ruby-repo-kit 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2909f2324f7d85ad154aa579190c1a6163b2245b742e96075ba7f8ba45c0eb73
-  data.tar.gz: e67253ccb000a0c816a0fca22aaf9ae1e0984ca16344f4d1f814fe7df0f96ab0
+  metadata.gz: ffeaa438a6aabff617d58d356184c706f8e95d279bd74d292a9077c51e32c9d9
+  data.tar.gz: 72e653e7fea5dcc94dcaa99e4116c5dec4e670ca8e7e2bd4f0dcd78c7d9991ff
 SHA512:
-  metadata.gz: 2e008180735fbb712e1860ad300104fbecfa27c6d8e677e16487660bd976b3c6318a7778ac0fae1593a4f3b56fb783e622494aaf09ba9ea8310bc19c1905c24e
-  data.tar.gz: 5cb158be5ed9a2153ca460026b8184d88f7bd50b9fd6be22039badc17cd71f8d9d0a48485ad7d82b5b55a19c9565ef2d2b0ea81e1adcb34330b60ca62848c632
+  metadata.gz: b0955bcebae7be6166af09ce531861e01a8396f8c49fdf42d2eb69467c8847ca39760bd7e27bff3a229abbf28162eb1f50d97394a553ed5e8a7cdb9967c906ec
+  data.tar.gz: d532a0e0a945ef4bd39d47eb28fc7bec468200419e0b77ad022fefb589346dc815dfbd684cd07295e19c0c49fe64ac8bbb055aaf60248e3bcdf8b8f6a7d2fc56

data/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## [Unreleased]
 
+## [0.1.1] - 2026-10-05
+
+### Added
+
+- Preserve consumer package smoke checks with application environment overrides while keeping isolated gem loading.
+- Configure hotfix-branch protection and required review-thread resolution without replacing the shared GitHub policy engine.
+- Document supported release-task and packaging APIs for existing repositories with their own maintenance tasks.
+
+### Fixed
+
+- Prevent automatic RubyGems and Bundler setup from loading dependencies or checkout code outside package smoke isolation.
+- Detect missing or empty RubyGems lockfile checksums in doctor and repo:check before frozen CI fails, without fetching or changing dependencies.
+- Keep generated CLI release notes under Unreleased so the first 0.1.0 release can be prepared without correcting a premature release history.
+
 ## [0.1.0] - 2026-10-05
 
 ### Added
@@ -10,5 +24,6 @@
 - Share release preparation, recovery, artifact verification and isolated package checks through a development gem.
 - Validate repository contracts and plan, verify or apply the initial GitHub maintenance policy.
 
-[Unreleased]: https://github.com/hvpaiva/ruby-repo-kit/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/hvpaiva/ruby-repo-kit/compare/v0.1.1...HEAD
 [0.1.0]: https://github.com/hvpaiva/ruby-repo-kit/releases/tag/v0.1.0
+[0.1.1]: https://github.com/hvpaiva/ruby-repo-kit/releases/tag/v0.1.1

data/README.md

@@ -83,7 +83,14 @@ the Ruby API, ownership boundaries and configuration example.
 
 Doctor validates the local maintenance contract: required files, package
 metadata, version consistency, package manifest, development dependency and
-shared lint configuration. It does not certify code quality, run the full test
+shared lint configuration. If Gemfile.lock enables CHECKSUMS, it also detects
+missing or empty checksums for RubyGems dependencies before frozen CI installation.
+PATH and Git dependencies do not need gem artifact checksums. This inspection
+does not install dependencies, access the network or modify the lockfile. To fix
+incomplete checksums, run `bundle lock --add-checksums`, review and commit the
+lockfile. This check verifies checksum presence; Bundler verifies artifact bytes
+when installing. Existing lockfiles without CHECKSUMS retain Bundler's opt-in
+behavior. Doctor does not certify code quality, run the full test
 suite, or verify hosted settings.
 
 The repository's check task combines lint, tests with coverage, structural checks

data/lib/ruby_repo_kit/checks/lockfile.rb

@@ -0,0 +1,33 @@
+# frozen_string_literal: true
+
+require "bundler"
+
+module RubyRepoKit
+  class Checks
+    # Parse only: never resolve, install, fetch or rewrite the consumer's bundle.
+    class Lockfile
+      def initialize(path:)
+        @path = path
+      end
+
+      def check
+        return true unless File.exist?(@path)
+
+        parsed = Bundler::LockfileParser.new(File.read(@path))
+        # Checksums are opt-in for existing lockfiles, including Bundler 2.6.
+        return true unless parsed.checksums
+
+        incomplete = parsed.specs.select do |spec|
+          spec.source.is_a?(Bundler::Source::Rubygems) &&
+            spec.source.checksum_store.to_lock(spec) == spec.name_tuple.lock_name
+        end
+        return true if incomplete.empty?
+
+        raise Error, "Gemfile.lock has empty or missing CHECKSUMS for: #{incomplete.map(&:full_name).join(', ')}. " \
+                     "Run `bundle lock --add-checksums`, then review and commit Gemfile.lock before frozen CI."
+      rescue Bundler::BundlerError, ArgumentError => e
+        raise Error, "Cannot inspect Gemfile.lock checksums: #{e.message}"
+      end
+    end
+  end
+end

data/lib/ruby_repo_kit/checks.rb

@@ -5,6 +5,7 @@ require "open3"
 require "psych"
 require "rbconfig"
 require_relative "specification"
+require_relative "checks/lockfile"
 
 module RubyRepoKit
   # Local structural checks. Evaluating a gemspec/Gemfile is trusted project code;
@@ -27,6 +28,7 @@ module RubyRepoKit
       [@project.gemspec, @project.version_file, @project.changelog, "Gemfile", "Rakefile"].each do |file|
         require_file(file)
       end
+      Lockfile.new(path: @project.path("Gemfile.lock")).check
       specification = Specification.load(project: @project)
       metadata(specification)
       manifest(specification)

data/lib/ruby_repo_kit/github/policy.rb

@@ -21,12 +21,13 @@ module RubyRepoKit
       def main_ruleset
         {
           "name" => "main", "target" => "branch", "enforcement" => "active", "bypass_actors" => [],
-          "conditions" => { "ref_name" => { "include" => %w[refs/heads/main refs/heads/hotfix/*], "exclude" => [] } },
+          "conditions" => { "ref_name" => { "include" => protected_branches, "exclude" => [] } },
           "rules" => [
             { "type" => "pull_request", "parameters" => {
               "required_approving_review_count" => 0, "dismiss_stale_reviews_on_push" => false,
               "require_code_owner_review" => false, "require_last_push_approval" => false,
-              "required_review_thread_resolution" => true, "allowed_merge_methods" => ["merge"]
+              "required_review_thread_resolution" => @project.require_review_thread_resolution,
+              "allowed_merge_methods" => ["merge"]
             } },
             { "type" => "required_status_checks", "parameters" => {
               "strict_required_status_checks_policy" => true, "do_not_enforce_on_create" => false,
@@ -47,6 +48,14 @@ module RubyRepoKit
           "rules" => %w[creation update deletion].map { |type| { "type" => type } }
         }
       end
+
+      private
+
+      def protected_branches
+        ["refs/heads/main"].tap do |branches|
+          branches << "refs/heads/hotfix/*" if @project.protect_hotfix_branches
+        end
+      end
     end
   end
 end

data/lib/ruby_repo_kit/package.rb

@@ -25,15 +25,17 @@ module RubyRepoKit
       target
     end
 
-    def check(artifact: nil)
+    def check(artifact: nil, environment: {})
+      environment = validated_environment(environment)
       Dir.mktmpdir("ruby-repo-package-") do |dir|
         package = artifact ? File.expand_path(artifact, @project.root) : build(output: File.join(dir, "package.gem"))
         spec = verify(package)
         home = File.join(dir, "gems")
         cache_dependencies(dir)
         Bundler.with_unbundled_env do
-          env = { "GEM_HOME" => home, "GEM_PATH" => home, "RUBYOPT" => nil, "RUBYLIB" => nil,
-                  "XDG_CONFIG_HOME" => File.join(dir, "config"), "NO_COLOR" => "1" }
+          env = environment.merge("GEM_HOME" => home, "GEM_PATH" => home, "RUBYOPT" => nil, "RUBYLIB" => nil,
+                                  "BUNDLER_SETUP" => nil, "RUBYGEMS_GEMDEPS" => nil,
+                                  "XDG_CONFIG_HOME" => File.join(dir, "config"), "NO_COLOR" => "1")
           # GEM_HOME selects the destination. --install-dir would make RubyGems
           # ignore installed specifications, including Ruby's uncached default gems.
           execute(env, [*gem_command, "install", "--local", "--no-document", "--norc",
@@ -70,6 +72,16 @@ module RubyRepoKit
 
     private
 
+    def validated_environment(environment)
+      valid = environment.is_a?(Hash) && environment.all? do |key, value|
+        key.is_a?(String) && key.match?(/\A[A-Za-z_][A-Za-z0-9_]*\z/) &&
+          (value.nil? || (value.is_a?(String) && !value.include?("\0")))
+      end
+      raise Error, "Package environment must map variable names to strings or nil" unless valid
+
+      environment.to_h { |key, value| [key.dup, value&.dup] }
+    end
+
     def specification
       spec = Specification.load(project: @project)
       raise Error, "Gemspec name differs from project name" unless spec.name == @project.name

data/lib/ruby_repo_kit/project.rb

@@ -10,10 +10,11 @@ module RubyRepoKit
     DEFAULT_CHECKS = ["quality", "commits", "audit", "fresh-dependencies", "test (ubuntu-latest, 3.4)",
                       "test (ubuntu-latest, 4.0)", "test (macos-latest, 4.0)"].freeze
     KEYS = %w[schema name repository version_file gemspec changelog generated_paths
-              generate_command check_command required_checks workflow environment].freeze
+              generate_command check_command required_checks workflow environment
+              protect_hotfix_branches require_review_thread_resolution].freeze
     attr_reader :root, :name, :repository, :version_file, :gemspec, :changelog,
                 :generated_paths, :generate_command, :check_command, :required_checks,
-                :workflow, :environment
+                :workflow, :environment, :protect_hotfix_branches, :require_review_thread_resolution
 
     def self.load(root: Dir.pwd)
       source = File.join(root, CONFIG_FILE)
@@ -25,9 +26,7 @@ module RubyRepoKit
     end
 
     def initialize(root:, settings:)
-      raise Error, "Project configuration must be a mapping" unless settings.is_a?(Hash)
-      raise Error, "Unknown project settings: #{settings.keys - KEYS}" unless (settings.keys - KEYS).empty?
-      raise Error, "Unsupported configuration schema (expected 1)" unless settings.fetch("schema", nil) == 1
+      validate_settings(settings)
 
       @root = File.realpath(root).freeze
       @name = identifier(settings["name"], /\A[a-z][a-z0-9]*(?:[-_][a-z0-9]+)*\z/, "gem name")
@@ -43,6 +42,8 @@ module RubyRepoKit
       @workflow = identifier(settings.fetch("workflow", "release.yml"), /\A[a-zA-Z0-9_-]+\.ya?ml\z/,
                              "workflow filename")
       @environment = identifier(settings.fetch("environment", "release"), /\A[a-zA-Z0-9_-]+\z/, "environment")
+      @protect_hotfix_branches = boolean_setting(settings, "protect_hotfix_branches")
+      @require_review_thread_resolution = boolean_setting(settings, "require_review_thread_resolution")
       freeze
     end
 
@@ -67,6 +68,19 @@ module RubyRepoKit
 
     private
 
+    def validate_settings(settings)
+      raise Error, "Project configuration must be a mapping" unless settings.is_a?(Hash)
+      raise Error, "Unknown project settings: #{settings.keys - KEYS}" unless (settings.keys - KEYS).empty?
+      raise Error, "Unsupported configuration schema (expected 1)" unless settings.fetch("schema", nil) == 1
+    end
+
+    def boolean_setting(settings, name)
+      value = settings.fetch(name, true)
+      raise Error, "#{name} must be true or false" unless [true, false].include?(value)
+
+      value
+    end
+
     def identifier(value, pattern, description)
       raise Error, "Invalid #{description}: #{value.inspect}" unless value.is_a?(String) && pattern.match?(value)
 

data/lib/ruby_repo_kit/rake_tasks.rb

@@ -10,10 +10,7 @@ module RubyRepoKit
     extend Rake::DSL
 
     def self.install(project:)
-      if Rake::Task.task_defined?("release")
-        raise Error,
-              "A release task already exists; remove competing release tooling before installing RubyRepoKit tasks"
-      end
+      install_release(project: project)
 
       desc "Validate local repository maintenance contracts"
       task "repo:check" do
@@ -43,11 +40,15 @@ module RubyRepoKit
         sh "bundle", "exec", "bundler-audit", "check", "--update"
       end
 
-      install_release(project)
       install_github(project)
     end
 
-    def self.install_release(project)
+    def self.install_release(project:)
+      if Rake::Task.task_defined?("release")
+        raise Error,
+              "A release task already exists; remove competing release tooling before installing RubyRepoKit tasks"
+      end
+
       require_relative "release"
 
       desc "Verify the release tag, version and changelog"

data/lib/ruby_repo_kit/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RubyRepoKit
-  VERSION = "0.1.0"
+  VERSION = "0.1.1"
 end

data/templates/cli/CHANGELOG.md.erb

@@ -4,11 +4,8 @@ All notable user-visible changes are documented here.
 
 ## [Unreleased]
 
-## [0.1.0] - <%= Time.now.strftime("%Y-%m-%d") %>
-
 ### Added
 
 - Initial text-printing CLI with help, version and predictable exit statuses.
 
-[Unreleased]: https://github.com/<%= @repository %>/compare/v0.1.0...HEAD
-[0.1.0]: https://github.com/<%= @repository %>/releases/tag/v0.1.0
+[Unreleased]: https://github.com/<%= @repository %>/commits/main

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: ruby-repo-kit
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Highlander Paiva
@@ -174,6 +174,7 @@ files:
 - lib/ruby_repo_kit.rb
 - lib/ruby_repo_kit/checks.rb
 - lib/ruby_repo_kit/checks/commits.rb
+- lib/ruby_repo_kit/checks/lockfile.rb
 - lib/ruby_repo_kit/cli.rb
 - lib/ruby_repo_kit/commands.rb
 - lib/ruby_repo_kit/github.rb