ra10ke 4.5.0 → 4.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ea18d86c034c89c78111ffadc6f2a3612332c9a8715275b957e3367d5c4a3d06
-  data.tar.gz: d7e12ba7bbc9a444c5a94d95c2e7421e0e632316ad6ce920a0152397510504c9
+  metadata.gz: e89462c238286812deefe1c66b23bd3458f10f68545f19394cda6e5cae239fa3
+  data.tar.gz: be70614d1b793aaae4e3e9151186709b70d68506687b3a3590f6e79ed6fe4298
 SHA512:
-  metadata.gz: 862eff9a48ac411815d92e71c01f12448d8d2b8d348ec0de709a8026d6617a8f7688161a15f294bb08dad75325853884fea3abd0e847d13a16129593f8438149
-  data.tar.gz: 756ad73f768fdd94ef42268769fbb4fe37b47e342e3ecfa811ceda820276bd787aaaaf381131f49e54961562fcade747f7e1784e209933ff569a96060ff5e462
+  metadata.gz: 95bbe0ab0fea1b2598c75f4e0f7cfee5c1b77acc457574bd55627bd584d9a9ae2b0360f6bb70fcafb8b4df03559b05d63db2ee5abc1f8364276e126ddfaae047
+  data.tar.gz: 0c1d340000c757922d5929b27f61d814c4d7a1b8c1c7220d2a4bd50ba30f42c66bec026eb959bb03b74169ff567a6ec409a0c0c2ac357aa5744e86fbe2dce287

data/.github/workflows/release.yml

@@ -15,7 +15,7 @@ jobs:
     name: Build the gem
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Install Ruby
         uses: ruby/setup-ruby@v1
         with:
@@ -24,7 +24,7 @@ jobs:
         shell: bash
         run: gem build --verbose *.gemspec
       - name: Upload gem to GitHub cache
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: gem-artifact
           path: '*.gem'
@@ -39,7 +39,7 @@ jobs:
       contents: write # clone repo and create release
     steps:
       - name: Download gem from GitHub cache
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: gem-artifact
       - name: Create Release
@@ -56,7 +56,7 @@ jobs:
       packages: write # publish to rubygems.pkg.github.com
     steps:
       - name: Download gem from GitHub cache
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: gem-artifact
       - name: Publish gem to GitHub packages
@@ -73,10 +73,10 @@ jobs:
       id-token: write # rubygems.org authentication
     steps:
       - name: Download gem from GitHub cache
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: gem-artifact
-      - uses: rubygems/configure-rubygems-credentials@v1.0.0
+      - uses: rubygems/configure-rubygems-credentials@v2.0.0
       - name: Publish gem to rubygems.org
         shell: bash
         run: gem push *.gem
@@ -92,7 +92,7 @@ jobs:
       - release-to-rubygems
     steps:
       - name: Download gem from GitHub cache
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@v8
         with:
           name: gem-artifact
       - name: Install Ruby

data/.github/workflows/test.yml

@@ -16,7 +16,7 @@ jobs:
     outputs:
       ruby: ${{ steps.ruby.outputs.versions }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Install Ruby ${{ matrix.ruby }}
         uses: ruby/setup-ruby@v1
         with:
@@ -25,7 +25,7 @@ jobs:
       - name: Run Rubocop
         run: bundle exec rake rubocop
       - id: ruby
-        uses: voxpupuli/ruby-version@v1
+        uses: voxpupuli/ruby-version@v2
   test:
     runs-on: ubuntu-latest
     needs: rubocop_and_matrix
@@ -35,7 +35,7 @@ jobs:
         ruby: ${{ fromJSON(needs.rubocop_and_matrix.outputs.ruby) }}
     name: Ruby ${{ matrix.ruby }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@v6
       - name: Install Ruby ${{ matrix.ruby }}
         uses: ruby/setup-ruby@v1
         with:

data/CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [v4.5.1](https://github.com/voxpupuli/ra10ke/tree/v4.5.1) (2026-05-11)
+
+[Full Changelog](https://github.com/voxpupuli/ra10ke/compare/v4.5.0...v4.5.1)
+
+**Fixed bugs:**
+
+- fix: process git modules before Forge modules to prevent dependency conflicts [\#145](https://github.com/voxpupuli/ra10ke/pull/145) ([bastelfreak](https://github.com/bastelfreak))
+
+**Closed issues:**
+
+- r10k:solve\_dependencies pulls in outdated constraints from last forge release as implicit dependency instead of explicit git module [\#128](https://github.com/voxpupuli/ra10ke/issues/128)
+
 ## [v4.5.0](https://github.com/voxpupuli/ra10ke/tree/v4.5.0) (2025-10-16)
 
 [Full Changelog](https://github.com/voxpupuli/ra10ke/compare/v4.4.0...v4.5.0)

data/Gemfile

@@ -5,5 +5,5 @@ gemspec
 
 group :release, optional: true do
   gem 'faraday-retry', '~> 2.1', require: false
-  gem 'github_changelog_generator', '~> 1.16.4', require: false
+  gem 'github_changelog_generator', '~> 1.18', require: false
 end

data/lib/ra10ke/solve.rb

@@ -50,38 +50,26 @@ module Ra10ke::Solve
       # List of modules we have in the Puppetfile, as [name, version] pairs
       @current_modules = []
 
+      # Single pass: partition modules into git/Forge arrays and simultaneously seed
+      # @processed_modules with all git module names. Seeding upfront prevents
+      # add_reqs_to_graph from fetching Forge releases for any git module encountered
+      # as a transitive dependency, regardless of declaration order in the Puppetfile.
+      git_modules = []
+      forge_modules = []
       puppetfile.modules.each do |puppet_module|
         next if ignore_modules.include? puppet_module.title
 
         if puppet_module.instance_of?(R10K::Module::Forge)
-          module_name = puppet_module.title.tr('/', '-')
-          installed_version = puppet_module.expected_version
-          puts "Processing Forge module #{module_name}-#{installed_version}"
-          @current_modules << [module_name, installed_version]
-          @graph.artifact(module_name, installed_version)
-          constraint = '>=0.0.0'
-          unless allow_major_bump
-            ver = Semverse::Version.new installed_version
-            if ver.major.zero?
-              constraint = "~>#{installed_version}"
-            else
-              nver = Semverse::Version.new([ver.major + 1, 0, 0])
-              constraint = "<#{nver}"
-            end
-          end
-          puts "...Adding a demand: #{module_name} #{constraint}"
-
-          @demands.add([module_name, constraint])
-          puts '...Fetching latest release version information'
-          forge_rel = PuppetForge::Module.find(module_name).current_release
-          mod = @graph.artifact(module_name, forge_rel.version)
-          puts '...Adding its requirements to the graph'
-          meta = get_release_metadata(module_name, forge_rel)
-          add_reqs_to_graph(mod, meta)
+          forge_modules << puppet_module
+        elsif puppet_module.instance_of?(R10K::Module::Git)
+          @processed_modules.add(puppet_module.title.tr('/', '-'))
+          git_modules << puppet_module
         end
+      end
 
-        next unless puppet_module.instance_of?(R10K::Module::Git)
-
+      # Process git modules first so their metadata populates the graph before
+      # any Forge module's transitive dependencies are resolved.
+      git_modules.each do |puppet_module|
         # This downloads the git module to modules/modulename
         meta = fetch_git_metadata(puppet_module)
         version = get_key_or_sym(meta, :version)
@@ -95,6 +83,35 @@ module Ra10ke::Solve
         puts "...Adding requirements for git module #{module_name}-#{version}"
         add_reqs_to_graph(mod, meta)
       end
+
+      # Process Forge modules. Any git module already in @processed_modules will
+      # be skipped by add_reqs_to_graph when encountered as a transitive dependency.
+      forge_modules.each do |puppet_module|
+        module_name = puppet_module.title.tr('/', '-')
+        installed_version = puppet_module.expected_version
+        puts "Processing Forge module #{module_name}-#{installed_version}"
+        @current_modules << [module_name, installed_version]
+        @graph.artifact(module_name, installed_version)
+        constraint = '>=0.0.0'
+        unless allow_major_bump
+          ver = Semverse::Version.new installed_version
+          if ver.major.zero?
+            constraint = "~>#{installed_version}"
+          else
+            nver = Semverse::Version.new([ver.major + 1, 0, 0])
+            constraint = "<#{nver}"
+          end
+        end
+        puts "...Adding a demand: #{module_name} #{constraint}"
+
+        @demands.add([module_name, constraint])
+        puts '...Fetching latest release version information'
+        forge_rel = PuppetForge::Module.find(module_name).current_release
+        mod = @graph.artifact(module_name, forge_rel.version)
+        puts '...Adding its requirements to the graph'
+        meta = get_release_metadata(module_name, forge_rel)
+        add_reqs_to_graph(mod, meta)
+      end
       puts
       puts 'Resolving dependencies...'
       puts 'WARNING:  Potentially breaking updates are allowed for this resolution' if allow_major_bump

data/lib/ra10ke/version.rb

@@ -1,3 +1,3 @@
 module Ra10ke
-  VERSION = '4.5.0'
+  VERSION = '4.5.1'
 end

data/spec/ra10ke/solve_spec.rb

@@ -0,0 +1,174 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec::Mocks.configuration.allow_message_expectations_on_nil = true
+
+RSpec.describe Ra10ke::Solve do
+  # Minimal helper class that mixes in the module so we can test its private methods.
+  let(:instance) do
+    klass = Class.new do
+      include Ra10ke::Solve
+
+      # Expose private helpers for direct testing.
+      public :get_key_or_sym, :get_version_req, :print_module_diff, :add_reqs_to_graph
+
+      def initialize
+        @graph             = Solve::Graph.new
+        @processed_modules = Set.new
+        @demands           = Set.new
+        # @metadata_cache is intentionally left nil here; tests that need it
+        # set it via instance_variable_set in a before block.
+      end
+    end
+    klass.new
+  end
+
+  let(:processed_modules) { instance.instance_variable_get(:@processed_modules) }
+  let(:demands)           { instance.instance_variable_get(:@demands) }
+  let(:graph)             { instance.instance_variable_get(:@graph) }
+
+  # -------------------------------------------------------------------------
+  describe '#get_key_or_sym' do
+    it 'fetches a value by symbol key' do
+      expect(instance.get_key_or_sym({ version: '1.0.0' }, :version)).to eq('1.0.0')
+    end
+
+    it 'fetches a value by string key when only the string form is present' do
+      expect(instance.get_key_or_sym({ 'version' => '2.0.0' }, :version)).to eq('2.0.0')
+    end
+
+    it 'prefers the symbol key over the string key when both are present' do
+      expect(instance.get_key_or_sym({ version: 'sym', 'version' => 'str' }, :version)).to eq('sym')
+    end
+
+    it 'returns nil when the key is absent in both forms' do
+      expect(instance.get_key_or_sym({}, :version)).to be_nil
+    end
+  end
+
+  # -------------------------------------------------------------------------
+  describe '#get_version_req' do
+    it 'returns version_requirement when present' do
+      expect(instance.get_version_req({ version_requirement: '>= 1.0.0' })).to eq('>= 1.0.0')
+    end
+
+    it 'falls back to version_range when version_requirement is absent' do
+      expect(instance.get_version_req({ version_range: '>= 2.0.0' })).to eq('>= 2.0.0')
+    end
+
+    it 'returns nil when neither key is present' do
+      expect(instance.get_version_req({})).to be_nil
+    end
+
+    it 'works with string keys' do
+      expect(instance.get_version_req({ 'version_requirement' => '~> 3.0' })).to eq('~> 3.0')
+    end
+  end
+
+  # -------------------------------------------------------------------------
+  describe '#print_module_diff' do
+    it 'reports OUTDATED for a module whose version has changed' do
+      expect do
+        instance.print_module_diff([['foo-bar', '1.0.0']], [['foo-bar', '2.0.0']])
+      end.to output(/OUTDATED.*foo-bar.*1\.0\.0.*2\.0\.0/).to_stdout
+    end
+
+    it 'reports MISSING for a module present in the resolution but not in current' do
+      expect do
+        instance.print_module_diff([], [['missing-mod', '1.2.3']])
+      end.to output(/MISSING.*missing-mod.*1\.2\.3/).to_stdout
+    end
+
+    it 'produces no output when all modules are up to date' do
+      expect do
+        instance.print_module_diff([['foo-bar', '1.0.0']], [['foo-bar', '1.0.0']])
+      end.not_to output.to_stdout
+    end
+
+    it 'reports all outdated modules in a single pass' do
+      current    = [['aaa-one', '1.0.0'], ['bbb-two', '2.0.0']]
+      resolution = [['aaa-one', '1.1.0'], ['bbb-two', '2.1.0']]
+      expect do
+        instance.print_module_diff(current, resolution)
+      end.to output(/aaa-one.*bbb-two/m).to_stdout
+    end
+  end
+
+  # -------------------------------------------------------------------------
+  describe '#add_reqs_to_graph' do
+    let(:artifact) { graph.artifact('mymod', '1.0.0') }
+
+    context 'when the dependency is already in @processed_modules' do
+      before { processed_modules.add('puppetlabs-stdlib') }
+
+      it 'does not attempt a Forge lookup' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/stdlib', version_requirement: '>= 4.0.0' }] }
+        expect(PuppetForge::Module).not_to receive(:find)
+        instance.add_reqs_to_graph(artifact, meta)
+      end
+
+      it 'adds the dependency name to @demands' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/stdlib', version_requirement: '>= 4.0.0' }] }
+        instance.add_reqs_to_graph(artifact, meta)
+        expect(demands).to include('puppetlabs-stdlib')
+      end
+
+      it 'records the version constraint on the artifact' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/stdlib', version_requirement: '>= 4.0.0' }] }
+        instance.add_reqs_to_graph(artifact, meta)
+        dep = artifact.dependencies.find { |d| d.name == 'puppetlabs-stdlib' }
+        expect(dep).not_to be_nil
+        expect(dep.constraint.to_s).to eq('>= 4.0.0')
+      end
+    end
+
+    context 'when no_demands flag is set' do
+      before { processed_modules.add('puppetlabs-stdlib') }
+
+      it 'does not add the dependency to @demands' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/stdlib', version_requirement: '>= 4.0.0' }] }
+        instance.add_reqs_to_graph(artifact, meta, :no_demands)
+        expect(demands).not_to include('puppetlabs-stdlib')
+      end
+    end
+
+    context 'when dependency has an invalid version constraint' do
+      before { processed_modules.add('puppetlabs-badmod') }
+
+      it 'prints a warning and continues without raising' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/badmod', version_requirement: 'not_valid' }] }
+        expect do
+          instance.add_reqs_to_graph(artifact, meta)
+        end.to output(/WARNING.*Invalid version constraint/).to_stdout
+      end
+    end
+
+    context 'when dependency has no version constraint' do
+      before { processed_modules.add('puppetlabs-nover') }
+
+      it 'falls back to >=0.0.0 and does not raise' do
+        meta = { name: 'mymod', dependencies: [{ name: 'puppetlabs/nover' }] }
+        expect { instance.add_reqs_to_graph(artifact, meta) }.not_to raise_error
+        dep = artifact.dependencies.find { |d| d.name == 'puppetlabs-nover' }
+        expect(dep.constraint.to_s).to eq('>= 0.0.0')
+      end
+    end
+
+    context 'when dependency has a compound constraint (>=x <y)' do
+      before { processed_modules.add('puppetlabs-compound') }
+
+      it 'records both bounds on the artifact' do
+        meta = {
+          name: 'mymod',
+          dependencies: [{ name: 'puppetlabs/compound', version_requirement: '>= 4.0.0 <9.0.0' }],
+        }
+        instance.add_reqs_to_graph(artifact, meta)
+        constraints = artifact.dependencies.select { |d| d.name == 'puppetlabs-compound' }
+                              .map { |d| d.constraint.to_s }
+        expect(constraints).to include('>= 4.0.0')
+        expect(constraints).to include('< 9.0.0')
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ra10ke
 version: !ruby/object:Gem::Version
-  version: 4.5.0
+  version: 4.5.1
 platform: ruby
 authors:
 - Theo Chatzimichos
@@ -213,6 +213,7 @@ files:
 - spec/ra10ke/duplicates_spec.rb
 - spec/ra10ke/git_repo_spec.rb
 - spec/ra10ke/puppetfile_parser_spec.rb
+- spec/ra10ke/solve_spec.rb
 - spec/ra10ke/validate_spec.rb
 - spec/ra10ke_spec.rb
 - spec/spec_helper.rb
@@ -234,7 +235,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.6.9
+rubygems_version: 4.0.6
 specification_version: 4
 summary: Syntax check for the Puppetfile, check for outdated installed puppet modules
 test_files: []