kettle-dev / kettle-family / 41157592154

88%

push

github

🐛 Block release on bootstrap dependency drift and scrub resume command secrets (#19)

Add a `bootstrap dependency drift` release preflight phase that compares
each selected member's committed Gemfile.lock against the newest
published version satisfying the member's declared floor for
bootstrap-managed gems (release.drift_check.gems, default [nomono]),
via the ETag-cached RubyGemsVersions lookup. Locked-behind drift now
blocks early with a `bundle update <gem>` / family template sweep hint
instead of dying mid-wave in CI (nomono 1.1.16/1.1.17, run 40998206316).
Registry lookup failures skip non-fatally with a diagnostic.

Redact secret-shaped env values (KETTLE_RELEASE_GEM_SIGNING_PASSPHRASE
at minimum) in generated resume commands to a shell-safe
<redacted-reauthorize> placeholder, so failed-run summaries no longer
embed the broker-cached passphrase in plaintext. Routing metadata keys
(*_SOURCE, *_PROVIDER, *_BROKER, *_FIELD) stay visible for
re-authorization.

3069 of 3962 branches covered (77.46%)

Branch coverage included in aggregate %.

52 of 56 new or added lines in 2 files covered. (92.86%)

7650 of 8216 relevant lines covered (93.11%)

113.81 hits per line