cookstyle 8.6.10 → 9.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c9e00c677da7b0f5e5e7792aa8772ae2ce0f6b84742cd236e62f84abac2cf6fc
-  data.tar.gz: c2b5e2c2170adafeccc37c37d706eb0b05d9bbfa6a4dd04ee07a48d2cf7d51f8
+  metadata.gz: b6cd3dcea2607da8e1f1393a8af2331944ea9e30b502447ed862fdf6d79e703a
+  data.tar.gz: bd596e0a8956d56b9e44c1dfd287263e1e04bac60d4767ab690deb14e093d9ea
 SHA512:
-  metadata.gz: 5b3f06243138e6a47cb55b88b7148cb3e4a5ea915d7c732e275e66a3632b72da0e65546a63d65beae7e5bf53516face8ffd3e80ef1762a765820c651f6409672
-  data.tar.gz: 846ffa7fe8a41c8b5948aab7289875798bda891260b8d9a1a9f828da5b4c0bcce70f116ba1283afb9eb958b1e91c53caa3460f196d13909a711c1cc4130de432
+  metadata.gz: 1432d8dadec991fdc89d85ef38379bfa938f74cc26153a71e9e0a3c51de9f1ffa1e070e7a3eaf459491880a0922fad113517c0f8f8cea58c5b3f69a0cb6f48f3
+  data.tar.gz: 718d4c62405c34b6e392eb00f8e8a11e797086439f1c47e514ac3a49885704a46553d4217025951b9c882fae0fbe65d73acba300d46e41c923bc2dd49e502954

data/config/chefstyle.yml

@@ -164,6 +164,8 @@ Lint/RedundantCopDisableDirective:
 
 Security/Eval:
   Enabled: true
+Security/YAMLLoad:
+  Enabled: true
 
 #
 # Metrics
@@ -880,6 +882,42 @@ Style/ModuleMemberExistenceCheck:
 Style/NegativeArrayIndex:
   Enabled: true
 
+# avoid a map to single and then a join when just a join would do
+Style/MapJoin:
+   Enabled: true
+
+# Use .partition instead of calls to both .select and .reject
+Style/PartitionInsteadOfDoubleSelect:
+  Enabled: true
+
+# avoid unecessary blocks
+Style/PredicateWithKind:
+  Enabled: true
+
+# Use .to_h instead of rolling your own hash construction
+Style/ReduceToHash:
+  Enabled: true
+
+# Use .max and .min instead of max_by and min_by with a block
+Style/RedundantMinMaxBy:
+  Enabled: true
+
+# avoid keyword_init when it's not necessary
+Style/RedundantStructKeywordInit:
+  Enabled: true
+
+# avoid select and reject with an uncessary block to select on class
+Style/SelectByKind:
+  Enabled: true
+
+# use .grep and .grep_v for simple ranges
+Style/SelectByRange:
+  Enabled: true
+
+# Use new .tally method that is much simpler that group_by with a block
+Style/TallyMethod:
+  Enabled: true
+
 Chef/Deprecations/Ruby27KeywordArgumentWarnings:
   Description: Pass options to shell_out helpers without the brackets to avoid Ruby 2.7 deprecation warnings.
   Enabled: true

data/config/cookstyle.yml

@@ -133,6 +133,7 @@ Chef/Style/TrueClassFalseClassResourceProperties:
   StyleGuide: 'chef_style_trueclassfalseclassresourceproperties'
   Enabled: true
   VersionAdded: '5.16.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
     - '**/resources/*.rb'
@@ -173,6 +174,7 @@ Chef/Style/IncludeRecipeWithParentheses:
   Description: "There is no need to wrap the recipe name in parentheses when using `include_recipe`. Write `include_recipe 'foo'` instead of `include_recipe('foo')`."
   StyleGuide: 'chef_style_includerecipewithparentheses'
   VersionAdded: '6.11.0'
+  VersionChanged: '9.0.0'
   Enabled: true
   Exclude:
     - '**/attributes/*.rb'
@@ -187,11 +189,21 @@ Chef/Correctness:
   Enabled: true
   StyleGuideBaseURL: https://docs.chef.io/workstation/cookstyle/
 
+Chef/Correctness/ConditionalUnifiedModeTrue:
+  Description: "Set `unified_mode true` unconditionally. Setting it conditionally leaves a resource running in unified mode on newer Chef Infra Client releases and in legacy mode on older ones, so it has to be written and tested against both execution models."
+  StyleGuide: 'chef_correctness_conditionalunifiedmodetrue'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Include:
+    - '**/libraries/*.rb'
+    - '**/resources/*.rb'
+
 Chef/Correctness/ServiceResource:
-  Description: Use the `service` resource to start and stop services instead of shelling out with `execute` or `bash` resources. The `service` resource is idempotent and handles platform differences automatically.
+  Description: Use the `service` resource to manage services instead of shelling out to an init script, `service`, `systemctl`, or a similar tool. The `service` resource is idempotent and handles platform differences automatically.
   StyleGuide: 'chef_correctness_serviceresource'
   Enabled: true
   VersionAdded: '5.0.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/attributes/*.rb'
     - '**/metadata.rb'
@@ -284,6 +296,7 @@ Chef/Correctness/ResourceWithNoneAction:
   StyleGuide: 'chef_correctness_resourcewithnoneaction'
   Enabled: true
   VersionAdded: '5.5.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/attributes/*.rb'
     - '**/metadata.rb'
@@ -391,11 +404,51 @@ Chef/Correctness/DnfPackageAllowDowngrades:
     - '**/metadata.rb'
     - '**/Berksfile'
 
+Chef/Correctness/ExecuteDeleteFile:
+  Description: "Use the `file` or `directory` resources built into Chef Infra Client with the `:delete` action to remove files and directories instead of shelling out to `rm`. The resource has to match what is on disk: `file` for a file, `directory` with `recursive true` for a directory."
+  StyleGuide: 'chef_correctness_executedeletefile'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/attributes/*.rb'
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
+Chef/Correctness/RubyGuardWithoutBlock:
+  Description: "A Ruby expression used as a resource guard (`not_if`/`only_if`) has to be wrapped in a block. String guards are run as shell commands and are fine as they are; it is only a bare Ruby expression that is a problem, since the guard receives the expression result rather than the expression."
+  StyleGuide: 'chef_correctness_rubyguardwithoutblock'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/attributes/*.rb'
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
+Chef/Correctness/InvalidChecksum:
+  Description: "The `checksum` property of the file downloading resources takes a SHA-256 digest. An MD5 or SHA-1 digest can never match, so the run fails with a checksum mismatch rather than installing anything."
+  StyleGuide: 'chef_correctness_invalidchecksum'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/attributes/*.rb'
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
+Chef/Correctness/PlatformVersionStringComparison:
+  Description: "Ohai version attributes are strings, so comparing one with an ordering operator compares them character by character rather than as versions. `'7.9' >= '10'` is true. Use `.to_i` for a major version comparison, or `Gem::Version` to compare full versions."
+  StyleGuide: 'chef_correctness_platformversionstringcomparison'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
 Chef/Correctness/EmptyResourceGuard:
-  Description: "Resource guards (`not_if`/`only_if`) should not be empty strings. In Ruby, empty strings are 'truthy', so an empty guard string will always pass, which is almost certainly not what you intended."
+  Description: "Resource guards (`not_if`/`only_if`) should not be empty. In Ruby, an empty string is 'truthy', so an empty guard string always passes. An empty block returns `nil`, so it always fails. Neither is likely to be what you intended."
   StyleGuide: 'chef_correctness_emptyresourceguard'
   Enabled: true
   VersionAdded: '8.4.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/attributes/*.rb'
     - '**/metadata.rb'
@@ -406,6 +459,7 @@ Chef/Correctness/ChefApplicationFatal:
   StyleGuide: 'chef_correctness_chefapplicationfatal'
   Enabled: true
   VersionAdded: '6.0.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -444,6 +498,7 @@ Chef/Correctness/OpenSSLPasswordHelpers:
   StyleGuide: 'chef_correctness_opensslpasswordhelpers'
   Enabled: true
   VersionAdded: '6.6.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -607,6 +662,15 @@ Chef/Sharing/EmptyMetadataField:
   Include:
     - '**/metadata.rb'
 
+Chef/Sharing/EmptyPropertyDescription:
+  Description: Resource properties should not set an empty `description`. Automated documentation tools have nothing to render from it, so it does no more than a missing field would while looking like the property has been documented.
+  StyleGuide: 'chef_sharing_emptypropertydescription'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Include:
+    - '**/libraries/*.rb'
+    - '**/resources/*.rb'
+
 Chef/Sharing/IncludePropertyDescriptions:
   Description: Resource properties should include a `description` field so that automated documentation tools can generate helpful documentation for your custom resources. Requires Chef Infra Client 13.9 or later.
   StyleGuide: 'chef_sharing_includepropertydescriptions'
@@ -745,6 +809,7 @@ Chef/Deprecations/UsesDeprecatedMixins:
   StyleGuide: 'chef_deprecations_usesdeprecatedmixins'
   Enabled: true
   VersionAdded: '5.4.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
     - '**/providers/*.rb'
@@ -755,6 +820,7 @@ Chef/Deprecations/IncludingXMLRubyRecipe:
   StyleGuide: 'chef_deprecations_includingxmlrubyrecipe'
   Enabled: true
   VersionAdded: '5.4.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/attributes/*.rb'
     - '**/metadata.rb'
@@ -765,6 +831,7 @@ Chef/Deprecations/LegacyYumCookbookRecipes:
   StyleGuide: 'chef_deprecations_legacyyumcookbookrecipes'
   Enabled: true
   VersionAdded: '5.4.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -773,6 +840,7 @@ Chef/Deprecations/UsesChefRESTHelpers:
   StyleGuide: 'chef_deprecations_useschefresthelpers'
   Enabled: true
   VersionAdded: '5.5.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -781,6 +849,7 @@ Chef/Deprecations/ChocolateyPackageUninstallAction:
   StyleGuide: 'chef_deprecations_chocolateypackageuninstallaction'
   Enabled: true
   VersionAdded: '5.5.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -941,6 +1010,7 @@ Chef/Deprecations/ResourceInheritsFromCompatResource:
   StyleGuide: 'chef_deprecations_resourceinheritsfromcompatresource'
   Enabled: true
   VersionAdded: '5.10.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
 
@@ -1029,6 +1099,7 @@ Chef/Deprecations/RubyBlockCreateAction:
   StyleGuide: 'chef_deprecations_rubyblockcreateaction'
   Enabled: true
   VersionAdded: '5.16.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/attributes/*.rb'
@@ -1077,6 +1148,7 @@ Chef/Deprecations/ChefWindowsPlatformHelper:
   StyleGuide: 'chef_deprecations_chefwindowsplatformhelper'
   Enabled: true
   VersionAdded: '6.0.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -1095,7 +1167,7 @@ Chef/Deprecations/HWRPWithoutProvides:
   StyleGuide: 'chef_deprecations_hwrpwithoutprovides'
   Enabled: true
   VersionAdded: '6.0.0'
-  VersionChanged: '6.8.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
 
@@ -1159,6 +1231,7 @@ Chef/Deprecations/ChefHandlerRecipe:
   StyleGuide: 'chef_deprecations_chefhandlerrecipe'
   Enabled: true
   VersionAdded: '6.12.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -1195,6 +1268,7 @@ Chef/Deprecations/ChefShellout:
   StyleGuide: 'chef_deprecations_chefshellout'
   Enabled: true
   VersionAdded: '6.17.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/attributes/*.rb'
@@ -1287,6 +1361,7 @@ Chef/Deprecations/HWRPWithoutUnifiedTrue:
   StyleGuide: 'chef_deprecations_hwrpwithoutunifiedtrue'
   Enabled: true
   VersionAdded: '7.12.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/libraries/*.rb'
 
@@ -1437,6 +1512,7 @@ Chef/Modernize/IncludingAptDefaultRecipe:
   StyleGuide: 'chef_modernize_includingaptdefaultrecipe'
   Enabled: true
   VersionAdded: '5.3.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1445,6 +1521,7 @@ Chef/Modernize/IncludingWindowsDefaultRecipe:
   StyleGuide: 'chef_modernize_includingwindowsdefaultrecipe'
   Enabled: true
   VersionAdded: '5.3.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1461,6 +1538,7 @@ Chef/Modernize/ExecuteAptUpdate:
   StyleGuide: 'chef_modernize_executeaptupdate'
   Enabled: true
   VersionAdded: '5.3.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1487,6 +1565,7 @@ Chef/Modernize/UseBuildEssentialResource:
   StyleGuide: 'chef_modernize_usebuildessentialresource'
   Enabled: true
   VersionAdded: '5.1.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1511,6 +1590,7 @@ Chef/Modernize/LibarchiveFileResource:
   StyleGuide: 'chef_modernize_libarchivefileresource'
   Enabled: true
   VersionAdded: '5.5.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
 
@@ -1522,6 +1602,16 @@ Chef/Modernize/PowershellScriptExpandArchive:
   Exclude:
     - '**/metadata.rb'
 
+Chef/Modernize/PowershellDownloadFile:
+  Description: "Use the `remote_file` resource to download files instead of shelling out to PowerShell. `remote_file` is idempotent and supports checksum verification, proxies, and conditional downloads."
+  StyleGuide: 'chef_modernize_powershelldownloadfile'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/attributes/*.rb'
+    - '**/Berksfile'
+
 Chef/Modernize/PowershellInstallPackage:
   Description: Use the package resource built into Chef Infra Client instead of using Install-Package in a powershell_script resource
   StyleGuide: 'chef_modernize_powershellinstallpackage'
@@ -1711,7 +1801,7 @@ Chef/Modernize/IncludingOhaiDefaultRecipe:
   StyleGuide: 'chef_modernize_includingohaidefaultrecipe'
   Enabled: true
   VersionAdded: '5.4.0'
-  VersionChanged: '5.15.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -1768,6 +1858,7 @@ Chef/Modernize/DslIncludeInResource:
   StyleGuide: 'chef_modernize_dslincludeinresource'
   Enabled: true
   VersionAdded: '5.17.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/resources/*.rb'
     - '**/providers/*.rb'
@@ -1782,6 +1873,26 @@ Chef/Modernize/ResourceForcingCompileTime:
     - '**/attributes/*.rb'
     - '**/Berksfile'
 
+Chef/Modernize/ExecuteUpdateAlternatives:
+  Description: "Chef Infra Client 16.0 and later includes an `alternatives` resource that should be used to manage alternatives links instead of shelling out to `update-alternatives` or `alternatives`."
+  StyleGuide: 'chef_modernize_executeupdatealternatives'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/attributes/*.rb'
+    - '**/Berksfile'
+
+Chef/Modernize/ExecuteArchiveExtract:
+  Description: "Use the `archive_file` resource built into Chef Infra Client 15+ instead of shelling out to `tar` or `unzip` to extract an archive."
+  StyleGuide: 'chef_modernize_executearchiveextract'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/attributes/*.rb'
+    - '**/Berksfile'
+
 Chef/Modernize/ExecuteSysctl:
   Description: Chef Infra Client 14.0 and later includes a sysctl resource that should be used to idempotently load sysctl values instead of templating files and using execute to load them.
   StyleGuide: 'chef_modernize_executesysctl'
@@ -1807,6 +1918,7 @@ Chef/Modernize/UseRequireRelative:
   StyleGuide: 'chef_modernize_userequirerelative'
   Enabled: true
   VersionAdded: '5.22.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/attributes/*.rb'
@@ -1856,6 +1968,7 @@ Chef/Modernize/DatabagHelpers:
   StyleGuide: 'chef_modernize_databaghelpers'
   Enabled: true
   VersionAdded: '6.0.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -1889,10 +2002,11 @@ Chef/Modernize/ShellOutHelper:
     - '**/libraries/*.rb'
 
 Chef/Modernize/ConditionalUsingTest:
-  Description: Use ::File.exist?('/foo/bar') instead of the slower 'test -f /foo/bar' which requires shelling out.
+  Description: "Use `::File.exist?('/foo/bar')` in an `only_if` or `not_if` guard instead of the slower `'test -f /foo/bar'`, which requires shelling out. The Ruby check has to be passed as a block."
   StyleGuide: 'chef_modernize_conditionalusingtest'
   Enabled: true
   VersionAdded: '6.11.0'
+  VersionChanged: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/Berksfile'
@@ -2114,7 +2228,7 @@ Chef/RedundantCode/UnnecessaryNameProperty:
   StyleGuide: 'chef_redundantcode_unnecessarynameproperty'
   Enabled: true
   VersionAdded: '5.8.0'
-  VersionChanged: '5.15.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/resources/*.rb'
     - '**/libraries/*.rb'
@@ -2199,6 +2313,7 @@ Chef/RedundantCode/StringPropertyWithNilDefault:
   StyleGuide: 'chef_redundantcode_stringpropertywithnildefault'
   Enabled: true
   VersionAdded: '5.21.0'
+  VersionChanged: '9.0.0'
   Include:
     - '**/resources/*.rb'
     - '**/libraries/*.rb'
@@ -2245,6 +2360,17 @@ Chef/RedundantCode/DoubleCompileTime:
   StyleGuide: 'chef_redundantcode_doublecompiletime'
   Enabled: true
   VersionAdded: '6.13.0'
+  VersionChanged: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/attributes/*.rb'
+    - '**/Berksfile'
+
+Chef/RedundantCode/ServiceGuardOnStopDisable:
+  Description: "The `:stop` and `:disable` actions of the `service` resource are already no-ops when the service isn't installed, so guarding them with a check for the init script or unit file is redundant. It's also fragile, since the guard hardcodes a single path while the provider searches several."
+  StyleGuide: 'chef_redundantcode_serviceguardonstopdisable'
+  Enabled: true
+  VersionAdded: '9.0.0'
   Exclude:
     - '**/metadata.rb'
     - '**/attributes/*.rb'
@@ -2366,6 +2492,15 @@ Chef/Security:
   Enabled: true
   StyleGuideBaseURL: https://docs.chef.io/workstation/cookstyle/
 
+Chef/Security/InsecureRemoteFileSource:
+  Description: "Fetch remote files over HTTPS. A file downloaded over plain HTTP or FTP can be modified in transit and the resource will use whatever it receives."
+  StyleGuide: 'chef_security_insecureremotefilesource'
+  Enabled: true
+  VersionAdded: '9.0.0'
+  Exclude:
+    - '**/metadata.rb'
+    - '**/Berksfile'
+
 Chef/Security/SshPrivateKey:
   Description: Do not include plain text SSH private keys in your cookbook code. This sensitive data should be fetched from secrets management systems so that secrets are not uploaded in plain text to the Chef Infra Server or committed to source control systems.
   StyleGuide: 'chef_security_sshprivatekey'
@@ -2704,6 +2839,8 @@ Lint/EnsureReturn:
   Enabled: true
 Security/Eval:
   Enabled: true
+Security/YAMLLoad:
+  Enabled: true
 Lint/FloatOutOfRange:
   Enabled: true
 Lint/FormatParameterMismatch:
@@ -2750,6 +2887,8 @@ Lint/UnusedMethodArgument:
   Enabled: true
 Lint/UnreachableCode:
   Enabled: true
+Lint/UriEscapeUnescape:
+  Enabled: true
 Lint/UselessAccessModifier:
   Enabled: true
 Lint/UselessAssignment:
@@ -3309,3 +3448,39 @@ Style/ModuleMemberExistenceCheck:
 # simplify array access
 Style/NegativeArrayIndex:
   Enabled: true
+
+# avoid a map to single and then a join when just a join would do
+Style/MapJoin:
+   Enabled: true
+
+# Use .partition instead of calls to both .select and .reject
+Style/PartitionInsteadOfDoubleSelect:
+  Enabled: true
+
+# avoid unecessary blocks
+Style/PredicateWithKind:
+  Enabled: true
+
+# Use .to_h instead of rolling your own hash construction
+Style/ReduceToHash:
+  Enabled: true
+
+# Use .max and .min instead of max_by and min_by with a block
+Style/RedundantMinMaxBy:
+  Enabled: true
+
+# avoid keyword_init when it's not necessary
+Style/RedundantStructKeywordInit:
+  Enabled: true
+
+# avoid select and reject with an uncessary block to select on class
+Style/SelectByKind:
+  Enabled: true
+
+# use .grep and .grep_v for simple ranges
+Style/SelectByRange:
+  Enabled: true
+
+# Use new .tally method that is much simpler that group_by with a block
+Style/TallyMethod:
+  Enabled: true

data/lib/cookstyle/version.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 module Cookstyle
-  VERSION = "8.6.10" # rubocop: disable Style/StringLiterals
-  RUBOCOP_VERSION = '1.84.2'
+  # version of cookstyle
+  VERSION = "9.0.0" # rubocop: disable Style/StringLiterals
+
+  # version of rubocop we pin to
+  RUBOCOP_VERSION = '1.90.0'
 end

data/lib/cookstyle.rb

@@ -8,6 +8,7 @@ require 'yaml' unless defined?(YAML)
 gem 'rubocop', "= #{Cookstyle::RUBOCOP_VERSION}"
 require 'rubocop'
 require_relative 'rubocop/monkey_patches/directive_comment'
+require_relative 'rubocop/monkey_patches/comment_config'
 
 # monkey patches needed for the TargetChefVersion config option
 require_relative 'rubocop/monkey_patches/config'

data/lib/rubocop/chef/cookbook_helpers.rb

@@ -67,6 +67,29 @@ module RuboCop
         end
       end
 
+      # Yield each action symbol declared by an `action` property, however it's written:
+      # `action :foo`, `action :foo, :bar`, `action [:foo, :bar]`, or `action %i(foo bar)`.
+      #
+      # The yielded prefix is what a corrector must put in front of a replacement action name.
+      # Inside a %i() literal the elements carry no colon, so replacing `%i(create)` with `:run`
+      # would produce the invalid `%i(:run)`.
+      #
+      # @param [RuboCop::AST::SendNode] action_property the `action` property node
+      #
+      # @yield [RuboCop::AST::SymbolNode, String] the action symbol and the replacement prefix
+      #
+      def each_action_symbol(action_property)
+        action_property.arguments.each do |arg|
+          if arg.sym_type?
+            yield(arg, ':')
+          elsif arg.array_type?
+            prefix = arg.percent_literal? ? '' : ':'
+            symbols = arg.values.select(&:sym_type?)
+            symbols.each { |symbol| yield(symbol, prefix) }
+          end
+        end
+      end
+
       def method_arg_ast_to_string(ast)
         # a property without a value. This is totally bogus, but they exist
         return if ast.children[2].nil?

data/lib/rubocop/chef.rb

@@ -4,7 +4,7 @@ module RuboCop
   module Chef
     PROJECT_ROOT   = Pathname.new(__dir__).parent.parent.expand_path.freeze
     CONFIG_DEFAULT = PROJECT_ROOT.join('config', 'cookstyle.yml').freeze
-    CONFIG         = YAML.load(CONFIG_DEFAULT.read).freeze
+    CONFIG         = YAML.safe_load(CONFIG_DEFAULT.read).freeze
 
     private_constant(*constants(false))
   end

data/lib/rubocop/cop/chef/correctness/chef_application_fatal.rb

@@ -21,10 +21,15 @@ module RuboCop
       module Correctness
         # Use `raise` to force Chef Infra Client to fail instead of using `Chef::Application.fatal`, which masks the full stack trace of the failure and makes debugging difficult.
         #
+        # `Chef::Application.fatal!` optionally takes an exit code as a second argument. That form is
+        # reported but not autocorrected, since `raise` has no way to express a specific exit code and
+        # rewriting it would silently change how the run terminates.
+        #
         # @example
         #
         #   # bad
         #   Chef::Application.fatal!('Something horrible happened!')
+        #   Chef::Application.fatal!('Something horrible happened!', 1)
         #
         #   # good
         #   raise "Something horrible happened!"
@@ -38,14 +43,21 @@ module RuboCop
           def_node_matcher :application_fatal?, <<-PATTERN
             (send
               (const
-                (const nil? :Chef) :Application) :fatal!
-              $( ... ))
+                (const {nil? cbase} :Chef) :Application) :fatal!
+              $...)
           PATTERN
 
           def on_send(node)
-            application_fatal?(node) do |val|
+            application_fatal?(node) do |args|
+              # Only the single message argument form maps cleanly onto raise. With an exit code (or
+              # with no message at all) we still report, but leave the rewrite to a human.
+              unless args.one?
+                add_offense(node, severity: :refactor)
+                next
+              end
+
               add_offense(node, severity: :refactor) do |corrector|
-                corrector.replace(node, "raise(#{val.source})")
+                corrector.replace(node, "raise(#{args.first.source})")
               end
             end
           end