, current_release: { metadata: { source: url } })
+  end
+  let(:forge_module) do
+    R10K::Module::Forge.new('example-module', fixtures_dir, version: '1.0.0')
+  end
+  let(:puppetfile) { instance_double(R10K::Puppetfile, load!: nil, forge: nil, modules: [forge_module]) }
+  let(:task_owner) { Ra10ke::RakeTask.new }
+
+  around do |example|
+    original_application = Rake.application
+    Rake.application = Rake::Application.new
+    example.run
+  ensure
+    Rake.application = original_application
+  end
+
+  before do
+    allow(forge_module).to receive_messages(v3_module: metadata, name: 'example-module')
+    allow(task_owner).to receive(:get_puppetfile).and_return(puppetfile)
+  end
+
+  it 'prints the matching tag name returned by GitRepo' do
+    allow(Git).to receive(:ls_remote).with(url).and_return(
+      'tags' => { 'v1.0.0' => { ref: 'refs', sha: 'abc12345' } },
+    )
+    expected = <<~PUPPETFILE
+      mod 'example-module',
+        :git => '#{url}',
+        :ref => 'v1.0.0'
+
+    PUPPETFILE
+    expect { Rake::Task['r10k:print_git_conversion'].execute }.to output(expected).to_stdout
+  end
+
+  it 'prints the existing error message when no tag matches' do
+    allow(Git).to receive(:ls_remote).with(url).and_return({})
+    expected = <<~PUPPETFILE
+      mod 'example-module',
+        :git => '#{url}',
+        :ref => 'bad url or tag 1.0.0 is missing'
+
+    PUPPETFILE
+    expect { Rake::Task['r10k:print_git_conversion'].execute }.to output(expected).to_stdout
+  end
+end

data/spec/ra10ke/git_repo_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
-require 'ra10ke/validate'
+require 'ra10ke/git_repo'
 
 RSpec.describe 'Ra10ke::GitRepo' do
   let(:url) { 'https://github.com/vshn/puppet-gitlab' }
@@ -10,11 +10,12 @@ RSpec.describe 'Ra10ke::GitRepo' do
     expect(Ra10ke::GitRepo.new(url)).to be_a Ra10ke::GitRepo
   end
 
-  it 'does not run_command more than once' do
+  it 'only fetches remote refs once' do
     i = Ra10ke::GitRepo.new(url)
-    expect(i).to receive(:run_command).with("git ls-remote --symref #{url}").once
+    expect(Git).to receive(:ls_remote).with(url).once.and_return({})
     i.valid_url?
-    i.all_refs
+    i.valid_ref?
+    i.get_ref_like('1.0.0')
   end
 
   describe 'good url' do
@@ -24,28 +25,56 @@ RSpec.describe 'Ra10ke::GitRepo' do
       Ra10ke::GitRepo.new(url)
     end
 
-    let(:reflist) { File.read(File.join(fixtures_dir, 'refs', 'gitlab.txt')) }
+    let(:reflist) do
+      File.readlines(File.join(fixtures_dir, 'refs', 'gitlab.txt')).each_with_object({}) do |line, refs|
+        sha, ref = line.strip.split("\t")
+        if ref == 'HEAD'
+          refs['head'] = { ref: ref, sha: sha }
+        else
+          prefix, type, name = ref.split('/', 3)
+          type = 'branches' if type == 'heads'
+          refs[type] ||= {}
+          refs[type][name] = { ref: prefix, sha: sha }
+        end
+      end
+    end
 
     before do
-      allow(instance).to receive(:run_command).with("git ls-remote --symref #{url}").and_return([reflist, true])
+      allow(Git).to receive(:ls_remote).with(url).and_return(reflist)
     end
 
-    it '#remote_refs is array' do
-      expect(instance.remote_refs).to be_a Array
+    it '#remote_refs returns the gem hash unchanged' do
+      expect(instance.remote_refs).to equal(reflist)
     end
 
     it '#remote_refs contains refs' do
-      expect(instance.remote_refs.first).to eq("1b3322d525e96bf7d0565b08703e2a44c90e7b4a\tHEAD\n")
+      expect(instance.remote_refs['head']).to eq(ref: 'HEAD', sha: '1b3322d525e96bf7d0565b08703e2a44c90e7b4a')
     end
 
     it '#get_ref_like' do
-      expect(instance.get_ref_like('8.0.0'))
+      expect(instance.get_ref_like('5.0.0')).to eq('v5.0.0')
     end
 
     it '#valid_ref?' do
       expect(instance.valid_ref?('master')).to be true
     end
 
+    it 'accepts HEAD explicitly and as the default ref' do
+      expect(instance.valid_ref?('HEAD')).to be true
+      expect(instance.valid_ref?).to be true
+    end
+
+    it 'excludes pull and merge request refs from validation' do
+      allow(Git).to receive(:ls_remote).with(url).and_return(
+        'pull' => { '74/head' => { ref: 'refs', sha: 'abc12345' } },
+        'merge_request' => { '12/merge' => { ref: 'refs', sha: 'def12345' } },
+      )
+      expect(instance.valid_ref?('74')).to be false
+      expect(instance.valid_ref?('abc12345')).to be false
+      expect(instance.valid_ref?('12')).to be false
+      expect(instance.valid_ref?('def12345')).to be false
+    end
+
     it '#valid_commit?' do
       expect(instance.valid_commit?('master')).to be true
     end
@@ -55,8 +84,9 @@ RSpec.describe 'Ra10ke::GitRepo' do
     end
 
     it '#valid_commit? but invalid sha' do
-      allow(instance).to receive(:run_command).with(/clone/, silent: true).and_return([nil, true])
-      allow(instance).to receive(:run_command).with(/git\sshow.*/, silent: true).and_return([nil, false])
+      repo = instance_double(Git::Base)
+      allow(Git).to receive(:clone).with(url, kind_of(String), bare: true).and_return(repo)
+      allow(repo).to receive(:rev_parse).with('invalid^{commit}').and_raise(Git::Error)
       expect(instance.valid_commit?('invalid')).to be false
     end
 
@@ -64,13 +94,28 @@ RSpec.describe 'Ra10ke::GitRepo' do
       expect(instance.valid_url?).to be true
     end
 
-    it '#all_refs is a Array of Hashes' do
-      refs = instance.all_refs
-      expect(refs).to be_a Array
-      expect(refs.last).to eq(
-        { name: 'v5.0.0^{}', ref: 'refs/tags/v5.0.0^{}', sha: '1febd15f90d32e6b3d6c242a70db386b2ef1942c', subtype: nil,
-          type: :tag, },
+    it 'accepts full and abbreviated SHAs but checks all supplied characters' do
+      sha = reflist['head'][:sha]
+      expect(instance.valid_ref?(sha)).to be true
+      expect(instance.valid_ref?(sha[0, 8])).to be true
+      expect(instance.valid_ref?(sha[0, 12])).to be true
+      expect(instance.valid_ref?("#{sha[0, 8]}#{'0' * 32}")).to be false
+      expect(instance.valid_ref?("#{sha}0")).to be false
+      expect(instance.valid_ref?(sha[0, 7])).to be false
+    end
+
+    it 'validates the peeled commit SHA of an annotated tag' do
+      expect(instance.valid_ref?('1febd15f90d32e6b3d6c242a70db386b2ef1942c')).to be true
+    end
+
+    it 'searches only tag names and skips peeled tag entries' do
+      allow(Git).to receive(:ls_remote).with(url).and_return(
+        'branches' => { 'feature/5.0.0' => { ref: 'refs', sha: 'abc12345' } },
+        'tags' => { 'v5.0.0^{}' => { ref: 'refs', sha: 'abc12345' }, 'v5.0.0' => { ref: 'refs', sha: 'def12345' } },
       )
+      expect(instance.get_ref_like('5.0.0')).to eq('v5.0.0')
+      expect(instance.get_ref_like('feature')).to be_nil
+      expect(instance.get_ref_like('^{}')).to be_nil
     end
   end
 
@@ -81,12 +126,143 @@ RSpec.describe 'Ra10ke::GitRepo' do
     end
 
     before do
-      allow(instance).to receive(:run_command).with("git ls-remote --symref #{url}").and_return(['', false])
+      allow(Git).to receive(:ls_remote).with(url).and_raise(Git::Error)
+    end
+
+    it 'returns empty remote refs and rejects HEAD' do
+      expect(instance.remote_refs).to eq({})
+      expect(instance.valid_ref?).to be false
+    end
+  end
+
+  describe 'failed remote lookup' do
+    it 'caches the failure and reports an invalid URL' do
+      repo = Ra10ke::GitRepo.new(url)
+      expect(Git).to receive(:ls_remote).with(url).once.and_raise(Git::Error)
+      expect(repo.valid_url?).to be false
+      expect(repo.remote_refs).to eq({})
+      expect(repo.get_ref_like('missing')).to be_nil
+      expect(Git).not_to receive(:clone)
+      expect(repo.valid_commit?('missing')).to be false
+    end
+  end
+
+  describe '#valid_commit?' do
+    let(:instance) { Ra10ke::GitRepo.new(url) }
+
+    before do
+      allow(Git).to receive(:ls_remote).with(url).and_return('head' => { ref: 'HEAD', sha: 'a' * 40 })
+    end
+
+    it 'does not clone for an empty SHA' do
+      expect(Git).not_to receive(:clone)
+      expect(instance.valid_commit?('')).to be false
+    end
+
+    it 'stops after a failed clone and removes the temporary directory' do
+      clone_dir = nil
+      expect(Git).to receive(:clone).with(url, kind_of(String), bare: true) do |_, dir|
+        clone_dir = dir
+        raise Git::Error
+      end
+      expect(instance.valid_commit?('missing')).to be false
+      expect(File.exist?(clone_dir)).to be false
+    end
+  end
+
+  describe '.current_branch' do
+    it 'handles nil returned by older git gem versions for detached HEAD' do
+      repo = instance_double(Git::Base, current_branch: nil)
+      allow(Git).to receive(:open).with('repo').and_return(repo)
+      expect(Ra10ke::GitRepo.current_branch('repo')).to be_nil
+    end
+
+    it 'returns nil for a directory without a repository' do
+      Dir.mktmpdir do |dir|
+        expect(Ra10ke::GitRepo.current_branch(dir)).to be_nil
+      end
+    end
+
+    it 'returns nil for a missing directory' do
+      Dir.mktmpdir do |dir|
+        expect(Ra10ke::GitRepo.current_branch(File.join(dir, 'missing'))).to be_nil
+      end
+    end
+  end
+
+  describe 'with a local repository' do
+    let(:tmpdir) { Dir.mktmpdir('ra10ke git repo ') }
+    let(:path) { File.join(tmpdir, 'source repo') }
+    let(:local_repo) { Git.init(path) }
+    let(:older_sha) { local_repo.revparse('HEAD~1') }
+
+    around do |example|
+      example.run
+    ensure
+      FileUtils.remove_entry(tmpdir)
+    end
+
+    before do
+      local_repo.config('user.name', 'Ra10ke Test')
+      local_repo.config('user.email', 'ra10ke@example.invalid')
+      local_repo.config('commit.gpgsign', 'false')
+      local_repo.config('tag.gpgsign', 'false')
+      File.write(File.join(path, 'file'), 'first')
+      local_repo.add('file')
+      local_repo.commit('first')
+      File.write(File.join(path, 'file'), 'second')
+      local_repo.add('file')
+      local_repo.commit('second')
+      local_repo.add_tag('v1.0.0')
+      local_repo.add_tag('v2.0.0', annotate: true, message: 'annotated tag')
+    end
+
+    it 'returns the branch without changing the working directory' do
+      cwd = Dir.pwd
+      expect(Ra10ke::GitRepo.current_branch(path)).to eq(local_repo.current_branch)
+      expect(Dir.pwd).to eq(cwd)
+    end
+
+    it 'returns nil for detached HEAD' do
+      local_repo.checkout(older_sha)
+      expect(Ra10ke::GitRepo.current_branch(path)).to be_nil
+    end
+
+    it 'finds branches, lightweight tags and annotated tags' do
+      repo = Ra10ke::GitRepo.new(path)
+      expect(repo.valid_url?).to be true
+      expect(repo.valid_ref?(local_repo.current_branch)).to be true
+      expect(repo.valid_ref?('v1.0.0')).to be true
+      expect(repo.valid_ref?('v2.0.0')).to be true
+      expect(repo.get_ref_like('2.0.0')).to eq('v2.0.0')
+    end
+
+    it 'preserves branch and tag names containing slashes' do
+      local_repo.branch('feature/example').create
+      local_repo.add_tag('release/v1.0.0')
+      repo = Ra10ke::GitRepo.new(path)
+      expect(repo.valid_ref?('feature/example')).to be true
+      expect(repo.valid_ref?('release/v1.0.0')).to be true
+      expect(repo.get_ref_like('release/')).to eq('release/v1.0.0')
+    end
+
+    it 'recognizes remote HEAD from the gem lookup' do
+      repo = Ra10ke::GitRepo.new(path)
+      expect(repo.valid_ref?).to be true
+      expect(repo.valid_ref?(local_repo.revparse('HEAD'))).to be true
+    end
+
+    it 'rejects a blob object during the commit fallback check' do
+      repo = Ra10ke::GitRepo.new(path)
+      blob_sha = local_repo.rev_parse('HEAD:file')
+      expect(repo.valid_commit?(blob_sha)).to be false
     end
 
-    it '#all_refs' do
-      expect(instance.all_refs).to be_a Array
-      expect(instance.all_refs).to eq []
+    it 'clones to validate a commit that is not advertised by a ref' do
+      repo = Ra10ke::GitRepo.new(path)
+      expect(repo.valid_ref?(older_sha)).to be false
+      expect(repo.valid_commit?(older_sha)).to be true
+      expect(repo.valid_commit?('invalid')).to be false
     end
   end
 end

data/spec/ra10ke/solve_spec.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec::Mocks.configuration.allow_message_expectations_on_nil = true
+
+RSpec.describe Ra10ke::Solve do
+  # Minimal helper class that mixes in the module so we can test its private methods.
+  let(:instance) do
+    klass = Class.new do
+      include Ra10ke::Solve
+
+      # Expose private helpers for direct testing.
+      public :get_key_or_sym, :get_version_req, :print_module_diff, :add_reqs_to_graph
+
+      def initialize
+        @graph             = Solve::Graph.new
+        @processed_modules = Set.new
+        @demands           = Set.new
+        # @metadata_cache is intentionally left nil here; tests that need it
+        # set it via instance_variable_set in a before block.
+      end
+    end
+    klass.new
+  end
+
+  let(:processed_modules) { instance.instance_variable_get(:@processed_modules) }
+  let(:demands)           { instance.instance_variable_get(:@demands) }
+  let(:graph)             { instance.instance_variable_get(:@graph) }
+
+  # -------------------------------------------------------------------------
+  describe '#get_key_or_sym' do
+    it 'fetches a value by symbol key' do
+      expect(instance.get_key_or_sym({ version: '1.0.0' }, :version)).to eq('1.0.0')
+    end
+
+    it 'fetches a value by string key when only the string form is present' do
+      expect(instance.get_key_or_sym({ 'version' => '2.0.0' }, :version)).to eq('2.0.0')
+    end
+
+    it 'prefers the symbol key over the string key when both are present' do
+      expect(instance.get_key_or_sym({ version: 'sym', 'version' => 'str' }, :version)).to eq('sym')
+    end
+
+    it 'returns nil when the key is absent in both forms' do
+      expect(instance.get_key_or_sym({}, :version)).to be_nil
+    end
+  end
+
+  # -------------------------------------------------------------------------
+  describe '#get_version_req' do
+    it 'returns version_requirement when present' do
+      expect(instance.get_version_req({ version_requirement: '>= 1.0.0' })).to eq('>= 1.0.0')
+    end
+
+    it 'falls back to version_range when version_requirement is absent' do
+      expect(instance.get_version_req({ version_range: '>= 2.0.0' })).to eq('>= 2.0.0')
+    end
+
+    it 'returns nil when neither key is present' do
+      expect(instance.get_version_req({})).to be_nil
+    end
+
+    it 'works with string keys' do
+      expect(instance.get_version_req({ 'version_requirement' => '~> 3.0' })).to eq('~> 3.0')
+    end
+  end
+
+  # -------------------------------------------------------------------------
+  describe '#print_module_diff' do
+    it 'reports OUTDATED for a module whose version has changed' do
+      expect do
+        instance.print_module_diff([['foo-bar', '1.0.0']], [['foo-bar', '2.0.0']])
+      end.to output(/OUTDATED.*foo-bar.*1\.0\.0.*2\.0\.0/).to_stdout
+    end
+
+    it 'reports MISSING for a module present in the resolution but not in current' do
+      expect do
+        instance.print_module_diff([], [['missing-mod', '1.2.3']])
+      end.to output(/MISSING.*missing-mod.*1\.2\.3/).to_stdout
+    end
+
+    it 'produces no output when all modules are up to date' do
+      expect do
+        instance.print_module_diff([['foo-bar', '1.0.0']], [['foo-bar', '1.0.0']])
+      end.not_to output.to_stdout
+    end
+
+    it 'reports all outdated modules in a single pass' do
+      current    = [['aaa-one', '1.0.0'], ['bbb-two', '2.0.0']]
+      resolution = [['aaa-one', '1.1.0'], ['bbb-two', '2.1.0']]
+      expect do
+        instance.print_module_diff(current, resolution)
+      end.to output(/aaa-one.*bbb-two/m).to_stdout
+    end
+  end
+
+  # -------------------------------------------------------------------------
+  describe '#add_reqs_to_graph' do
+    let(:artifact) { graph.artifact('mymod', '1.0.0') }
+
+    context 'when the dependency is already in @processed_modules' do
+      before { processed_modules.add('puppetlabs-stdlib') }
+
+      it 'does not attempt a Forge lookup' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/stdlib', version_requirement: '>= 4.0.0' }] }
+        expect(PuppetForge::Module).not_to receive(:find)
+        instance.add_reqs_to_graph(artifact, meta)
+      end
+
+      it 'adds the dependency name to @demands' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/stdlib', version_requirement: '>= 4.0.0' }] }
+        instance.add_reqs_to_graph(artifact, meta)
+        expect(demands).to include('puppetlabs-stdlib')
+      end
+
+      it 'records the version constraint on the artifact' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/stdlib', version_requirement: '>= 4.0.0' }] }
+        instance.add_reqs_to_graph(artifact, meta)
+        dep = artifact.dependencies.find { |d| d.name == 'puppetlabs-stdlib' }
+        expect(dep).not_to be_nil
+        expect(dep.constraint.to_s).to eq('>= 4.0.0')
+      end
+    end
+
+    context 'when no_demands flag is set' do
+      before { processed_modules.add('puppetlabs-stdlib') }
+
+      it 'does not add the dependency to @demands' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/stdlib', version_requirement: '>= 4.0.0' }] }
+        instance.add_reqs_to_graph(artifact, meta, :no_demands)
+        expect(demands).not_to include('puppetlabs-stdlib')
+      end
+    end
+
+    context 'when dependency has an invalid version constraint' do
+      before { processed_modules.add('puppetlabs-badmod') }
+
+      it 'prints a warning and continues without raising' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/badmod', version_requirement: 'not_valid' }] }
+        expect do
+          instance.add_reqs_to_graph(artifact, meta)
+        end.to output(/WARNING.*Invalid version constraint/).to_stdout
+      end
+    end
+
+    context 'when dependency has no version constraint' do
+      before { processed_modules.add('puppetlabs-nover') }
+
+      it 'falls back to >=0.0.0 and does not raise' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/nover' }] }
+        expect { instance.add_reqs_to_graph(artifact, meta) }.not_to raise_error
+        dep = artifact.dependencies.find { |d| d.name == 'puppetlabs-nover' }
+        expect(dep.constraint.to_s).to eq('>= 0.0.0')
+      end
+    end
+
+    context 'when dependency has a compound constraint (>=x <y)' do
+      before { processed_modules.add('puppetlabs-compound') }
+
+      it 'records both bounds on the artifact' do
+        meta = {
+          name: 'mymod',
+          dependencies: [{ name: 'puppetlabs/compound', version_requirement: '>= 4.0.0 <9.0.0' }],
+        }
+        instance.add_reqs_to_graph(artifact, meta)
+        constraints = artifact.dependencies.select { |d| d.name == 'puppetlabs-compound' }
+                              .map { |d| d.constraint.to_s }
+        expect(constraints).to include('>= 4.0.0')
+        expect(constraints).to include('< 9.0.0')
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ra10ke
 version: !ruby/object:Gem::Version
-  version: 4.5.0
+  version: 4.6.0
 platform: ruby
 authors:
 - Theo Chatzimichos
@@ -16,7 +16,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.18'
+        version: '2.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '5.0'
@@ -26,7 +26,7 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1.18'
+        version: '2.0'
     - - "<"
       - !ruby/object:Gem::Version
         version: '5.0'
@@ -168,7 +168,9 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".github/dependabot.yml"
+- ".github/labeler.yml"
 - ".github/release.yml"
+- ".github/workflows/labeler.yml"
 - ".github/workflows/release.yml"
 - ".github/workflows/test.yml"
 - ".gitignore"
@@ -207,12 +209,14 @@ files:
 - spec/fixtures/refs/gitlab.txt
 - spec/fixtures/refs/r10k.txt
 - spec/fixtures/refs/reflist.txt
+- spec/ra10ke/dependencies_git_conversion_spec.rb
 - spec/ra10ke/dependencies_spec.rb
 - spec/ra10ke/deprecation_spec.rb
 - spec/ra10ke/diff_spec.rb
 - spec/ra10ke/duplicates_spec.rb
 - spec/ra10ke/git_repo_spec.rb
 - spec/ra10ke/puppetfile_parser_spec.rb
+- spec/ra10ke/solve_spec.rb
 - spec/ra10ke/validate_spec.rb
 - spec/ra10ke_spec.rb
 - spec/spec_helper.rb
@@ -234,7 +238,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Syntax check for the Puppetfile, check for outdated installed puppet modules
 test_files: []