✨ kettle-jem: security floors from kettle-rb; drop dead appraisal helpers

gems/ast-crispr/Gemfile

@@ -24,11 +24,8 @@ gem 'kettle-family', '~> 1.2', '>= 1.2.100'
 structuredmerge_rust_dev = ENV.fetch('STRUCTUREDMERGE_RUST_DEV', '').strip
 if !structuredmerge_rust_dev.empty? && !%w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
   gem 'structuredmerge_host_prototype', path: File.join(structuredmerge_rust_dev, 'packages/ruby')
-end
-
-# CI current and coverage jobs require the published Rust host gem; this fails until it is released.
-if ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero? &&
-   instance_variable_get(:@dependencies).none? { |dependency| dependency.name == 'structuredmerge_host_prototype' }
+elsif ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero?
+  # CI current and coverage jobs require the published Rust host gem; this fails until it is released.
   gem 'structuredmerge_host_prototype', '~> 0.2'
 end
 

gems/ast-merge-git/Gemfile

@@ -11,11 +11,8 @@ source 'https://gem.coop'
 structuredmerge_rust_dev = ENV.fetch('STRUCTUREDMERGE_RUST_DEV', '').strip
 if !structuredmerge_rust_dev.empty? && !%w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
   gem 'structuredmerge_host_prototype', path: File.join(structuredmerge_rust_dev, 'packages/ruby')
-end
-
-# CI current and coverage jobs require the published Rust host gem; this fails until it is released.
-if ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero? &&
-   instance_variable_get(:@dependencies).none? { |dependency| dependency.name == 'structuredmerge_host_prototype' }
+elsif ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero?
+  # CI current and coverage jobs require the published Rust host gem; this fails until it is released.
   gem 'structuredmerge_host_prototype', '~> 0.2'
 end
 

gems/ast-template/Gemfile

@@ -32,11 +32,8 @@ direct_sibling_gems = %w[
 structuredmerge_rust_dev = ENV.fetch('STRUCTUREDMERGE_RUST_DEV', '').strip
 if !structuredmerge_rust_dev.empty? && !%w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
   gem 'structuredmerge_host_prototype', path: File.join(structuredmerge_rust_dev, 'packages/ruby')
-end
-
-# CI current and coverage jobs require the published Rust host gem; this fails until it is released.
-if ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero? &&
-   instance_variable_get(:@dependencies).none? { |dependency| dependency.name == 'structuredmerge_host_prototype' }
+elsif ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero?
+  # CI current and coverage jobs require the published Rust host gem; this fails until it is released.
   gem 'structuredmerge_host_prototype', '~> 0.2'
 end
 

gems/bash-merge/Gemfile

@@ -19,13 +19,10 @@ git_source(:gitlab) { |repo_name| "https://gitlab.com/#{repo_name}" }
 gemspec
 
 structuredmerge_rust_dev = ENV.fetch('STRUCTUREDMERGE_RUST_DEV', '').strip
-unless structuredmerge_rust_dev.empty? || %w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
+if !structuredmerge_rust_dev.empty? && !%w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
   gem 'structuredmerge_host_prototype', path: File.join(structuredmerge_rust_dev, 'packages/ruby')
-end
-
-# CI current and coverage jobs require the published Rust host gem; this fails until it is released.
-if ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero? &&
-   instance_variable_get(:@dependencies).none? { |dependency| dependency.name == 'structuredmerge_host_prototype' }
+elsif ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero?
+  # CI current and coverage jobs require the published Rust host gem; this fails until it is released.
   gem 'structuredmerge_host_prototype', '~> 0.2'
 end
 

gems/go-merge/Gemfile

@@ -19,13 +19,10 @@ git_source(:gitlab) { |repo_name| "https://gitlab.com/#{repo_name}" }
 gemspec
 
 structuredmerge_rust_dev = ENV.fetch('STRUCTUREDMERGE_RUST_DEV', '').strip
-unless structuredmerge_rust_dev.empty? || %w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
+if !structuredmerge_rust_dev.empty? && !%w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
   gem 'structuredmerge_host_prototype', path: File.join(structuredmerge_rust_dev, 'packages/ruby')
-end
-
-# CI current and coverage jobs require the published Rust host gem; this fails until it is released.
-if ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero? &&
-   instance_variable_get(:@dependencies).none? { |dependency| dependency.name == 'structuredmerge_host_prototype' }
+elsif ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero?
+  # CI current and coverage jobs require the published Rust host gem; this fails until it is released.
   gem 'structuredmerge_host_prototype', '~> 0.2'
 end
 

gems/json-merge/Gemfile

@@ -19,13 +19,10 @@ git_source(:gitlab) { |repo_name| "https://gitlab.com/#{repo_name}" }
 gemspec
 
 structuredmerge_rust_dev = ENV.fetch('STRUCTUREDMERGE_RUST_DEV', '').strip
-unless structuredmerge_rust_dev.empty? || %w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
+if !structuredmerge_rust_dev.empty? && !%w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
   gem 'structuredmerge_host_prototype', path: File.join(structuredmerge_rust_dev, 'packages/ruby')
-end
-
-# CI current and coverage jobs require the published Rust host gem; this fails until it is released.
-if ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero? &&
-   instance_variable_get(:@dependencies).none? { |dependency| dependency.name == 'structuredmerge_host_prototype' }
+elsif ENV.fetch('STRUCTUREDMERGE_RUST_HOST_PUBLISHED', 'false').casecmp('true').zero?
+  # CI current and coverage jobs require the published Rust host gem; this fails until it is released.
   gem 'structuredmerge_host_prototype', '~> 0.2'
 end
 

gems/kettle-jem/CHANGELOG.md

@@ -31,9 +31,21 @@ Please file a bug if you notice a violation of semantic versioning.
   the existing template-managed (case 1) conflicts, and the same
   auto-resolution path for any future entry in this category with
   `force_review: false`.
+- `workflows.framework_matrix` gemfiles for gems tracked by kettle-rb's
+  `Kettle::Rb::GemFloors` (activemodel, activerecord, activesupport, sqlite3)
+  require the minor series' security floor when the version's requirement
+  still admits the series' first release (e.g.
+  `gem "activerecord", "~> 7.1.0", ">= 7.1.6"`), and carry a `# kettle-rb:`
+  warning comment when no release in the series fixes an advisory.
 
 ### Changed
 
+- Require kettle-rb `>= 0.1.14` (security floor data).
+- The `sqlite3` `KNOWN_GEM_CONFLICT_RESOLUTIONS` reason now points at a
+  `platforms: [:ruby]` modular gemfile (kettle-jem-appraisals generates
+  `gemfiles/modular/activerecord_support/*.gemfile`) instead of saying sqlite3
+  has no modular home.
+
 - [kc] kettle-jem-deps-floor: Update kettle-jem template dependency floors:
   - appraisal2 (>= 3.2.3 -> >= 3.2.4)
   - appraisal2-rubocop (>= 1.0.2 -> >= 1.0.3)

gems/kettle-jem/Gemfile

@@ -19,13 +19,10 @@ git_source(:gitlab) { |repo_name| "https://gitlab.com/#{repo_name}" }
 gemspec
 
 structuredmerge_rust_dev = ENV.fetch("STRUCTUREDMERGE_RUST_DEV", "").strip
-unless structuredmerge_rust_dev.empty? || %w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
+if !structuredmerge_rust_dev.empty? && !%w[false 0 no off].include?(structuredmerge_rust_dev.downcase)
   gem "structuredmerge_host_prototype", path: File.join(structuredmerge_rust_dev, "packages/ruby")
-end
-
-# CI current and coverage jobs require the published Rust host gem; this fails until it is released.
-if ENV.fetch("STRUCTUREDMERGE_RUST_HOST_PUBLISHED", "false").casecmp("true").zero? &&
-    instance_variable_get(:@dependencies).none? { |dependency| dependency.name == "structuredmerge_host_prototype" }
+elsif ENV.fetch("STRUCTUREDMERGE_RUST_HOST_PUBLISHED", "false").casecmp("true").zero?
+  # CI current and coverage jobs require the published Rust host gem; this fails until it is released.
   gem "structuredmerge_host_prototype", "~> 0.2"
 end
 

gems/kettle-jem/Gemfile.lock

@@ -24,7 +24,7 @@ PATH
       kettle-dev (~> 3.0, >= 3.0.34)
       kettle-gha-pins (~> 0.3, >= 0.3.14)
       kettle-ndjson (~> 0.1, >= 0.1.13)
-      kettle-rb (~> 0.1, >= 0.1.11)
+      kettle-rb (~> 0.1, >= 0.1.14)
       kramdown-merge (~> 7.1, >= 7.1.8)
       markdown-merge (~> 7.1, >= 7.1.8)
       markly-merge (~> 7.1, >= 7.1.8)
@@ -337,8 +337,6 @@ GEM
     command_kit-completion (0.3.0)
       command_kit (~> 0.1)
       completely (~> 0.6)
-    commonmarker (2.10.0)
-      rb_sys (~> 0.9)
     commonmarker (2.10.0-aarch64-linux)
     commonmarker (2.10.0-aarch64-linux-musl)
     commonmarker (2.10.0-arm64-darwin)
@@ -439,7 +437,7 @@ GEM
       version_gem (~> 1.1, >= 1.1.15)
     kettle-ndjson (0.1.15)
       version_gem (~> 1.1, >= 1.1.15)
-    kettle-rb (0.1.12)
+    kettle-rb (0.1.14)
     kettle-soup-cover (3.0.10)
       kettle-wash (~> 0.1, >= 0.1.6)
       simplecov (>= 1.0)
@@ -510,9 +508,6 @@ GEM
     racc (1.8.1)
     rainbow (3.1.1)
     rake (13.4.2)
-    rake-compiler-dock (1.12.0)
-    rb_sys (0.9.130)
-      rake-compiler-dock (= 1.12.0)
     rbs (4.2.0)
       logger
       prism (>= 1.6.0)
@@ -707,9 +702,6 @@ GEM
     toml-rb (4.2.1)
       citrus (~> 3.0, > 3.0)
       racc (~> 1.7)
-    tree_sitter_language_pack (1.19.1)
-      rb_sys (>= 0.9.130, < 0.10)
-      sorbet-runtime (~> 0.5)
     tree_sitter_language_pack (1.19.1-aarch64-linux)
       sorbet-runtime (~> 0.5)
     tree_sitter_language_pack (1.19.1-arm64-darwin)
@@ -875,7 +867,6 @@ CHECKSUMS
   colsole (1.0.1) sha256=7632a300ace2db877c024ffe413c684954cf37e41264b75ace9f456c9d657b02
   command_kit (0.6.0) sha256=e57f29cf5aee4f571c210041d910ff87f85749e42dfe75139c57cc93d84afa90
   command_kit-completion (0.3.0) sha256=d9c498555125bcdd0c9d869f2a64a25a2f0205102a7f28c81c7937ae633ea737
-  commonmarker (2.10.0) sha256=1884529957bf59bcd4f19fcc29e931f2042760ced273353e8010a20fe4ae68cb
   commonmarker (2.10.0-aarch64-linux) sha256=eeb167dea203dee066eb0dd99b3fd2deb526c8b5e7297ad385f7a5d60f869478
   commonmarker (2.10.0-aarch64-linux-musl) sha256=e95d9e87ea6306e21ffa11855a7bb55518538143b23a227fe3bb00b41873ce25
   commonmarker (2.10.0-arm64-darwin) sha256=39ecc891d1e4308b5233cc28b40383de854a2bfbefe17d68e49174347a8aa79e
@@ -913,12 +904,12 @@ CHECKSUMS
   json-merge (7.1.9)
   kettle-changelog (1.0.7) sha256=42b9307e46e1e551434e8054ca4f467e8b13b69bd65e5dea4544b279179a50ff
   kettle-dev (3.1.0) sha256=2780915bf964f2ef0afe8468aaf90991195545f46628f9ec65f999ac58f19957
-  kettle-drift (1.0.13) sha256=bb39982c637ecc6cdc56276cbd7679cb071317bb601dcd40c122997543643ed6
+  kettle-drift (1.0.13)
   kettle-family (1.3.1) sha256=0e77fb67d8e989a806ae453fdcac43a44e3dd43e1d2dae7a51418504309e27d6
   kettle-gha-pins (0.3.14) sha256=443a218149d3a2ab300875eb10ef55d5c4bc340bce7ba7caba026e1680dd8c21
   kettle-jem (7.1.28)
   kettle-ndjson (0.1.15) sha256=8606ab5b59092d46ba50394b2ad65738f6a5cc11258c6cc943f8e451da864a1f
-  kettle-rb (0.1.12) sha256=918ea072d3069f998e7dbd76836a14378cc9a16e317e2bf79da714f5ec0be5a4
+  kettle-rb (0.1.14) sha256=22b124f56d4c45a6ccebb686e9c7a802bc23a6636f572b2f07d5b9365bcc03d1
   kettle-soup-cover (3.0.10) sha256=579e09d382d5c46b2a4787df492fdf598c774545d4ab1b7bd8cfaf6104424edd
   kettle-test (2.0.21) sha256=2ab0dd1a1d11568f8fba61084ebef84717cd4dff028a527777c92d4e77f0e9c5
   kettle-wash (0.1.6) sha256=934dfb955f41b89540fe5df87614cf718a73ebc1696de7c50e7940a4695753ed
@@ -960,8 +951,6 @@ CHECKSUMS
   racc (1.8.1) sha256=4a7f6929691dbec8b5209a0b373bc2614882b55fc5d2e447a21aaa691303d62f
   rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
   rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
-  rake-compiler-dock (1.12.0) sha256=f13205c2738f3d2053afcd03491a9e4541b22a59a0bfc53fc8bc883bd8188023
-  rb_sys (0.9.130) sha256=7d486d99c1da02635515deaf9860fc5aea90bb4ab2589b2deec7fdc7d3548615
   rbs (4.2.0) sha256=51f7b886dcc05bc09e10b901daa6a81829f6adc03101d6ca9ea4aac6103e0674
   rbs-merge (7.1.9)
   rdoc (7.2.0) sha256=8650f76cd4009c3b54955eb5d7e3a075c60a57276766ebf36f9085e8c9f23192
@@ -1027,11 +1016,10 @@ CHECKSUMS
   timecop (0.9.11) sha256=41284dc6e5041f2184f781ace766f942108c842f8d8c1386a26e6343decc7542
   timecop-rspec (1.0.3) sha256=005f14841bb606dcaefb060e321b5388e2e59537742bee8b3a9a9a40e598fab9
   token-resolver (2.0.10) sha256=188df2d18d90816c690ba9a66d7299ba9de9a73779d816170ea70da624aa3d87
-  toml (0.3.0) sha256=0a91d0f76a9036e84e44f95693b12f58d358c1df3ac8e3b5271f2056ecc6e4b9
+  toml (0.3.0)
   toml-merge (7.1.9)
   toml-rb (4.2.1) sha256=e6c40e27905e86a7d38cc252eb4bc12d72c61576c826a358390c30f5de0b9dbb
   tree_haver (7.1.9)
-  tree_sitter_language_pack (1.19.1) sha256=12623c568e593e490f5bd027a4a9ab1d10aa49f283ff6d9e361cafbde8977e43
   tree_sitter_language_pack (1.19.1-aarch64-linux) sha256=83cf05faaf78d4df8817217afb6b7eda479c1643f20bb2346e948101b7f632ec
   tree_sitter_language_pack (1.19.1-arm64-darwin) sha256=b3f42f5ae54b37893eb52ca8e1afa3bf7027d0a50af36c5b2a842466a372b6f4
   tree_sitter_language_pack (1.19.1-x86_64-darwin) sha256=a84070e2b71f9edf8c3b07db48b5fedf96b6556abf133f412d1b7f0ef763d75f

gems/kettle-jem/kettle-jem.gemspec

@@ -108,7 +108,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency("kettle-dev", "~> 3.0", ">= 3.0.34")               # ruby >= 2.3.0
   spec.add_dependency("kettle-gha-pins", "~> 0.3", ">= 0.3.14")          # ruby >= 2.4.0
   spec.add_dependency("kettle-ndjson", "~> 0.1", ">= 0.1.13")            # ruby >= 2.4.0
-  spec.add_dependency("kettle-rb", "~> 0.1", ">= 0.1.11")                 # ruby >= 1.8.7
+  spec.add_dependency("kettle-rb", "~> 0.1", ">= 0.1.14")                 # ruby >= 1.8.7
   spec.add_dependency("kramdown-merge", "~> 7.1", ">= 7.1.8")             # ruby >= 4.0.0
   spec.add_dependency("markdown-merge", "~> 7.1", ">= 7.1.8")             # ruby >= 4.0.0
   spec.add_dependency("markly-merge", "~> 7.1", ">= 7.1.8")               # ruby >= 4.0.0