metz-scan 0.5.3 → 0.6.0

data/lib/metz_scan/commands/explain.rb

@@ -2,6 +2,7 @@
 
 require "optparse"
 require "yaml"
+require_relative "../cli"
 
 module MetzScan
   module Commands
@@ -23,6 +24,8 @@ module MetzScan
         return missing_argument_error if args.empty?
 
         emit_or_error(args.first)
+      rescue OptionParser::ParseError => e
+        parser_error(e)
       end
 
       def emit_or_error(cop_name)
@@ -52,17 +55,23 @@ module MetzScan
         cop.cop_name.start_with?("Metz/") && cop.respond_to?(:metz_metadata)
       end
 
+      def parser_error(err)
+        stderr.puts "metz-scan explain: #{err.message}"
+        stderr.puts USAGE
+        CLI::USAGE_ERROR
+      end
+
       def missing_argument_error
         stderr.puts "metz-scan explain: missing required COP_NAME argument."
         stderr.puts USAGE
         stderr.puts "Run `metz-scan rules` to see the list of available Metz cops."
-        1
+        CLI::USAGE_ERROR
       end
 
       def unknown_cop_error(name)
         stderr.puts "metz-scan explain: no such cop '#{name}'."
         stderr.puts "Run `metz-scan rules` to see the list of available Metz cops."
-        1
+        CLI::USAGE_ERROR
       end
 
       def emit(cop)

data/lib/metz_scan/commands/project_analyzers.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "optparse"
+require_relative "../cli"
 
 require_relative "scan/project_analyzer_runner"
 
@@ -21,7 +22,7 @@ module MetzScan
 
       def run(argv)
         options = parse_options(argv)
-        return 1 unless options
+        return CLI::USAGE_ERROR unless options
 
         entries = analyzer_entries
         options[:json] ? emit_json(entries) : emit_table(entries)
@@ -41,7 +42,7 @@ module MetzScan
       end
 
       def parse_error(error)
-        stderr.puts error.message
+        stderr.puts "metz-scan project-analyzers: #{error.message}"
         stderr.puts option_parser.help
         nil
       end

data/lib/metz_scan/commands/report.rb

@@ -8,6 +8,7 @@ require_relative "scan/compliance_scorecard"
 require_relative "scan/text_renderer"
 require_relative "scan/sarif_renderer"
 require_relative "scan/github_annotations_renderer"
+require_relative "../cli"
 
 module MetzScan
   module Commands
@@ -87,28 +88,28 @@ module MetzScan
       def parser_error(err)
         stderr.puts "metz-scan report: #{err.message}"
         stderr.puts USAGE
-        1
+        CLI::USAGE_ERROR
       end
 
       def missing_path_arg
         stderr.puts "metz-scan report: missing PATH argument."
         stderr.puts USAGE
-        1
+        CLI::USAGE_ERROR
       end
 
       def missing_file(path)
         stderr.puts "metz-scan report: no such file: #{path}"
-        1
+        CLI::USAGE_ERROR
       end
 
       def invalid_format(fmt)
         stderr.puts "metz-scan report: invalid --format '#{fmt}'. Valid formats: text, json, sarif, gh-annotations."
-        1
+        CLI::USAGE_ERROR
       end
 
       def invalid_json(path, detail)
         stderr.puts "metz-scan report: invalid JSON in #{path}: #{detail}"
-        1
+        CLI::USAGE_ERROR
       end
     end
   end

data/lib/metz_scan/commands/rules.rb

@@ -2,6 +2,7 @@
 
 require "json"
 require "optparse"
+require_relative "../cli"
 
 module MetzScan
   module Commands
@@ -23,16 +24,27 @@ module MetzScan
       end
 
       def run(argv)
-        options = parse_options(argv)
-        cops = load_cops
-        options[:json] ? emit_json(cops) : emit_table(cops)
-        0
+        emit(parse_options(argv))
+      rescue OptionParser::ParseError => e
+        parser_error(e)
       end
 
       private
 
       attr_reader :stdout, :stderr
 
+      def emit(options)
+        cops = load_cops
+        options[:json] ? emit_json(cops) : emit_table(cops)
+        0
+      end
+
+      def parser_error(err)
+        stderr.puts "metz-scan rules: #{err.message}"
+        stderr.puts USAGE
+        CLI::USAGE_ERROR
+      end
+
       def parse_options(argv)
         options = { json: false }
         OptionParser.new { |opts| configure_options(opts, options) }.parse!(argv)

data/lib/metz_scan/commands/scan/auto_fix.rb

@@ -8,8 +8,6 @@ module MetzScan
   module Commands
     class Scan
       class AutoFix
-        SAFE_FLAG = "-a"
-        UNSAFE_FLAG = "-A"
         CommandResult = Struct.new(:status, :stdout, :stderr, keyword_init: true)
 
         def initialize(stdout:, stderr:)
@@ -63,8 +61,10 @@ module MetzScan
         end
 
         def rubocop_argv(options)
-          flag = options.unsafe ? UNSAFE_FLAG : SAFE_FLAG
-          ["--plugin", "rubocop-metz", *Runner.cop_selection_argv(options.all_cops), flag, *options.paths]
+          flag = options.unsafe ? "-A" : "-a"
+          selection = Runner.cop_selection_argv(options.all_cops)
+          selection += ["--disable-pending-cops"] unless options.all_cops
+          ["--plugin", "rubocop-metz", *selection, flag, *options.paths]
         end
 
         def capture_rubocop(argv)
@@ -103,8 +103,7 @@ module MetzScan
         end
 
         def print_file_diff(path, original)
-          return unless File.exist?(path)
-          return if File.binread(path) == original
+          return unless File.exist?(path) && changed?(path, original)
 
           stdout.puts diff_against(path, original)
         end
@@ -130,8 +129,11 @@ module MetzScan
         def restore_files(snapshot)
           return unless snapshot
 
-          snapshot.each { |path, content| File.binwrite(path, content) }
+          snapshot.each { |path, content| File.binwrite(path, content) if changed?(path, content) }
         end
+
+        # Only rewrite what RuboCop touched, so an unchanged read-only file cannot abort the restore.
+        def changed?(path, original) = !File.exist?(path) || File.binread(path) != original
       end
     end
   end

data/lib/metz_scan/commands/scan/config_exclusions.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require "rubocop"
+
+require "metz_scan/commands/scan/exclude_entry_locator"
+
+module MetzScan
+  module Commands
+    class Scan
+      # Default mode runs stock Metz config (--force-default-config) but must
+      # still honor the project's per-cop file scope (Include/Exclude), the
+      # same way #33 honors AllCops: Exclude. RuboCop's own excluded_file?
+      # resolves the project config's scope per cop (#37); offenses on files a
+      # cop is scoped off are hidden, and the project Exclude entry that hid
+      # one is credited in the suppression ledger.
+      class ConfigExclusions
+        def initialize(store)
+          @store = store
+          @locators = {}
+        end
+
+        def scoped_off?(path, offense)
+          cop_class = cop_class(offense)
+          return false unless cop_class
+
+          absolute = File.expand_path(path)
+          cop_class.new(store.for_file(absolute)).excluded_file?(absolute)
+        end
+
+        def record_fields(path, offense)
+          entry = store.applied_exclude(cop_class(offense).badge, File.expand_path(path))
+          return unless entry
+
+          location = locator(entry.config_path).locate(entry.key, entry.pattern)
+          { "suppressed_by" => "config_exclude", "reason" => location.reason,
+            "reason_status" => location.reason_status, "directive" => nil, "config" => config(entry, location) }
+        end
+
+        private
+
+        attr_reader :store
+
+        def cop_class(offense)
+          RuboCop::Cop::Registry.global.find_by_cop_name(offense.fetch("cop_name"))
+        end
+
+        def config(entry, location)
+          { "path" => Runner.display_path(entry.config_path), "line" => location.line,
+            "pattern" => display(entry.pattern) }
+        end
+
+        def display(pattern)
+          pattern.is_a?(Regexp) ? pattern.inspect : pattern
+        end
+
+        def locator(config_path)
+          @locators[config_path] ||= ExcludeEntryLocator.new(config_path)
+        end
+      end
+
+      # Invalid project config leaves no project scope to honor, matching the
+      # forced-default target-discovery fallback.
+      module NoConfigExclusions
+        module_function
+
+        def scoped_off?(_path, _offense)
+          false
+        end
+
+        def record_fields(_path, _offense)
+          nil
+        end
+      end
+    end
+  end
+end

data/lib/metz_scan/commands/scan/exclude_entries.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require "rubocop"
+
+module MetzScan
+  module Commands
+    class Scan
+      module ProjectConfigScope
+        # The per-cop Exclude entries a scope-only config applies, each mapped
+        # back to the config file that wrote it. Entries are paired with their
+        # source by object identity before make_excludes_absolute rewrites
+        # them, so an entry a derived file overrides is never credited.
+        class ExcludeEntries
+          Entry = Struct.new(:config_path, :key, :pattern, keyword_init: true)
+
+          def self.patterns(config)
+            config.to_h.filter_map { |key, value| [key, value["Exclude"].dup] if per_cop_exclude?(key, value) }.to_h
+          end
+
+          def self.per_cop_exclude?(key, value)
+            key != "AllCops" && value.is_a?(Hash) && value["Exclude"].is_a?(Array)
+          end
+
+          def initialize(raw_patterns = {}, absolute_patterns = {}, sources = {})
+            @entries = {}
+            raw_patterns.each do |key, patterns|
+              patterns.zip(absolute_patterns.fetch(key)).each { |raw, absolute| index(key, raw, absolute, sources) }
+            end
+          end
+
+          # The first Exclude pattern a cop applies to `file` that a project
+          # config wrote; stock-default patterns have no source and are skipped.
+          def applied(config, badge, file)
+            relative = config.path_relative_to_config(file)
+            Array(config.for_badge(badge)["Exclude"]).lazy.filter_map do |pattern|
+              sourced_entry(badge, pattern) if matches?(pattern, relative, file)
+            end.first
+          end
+
+          private
+
+          def index(key, raw, absolute, sources)
+            return unless sources.key?(raw)
+
+            @entries[[key, absolute]] = Entry.new(config_path: sources.fetch(raw), key: key, pattern: raw)
+          end
+
+          def sourced_entry(badge, pattern)
+            @entries[[badge.to_s, pattern]] || @entries[[badge.department_name, pattern]]
+          end
+
+          def matches?(pattern, relative, file)
+            RuboCop::PathUtil.match_path?(pattern, relative) || RuboCop::PathUtil.match_path?(pattern, file)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/metz_scan/commands/scan/exclude_entry_locator.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "erb"
+require "psych"
+
+module MetzScan
+  module Commands
+    class Scan
+      # Finds where a config file writes one Exclude entry and the reason
+      # comment documenting it. ERB configs are read as RuboCop renders them;
+      # their rendered line numbers do not match the file, so no line is given.
+      class ExcludeEntryLocator
+        Location = Struct.new(:line, :reason, :reason_status, keyword_init: true)
+        UNCHECKED = Location.new(line: nil, reason: nil, reason_status: "unchecked").freeze
+        COMMENT_LINE = /\A\s*#/
+        TRAILING_COMMENT = /(?:\A|\s)#(.*)\z/
+
+        def initialize(config_path)
+          raw = File.read(config_path, encoding: Encoding::UTF_8)
+          rendered = Dir.chdir(File.dirname(config_path)) { ERB.new(raw).result }
+          @erb = rendered != raw
+          @lines = rendered.lines.map(&:chomp)
+          @root = Psych.parse(rendered).root
+        end
+
+        def locate(key, pattern)
+          exclude_key, entry = entry_nodes(key, pattern)
+          return UNCHECKED unless entry
+
+          reason = entry_reason(entry) || key_reason(exclude_key)
+          Location.new(line: (entry.start_line + 1 unless @erb), reason: reason,
+                       reason_status: reason ? "present" : "missing")
+        end
+
+        private
+
+        def entry_nodes(key, pattern)
+          exclude_key, excludes = mapping_pair(mapping_pair(@root, key)&.last, "Exclude")
+          return unless excludes.is_a?(Psych::Nodes::Sequence)
+
+          [exclude_key, excludes.children.find { |node| node.is_a?(Psych::Nodes::Scalar) && node.value == pattern }]
+        end
+
+        def mapping_pair(node, key)
+          return unless node.is_a?(Psych::Nodes::Mapping)
+
+          node.children.each_slice(2).find { |name, _value| name.is_a?(Psych::Nodes::Scalar) && name.value == key }
+        end
+
+        def entry_reason(entry)
+          trailing_comment(entry) || comment_block_above(entry.start_line)
+        end
+
+        def key_reason(exclude_key)
+          trailing_comment(exclude_key) || comment_block_above(exclude_key.start_line)
+        end
+
+        def trailing_comment(node)
+          comment_text(@lines.fetch(node.end_line)[node.end_column..][TRAILING_COMMENT, 1])
+        end
+
+        def comment_block_above(line_index)
+          block = @lines.first(line_index).reverse.take_while { |line| line.match?(COMMENT_LINE) }
+          comment_text(block.reverse.map { |line| line.sub(COMMENT_LINE, "").strip }.join(" "))
+        end
+
+        def comment_text(text)
+          stripped = text.to_s.strip
+          stripped unless stripped.empty?
+        end
+      end
+    end
+  end
+end

data/lib/metz_scan/commands/scan/exclude_provenance.rb

@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+require "rubocop"
+
+require "metz_scan/commands/scan/exclude_entries"
+
+module MetzScan
+  module Commands
+    class Scan
+      module ProjectConfigScope
+        # Remembers which config file wrote each Exclude entry the scope-only
+        # loader reads, so the suppression ledger can credit the entry a cop
+        # actually applies. Raw YAML entries are tracked by object identity:
+        # two files writing the same pattern stay distinct.
+        class ExcludeProvenance
+          def initialize
+            @sources = {}.compare_by_identity
+            @entries = {}
+          end
+
+          def load_yaml_configuration(absolute_path)
+            RuboCop::ConfigLoader.load_yaml_configuration(absolute_path).tap do |raw_hash|
+              record_sources(raw_hash, absolute_path)
+            end
+          end
+
+          def make_excludes_absolute(config)
+            raw_patterns = ExcludeEntries.patterns(config)
+            config.make_excludes_absolute
+            @entries[config.loaded_path] = ExcludeEntries.new(raw_patterns, ExcludeEntries.patterns(config), @sources)
+          end
+
+          def entries_for(config)
+            @entries.fetch(config.loaded_path) { ExcludeEntries.new }
+          end
+
+          private
+
+          def record_sources(raw_hash, absolute_path)
+            raw_hash.each_value do |value|
+              Array(value["Exclude"]).each { |entry| @sources[entry] = absolute_path } if value.is_a?(Hash)
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/metz_scan/commands/scan/inline_directive_locator.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "rubocop"
+
+module MetzScan
+  module Commands
+    class Scan
+      # Credits a suppressed offense to the innermost real directive comment
+      # covering it. Ranges RuboCop opens at -Infinity for opt-in cops are
+      # synthetic (CommentConfig::ConfigDisabledCopDirectiveComment), not a
+      # comment anyone wrote, so they credit nothing.
+      class InlineDirectiveLocator
+        def initialize
+          @ranges = {}
+        end
+
+        def record_fields(path, offense)
+          directive = covering_directive(path, offense)
+          return unless directive
+
+          reason = directive.reason
+          { "suppressed_by" => "inline_disable", "reason" => reason, "reason_status" => reason ? "present" : "missing",
+            "directive" => { "line" => directive.line_number }, "config" => nil }
+        end
+
+        private
+
+        def covering_directive(path, offense)
+          location = offense.fetch("location")
+          ranges_for(path).fetch(offense.fetch("cop_name"), [])
+                          .select { |range| covers?(range, location) }
+                          .max_by(&:begin)&.directive
+        end
+
+        def covers?(range, location)
+          range.is_a?(RuboCop::CommentConfig::DirectiveRange) && range.begin.finite? &&
+            range.end >= location.fetch("start_line") && range.begin <= location.fetch("last_line")
+        end
+
+        def ranges_for(path)
+          @ranges[path] ||= processed_source(path).comment_config.cop_disabled_line_ranges
+        end
+
+        def processed_source(path)
+          config = RuboCop::ConfigLoader.default_configuration
+          RuboCop::ProcessedSource.from_file(path, config.target_ruby_version, parser_engine: config.parser_engine)
+                                  .tap { |source| source.config = config }
+                                  .tap { |source| source.registry = RuboCop::Cop::Registry.global }
+        end
+      end
+    end
+  end
+end

data/lib/metz_scan/commands/scan/project_analyzer_runner.rb

@@ -8,6 +8,7 @@ require_relative "../../analyzers/namespace_leak_pressure"
 require_relative "../../analyzers/implicit_context_pressure"
 require_relative "../../analyzers/repeated_query_criteria"
 require_relative "../../analyzers/subclass_override_pressure"
+require_relative "../../analyzers/test_calls_private_method"
 require_relative "../../project_index"
 require_relative "runner"
 require_relative "project_analyzer_metadata"
@@ -27,10 +28,12 @@ module MetzScan
           Analyzers::NamespaceLeakPressure,
           Analyzers::ImplicitContextPressure,
           Analyzers::RepeatedQueryCriteria,
-          Analyzers::SubclassOverridePressure
+          Analyzers::SubclassOverridePressure,
+          Analyzers::TestCallsPrivateMethod
         ].freeze
         INDEX_BACKED_ANALYZERS = [Analyzers::InheritanceDescendants, Analyzers::PackageDependencyPressure,
-                                  Analyzers::NamespaceLeakPressure, Analyzers::SubclassOverridePressure].freeze
+                                  Analyzers::NamespaceLeakPressure, Analyzers::SubclassOverridePressure,
+                                  Analyzers::TestCallsPrivateMethod].freeze
         DEFAULT_OUTPUT_STATUS = "validated"
         DEFAULT_OUTPUT_CONFIDENCE = "medium"
         DEFAULT_OUTPUT_TRIAGE_SEVERITY = "design pressure"
@@ -80,7 +83,7 @@ module MetzScan
 
         def project_index_for(paths, index, analyzers)
           return index if index
-          return nil unless analyzers.any? { |analyzer| INDEX_BACKED_ANALYZERS.include?(analyzer) }
+          return nil unless analyzers.intersect?(INDEX_BACKED_ANALYZERS)
 
           ProjectIndex.build(paths)
         end

data/lib/metz_scan/commands/scan/project_config_scope.rb

@@ -3,6 +3,8 @@
 require "pathname"
 require "rubocop"
 
+require "metz_scan/commands/scan/exclude_provenance"
+
 module MetzScan
   module Commands
     class Scan
@@ -104,9 +106,18 @@ module MetzScan
             path = @path_cache[dir] ||= RuboCop::ConfigLoader.configuration_file_for(dir)
             @object_cache[path] ||= @loader.load(path)
           end
+
+          # The project Exclude entry (with its source config file) that scopes
+          # the cop off `file`, or nil when only a stock default does.
+          def applied_exclude(badge, file)
+            config = for_file(file)
+            @loader.provenance.entries_for(config).applied(config, badge, file)
+          end
         end
 
         class ConfigLoader
+          def provenance = @provenance ||= ExcludeProvenance.new
+
           def default_for(dir)
             path = File.join(File.expand_path(dir), ".rubocop.yml")
             config = RuboCop::Config.new({}, path)
@@ -118,7 +129,7 @@ module MetzScan
 
             config = RuboCop::Config.new(scope_hash(path), path)
             config.deprecation_check { |_message| nil }
-            config.make_excludes_absolute
+            provenance.make_excludes_absolute(config)
             RuboCop::ConfigLoader.merge_with_default(config, path)
           end
 
@@ -128,17 +139,28 @@ module MetzScan
             absolute_path = File.expand_path(path)
             return {} if seen.include?(absolute_path)
 
-            raw_hash = RuboCop::ConfigLoader.load_yaml_configuration(absolute_path)
+            raw_hash = provenance.load_yaml_configuration(absolute_path)
             inherited = inherited_scope_hash(raw_hash, absolute_path, [*seen, absolute_path])
-            RuboCop::ConfigLoader.merge(inherited, local_scope_hash(raw_hash))
+            merge(inherited, local_scope_hash(raw_hash), raw_hash["inherit_mode"])
           end
 
           def inherited_scope_hash(raw_hash, path, seen)
             inherited_paths(raw_hash, path).each_with_object({}) do |inherited_path, merged|
-              merged.replace(RuboCop::ConfigLoader.merge(merged, scope_hash(inherited_path, seen)))
+              merged.replace(merge(merged, scope_hash(inherited_path, seen), raw_hash["inherit_mode"]))
             end
           end
 
+          # RuboCop's resolve_inheritance merges every inherited file with the
+          # inheriting file's top-level inherit_mode, so sibling inherit_from
+          # files union under `merge: [Exclude]` too.
+          def merge(base_hash, derived_hash, inherit_mode)
+            resolver.merge(base_hash, derived_hash, inherit_mode: inherit_mode || {})
+          end
+
+          def resolver
+            @resolver ||= RuboCop::ConfigLoaderResolver.new
+          end
+
           def inherited_paths(raw_hash, path)
             gem_inherited_paths(raw_hash["inherit_gem"], path) + local_inherited_paths(raw_hash["inherit_from"], path)
           end