cookstyle 8.7.6 → 9.0.0

data/lib/rubocop/cop/chef/modernize/execute_archive_extract.rb

@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Modernize
+        # Use the archive_file resource built into Chef Infra Client 15+ instead of shelling out to
+        # tar or unzip. The resource extracts tar, tar.gz, tar.bz2, tar.xz, and zip archives, and it
+        # only runs when the archive is newer than what was already extracted, where the shelled out
+        # command re-extracts on every converge.
+        #
+        # @example
+        #
+        #   # bad
+        #   execute 'extract nginx' do
+        #     command "tar xzf #{Chef::Config[:file_cache_path]}/nginx.tar.gz -C /opt/nginx"
+        #   end
+        #
+        #   execute 'unzip -o /tmp/app.zip -d /opt/app'
+        #
+        #   # good
+        #   archive_file 'extract nginx' do
+        #     path "#{Chef::Config[:file_cache_path]}/nginx.tar.gz"
+        #     destination '/opt/nginx'
+        #   end
+        #
+        class ExecuteArchiveExtract < Base
+          include RuboCop::Chef::CookbookHelpers
+          extend TargetChefVersion
+
+          minimum_target_chef_version '15.0'
+
+          MSG = 'Use the archive_file resource built into Chef Infra Client 15+ instead of shelling out to tar or unzip'
+          RESTRICT_ON_SEND = [:execute].freeze
+
+          # `tar` extracts when its short flags include an x, or with the --extract long option.
+          # Anchoring the flag cluster directly after `tar` keeps `tar czf` (create), `tar tzf`
+          # (list), and `tar --exclude=.git -czf` from matching, since none of those put an x
+          # in the first cluster.
+          EXTRACT_COMMAND = %r{
+            \A\s*(?:\S*/)?(?:
+              tar\s+(?:-)?[a-z]*x[a-z]*(?:\s|\z) |  # tar xzf / tar -xzf / tar zxvf
+              tar\s+--extract\b                  |  # tar --extract --file
+              unzip(?:\s|\z)                        # unzip -o foo.zip -d /opt
+            )
+          }xi.freeze
+
+          # the shell resources whose script lives in a code property
+          SCRIPT_RESOURCES = %i(bash sh csh ksh zsh script).freeze
+
+          # A command that chains, pipes, or substitutes is doing more than extracting, so
+          # archive_file cannot replace it wholesale and the suggestion would be wrong.
+          SHELL_OPERATORS = ['&&', '||', ';', '|', '`', '$(', "\n"].freeze
+
+          def on_send(node)
+            command = node.arguments.first
+            return unless command
+
+            # Match on source rather than .value so an interpolated name such as
+            # execute "tar xzf #{node['foo']['tarball']}" is caught too -- that is a
+            # dstr node whose .value does not exist.
+            return unless %i(str dstr).include?(command.type)
+
+            add_offense(node, severity: :refactor) if extracts_archive?(unquote(command.source))
+          end
+
+          def on_block(node)
+            match_property_in_resource?(:execute, 'command', node) do |property|
+              report_property(node, property)
+            end
+
+            match_property_in_resource?(SCRIPT_RESOURCES, 'code', node) do |property|
+              report_property(node, property)
+            end
+          end
+
+          private
+
+          # strip the surrounding quotes off a string literal's source so the
+          # command regexes, which are anchored at the start, still match
+          #
+          # @param [String] source
+          #
+          # @return [String]
+          def unquote(source)
+            source.sub(/\A["']/, '').sub(/["']\z/, '')
+          end
+
+          def report_property(node, property)
+            command = method_arg_ast_to_string(property)
+            add_offense(node, severity: :refactor) if command && extracts_archive?(command)
+          end
+
+          # @param [String] command
+          #
+          # @return [Boolean]
+          def extracts_archive?(command)
+            return false if SHELL_OPERATORS.any? { |operator| command.include?(operator) }
+
+            EXTRACT_COMMAND.match?(command)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/modernize/execute_update_alternatives.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Modernize
+        # Chef Infra Client 16.0 and later includes an `alternatives` resource that should be used to
+        # manage alternatives links instead of shelling out to `update-alternatives` or `alternatives`.
+        # The resource is idempotent and handles both the Debian and RHEL flavours of the command, where
+        # an `execute` re-runs on every converge and reports the resource as updated every time.
+        #
+        # @example
+        #
+        #   # bad
+        #   execute 'install java alternative' do
+        #     command 'update-alternatives --install /usr/bin/java java /usr/lib/jvm/jre-11/bin/java 1'
+        #   end
+        #
+        #   execute 'alternatives --set java /usr/lib/jvm/jre-11/bin/java'
+        #
+        #   # good
+        #   alternatives 'java' do
+        #     link '/usr/bin/java'
+        #     path '/usr/lib/jvm/jre-11/bin/java'
+        #     priority 1
+        #     action :install
+        #   end
+        #
+        class ExecuteUpdateAlternatives < Base
+          include RuboCop::Chef::CookbookHelpers
+          extend TargetChefVersion
+
+          minimum_target_chef_version '16.0'
+
+          MSG = 'Chef Infra Client 16.0 and later includes an alternatives resource that should be used to manage alternatives links instead of shelling out to update-alternatives or alternatives'
+          RESTRICT_ON_SEND = [:execute].freeze
+
+          # Debian ships update-alternatives and RHEL ships alternatives, and the resource drives both.
+          # Matching is limited to the four subcommands the resource can express: --install, --set,
+          # --auto, and --remove. The rest are deliberately left alone -- --config and --display are
+          # interactive or read only, and --remove-all has no resource equivalent.
+          ALTERNATIVES_COMMAND = %r{
+            \A\s*(?:/usr/sbin/|/usr/bin/|/sbin/|/bin/)?  # an optional absolute path to the binary
+            (?:update-)?alternatives\s+
+            --(?:install|set|auto|remove(?!-all))\b
+          }x.freeze
+
+          # the shell resources whose script lives in a code property
+          SCRIPT_RESOURCES = %i(bash sh csh ksh zsh).freeze
+
+          def on_send(node)
+            command = node.arguments.first
+            return unless command&.str_type? && manages_alternatives?(command.value)
+
+            add_offense(node, severity: :refactor)
+          end
+
+          def on_block(node)
+            match_property_in_resource?(:execute, 'command', node) do |property|
+              report_property(node, property)
+            end
+
+            match_property_in_resource?(SCRIPT_RESOURCES, 'code', node) do |property|
+              report_property(node, property)
+            end
+          end
+
+          private
+
+          def report_property(node, property)
+            command = method_arg_ast_to_string(property)
+            add_offense(node, severity: :refactor) if command && manages_alternatives?(command)
+          end
+
+          # @param [String] command
+          #
+          # @return [Boolean]
+          def manages_alternatives?(command)
+            ALTERNATIVES_COMMAND.match?(command)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/modernize/includes_mixin_shellout.rb

@@ -29,6 +29,10 @@ module RuboCop
         #   require 'chef/mixin/powershell_out'
         #   include Chef::Mixin::PowershellOut
         #
+        #   # good
+        #   # shell_out is available in resources and providers with no include
+        #   shell_out!('/opt/app/bin/app --version')
+        #
         class IncludingMixinShelloutInResources < Base
           extend AutoCorrector
           include RangeHelp

data/lib/rubocop/cop/chef/modernize/libarchive_file.rb

@@ -26,12 +26,12 @@ module RuboCop
         #   # bad
         #   depends 'libarchive'
         #
-        #   libarchive_file "C:\file.zip" do
+        #   libarchive_file 'C:\file.zip' do
         #     path 'C:\expand_here'
         #   end
         #
         #   # good
-        #   archive_file "C:\file.zip" do
+        #   archive_file 'C:\file.zip' do
         #     path 'C:\expand_here'
         #   end
         #
@@ -44,8 +44,10 @@ module RuboCop
           MSG = 'Use the archive_file resource built into Chef Infra Client 15+ instead of the libarchive_file resource from the libarchive cookbook'
           RESTRICT_ON_SEND = [:libarchive_file, :notifies, :subscribes].freeze
 
+          # the notification timing is optional and defaults to :delayed, so the trailing
+          # argument is matched with ... rather than being required
           def_node_matcher :notification_property?, <<-PATTERN
-            (send nil? {:notifies :subscribes} (sym _) $(...) (sym _))
+            (send nil? {:notifies :subscribes} (sym _) $(...) ...)
           PATTERN
 
           def on_send(node)

data/lib/rubocop/cop/chef/modernize/ohai_default_recipe.rb

@@ -27,12 +27,17 @@ module RuboCop
         #   include_recipe 'ohai::default'
         #   include_recipe 'ohai'
         #
+        #   # good
+        #   ohai_plugin 'my_custom_plugin' do
+        #     source_file 'my_plugin.rb'
+        #   end
+        #
         class IncludingOhaiDefaultRecipe < Base
           MSG = "Use the ohai_plugin resource to ship custom Ohai plugins instead of using the ohai::default recipe. If you're not shipping custom Ohai plugins, then you can remove this recipe entirely"
           RESTRICT_ON_SEND = [:include_recipe].freeze
 
           def_node_matcher :ohai_recipe_usage?, <<-PATTERN
-            (send nil? :include_recipe (str {"ohai" "ohai::default"}))
+            (send {nil? (send nil? :run_context)} :include_recipe (str {"ohai" "ohai::default"}))
           PATTERN
 
           def on_send(node)

data/lib/rubocop/cop/chef/modernize/powershell_download_file.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+#
+# Copyright:: Copyright (c) 2016-2025 Progress Software Corporation and/or its subsidiaries or affiliates. All Rights Reserved.
+# Author:: Tim Smith (<tsmith84@gmail.com>)
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+module RuboCop
+  module Cop
+    module Chef
+      module Modernize
+        # Use the `remote_file` resource to download files instead of shelling out to PowerShell.
+        # `remote_file` is idempotent, supports checksum verification, proxies, and conditional
+        # downloads with etags and last-modified headers, none of which a script gets for free.
+        #
+        # @example
+        #
+        #   # bad
+        #   powershell_script 'download the installer' do
+        #     code 'Invoke-WebRequest -Uri https://example.com/foo.msi -OutFile C:\foo.msi'
+        #   end
+        #
+        #   # good
+        #   remote_file 'C:\foo.msi' do
+        #     source 'https://example.com/foo.msi'
+        #   end
+        #
+        class PowershellDownloadFile < Base
+          include RuboCop::Chef::CookbookHelpers
+
+          MSG = 'Use the remote_file resource to download files instead of downloading them in a PowerShell script resource'
+
+          # the PowerShell ways of pulling a file down over HTTP
+          DOWNLOAD_COMMANDS = Regexp.union(
+            /invoke-webrequest\s/i,
+            /\bstart-bitstransfer\s/i,
+            /\bwget\s/i,        # PowerShell alias for Invoke-WebRequest
+            /\bcurl\s/i,        # PowerShell alias for Invoke-WebRequest
+            /system\.net\.webclient/i
+          ).freeze
+
+          def on_block(node)
+            match_property_in_resource?(%i(powershell_script pwsh_script), 'code', node) do |code_property|
+              property_data = method_arg_ast_to_string(code_property)
+              next unless property_data&.match?(DOWNLOAD_COMMANDS)
+
+              add_offense(node, severity: :refactor)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/chef/modernize/powershell_expand_archive.rb

@@ -25,7 +25,14 @@ module RuboCop
         #
         #   # bad
         #   powershell_script 'Expand website' do
-        #     code 'Expand-Archive "C:\\file.zip" -DestinationPath "C:\\inetpub\\wwwroot\\" -Force'
+        #     code 'Expand-Archive "C:\file.zip" -DestinationPath "C:\inetpub\wwwroot" -Force'
+        #   end
+        #
+        #   # good
+        #   archive_file 'Expand website' do
+        #     path 'C:\file.zip'
+        #     destination 'C:\inetpub\wwwroot'
+        #     overwrite true
         #   end
         #
         class PowershellScriptExpandArchive < Base

data/lib/rubocop/cop/chef/modernize/powershell_guard_interpreter.rb

@@ -25,22 +25,22 @@ module RuboCop
         #
         #   # bad
         #   powershell_script 'Create Directory' do
-        #     code "New-Item -ItemType Directory -Force -Path C:\mydir"
+        #     code 'New-Item -ItemType Directory -Force -Path C:\mydir'
         #     guard_interpreter :powershell_script
         #   end
         #
         #   batch 'Create Directory' do
-        #     code "mkdir C:\mydir"
+        #     code 'mkdir C:\mydir'
         #     guard_interpreter :powershell_script
         #   end
         #
         #   # good
         #   powershell_script 'Create Directory' do
-        #     code "New-Item -ItemType Directory -Force -Path C:\mydir"
+        #     code 'New-Item -ItemType Directory -Force -Path C:\mydir'
         #   end
         #
         #   batch 'Create Directory' do
-        #     code "mkdir C:\mydir"
+        #     code 'mkdir C:\mydir'
         #   end
         #
         class PowerShellGuardInterpreter < Base

data/lib/rubocop/cop/chef/modernize/sc_windows_resource.rb

@@ -25,14 +25,14 @@ module RuboCop
         #
         #   # bad
         #   sc_windows 'chef-client' do
-        #     path "C:\\opscode\\chef\\bin"
+        #     path 'C:\opscode\chef\bin'
         #     action :create
         #   end
         #
         #   # good
         #   windows_service 'chef-client' do
         #     action :create
-        #     binary_path_name "C:\\opscode\\chef\\bin"
+        #     binary_path_name 'C:\opscode\chef\bin'
         #   end
         #
         class WindowsScResource < Base

data/lib/rubocop/cop/chef/modernize/seven_zip_archive.rb

@@ -24,10 +24,16 @@ module RuboCop
         # @example
         #
         #   # bad
-        #   seven_zip_archive "C:\file.zip" do
+        #   seven_zip_archive 'C:\file.zip' do
         #     path 'C:\expand_here'
         #   end
         #
+        #   # good
+        #   archive_file 'expand file.zip' do
+        #     path 'C:\file.zip'
+        #     destination 'C:\expand_here'
+        #   end
+        #
         class SevenZipArchiveResource < Base
           extend TargetChefVersion
 

data/lib/rubocop/cop/chef/modernize/shellouts_to_chocolatey.rb

@@ -28,10 +28,21 @@ module RuboCop
         #     command "choco install --source=artifactory \"foo\" -y --no-progress --ignore-package-exit-codes"
         #   end
         #
-        #  powershell_script 'add artifactory choco source' do
-        #    code "choco source add -n=artifactory -s='https://mycorp.jfrog.io/mycorp/api/nuget/chocolatey-remote' -u foo -p bar"
-        #    not_if 'choco source list | findstr artifactory'
-        #  end
+        #   powershell_script 'add artifactory choco source' do
+        #     code "choco source add -n=artifactory -s='https://mycorp.jfrog.io/mycorp/api/nuget/chocolatey-remote' -u foo -p bar"
+        #     not_if 'choco source list | findstr artifactory'
+        #   end
+        #
+        #   # good
+        #   chocolatey_package 'foo' do
+        #     source 'artifactory'
+        #     options '--no-progress --ignore-package-exit-codes'
+        #   end
+        #
+        #   chocolatey_source 'artifactory' do
+        #     source 'https://mycorp.jfrog.io/mycorp/api/nuget/chocolatey-remote'
+        #     action :add
+        #   end
         #
         class ShellOutToChocolatey < Base
           include RuboCop::Chef::CookbookHelpers

data/lib/rubocop/cop/chef/modernize/use_require_relative.rb

@@ -38,7 +38,7 @@ module RuboCop
           def_node_matcher :require_with_expand_path?, <<-PATTERN
             (send nil? :require
               (send
-                (const nil? :File) :expand_path
+                (const {nil? cbase} :File) :expand_path
                 $( str ... )
                 $( str ... )))
           PATTERN

data/lib/rubocop/cop/chef/modernize/windows_default_recipe.rb

@@ -35,7 +35,7 @@ module RuboCop
           RESTRICT_ON_SEND = [:include_recipe].freeze
 
           def_node_matcher :windows_recipe_usage?, <<-PATTERN
-            (send nil? :include_recipe (str {"windows" "windows::default"}))
+            (send {nil? (send nil? :run_context)} :include_recipe (str {"windows" "windows::default"}))
           PATTERN
 
           def on_send(node)

data/lib/rubocop/cop/chef/modernize/windows_zipfile.rb

@@ -24,8 +24,14 @@ module RuboCop
         # @example
         #
         #   # bad
-        #   windows_zipfile 'C:\\files\\' do
-        #     source 'C:\\Temp\\file.zip'
+        #   windows_zipfile 'C:\files' do
+        #     source 'C:\Temp\file.zip'
+        #   end
+        #
+        #   # good
+        #   archive_file 'expand file.zip' do
+        #     path 'C:\Temp\file.zip'
+        #     destination 'C:\files'
         #   end
         #
         class WindowsZipfileUsage < Base

data/lib/rubocop/cop/chef/modernize/zipfile_resource.rb

@@ -24,10 +24,16 @@ module RuboCop
         # @example
         #
         #   # bad
-        #   zipfile "C:\file.zip" do
+        #   zipfile 'C:\file.zip' do
         #     path 'C:\expand_here'
         #   end
         #
+        #   # good
+        #   archive_file 'expand file.zip' do
+        #     path 'C:\file.zip'
+        #     destination 'C:\expand_here'
+        #   end
+        #
         class ZipfileResource < Base
           include RuboCop::Chef::CookbookHelpers
           extend TargetChefVersion

data/lib/rubocop/cop/chef/modernize/zypper_repo.rb

@@ -25,7 +25,7 @@ module RuboCop
         #
         #   # bad
         #   zypper_repo 'apache' do
-        #     baseurl 'http://download.opensuse.org/repositories/Apache'
+        #     baseurl 'https://download.opensuse.org/repositories/Apache'
         #     path '/openSUSE_Leap_42.2'
         #     type 'rpm-md'
         #     priority '100'
@@ -33,7 +33,7 @@ module RuboCop
         #
         #   # good
         #   zypper_repository 'apache' do
-        #     baseurl 'http://download.opensuse.org/repositories/Apache'
+        #     baseurl 'https://download.opensuse.org/repositories/Apache'
         #     path '/openSUSE_Leap_42.2'
         #     type 'rpm-md'
         #     priority '100'

data/lib/rubocop/cop/chef/redundant/custom_resource_with_allowed_actions.rb

@@ -29,6 +29,16 @@ module RuboCop
         #   # also bad
         #   actions [:create, :remove]
         #
+        #   # good
+        #   # Chef Infra Client derives the allowed actions from the actions you define
+        #   action :create do
+        #     # ...
+        #   end
+        #
+        #   action :remove do
+        #     # ...
+        #   end
+        #
         class CustomResourceWithAllowedActions < Base
           include RangeHelp
           extend AutoCorrector

data/lib/rubocop/cop/chef/redundant/double_compile_time.rb

@@ -41,23 +41,37 @@ module RuboCop
           MSG = "If a resource includes the `compile_time` property there's no need to also use `.run_action(:some_action)` on the resource block."
           RESTRICT_ON_SEND = [:run_action].freeze
 
-          def_node_matcher :compile_time_and_run_action?, <<-PATTERN
+          def_node_matcher :run_action_on_resource?, <<-PATTERN
           (send
             $(block
               (send nil? ... )
               (args)
-              (begin <
-                (send nil? :action (sym $_) )
-                (send nil? :compile_time (true) )
-                ...
-              >)
+              _
             ) :run_action (sym $_) )
           PATTERN
 
+          def_node_search :compile_time_true?, '(send nil? :compile_time (true))'
+          def_node_search :action_nodes, '(send nil? :action $(sym _))'
+
           def on_send(node)
-            compile_time_and_run_action?(node) do |resource, action, run_action|
+            run_action_on_resource?(node) do |resource, run_action|
+              next unless compile_time_true?(resource.body)
+
+              # without an explicit action there's nothing to rewrite: the resource runs its
+              # default action, and picking the replacement would mean knowing what that is.
+              # report it, but leave the fix to a human.
+              action = action_nodes(resource.body).first
+              unless action
+                add_offense(node.loc.selector, severity: :refactor)
+                next
+              end
+
               add_offense(node.loc.selector, severity: :refactor) do |corrector|
-                corrector.replace(node, resource.source.gsub(action.to_s, run_action.to_s))
+                # rewrite the action's value and drop the trailing .run_action(...). rewriting the
+                # whole block source instead would replace the action name wherever else it appears,
+                # renaming the resource itself in something like chef_gem 'nothing'
+                corrector.replace(action, ":#{run_action}")
+                corrector.remove(node.loc.dot.join(node.source_range.end))
               end
             end
           end