cookstyle 8.7.6 → 9.0.0

data/lib/rubocop/cop/chef/correctness/execute_delete_file.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Use the `file` or `directory` resources built into Chef Infra Client with the `:delete` action
+        # to remove files and directories instead of shelling out to `rm`. The resources are idempotent,
+        # report correctly on what they changed, and work without a shell.
+        #
+        # The two resources are not interchangeable and the one you pick has to match what is on disk.
+        # `directory` asserts the path really is a directory before deleting, so it raises
+        # `Cannot delete directory[...]` on a file even with `recursive true`, and `file` calls
+        # `File.delete`, so it raises `Errno::EISDIR` on a directory. A `directory` delete also needs
+        # `recursive true` for anything that isn't empty, or it raises `Errno::ENOTEMPTY`.
+        #
+        # Only a single `rm` of one path is flagged. A command containing a glob, a shell operator, or
+        # anything beyond the one deletion is left alone, since the `file` and `directory` resources
+        # can't express those.
+        #
+        # @example
+        #
+        #   # bad -- rm without -r, which the shell will not let you point at a directory
+        #   execute 'rm /etc/foo.conf'
+        #
+        #   # good
+        #   file '/etc/foo.conf' do
+        #     action :delete
+        #   end
+        #
+        #   # bad -- a recursive rm of a directory
+        #   execute 'delete the thing' do
+        #     command 'rm -rf /opt/thing'
+        #   end
+        #
+        #   # good
+        #   directory '/opt/thing' do
+        #     recursive true
+        #     action :delete
+        #   end
+        #
+        class ExecuteDeleteFile < Base
+          include RuboCop::Chef::CookbookHelpers
+
+          # The two resources are not interchangeable, so the message has to name the right one.
+          # `directory` asserts the path really is a directory before deleting, and `file` calls
+          # File.delete, so pointing at the wrong one fails the converge rather than doing nothing.
+          FILE_MSG = 'Use the `file` resource with the :delete action to remove a file instead of shelling out to rm'
+          DIRECTORY_MSG = 'Use the `directory` resource with `recursive true` and the :delete action to remove a directory instead of shelling out to rm. Use the `file` resource instead if the path is a file.'
+
+          RESTRICT_ON_SEND = [:execute].freeze
+
+          # a lone rm of a single path: optional flags, one target, nothing else on the line.
+          # the target excludes the shell metacharacters used for substitution and expansion, since
+          # a path the shell computes at runtime isn't something the file/directory resources can take
+          DELETE_COMMAND = %r{\A\s*(?:/bin/|/usr/bin/)?rm\s+(?<flags>(?:-[a-zA-Z]+\s+)*)(?<path>[^\s;&|<>$`(){}]+)\s*\z}.freeze
+
+          # the shell resources whose script lives in a code property
+          SCRIPT_RESOURCES = %i(bash sh csh ksh zsh).freeze
+
+          def_node_matcher :execute_with_command_name?, '(send nil? :execute (str $_))'
+
+          def on_send(node)
+            execute_with_command_name?(node) do |command|
+              message = message_for(command)
+              add_offense(node, message: message, severity: :refactor) if message
+            end
+          end
+
+          def on_block(node)
+            match_property_in_resource?(:execute, 'command', node) do |property|
+              report_property(node, property)
+            end
+
+            match_property_in_resource?(SCRIPT_RESOURCES, 'code', node) do |property|
+              report_property(node, property)
+            end
+          end
+
+          private
+
+          def report_property(node, property)
+            command = method_arg_ast_to_string(property)
+            return unless command
+
+            message = message_for(command)
+            add_offense(node, message: message, severity: :refactor) if message
+          end
+
+          # Does the command do nothing but delete one named path, and if so which resource replaces
+          # it? Globs are excluded because the file and directory resources take a single path rather
+          # than a pattern.
+          #
+          # Without -r the shell refuses to remove a directory, so a bare `rm` provably targets a
+          # file and `file` is the right answer. With -r the author is removing a tree, so
+          # `directory` is, though the path could still be a file that -rf was used on out of habit.
+          #
+          # @param [String] command
+          #
+          # @return [String, nil] the message to report, or nil when this isn't a simple delete
+          def message_for(command)
+            match = DELETE_COMMAND.match(command)
+            return if match.nil?
+            return if match[:path].match?(/[*?\[]/)
+
+            match[:flags].match?(/-[a-zA-Z]*r/i) ? DIRECTORY_MSG : FILE_MSG
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/invalid_checksum.rb

@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # The `checksum` property of the file downloading resources is a SHA-256 digest. An MD5 or
+        # SHA-1 digest can never match, so the resource fails the run with a checksum mismatch rather
+        # than installing anything.
+        #
+        # Only digests that are unambiguously the wrong algorithm are flagged: 32 character (MD5) and
+        # 40 character (SHA-1) hex strings. Anything else is left alone.
+        #
+        # @example
+        #
+        #   # bad
+        #   remote_file '/tmp/foo.tar.gz' do
+        #     source 'https://example.com/foo.tar.gz'
+        #     checksum 'd41d8cd98f00b204e9800998ecf8427e'
+        #   end
+        #
+        #   # good
+        #   remote_file '/tmp/foo.tar.gz' do
+        #     source 'https://example.com/foo.tar.gz'
+        #     checksum 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
+        #   end
+        #
+        class InvalidChecksum < Base
+          include RuboCop::Chef::CookbookHelpers
+
+          MSG = 'The checksum property takes a SHA-256 digest. An MD5 or SHA-1 digest can never match, so the run fails with a checksum mismatch.'
+
+          # the file downloading resources that validate a SHA-256 checksum
+          RESOURCES = %i(remote_file windows_package msu_package dmg_package).freeze
+
+          # hex digest lengths of the algorithms people reach for by mistake, with the article that
+          # reads correctly in front of each name
+          WRONG_ALGORITHM_LENGTHS = { 32 => 'an MD5', 40 => 'a SHA-1' }.freeze
+
+          def on_block(node)
+            match_property_in_resource?(RESOURCES, 'checksum', node) do |checksum|
+              value = checksum.arguments.first
+              next unless value&.str_type?
+
+              algorithm = WRONG_ALGORITHM_LENGTHS[value.value.length]
+              next unless algorithm && hex?(value.value)
+
+              add_offense(checksum, message: "#{MSG} This looks like #{algorithm} digest.", severity: :refactor)
+            end
+          end
+
+          private
+
+          # @param [String] string
+          #
+          # @return [Boolean]
+          def hex?(string)
+            string.match?(/\A\h+\z/)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/invalid_platform_family_helper.rb

@@ -27,7 +27,7 @@ module RuboCop
         #   platform_family?('redhat')
         #   platform_family?('sles')
         #
-        #   # bad
+        #   # good
         #   platform_family?('rhel')
         #   platform_family?('suse')
         #

data/lib/rubocop/cop/chef/correctness/invalid_platform_family_values_in_case.rb

@@ -27,6 +27,16 @@ module RuboCop
         #   case node['platform_family']
         #   when 'redhat'
         #     puts "I'm on a RHEL-like system"
+        #   when 'debian'
+        #     puts "I'm on a Debian-like system"
+        #   end
+        #
+        #   # good
+        #   case node['platform_family']
+        #   when 'rhel'
+        #     puts "I'm on a RHEL-like system"
+        #   when 'debian'
+        #     puts "I'm on a Debian-like system"
         #   end
         #
         class InvalidPlatformFamilyInCase < Base

data/lib/rubocop/cop/chef/correctness/invalid_platform_values_in_case.rb

@@ -27,6 +27,16 @@ module RuboCop
         #   case node['platform']
         #   when 'rhel'
         #     puts "I'm on a Red Hat system!"
+        #   when 'ubuntu'
+        #     puts "I'm on Ubuntu!"
+        #   end
+        #
+        #   # good
+        #   case node['platform']
+        #   when 'redhat'
+        #     puts "I'm on a Red Hat system!"
+        #   when 'ubuntu'
+        #     puts "I'm on Ubuntu!"
         #   end
         #
         class InvalidPlatformInCase < Base

data/lib/rubocop/cop/chef/correctness/invalid_value_for_platform_helper.rb

@@ -28,6 +28,7 @@ module RuboCop
         #     %w(rhel mac_os_x_server) => { 'default' => 'foo' },
         #     %w(sles) => { 'default' => 'bar' }
         #   )
+        #
         #   # good
         #   value_for_platform(
         #     %w(redhat mac_os_x) => { 'default' => 'foo' },

data/lib/rubocop/cop/chef/correctness/openssl_password_helpers.rb

@@ -31,7 +31,7 @@ module RuboCop
           def_node_matcher :openssl_helper?, <<~PATTERN
             (const
               (const
-                (const nil? :Opscode) :OpenSSL) :Password)
+                (const {nil? cbase} :Opscode) :OpenSSL) :Password)
           PATTERN
 
           def on_const(node)

data/lib/rubocop/cop/chef/correctness/platform_version_string_comparison.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # Ohai reports version attributes as strings, so comparing one with `<`, `>`, `<=`, or `>=`
+        # compares them character by character rather than as versions. That gives the wrong answer
+        # whenever the version numbers have different digit counts:
+        #
+        #   '7.9' >= '10'   # => true, because '7' sorts after '1'
+        #   '9' > '10'      # => true
+        #
+        # Compare the major version as an integer with `node['platform_version'].to_i`, or compare
+        # full versions with `Gem::Version`.
+        #
+        # @example
+        #
+        #   # bad
+        #   node['platform_version'] >= '10'
+        #   node['platform_version'] < '7.4'
+        #
+        #   # good
+        #   node['platform_version'].to_i >= 10
+        #   Gem::Version.new(node['platform_version']) >= Gem::Version.new('7.4')
+        #
+        #   # good - equality is a plain string match, which is fine
+        #   node['platform_version'] == '10'
+        #
+        class PlatformVersionStringComparison < Base
+          MSG = 'Ohai version attributes are strings, so comparing them with an ordering operator compares them character by character. Use .to_i for a major version comparison, or Gem::Version to compare full versions.'
+          RESTRICT_ON_SEND = %i(< > <= >=).freeze
+
+          # the flat Ohai attributes that hold a dotted version string
+          def_node_matcher :version_attribute_comparison?, <<-PATTERN
+            (send
+              (send (send nil? :node) :[] (str {"platform_version" "os_version"}))
+              {:< :> :<= :>=}
+              (str _))
+          PATTERN
+
+          def on_send(node)
+            version_attribute_comparison?(node) do
+              add_offense(node, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/powershell_delete_file.rb

@@ -26,13 +26,13 @@ module RuboCop
         #   # bad
         #   powershell_script 'Cleanup old files' do
         #     code 'Remove-Item C:\Windows\foo\bar.txt'
-        #     only_if { ::File.exist?('C:\\Windows\\foo\\bar.txt') }
+        #     only_if { ::File.exist?('C:\Windows\foo\bar.txt') }
         #   end
         #
-        #  ### correct
-        #  file 'C:\Windows\foo\bar.txt' do
-        #    action :delete
-        #  end
+        #   # good
+        #   file 'C:\Windows\foo\bar.txt' do
+        #     action :delete
+        #   end
         #
         class PowershellScriptDeleteFile < Base
           include RuboCop::Chef::CookbookHelpers

data/lib/rubocop/cop/chef/correctness/powershell_file_exists.rb

@@ -24,7 +24,7 @@ module RuboCop
         # @example
         #
         #   # bad
-        #   powershell_out('Test-Path "C:\\Program Files\\LAPS\\CSE\\AdmPwd.dll"').stdout.strip == 'True'
+        #   powershell_out('Test-Path "C:\Program Files\LAPS\CSE\AdmPwd.dll"').stdout.strip == 'True'
         #
         #   # good
         #   ::File.exist?('C:\Program Files\LAPS\CSE\AdmPwd.dll')

data/lib/rubocop/cop/chef/correctness/resource_with_none_action.rb

@@ -41,10 +41,10 @@ module RuboCop
 
           def on_block(node)
             match_property_in_resource?(nil, 'action', node) do |action_node|
-              action_node.arguments.each do |action|
-                next unless action.source == ':none'
+              each_action_symbol(action_node) do |action, prefix|
+                next unless action.value == :none
                 add_offense(action, severity: :refactor) do |corrector|
-                  corrector.replace(action, ':nothing')
+                  corrector.replace(action, "#{prefix}nothing")
                 end
               end
             end

data/lib/rubocop/cop/chef/correctness/ruby_guard_without_block.rb

@@ -0,0 +1,91 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Correctness
+        # A `not_if`/`only_if` guard takes either a string, which is run as a shell command, or a block,
+        # which is run as Ruby. Passing a Ruby expression directly gives the guard the expression's
+        # *result* rather than the expression, because it is evaluated while the recipe is compiled.
+        #
+        # A guard that receives `true` or `false` raises at converge time:
+        #
+        #   ArgumentError: Invalid only_if/not_if command, expected a string: true (TrueClass)
+        #
+        # Worse, an expression that happens to return a string is accepted and then run as a shell
+        # command, so the guard quietly tests something entirely different to what was intended.
+        #
+        # Only expressions that clearly produce a boolean are flagged, so a shell command built in Ruby
+        # and held in a variable is left alone.
+        #
+        # @example
+        #
+        #   # bad
+        #   not_if ::File.exist?('/etc/foo')
+        #   only_if node['foo']['version'] == '1.0'
+        #
+        #   # good
+        #   not_if { ::File.exist?('/etc/foo') }
+        #   only_if { node['foo']['version'] == '1.0' }
+        #
+        #   # good - a string guard runs as a shell command
+        #   not_if 'test -f /etc/foo'
+        #
+        class RubyGuardWithoutBlock < Base
+          extend AutoCorrector
+
+          MSG = 'A Ruby expression used as a resource guard has to be wrapped in a block. Passing it directly hands the guard the expression result, which raises at converge time or silently runs a shell command.'
+          RESTRICT_ON_SEND = [:not_if, :only_if].freeze
+
+          # comparison and negation operators always produce a boolean
+          BOOLEAN_OPERATORS = %i(== != < > <= >= =~ !~ ! equal? eql?).freeze
+
+          def_node_matcher :guard_with_argument, '(send nil? {:not_if :only_if} $_)'
+
+          def on_send(node)
+            guard_with_argument(node) do |argument|
+              next unless boolean_expression?(argument)
+
+              add_offense(node, severity: :refactor) do |corrector|
+                corrector.replace(node, "#{node.method_name} { #{argument.source} }")
+              end
+            end
+          end
+
+          private
+
+          # Can we tell that this expression produces a boolean rather than a shell command? Anything
+          # we can't be sure about, such as a bare method call or a local variable, is left alone: it
+          # may well hold a perfectly good command string.
+          #
+          # @param [RuboCop::AST::Node] node
+          #
+          # @return [Boolean]
+          def boolean_expression?(node)
+            return true if node.boolean_type? || node.defined_type?
+            return true if node.operator_keyword? # && and ||
+            return node.children.one? && boolean_expression?(node.children.first) if node.begin_type?
+            return false unless node.send_type?
+
+            node.method_name.to_s.end_with?('?') || BOOLEAN_OPERATORS.include?(node.method_name)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/correctness/service_resource.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 #
-# Copyright:: 2016, Chris Henry
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -18,36 +19,86 @@ module RuboCop
   module Cop
     module Chef
       module Correctness
-        # Use a service resource to start and stop services
+        # Use the `service` resource to manage services instead of shelling out. The resource is
+        # idempotent, picks the right init system for the platform, and reports correctly on what it
+        # changed. A shelled out command runs on every converge whether or not anything needed to
+        # change, so the run reports the resource as updated every time.
         #
-        # @example when command starts a service
+        # @example
         #
         #   # bad
-        #   command "/etc/init.d/mysql start"
-        #   command "/sbin/service/memcached start"
+        #   execute 'restart apache' do
+        #     command 'systemctl restart httpd'
+        #   end
+        #
+        #   execute '/etc/init.d/httpd start'
+        #
+        #   # good
+        #   service 'httpd' do
+        #     action :restart
+        #   end
         #
         class ServiceResource < Base
-          MSG = 'Use a service resource to start and stop services'
-          RESTRICT_ON_SEND = [:command].freeze
+          MSG = 'Use the service resource to manage services instead of shelling out to an init script, service, systemctl, or a similar tool'
+          RESTRICT_ON_SEND = %i(command code execute).freeze
+
+          # the state changing verbs. `status` is left out: a status check is usually a guard rather
+          # than something the service resource replaces
+          SERVICE_ACTIONS = %w(
+            start stop restart reload force-reload try-restart reload-or-restart
+            enable disable mask unmask
+          ).freeze
+
+          # commands whose service action is captured and checked against SERVICE_ACTIONS
+          ACTION_COMMANDS = [
+            %r{\A/(?:etc/init\.d|etc/rc\.d|usr/local/etc/rc\.d)/\S+\s+(\S+)}, # /etc/init.d/httpd start
+            %r{\A(?:/usr/sbin/|/sbin/)?service\s+\S+\s+(\S+)},                # service httpd start
+            %r{\A(?:/usr/bin/|/bin/)?systemctl\s+(?:--\S+\s+)*(\S+)\s+\S+},   # systemctl start httpd
+            /\Ainvoke-rc\.d\s+\S+\s+(\S+)/,                                   # invoke-rc.d httpd start
+            /\Ainitctl\s+(\S+)\s+\S+/,                                        # initctl start httpd
+            /\Asvcadm\s+(\S+)\s+\S+/,                                         # svcadm enable httpd
+          ].freeze
+
+          # commands that manage a service whatever the rest of the line says
+          DIRECT_COMMANDS = [
+            /\A(?:start|stop|restart)\s+\S+\z/,                               # upstart: start httpd
+            /\Alaunchctl\s+(?:load|unload|start|stop|enable|disable|bootstrap|bootout)\s/,
+            /\Achkconfig\s+(?:--\S+\s+)*\S+\s+(?:on|off)\z/,                  # chkconfig httpd on
+            /\Aupdate-rc\.d\s/,                                               # update-rc.d httpd defaults
+            /\A(?:sc|net)\s+(?:start|stop|config)\s+\S+/i,                    # windows: net start httpd
+          ].freeze
+
+          # a command doing more than the one service action can't be swapped for the resource
+          SHELL_OPERATORS = ['&&', '||', ';', '|', '`', '$('].freeze
 
-          def_node_matcher :execute_command?, <<-PATTERN
-            (send nil? :command $str)
-          PATTERN
+          def_node_matcher :command_property?, '(send nil? {:command :code} $str)'
+          def_node_matcher :execute_with_command_name?, '(send nil? :execute $str)'
 
           def on_send(node)
-            execute_command?(node) do |command|
-              if starts_service?(command)
-                add_offense(command, severity: :refactor)
-              end
+            command_property?(node) do |command|
+              add_offense(command, severity: :refactor) if manages_service?(command.value)
+            end
+
+            execute_with_command_name?(node) do |command|
+              add_offense(node, severity: :refactor) if manages_service?(command.value)
             end
           end
 
-          def starts_service?(cmd)
-            cmd_str = cmd.to_s
-            (cmd_str.include?('/etc/init.d') || ['service ', '/sbin/service ',
-                                                 'start ', 'stop ', 'invoke-rc.d '].any? do |service_cmd|
-               cmd_str.start_with?(service_cmd)
-             end) && %w(start stop restart reload).any? { |a| cmd_str.include?(a) }
+          private
+
+          # @param [String] command the literal command string
+          #
+          # @return [Boolean]
+          def manages_service?(command)
+            cmd = command.strip
+            return false if SHELL_OPERATORS.any? { |operator| cmd.include?(operator) }
+
+            ACTION_COMMANDS.each do |pattern|
+              match = pattern.match(cmd)
+              return true if match && SERVICE_ACTIONS.include?(match[1].downcase)
+            end
+
+            DIRECT_COMMANDS.any? { |pattern| cmd.match?(pattern) }
           end
         end
       end

data/lib/rubocop/cop/chef/deprecation/chef_handler_recipe.rb

@@ -27,6 +27,13 @@ module RuboCop
         #   include_recipe 'chef_handler'
         #   include_recipe 'chef_handler::default'
         #
+        #   # good
+        #   # the chef_handler resource ships in Chef Infra Client, so no recipe include is needed
+        #   chef_handler 'MyHandler' do
+        #     source '/etc/chef/handlers/my_handler.rb'
+        #     action :enable
+        #   end
+        #
         class ChefHandlerRecipe < Base
           include RangeHelp
           extend AutoCorrector
@@ -35,7 +42,7 @@ module RuboCop
           RESTRICT_ON_SEND = [:include_recipe].freeze
 
           def_node_matcher :chef_handler_recipe?, <<-PATTERN
-            (send nil? :include_recipe (str {"chef_handler" "chef_handler::default"}))
+            (send {nil? (send nil? :run_context)} :include_recipe (str {"chef_handler" "chef_handler::default"}))
           PATTERN
 
           def on_send(node)

data/lib/rubocop/cop/chef/deprecation/chef_rest.rb

@@ -27,6 +27,9 @@ module RuboCop
         #   require 'chef/rest'
         #   Chef::REST::RESTRequest.new(:GET, FOO, nil).call
         #
+        #   # good
+        #   Chef::ServerAPI.new(Chef::Config[:chef_server_url]).get('nodes')
+        #
         class UsesChefRESTHelpers < Base
           MSG = "Don't use the helpers in Chef::REST which were removed in Chef Infra Client 13"
           RESTRICT_ON_SEND = [:require].freeze
@@ -36,7 +39,7 @@ module RuboCop
           PATTERN
 
           def_node_matcher :rest_const?, <<-PATTERN
-          (const (const nil? :Chef) :REST)
+          (const (const {nil? cbase} :Chef) :REST)
           PATTERN
 
           def on_send(node)

data/lib/rubocop/cop/chef/deprecation/chef_shellout.rb

@@ -43,7 +43,7 @@ module RuboCop
           def_node_matcher :include_shellout?, <<-PATTERN
           (send nil? :include
             (const
-              (const nil? :Chef) :ShellOut))
+              (const {nil? cbase} :Chef) :ShellOut))
           PATTERN
 
           def_node_matcher :require_shellout?, <<-PATTERN
@@ -53,7 +53,7 @@ module RuboCop
           def_node_matcher :shellout_new?, <<-PATTERN
           (send
             (const
-              (const nil? :Chef) :ShellOut) :new
+              (const {nil? cbase} :Chef) :ShellOut) :new
               ... )
           PATTERN
 

data/lib/rubocop/cop/chef/deprecation/chef_sugar_helpers.rb

@@ -41,6 +41,12 @@ module RuboCop
         #   nexentacore?
         #   opensolaris?
         #
+        #   # good
+        #   # the equivalents now shipping in Chef Infra Client and in Ruby itself
+        #   vagrant?
+        #   node.recipe?('foo::bar')
+        #   shell_out!('/opt/app/bin/app --version', out: File::NULL)
+        #
         class ChefSugarHelpers < Base
           MSG = 'Do not use legacy chef-sugar helper methods, which will not be moved into Chef Infra Client itself. For a complete set of chef-sugar helpers now shipping in Chef Infra Client itself see https://github.com/chef/chef/tree/main/chef-utils#getting-started'
           RESTRICT_ON_SEND = [:vagrant_key?, :vagrant_domain?, :vagrant_user?, :require_chef_gem, :best_ip_for, :nexus?, :ios_xr?, :ruby_20?, :ruby_19?, :includes_recipe?, :wrlinux?, :dev_null, :nexentacore_platform?, :opensolaris_platform?, :nexentacore?, :opensolaris?].freeze