ruby-gem-release 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 3b3f5a468e45bd12e4299965c4e9417c9b49b0ac11e49339e5dd448c03ee10de
-  data.tar.gz: afb1782d46c31b3a2a93f582315f88d0c24947518a5fe9d3d5731acf01b7b46e
+  metadata.gz: bb0d582f2aa91a4b7e06e0ca416a6e27a3eb12640ffe11d10f833eb6c2652ca0
+  data.tar.gz: cf2c4a04e05ae5f4d148ff2d24fc1ff723e38e2abfb41bf0cd9ade68619ea271
 SHA512:
-  metadata.gz: e25947ecf903be0158b6958a77fbccf5e50cdd74b0984f7c3f7ab3cf22c72b26fa0aaf90b0006bbbcc478d8e3b232152cbb8fc52ea07c973323d5150bbca2255
-  data.tar.gz: 8c97476f80580b55cff61957917135539962a63fb664948895a8e7b301cdeb6f5bfe3f44d87286fcaeec5ffb25f82d34df7457e10d28cd197676bac952154809
+  metadata.gz: 1d1a8f271c218dbcac3b94cebfb0259559f817f7e64e6581bb51352c3aaa38fd95de13336098d4501aab8ec114d3ec04cfc56861ada30a5bbe6a16b1bfd8ce0a
+  data.tar.gz: 2f1f8a38fa8de16d07cd5e9968b298114ae78ab478494b5d452fdbd4202e94be18f797fb27986f4f07e88772f4447d1d61b8899928a1214d7c210d6a411aba26

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.3.1 (2026/11/07)
+
+- [#23](https://github.com/dblock/ruby-gem-release/pull/23): Reject dirty checkouts after dependency installation and commit only staged release preparation changes, preventing generated Bundler artifacts and unrelated files from entering releases - [@dblock](https://github.com/dblock).
+
 ## 0.3.0 (2026/11/07)
 
 - [#22](https://github.com/dblock/ruby-gem-release/pull/22): Make the release timezone configurable with a UTC default, use Eastern Time for this project's releases, and prepare version 0.3.0 - [@dblock](https://github.com/dblock).

data/README.md

@@ -53,7 +53,7 @@ permissions:
 
 jobs:
   release:
-    uses: dblock/ruby-gem-release/.github/workflows/release.yml@v0.2.3
+    uses: dblock/ruby-gem-release/.github/workflows/release.yml@v0.3.0
     with:
       ruby-version: '3.3'
       rubygems-owner: ${{ inputs.rubygems-owner }}

data/lib/ruby-gem-release/source_control/git/preparation.rb

@@ -0,0 +1,83 @@
+# frozen_string_literal: true
+
+require 'fileutils'
+
+module RubyGemRelease
+  module SourceControl
+    class Git
+      class Preparation
+        def initialize(directory:, &command)
+          @path = File.join(directory, 'prepared-tree')
+          @command = command
+        end
+
+        def check_clean!
+          entries = changes
+          return if entries.empty?
+
+          raise unexpected_changes('Release requires a clean checkout after dependency installation', entries)
+        end
+
+        def stage_changes!
+          if block_given?
+            check_clean!
+            yield
+          end
+          paths = changed_paths
+          run('--literal-pathspecs', 'add', '--', *paths) unless paths.empty?
+          FileUtils.mkdir_p(File.dirname(@path))
+          File.write(@path, run('write-tree').strip)
+        end
+
+        def verify!
+          entries = changes
+          return if entries.empty? && !File.file?(@path)
+
+          prepared = File.file?(@path) && File.read(@path)
+          staged_only = entries.all? { |entry| entry.first[1] == ' ' }
+          return if staged_only && prepared == run('write-tree').strip
+
+          raise unexpected_changes('Working tree or index changed outside release preparation; commit refused', entries)
+        end
+
+        def clear!
+          FileUtils.rm_f(@path)
+        end
+
+        private
+
+        def changed_paths
+          changes.flat_map do |status, path, source|
+            next [] if status[1] == ' '
+
+            status[0].match?(/[RC]/) ? [path] : [path, source].compact
+          end.uniq
+        end
+
+        def changes
+          fields = run('status', '--porcelain=v1', '-z', '--untracked-files=all').split("\0")
+          entries = []
+          until fields.empty?
+            field = fields.shift
+            entry = [field[0, 2], field[3..]]
+            entry << fields.shift if entry.first.match?(/[RC]/)
+            entries << entry
+          end
+          entries
+        end
+
+        def unexpected_changes(message, entries)
+          details = entries.first(20).map { |status, path, source| "  #{status} #{path.inspect}#{" (from #{source.inspect})" if source}" }
+          details << "  ... #{entries.size - 20} more paths" if entries.size > 20
+          "#{message} (#{entries.size} paths):\n#{details.join("\n")}\n" \
+            'Remove generated files, restore unexpected tracked/index changes, or intentionally ignore dependency artifacts such as .bundle/config and vendor/bundle. ' \
+            'Stage intended release edits with stage_changes! during preparation, not publication.'
+        end
+
+        def run(*)
+          @command.call(*)
+        end
+      end
+    end
+  end
+end

data/lib/ruby-gem-release/source_control/git.rb

@@ -3,6 +3,7 @@
 require 'open3'
 require 'tmpdir'
 require 'fileutils'
+require_relative 'git/preparation'
 
 module RubyGemRelease
   module SourceControl
@@ -36,6 +37,14 @@ module RubyGemRelease
         raise 'Default branch advanced; start a new release' unless remote_head == expected
       end
 
+      def check_clean!
+        preparation.check_clean!
+      end
+
+      def stage_changes!(&)
+        preparation.stage_changes!(&)
+      end
+
       def commit!(release)
         @release = release
         @initial_commit = ENV['RELEASE_INITIAL_COMMIT'] || head
@@ -87,15 +96,24 @@ module RubyGemRelease
       end
 
       def commit_changes(message, required:)
-        run('add', '-A')
-        output = run('diff', '--cached', '--name-only')
+        preparation.verify!
+        output = run('diff', '--cached', '--name-only', '-z')
         raise 'Preparing the next development iteration did not change any files' if required && output.empty?
-        return head if output.empty?
+
+        if output.empty?
+          preparation.clear!
+          return head
+        end
 
         run('commit', '-m', message)
+        preparation.clear!
         head
       end
 
+      def preparation
+        @preparation ||= Preparation.new(directory: @directory, &method(:run))
+      end
+
       def run(*)
         output, error, status = Open3.capture3('git', *)
         raise "Git command failed: #{error.strip}\n#{output.strip}" unless status.success?

data/lib/ruby-gem-release/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyGemRelease
-  VERSION = '0.3.0'
+  VERSION = '0.3.1'
 end

data/lib/ruby-gem-release/workflow/context.rb

@@ -18,9 +18,10 @@ module RubyGemRelease
       def capture!
         check_branch
         validate_timezone(ENV.fetch('TZ', 'UTC'))
+        git = configured_git
+        git.check_clean!
         package = Package::RubyGem.new(gemspec: ENV.fetch('INPUT_GEMSPEC', nil))
         release = initial_release(package)
-        git = configured_git
         git.check_current!(release)
         export('TZ' => ENV.fetch('TZ', 'UTC'), 'GEMSPEC' => package.gemspec, 'RELEASE_PREVIOUS_VERSION' => release.version,
                'RELEASE_DATE' => release.date.iso8601, 'RELEASE_INITIAL_COMMIT' => git.head)
@@ -32,7 +33,9 @@ module RubyGemRelease
         expected = ENV.fetch('INPUT_VERSION', '')
         raise "Prepared version #{version} does not match expected version #{expected}" unless expected.empty? || version == expected
 
-        SourceControl::Git.new.check_tag!(version)
+        git = SourceControl::Git.new
+        git.check_tag!(version)
+        git.stage_changes!
         export('RELEASE_VERSION' => version)
       end
 

data/lib/ruby-gem-release/workflow/ruby_gem.rb

@@ -27,7 +27,9 @@ module RubyGemRelease
       private
 
       def prepare_release(release)
-        @changelog&.release!(release.with_version(@version.read))
+        @git.stage_changes! do
+          @changelog&.release!(release.with_version(@version.read))
+        end
       end
 
       def publish(release)
@@ -40,8 +42,11 @@ module RubyGemRelease
       end
 
       def prepare_next(release)
-        next_release = release.with_next_version(@version.increment!)
-        @changelog&.prepare_next!(next_release)
+        next_release = nil
+        @git.stage_changes! do
+          next_release = release.with_next_version(@version.increment!)
+          @changelog&.prepare_next!(next_release)
+        end
         @git.commit_next!(next_release)
         @git.push!
       end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-gem-release
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Daniel Doubrovkine
@@ -56,6 +56,7 @@ files:
 - lib/ruby-gem-release/package/ruby_gem.rb
 - lib/ruby-gem-release/release.rb
 - lib/ruby-gem-release/source_control/git.rb
+- lib/ruby-gem-release/source_control/git/preparation.rb
 - lib/ruby-gem-release/tasks.rb
 - lib/ruby-gem-release/version.rb
 - lib/ruby-gem-release/version/ruby_constant.rb