[xiangfu0]

Summary

The auto-release workflow bumps lib/pinot/version.rb on every push to main but never updated Gemfile.lock's PATH gem pin. Because pinot.gemspec reads Pinot::VERSION, each bump changed the path gem's version while the lockfile's pinot-client pin stayed stale (1.29.0 vs. gemspec 1.44.0).

This is the durable fix for the recurring drift that #67 patched one line at a time — it repairs the owning bump step so the mismatch cannot reappear, validates against a frozen install, and covers both release paths.

Why it matters

Plain bundle install (what CI uses) silently rewrites the lockfile to match, masking the drift. A frozen/deployment install surfaces it:

$ BUNDLE_FROZEN=true bundle install
The gemspecs for path gems changed, but the lockfile can't be updated
because frozen mode is set

Since bin/bump-version only touched version.rb, the drift reappeared on every release. PR #67's one-line edit fixed the symptom once; the next release recreated it.

Change

1. bin/bump-version — after writing version.rb, sync the Gemfile.lock PATH pin. Prefers bundle lock --local (canonical lockfile); falls back to a targeted, anchored in-place edit when Bundler is unavailable.
   • Preserves the committed BUNDLED WITH Bundler pin after bundle lock, so the release commit carries no unrelated Bundler-version churn.
   • Normalizes the version through RubyGems and loosens the fallback regex so prerelease versions (1.5.0-rc1 → 1.5.0.pre.rc1) produce a valid, matching lockfile pin.
2. .github/workflows/auto-release-minor.yml — the release commit now stages Gemfile.lock alongside version.rb.
3. .github/workflows/release.yml — the manual-release commit step likewise stages Gemfile.lock, so manual releases don't recreate the drift.
4. Gemfile.lock — fixes the current drift (1.29.0 → 1.44.0); the only line that changes.

No runtime/API behavior changes. The lockfile edit is pure metadata; the rest is release-tooling.

Validation (local, source @ this branch, Ruby 3.4.11)

• BUNDLE_FROZEN=true bundle install → success (was failing on committed source)
• E2E auto-release simulation (bin/bump-version 1.45.0): version.rb + lockfile pin move together; BUNDLED WITH preserved (4.0.8, not rewritten to local 4.0.21); lockfile diff is exactly one line; idempotent; frozen install succeeds
• Fallback path (Bundler absent): plain and prerelease versions both produce a correct normalized pin; idempotent
• Unit tests (COVERAGE_MIN=95 bundle exec rspec spec/pinot/) → 524 examples, 0 failures, 1 pending; coverage 99.72% (≥95%)
• RuboCop (bundle exec rubocop lib/ spec/) → clean
• bundle exec bundle-audit check → no vulnerabilities
• bash -n bin/bump-version → OK

Ruby 3.2/3.3 lanes covered by CI. Integration tests unaffected (no runtime change).

Review findings addressed

• Medium — release.yml committed only version.rb: fixed (now stages Gemfile.lock).
• Low — bundle lock rewriting BUNDLED WITH: fixed (pin preserved).
• Low — sed fallback breaking on prerelease: fixed (RubyGems normalization + loosened match).

Supersedes

Closes out the drift that #67 addressed; #67 can be closed in favor of this once reviewed/merged.

Note: merging a Gemfile.lock change triggers the auto-release/publication path and remains subject to explicit release authorization plus eligible independent approval.

[intentlab-ai]

Code Health Review

✅ Passed

Existing debt (10)

• Inherited · Cognitive Complexity — lib/pinot/transport.rb::execute
  cognitive complexity is 37; limit is 20.
  Reduce this metric below the limit.
• Inherited · Cognitive Complexity — lib/pinot/transport.rb::configure_ssl
  cognitive complexity is 29; limit is 20.
  Reduce this metric below the limit.
• Inherited · Cognitive Complexity — lib/pinot/connection.rb::format_arg
  cognitive complexity is 26; limit is 20.
  Reduce this metric below the limit.
• Inherited · Cognitive Complexity — lib/pinot/response.rb::get_int
  cognitive complexity is 23; limit is 20.
  Reduce this metric below the limit.
• Inherited · Nesting Max — lib/pinot/transport.rb::checkout
  nesting max is 5; limit is 4.
  Reduce this metric below the limit.
• Inherited · Nesting Max — lib/pinot/transport.rb::configure_ssl
  nesting max is 5; limit is 4.
  Reduce this metric below the limit.
• Inherited · Parameter Count — lib/pinot/connection.rb::initialize
  parameter count is 6; limit is 5.
  Reduce this metric below the limit.
• Inherited · Parameter Count — lib/pinot/connection.rb::paginate
  parameter count is 6; limit is 5.
  Reduce this metric below the limit.
• Inherited · Parameter Count — lib/pinot/transport.rb::initialize
  parameter count is 6; limit is 5.
  Reduce this metric below the limit.
• Inherited · Clone family — lib/pinot/transport.rb:43-50
  Near-duplicate functions (100% normalized-structure similarity). Members: lib/pinot/transport.rb:43-50 (delete); lib/pinot/transport.rb:34-41 (get).
  To resolve: extract the duplicated logic into a single function and call it from every member, or fold near-duplicates into a parameterised helper. Re-run the analyzer to confirm the family is gone.

_{Reviewed c9c197e}

[intentlab-ai]

PR Readiness Review

✅ Passed

_{Reviewed c9c197e}

[intentlab-ai]

Code Review

✅ Passed

_{Reviewed c9c197e}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.72%. Comparing base (dd6a412) to head (c9c197e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #68   +/-   ##
=======================================
  Coverage   99.72%   99.72%           
=======================================
  Files          27       27           
  Lines        1103     1103           
=======================================
  Hits         1100     1100           
  Misses          3        3           

Flag	Coverage Δ
unit	99.72% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[xiangfu0]

Addressed the three automated code-review findings and a follow-up found in independent review. Current head: c9c197e.

Code-review findings (on 3386bd6):

• Medium — release.yml committed only version.rb: fixed. The manual-release commit step now stages Gemfile.lock too, matching auto-release-minor.yml, so manual releases no longer recreate the drift.
• Low — bundle lock rewriting BUNDLED WITH: fixed. bin/bump-version now captures and restores the committed Bundler pin after bundle lock --local, so the release commit carries no unrelated Bundler-version churn.
• Low — sed fallback breaking on prerelease: fixed. The version is normalized via Gem::Version and the fallback regex matches any version inside the pin, so 1.5.0-rc1 yields a valid 1.5.0.pre.rc1 pin.

Independent review follow-up: the first restore attempt used a 3-space sed pattern while Bundler indents the value with 2 spaces, making the restore a silent no-op whenever CI's Bundler differed from the committed pin. Replaced with an awk pass that captures the full original value line and restores it verbatim regardless of indentation. Verified end-to-end: forcing a differing committed BUNDLED WITH (e.g. 9.9.9) and running bin/bump-version restores it exactly while the pin moves.

Validation on c9c197e:

• CI green on all lanes: Unit Tests 3.2/3.3/3.4, RuboCop Lint, Security Audit, Integration Tests.
• Local: unit 524 examples, 0 failures, 1 pending, coverage 99.72% (≥95%); RuboCop clean; bundle-audit no vulnerabilities.
• E2E auto-release simulation: version.rb + lockfile pin move together, BUNDLED WITH preserved, lockfile diff is exactly one line, idempotent, BUNDLE_FROZEN=true bundle install succeeds; fallback path verified for plain and prerelease versions.

Note: because this changes Gemfile.lock, merging to main triggers the auto-release/publication path and remains gated on explicit release authorization plus eligible independent (non-author) approval.