necropsy 0.1.0

data/lib/necropsy/confidence/scorer.rb

@@ -0,0 +1,158 @@
+# frozen_string_literal: true
+
+require 'date'
+
+module Necropsy
+  module Confidence
+    class Scorer
+      def initialize(graph:, reachability:, project:)
+        @graph = graph
+        @reachability = reachability
+        @project = project
+      end
+
+      def findings
+        graph.method_nodes.filter_map do |node|
+          next if node.test
+
+          classification = classification_for(node)
+          next unless classification
+
+          score, level, reasons = score_for(node, classification)
+          Finding.new(
+            node: node,
+            classification: classification,
+            confidence: level,
+            score: score,
+            reasons: reasons,
+            evidences: graph.incoming_edges(node.id).flat_map(&:evidences) + graph.alive_evidences(node.id)
+          )
+        end
+      end
+
+      private
+
+      attr_reader :graph, :reachability, :project
+
+      def classification_for(node)
+        if reachability.runtime_alive.include?(node.id)
+          return :unused if graph.dynamic_enabled? && !graph.dynamic_alive?(node.id)
+
+          nil
+        elsif reachability.test_alive.include?(node.id)
+          :test_only_reachable
+        else
+          :unreachable
+        end
+      end
+
+      def score_for(node, classification)
+        reasons = []
+        score = base_score(classification)
+
+        if graph.uncertainties(node.id).any?
+          score -= 0.35
+          reasons << 'Lowered because this node is near unresolved metaprogramming.'
+        end
+
+        if graph.class_info(node.owner)&.dynamic
+          score -= 0.25
+          reasons << 'Lowered because the owner class defines dynamic dispatch.'
+        end
+
+        if generated_accessor?(node)
+          score -= 0.2
+          reasons << 'Lowered because this node is generated by a Ruby accessor DSL.'
+        end
+
+        static_count = graph.profiles.count { |profile| profile.kind == :static }
+        if static_count > 1
+          score += [static_count - 1, 3].min * 0.04
+          reasons << "Raised because #{static_count} static analyzers participated."
+        end
+
+        evidence_analyzers = graph.incoming_edges(node.id).flat_map(&:evidences).map(&:analyzer).uniq
+        if evidence_analyzers.length > 1
+          score += 0.08
+          reasons << 'Raised because multiple analyzers agree on incoming reachability evidence.'
+        end
+
+        if classification == :unreachable && graph.dynamic_enabled? && !graph.dynamic_alive?(node.id)
+          score += 0.25
+          reasons << 'Static unreachable and absent from dynamic observations.'
+        end
+
+        if classification == :unreachable && quarantine_expired?(node)
+          score = [score, 0.95].max
+          reasons << 'Raised because quarantine annotation has expired without alive evidence.'
+        end
+
+        if classification == :unused
+          days = observation_days
+          if days && days < project.config.min_observation_days
+            score -= 0.3
+            reasons << "Observation window is #{days} days, below the configured minimum."
+          else
+            reasons << 'Reachable statically but never observed dynamically.'
+          end
+        end
+
+        score = [[score, 0.0].max, 1.0].min
+        [score, level_for(score), reasons]
+      end
+
+      def base_score(classification)
+        case classification
+        when :unreachable
+          graph.profiles.any? { |profile| profile.name == :rta } ? 0.78 : 0.62
+        when :test_only_reachable
+          0.55
+        when :unused
+          0.58
+        else
+          0.25
+        end
+      end
+
+      def generated_accessor?(node)
+        %i[attr_reader attr_writer attr_accessor struct_new data_define].include?(node.defined_via)
+      end
+
+      def level_for(score)
+        return :certain if score >= 0.9
+        return :high if score >= 0.7
+        return :medium if score >= 0.45
+
+        :low
+      end
+
+      def observation_days
+        graph.observation.values.filter_map do |value|
+          next unless value.is_a?(Hash)
+
+          value['days'] || value[:days] || value['observation_days'] || value[:observation_days]
+        end.map(&:to_i).max
+      end
+
+      def quarantine_expired?(node)
+        since = quarantine_since(node)
+        return false unless since
+
+        since <= Date.today - project.config.quarantine_days
+      end
+
+      def quarantine_since(node)
+        path = File.join(project.root, node.file)
+        return nil unless File.exist?(path)
+
+        window = File.readlines(path, chomp: true)[[node.line - 4, 0].max, 4] || []
+        annotation = window.find { |line| line.include?('necropsy:quarantine') && line.match?(/\bsince=/) }
+        return nil unless annotation
+
+        Date.iso8601(annotation[/\bsince=([0-9-]+)/, 1])
+      rescue ArgumentError, SystemCallError
+        nil
+      end
+    end
+  end
+end

data/lib/necropsy/configuration.rb

@@ -0,0 +1,116 @@
+# frozen_string_literal: true
+
+require 'yaml'
+
+module Necropsy
+  class Configuration
+    DEFAULT_FAIL_ON = :high
+    DEFAULT_BASELINE = '.necropsy_baseline.yml'
+
+    attr_reader :root, :path, :data
+
+    def self.load(root:, path: nil)
+      config_path = path ? File.expand_path(path, root) : File.join(root, '.necropsy.yml')
+      data = File.exist?(config_path) ? YAML.load_file(config_path) : {}
+      new(root: root, path: config_path, data: data || {})
+    end
+
+    def initialize(root:, path:, data:)
+      @root = File.expand_path(root)
+      @path = path
+      @data = stringify_keys(data)
+    end
+
+    def static_analyzers
+      Array(fetch('analyzers', 'static') || %w[name_resolution cha rta]).map(&:to_s)
+    end
+
+    def dynamic_config(name)
+      fetch('analyzers', 'dynamic', name.to_s) || {}
+    end
+
+    def custom_analyzers
+      Array(fetch('analyzers', 'custom')).compact
+    end
+
+    def entry_point_patterns
+      Array(fetch('entry_points', 'extra')).compact.map(&:to_s)
+    end
+
+    def frameworks
+      Array(data['frameworks']).map(&:to_s)
+    end
+
+    def rails_enabled?
+      return true if frameworks.include?('rails')
+
+      gemfiles = [File.join(root, 'Gemfile.lock'), File.join(root, 'Gemfile')]
+      gemfiles.any? { |file| File.exist?(file) && File.read(file).match?(/(?:^|\s)rails(?:\s|\z|,)/) }
+    end
+
+    def baseline_path
+      fetch('ci', 'baseline') || DEFAULT_BASELINE
+    end
+
+    def fail_on
+      (fetch('ci', 'fail_on') || DEFAULT_FAIL_ON).to_sym
+    end
+
+    def min_observation_days
+      coverage_days = fetch('analyzers', 'dynamic', 'coverage', 'min_observation_days')
+      coverband_days = fetch('analyzers', 'dynamic', 'coverband', 'min_observation_days')
+      (coverage_days || coverband_days || 30).to_i
+    end
+
+    def quarantine_days
+      (fetch('quarantine', 'days') || 30).to_i
+    end
+
+    def bench_precision_threshold
+      (fetch('bench', 'precision_threshold') || 0.85).to_f
+    end
+
+    def bench_recall_threshold
+      value = fetch('bench', 'recall_threshold')
+      value&.to_f
+    end
+
+    def cache_enabled?
+      value = fetch('cache', 'enabled')
+      value.nil? || value != false
+    end
+
+    def cache_path
+      fetch('cache', 'path') || '.necropsy_cache/scan.yml'
+    end
+
+    def scan_cache_key
+      data.except('cache')
+    end
+
+    def factory_methods
+      Array(fetch('rta', 'factory_methods') || %w[build create build_stubbed]).map(&:to_s)
+    end
+
+    private
+
+    def fetch(*keys)
+      keys.reduce(data) do |current, key|
+        break nil unless current.is_a?(Hash)
+
+        current[key.to_s]
+      end
+    end
+
+    def stringify_keys(value)
+      case value
+      when Hash
+        value.each_with_object({}) { |(key, child), memo| memo[key.to_s] = stringify_keys(child) }
+      when Array
+        value.map { |child| stringify_keys(child) }
+      else
+        value
+      end
+    end
+  end
+end

data/lib/necropsy/coverage_runtime.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+require 'necropsy/analyzers/dynamic/coverage_collector'
+
+root = ENV.fetch('NECROPSY_COVERAGE_ROOT', nil)
+output = ENV.fetch('NECROPSY_COVERAGE_OUTPUT', nil)
+merge = ENV['NECROPSY_COVERAGE_MERGE'] == '1'
+run_id = ENV.fetch('NECROPSY_COVERAGE_RUN_ID', nil)
+
+if root && output
+  Necropsy::Analyzers::Dynamic::CoverageCollector.install_at_exit(root: root, output: output, merge: merge,
+                                                                  run_id: run_id)
+end

data/lib/necropsy/entry_points/plain.rb

@@ -0,0 +1,36 @@
+# frozen_string_literal: true
+
+module Necropsy
+  module EntryPoints
+    class Plain
+      SCRIPT_PATTERNS = [
+        'bin/*',
+        'exe/*',
+        'Rakefile',
+        '**/*.rake',
+        '*.gemspec'
+      ].freeze
+
+      def apply(graph, project)
+        graph.nodes.values.select { |node| node.kind == :block_entry && !node.test }.each do |node|
+          next unless SCRIPT_PATTERNS.any? { |pattern| File.fnmatch?(pattern, node.file, File::FNM_PATHNAME) }
+
+          graph.add_entry_point(node.id, :main_script)
+        end
+
+        project.config.entry_point_patterns.each do |pattern|
+          graph.nodes.each_key do |node_id|
+            graph.add_entry_point(node_id, :public_api_declared) if File.fnmatch?(pattern, node_id)
+          end
+        end
+
+        graph.method_nodes.each do |node|
+          next unless node.file == 'lib/necropsy.rb'
+          next unless node.kind == :singleton_method && node.owner == 'Necropsy'
+
+          graph.add_entry_point(node.id, :public_api_declared)
+        end
+      end
+    end
+  end
+end

data/lib/necropsy/entry_points/rails.rb

@@ -0,0 +1,335 @@
+# frozen_string_literal: true
+
+module Necropsy
+  module EntryPoints
+    class Rails
+      ROUTE_VERBS = %w[get post put patch delete match].freeze
+      RESTFUL_ACTIONS = %w[index show new create edit update destroy].freeze
+      SINGULAR_ACTIONS = %w[show new create edit update destroy].freeze
+      RouteContext = Struct.new(:modules, :resource, :controller, keyword_init: true)
+
+      def apply(graph, project)
+        return unless project.config.rails_enabled?
+
+        graph.method_nodes.each do |node|
+          case node.file
+          when %r{\Aapp/jobs/}
+            graph.add_entry_point(node.id, :job_perform) if node.name == 'perform'
+          when %r{\Aapp/mailers/}
+            graph.add_entry_point(node.id, :mailer_action) if node.kind == :instance_method
+          when %r{\Aapp/helpers/}
+            graph.add_entry_point(node.id, :rails_view_helper) if helper_referenced?(project, node.name)
+          when %r{\Aapp/components/}
+            graph.add_entry_point(node.id, :rails_component) if component_entrypoint?(node)
+          end
+        end
+
+        graph.nodes.values.select do |node|
+          node.kind == :block_entry && node.file.start_with?('config/initializers/')
+        end.each do |node|
+          graph.add_entry_point(node.id, :callback_registered)
+        end
+
+        route_entry_points(project).each do |node_id|
+          matching_route_nodes(graph, node_id).each do |matching_id|
+            graph.add_entry_point(matching_id, :rails_route)
+          end
+        end
+      end
+
+      private
+
+      def route_entry_points(project)
+        routes = File.join(project.root, 'config/routes.rb')
+        parse_route_file(project.root, routes, seen: {}, concerns: {})
+      end
+
+      def parse_route_file(root, path, seen:, concerns:)
+        expanded = File.expand_path(path, root)
+        return [] unless File.exist?(expanded)
+        return [] if seen[expanded]
+
+        seen[expanded] = true
+        parse_routes(File.readlines(expanded), root: root, seen: seen, concerns: concerns)
+      end
+
+      def parse_routes(lines, root:, seen:, concerns:, initial_context: RouteContext.new(modules: [], resource: nil))
+        contexts = [initial_context]
+        capture = nil
+        targets = []
+
+        lines.each do |line|
+          stripped = strip_route_comment(line).strip
+          next if stripped.empty?
+
+          if capture
+            capture[:depth] += block_openings(stripped)
+            capture[:depth] -= 1 if stripped == 'end'
+
+            if capture[:depth].zero?
+              concerns[capture[:name]] = capture[:lines]
+              capture = nil
+            else
+              capture[:lines] << stripped
+            end
+            next
+          end
+
+          if (match = stripped.match(/\bconcern\s+:([a-zA-Z_]\w*)\s+do\b/))
+            capture = { name: match[1], depth: 1, lines: [] }
+            next
+          end
+
+          if stripped == 'end'
+            contexts.pop if contexts.length > 1
+            next
+          end
+
+          context = contexts.last
+          targets.concat(route_targets(stripped, context))
+          targets.concat(route_file_targets(stripped, root, seen, concerns))
+          targets.concat(concern_targets(stripped, context, root, seen, concerns))
+          push_context(contexts, stripped, context)
+        end
+
+        targets.compact.uniq
+      end
+
+      def route_targets(line, context)
+        if (match = line.match(/\broot\s+["']([^#"']+)#([^"']+)["']/))
+          return [controller_action_id(route_controller(context, match[1]), match[2])]
+        end
+
+        if (match = line.match(/\b(?:#{ROUTE_VERBS.join('|')}|root)\b.*\bto:\s*["']([^#"']+)#([^"']+)["']/))
+          return [controller_action_id(route_controller(context, match[1]), match[2])]
+        end
+
+        if (target = controller_action_target(line, context))
+          return [target]
+        end
+
+        if (match = line.match(/\b(?:#{ROUTE_VERBS.join('|')}|root)\b.*=>\s*["']([^#"']+)#([^"']+)["']/))
+          return [controller_action_id(route_controller(context, match[1]), match[2])]
+        end
+
+        if (match = line.match(/\bmount\s+([A-Z][\w:]+)\s*(?:=>|,\s*at:)/))
+          return mounted_engine_targets(match[1])
+        end
+
+        if (match = line.match(%r{\b(?:#{ROUTE_VERBS.join('|')})\s+["']/?([a-zA-Z_][\w/]*)/([a-zA-Z_]\w*)["']}))
+          return [controller_action_id(route_controller(context, match[1]), match[2])]
+        end
+
+        if (match = line.match(/\bresources\s+:([a-zA-Z_]\w*)/))
+          controller = resource_controller(line, match[1])
+          return resource_actions(line, singular: false).map do |action|
+            controller_action_id(route_controller(context, controller), action)
+          end
+        end
+
+        if (match = line.match(/\bresource\s+:([a-zA-Z_]\w*)/))
+          controller = resource_controller(line, pluralize(match[1]))
+          return resource_actions(line, singular: true).map do |action|
+            controller_action_id(route_controller(context, controller), action)
+          end
+        end
+
+        if context.resource && (match = line.match(/\b(?:#{ROUTE_VERBS.join('|')})\s+:([a-zA-Z_]\w*)/))
+          return [controller_action_id(route_controller(context, context.resource), match[1])]
+        end
+
+        if context.controller && (match = line.match(/\b(?:#{ROUTE_VERBS.join('|')})\s+:?["']?([a-zA-Z_]\w*)/))
+          return [controller_action_id(route_controller(context, context.controller), match[1])]
+        end
+
+        []
+      end
+
+      def push_context(contexts, line, context)
+        if (match = line.match(/\bnamespace\s+:([a-zA-Z_]\w*)/))
+          contexts << RouteContext.new(modules: context.modules + [match[1]], resource: context.resource,
+                                       controller: context.controller)
+        elsif (match = line.match(/\bscope\b.*\bmodule:\s+:?["']?([a-zA-Z_]\w*)/))
+          contexts << RouteContext.new(modules: context.modules + [match[1]], resource: context.resource,
+                                       controller: scoped_controller_option(line, context.controller))
+        elsif (match = line.match(%r{\bcontroller\s+:?["']?([a-zA-Z_][\w/]*)["']?\s+do\b}))
+          contexts << RouteContext.new(modules: context.modules, resource: context.resource, controller: match[1])
+        elsif line.match?(/\bscope\b.*\bcontroller:\s*.*do\b/)
+          contexts << RouteContext.new(modules: context.modules, resource: context.resource,
+                                       controller: scoped_controller_option(line, context.controller))
+        elsif (match = line.match(/\bresources\s+:([a-zA-Z_]\w*).*do\b/))
+          contexts << RouteContext.new(modules: context.modules, resource: resource_controller(line, match[1]),
+                                       controller: context.controller)
+        elsif (match = line.match(/\bresource\s+:([a-zA-Z_]\w*).*do\b/))
+          contexts << RouteContext.new(modules: context.modules,
+                                       resource: resource_controller(line, pluralize(match[1])), controller: context.controller)
+        elsif line.match?(/\b(?:member|collection)\s+do\b/)
+          contexts << RouteContext.new(modules: context.modules, resource: context.resource,
+                                       controller: context.controller)
+        elsif line.match?(/\b(?:constraints|defaults|scope)\b.*do\b/)
+          contexts << RouteContext.new(modules: context.modules, resource: context.resource,
+                                       controller: scoped_controller_option(line, context.controller))
+        end
+      end
+
+      def route_file_targets(line, root, seen, concerns)
+        return [] unless (match = line.match(/\bdraw\s+:?["']?([a-zA-Z_]\w*)/))
+
+        parse_route_file(root, File.join(root, "config/routes/#{match[1]}.rb"), seen: seen, concerns: concerns)
+      end
+
+      def concern_targets(line, context, root, seen, concerns)
+        target_context = concern_context(line, context)
+        concern_names(line).flat_map do |name|
+          parse_routes(concerns.fetch(name, []), root: root, seen: seen, concerns: concerns,
+                                                 initial_context: target_context)
+        end
+      end
+
+      def concern_context(line, context)
+        if (match = line.match(/\bresources\s+:([a-zA-Z_]\w*)/))
+          return RouteContext.new(modules: context.modules, resource: resource_controller(line, match[1]),
+                                  controller: context.controller)
+        end
+
+        if (match = line.match(/\bresource\s+:([a-zA-Z_]\w*)/))
+          return RouteContext.new(modules: context.modules, resource: resource_controller(line, pluralize(match[1])),
+                                  controller: context.controller)
+        end
+
+        context
+      end
+
+      def concern_names(line)
+        names = line.scan(/\bconcerns?\s+:([a-zA-Z_]\w*)/).flatten
+        names.concat(line.scan(/\bconcerns?:\s+:([a-zA-Z_]\w*)/).flatten)
+        if (array_value = line[/\bconcerns?:\s*\[([^\]]+)\]/, 1])
+          names.concat(array_value.scan(/:([a-zA-Z_]\w*)/).flatten)
+        end
+        names.uniq
+      end
+
+      def resource_actions(line, singular:)
+        return action_option(line, 'only') if line.include?('only:')
+
+        excluded = action_option(line, 'except')
+        (singular ? SINGULAR_ACTIONS : RESTFUL_ACTIONS) - excluded
+      end
+
+      def action_option(line, name)
+        array_value = line[/\b#{name}:\s*(?:\[([^\]]+)\]|%i\[([^\]]+)\])/, 1] ||
+                      line[/\b#{name}:\s*(?:\[([^\]]+)\]|%i\[([^\]]+)\])/, 2]
+        return array_value.scan(/:?["']?([a-zA-Z_]\w*)["']?/) if array_value
+
+        Array(line[/\b#{name}:\s+:?["']?([a-zA-Z_]\w*)/, 1])
+      end
+
+      def resource_controller(line, fallback)
+        line[/\bcontroller:\s*["']([^"']+)["']/, 1] || fallback
+      end
+
+      def scoped_controller_option(line, fallback)
+        line[%r{\bcontroller:\s+:?["']?([a-zA-Z_][\w/]*)}, 1] || fallback
+      end
+
+      def scoped_controller(context, controller)
+        [*context.modules, controller].join('/')
+      end
+
+      def route_controller(context, controller)
+        return controller.delete_prefix('/') if controller.start_with?('/')
+        return controller if controller.include?('/')
+
+        scoped_controller(context, controller)
+      end
+
+      def controller_action_target(line, context)
+        controller = line[%r{\bcontroller:\s+:?["']?([a-zA-Z_][\w/]*)}, 1]
+        action = line[/\baction:\s+:?["']?([a-zA-Z_]\w*)/, 1]
+        controller ||= context.controller
+        return nil unless controller && action
+
+        controller_action_id(route_controller(context, controller), action)
+      end
+
+      def mounted_engine_targets(engine_name)
+        ["#{engine_name}.call", "#{engine_name}#call"]
+      end
+
+      def pluralize(name)
+        return "#{name}es" if name.end_with?('s', 'x', 'z', 'ch', 'sh')
+        return "#{name.delete_suffix('y')}ies" if name.end_with?('y')
+
+        "#{name}s"
+      end
+
+      def controller_action_id(controller_path, action)
+        "#{camelize(controller_path)}Controller##{action}"
+      end
+
+      def matching_route_nodes(graph, node_id)
+        return [node_id] if graph.nodes.key?(node_id)
+
+        suffix = "::#{node_id}"
+        graph.nodes.keys.select { |candidate| candidate.end_with?(suffix) }
+      end
+
+      def helper_referenced?(project, method_name)
+        view_files(project).any? do |path|
+          view_source(path).match?(/\b#{Regexp.escape(method_name)}\b/)
+        end
+      rescue SystemCallError, EncodingError
+        false
+      end
+
+      def view_files(project)
+        Dir.glob(File.join(project.root, '{app/views,app/components}/**/*')).select { |path| File.file?(path) }
+      end
+
+      def view_source(path)
+        File.read(path)
+            .gsub(/<%#.*?%>/m, '')
+            .gsub(/<!--.*?-->/m, '')
+            .lines.reject { |line| line.strip.start_with?('-#') }.join
+      end
+
+      def component_entrypoint?(node)
+        node.kind == :instance_method && %w[call render? before_render].include?(node.name)
+      end
+
+      def camelize(path)
+        path.split('/').map { |part| part.split('_').map(&:capitalize).join }.join('::')
+      end
+
+      def block_openings(line)
+        line.scan(/\bdo\b/).length
+      end
+
+      def strip_route_comment(line)
+        quote = nil
+        escaped = false
+        line.each_char.with_index do |char, index|
+          if escaped
+            escaped = false
+            next
+          end
+
+          if char == '\\'
+            escaped = true
+            next
+          end
+
+          if quote
+            quote = nil if char == quote
+            next
+          end
+
+          quote = char if ["'", '"'].include?(char)
+          return line[0...index] if char == '#'
+        end
+
+        line
+      end
+    end
+  end
+end

data/lib/necropsy/entry_points/test.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Necropsy
+  module EntryPoints
+    class Test
+      def apply(graph, _project)
+        graph.nodes.values.select { |node| node.kind == :block_entry && node.test }.each do |node|
+          graph.add_entry_point(node.id, :test_suite)
+        end
+      end
+    end
+  end
+end