panolint 0.1.0 → 0.1.4

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d105b6c29c1e4f554308503e7c8ec1f1e55de7ccafb67bd24b733a6e233b484a
-  data.tar.gz: b9420c644510fac68763f8cf8fb8a175b3fa0c30012bc0f7f3ff7b3da44e246f
+  metadata.gz: a7bcaf44939e18713d7b9072ee3236b2508388b4fd061240d6ec1bc704c44a6e
+  data.tar.gz: 90f7a81732f9f894ddfe08019a40ed6bf889150f9a7422b10090419d346bc683
 SHA512:
-  metadata.gz: eaa48d827a15f87b9120af91273780f9451cb13e471399518e3a143899d56ddfd704bb365bfd2284be07b0e888c1313f3770a514fd0d3c117463a32890fd3537
-  data.tar.gz: abf1ed9a4ba750f2ebb23cea8fa0d381a4f1ffaf423115136d098629b086de22515f900882a8333466916f749f4a54347e3cda83716ce09bc502392d99605b64
+  metadata.gz: c9a0b75079305a13426a1261f30326001ddf50685634314ebd8714690b24bbbc124acd3b6004d02979db160294abab01c91ac3fc0b784f21e1eba6612e7f77c5
+  data.tar.gz: 222e53ef2cb0a74c4e2a0c00e6e5eff97c4c9feed130d39c0c91aa2485b1be95dd5b14c4f16f5ebb42d873dd5ba2969fe8b3e7df3610a2fa3fafffd9e7e9c42a

data/.dependabot/config.yml

@@ -0,0 +1,46 @@
+# This is a dependabot configuration file. When this file is seen on github, a
+# dependabot configuration is created for the project. We can use this to
+# control various aspects of the automated dependency checking, such as the
+# frequency and the target_branch.
+#
+# Reference: https://dependabot.com/docs/config-file/
+version: 1
+update_configs:
+  # This configures dependency updates for one package manager. In some
+  # projects, such as warehouse, where we have Ruby and Python, there can be
+  # separate package_manager entries.
+  - package_manager: "ruby:bundler"
+    directory: "/"
+    update_schedule: "weekly"
+
+    default_labels:
+      - "dependencies"
+      - "Needs QA"
+
+    # Dependabot will use a repository's default branch. This will override
+    # that.
+    # target_branch: "master"
+
+    allowed_updates:
+      - match:
+          dependency_type: "direct"
+
+    automerged_updates:
+      # This allows all dependencies that are used for development, e.g., rspec,
+      # rspec-mock, vcr, etc, to be automatically updated. This is generally
+      # okay because the dependencies are not used in production.
+      - match:
+          dependency_type: "all"
+          update_type: "all"
+
+    #   # This is an example entry to enable automerging of a specific dependency
+    #   # when the update is only for minor or patch semantic versions.
+    #   #
+    #   # The dependency_name can also be a wildcard.
+    #   #
+    #   # This is left commented, but whitelisting a dependency for automatic
+    #   # merging is as simple as creating a new entry that looks like the below.
+    #   - match:
+    #       dependency_type: "all"
+    #       dependency_name: "aws-sdk-s3"
+    #       update_type: "semver:minor"

data/.github/workflows/auto-approve-dependabot.yml

@@ -0,0 +1,26 @@
+# This workflow auto-approves pull-requests when the github actor is a
+# dependabot user and it is opening a new pull request.
+#
+# The problem that this workflow solves is that we have branch protection on
+# our repositories that prevent PRs from merging unless there is an
+# approval present. The problem is that this will block PRs that dependabot
+# may want to merge automatically. Auto-approving dependabot PRs will allow
+# the automatic merge to complete. We control what gets automerged through
+# the dependabot configuration.
+#
+# This is a known issue: https://github.com/dependabot/feedback/issues/852
+name: Auto-approve dependabot pull requests
+on:
+  pull_request:
+    types: [opened]
+
+jobs:
+  dependabot-triage:
+    runs-on: ubuntu-latest
+    if: (github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]')
+
+    steps:
+      - name: Auto-approve for dependabot
+        uses: hmarr/auto-approve-action@v2.0.0
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"

data/.github/workflows/remove-needs-qa.yml

@@ -0,0 +1,35 @@
+# This workflow removes a "Needs QA" label from a PR when the actor is the
+# dependabot user merging a PR.
+#
+# We need this mechanism to allow for automerging whitelisted dependencies while
+# also allowing for blocking a merge to master for deployment (in the way that
+# our other PRs work). When the automerge script runs in henchman, it looks
+# for `Needs QA` on github pull requests, and if the label is present,
+# blocks the commit from merging.
+name: Remove 'Needs QA' label for auto-merged PRs.
+on:
+  pull_request:
+    types: [closed]
+
+jobs:
+  remove-label:
+    runs-on: ubuntu-latest
+    if: >
+      (github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]')
+      && github.event.pull_request.merged
+
+    steps:
+      # Our triage workflow adds 'Needs QA' to the PR in order to block it from
+      # merging to production. This removes that label when dependabot is doing
+      # the merging.
+      - name: Remove QA Label
+        uses: actions/github-script@0.4.0
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          script: |
+            github.issues.removeLabel({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              name: 'Needs QA'
+            })

data/.github/workflows/{main.yml → tests.yml}

@@ -19,5 +19,5 @@ jobs:
           ${{ runner.os }}-gems-
     - run: bundle config path vendor/bundle
     - run: bundle install --jobs 4 --retry 3
-    - run: bundle exec rubocop
+    - run: bundle exec rubocop --config panolint-rubocop.yml
     - run: bundle exec rspec

data/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/) and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.3] - 2021-04-22
+
+## [0.1.2] - 2020-04-10
+
+### Changed
+
+- The `panolint.yml` file renamed to `rubocop.yml`.
+- Add `brakeman` and instructions for running it.
+
+## [0.1.1] - 2020-04-10
+
+### Changed
+
+- Explicitly ignore the `Naming/FileName` rule on `.overcommit/Gemfile` files.
+- Change the config name from `.rubocop.yml` to `panolint.yml`.
+
+## [0.1.0] - 2020-04-09
+
+### Added
+
+- Initial release. 🎉
+
+[unreleased]: https://github.com/panorama-ed/panolint/compare/v0.1.3...HEAD
+[0.1.3]: https://github.com/panorama-ed/panolint/compare/v0.1.2...v0.1.3
+[0.1.2]: https://github.com/panorama-ed/panolint/compare/v0.1.1...v0.1.2
+[0.1.1]: https://github.com/panorama-ed/panolint/compare/v0.1.0...v0.1.1
+[0.1.0]: https://github.com/panorama-ed/panolint/compare/45c38b...v0.1.0

data/Gemfile.lock

@@ -1,70 +1,78 @@
 PATH
   remote: .
   specs:
-    panolint (0.1.0)
-      rubocop (~> 0.81)
+    panolint (0.1.4)
+      brakeman (>= 4.8, < 6.0)
+      rubocop (>= 0.83, < 2.0)
       rubocop-performance (~> 1.5)
       rubocop-rails (~> 2.5)
-      rubocop-rspec (~> 1.38)
+      rubocop-rake (~> 0.5)
+      rubocop-rspec (~> 2.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (6.0.2.2)
+    activesupport (6.1.4.1)
       concurrent-ruby (~> 1.0, >= 1.0.2)
-      i18n (>= 0.7, < 2)
-      minitest (~> 5.1)
-      tzinfo (~> 1.1)
-      zeitwerk (~> 2.2)
-    ast (2.4.0)
-    concurrent-ruby (1.1.6)
-    diff-lcs (1.3)
-    i18n (1.8.2)
+      i18n (>= 1.6, < 2)
+      minitest (>= 5.1)
+      tzinfo (~> 2.0)
+      zeitwerk (~> 2.3)
+    ast (2.4.2)
+    brakeman (5.1.2)
+    concurrent-ruby (1.1.9)
+    diff-lcs (1.4.4)
+    i18n (1.8.11)
       concurrent-ruby (~> 1.0)
-    jaro_winkler (1.5.4)
-    minitest (5.14.0)
-    parallel (1.19.1)
-    parser (2.7.1.0)
-      ast (~> 2.4.0)
-    rack (2.2.2)
+    minitest (5.14.4)
+    parallel (1.21.0)
+    parser (3.0.2.0)
+      ast (~> 2.4.1)
+    rack (2.2.3)
     rainbow (3.0.0)
-    rake (13.0.1)
-    rexml (3.2.4)
-    rspec (3.9.0)
-      rspec-core (~> 3.9.0)
-      rspec-expectations (~> 3.9.0)
-      rspec-mocks (~> 3.9.0)
-    rspec-core (3.9.1)
-      rspec-support (~> 3.9.1)
-    rspec-expectations (3.9.1)
+    rake (13.0.6)
+    regexp_parser (2.1.1)
+    rexml (3.2.5)
+    rspec (3.10.0)
+      rspec-core (~> 3.10.0)
+      rspec-expectations (~> 3.10.0)
+      rspec-mocks (~> 3.10.0)
+    rspec-core (3.10.0)
+      rspec-support (~> 3.10.0)
+    rspec-expectations (3.10.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-mocks (3.9.1)
+      rspec-support (~> 3.10.0)
+    rspec-mocks (3.10.0)
       diff-lcs (>= 1.2.0, < 2.0)
-      rspec-support (~> 3.9.0)
-    rspec-support (3.9.2)
-    rubocop (0.81.0)
-      jaro_winkler (~> 1.5.1)
+      rspec-support (~> 3.10.0)
+    rspec-support (3.10.0)
+    rubocop (1.22.1)
       parallel (~> 1.10)
-      parser (>= 2.7.0.1)
+      parser (>= 3.0.0.0)
       rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 1.8, < 3.0)
       rexml
+      rubocop-ast (>= 1.12.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 2.0)
-    rubocop-performance (1.5.2)
-      rubocop (>= 0.71.0)
-    rubocop-rails (2.5.2)
-      activesupport
+      unicode-display_width (>= 1.4.0, < 3.0)
+    rubocop-ast (1.13.0)
+      parser (>= 3.0.1.1)
+    rubocop-performance (1.11.5)
+      rubocop (>= 1.7.0, < 2.0)
+      rubocop-ast (>= 0.4.0)
+    rubocop-rails (2.12.2)
+      activesupport (>= 4.2.0)
       rack (>= 1.1)
-      rubocop (>= 0.72.0)
-    rubocop-rspec (1.38.1)
-      rubocop (>= 0.68.1)
-    ruby-progressbar (1.10.1)
-    thread_safe (0.3.6)
-    tzinfo (1.2.7)
-      thread_safe (~> 0.1)
-    unicode-display_width (1.7.0)
-    zeitwerk (2.3.0)
+      rubocop (>= 1.7.0, < 2.0)
+    rubocop-rake (0.6.0)
+      rubocop (~> 1.0)
+    rubocop-rspec (2.5.0)
+      rubocop (~> 1.19)
+    ruby-progressbar (1.11.0)
+    tzinfo (2.0.4)
+      concurrent-ruby (~> 1.0)
+    unicode-display_width (2.1.0)
+    zeitwerk (2.5.1)
 
 PLATFORMS
   ruby
@@ -76,4 +84,4 @@ DEPENDENCIES
   rspec (~> 3.0)
 
 BUNDLED WITH
-   2.1.4
+   2.2.29

data/README.md

@@ -1,5 +1,8 @@
 # Panolint
 
+[![Build Status](https://github.com/panorama-ed/panolint/workflows/Main/badge.svg)](https://github.com/panorama-ed/panolint/actions)
+[![Gem Version](https://img.shields.io/gem/v/panolint.svg)](https://github.com/panorama-ed/panolint)
+
 A small gem containing rules for linting code at Panorama Education.
 
 ## Installation
@@ -20,13 +23,25 @@ Or install it yourself as:
 
 ## Usage
 
-You can use this in your project's `.rubocop.yml` with the following at the top:
+### `brakeman`
+
+You can use `panolint`'s `brakeman` configuration in your project by pointing the `brakeman` run at the configuration file in this repo:
+
+```
+$ bundle exec brakeman -c "$(bundle show brakeman)/brakeman.yml"
+```
+
+### `rubocop`
+
+You can use `panolint`'s rubocop configuration in your project with the following addition to the top of your project's `.rubocop.yml`:
 
 ```
 inherit_gem:
-  panolint: .rubocop.yml
+  panolint: panolint-rubocop.yml
 ```
 
+Note that it for this gem in particular in needs to not be a `.rubocop.yml` file because of rubocop's [path relativity](https://github.com/rubocop-hq/rubocop/blob/master/manual/configuration.md#path-relativity).
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/brakeman.yml

@@ -0,0 +1,13 @@
+---
+:ensure_latest: true # From brakeman --help: "Fail when Brakeman is outdated"
+:run_all_checks: true # "Run all default and optional checks"
+:branch_limit: -1 # "Limit depth of values in branches (-1 for no limit)"
+
+# The brakeman wiki says this option "enables deeper data flow analysis by
+# allowing Brakeman to inspect called methods and attempt to determine the
+# return value of the call."
+:interprocedural: true
+:additional_libs_path:
+# This ensures brakeman is run on all files, not just those in standard Rails
+# directories.
+- .

data/lib/panolint/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Panolint
-  VERSION = "0.1.0"
+  VERSION = "0.1.4"
 end

data/{.rubocop.yml → panolint-rubocop.yml}

@@ -3,7 +3,7 @@
 # You can use this in your project's .rubocop.yml with the following at the top:
 #
 #     inherit_gem:
-#       panolint: .rubocop.yml
+#       panolint: panolint-rubocop.yml
 #
 # This allows you to selectively override settings in projects, for example, if
 # you're working on a Sinatra project, disabling the Rails cops is probably
@@ -18,6 +18,11 @@ AllCops:
     - !ruby/regexp /vendor\/(?!panoramaed).*$/
     - "db/schema.rb"
     - "db/migrate/**/*"
+    - "node_modules/**/*"
+  NewCops: enable
+
+Gemspec/RequiredRubyVersion:
+  Enabled: false
 
 Layout/DotPosition:
   EnforcedStyle: trailing
@@ -33,6 +38,12 @@ Lint/AmbiguousBlockAssociation:
 Lint/Debugger:
   Severity: error
 
+Lint/DuplicateElsifCondition:
+  Enabled: true
+
+Lint/MixedRegexpCaptureTypes:
+  Enabled: true
+
 Lint/SuppressedException:
   Enabled: false
 
@@ -65,6 +76,10 @@ Metrics/PerceivedComplexity:
 Naming/BinaryOperatorParameterName:
   Enabled: false
 
+Naming/FileName:
+  Exclude:
+    - .overcommit/Gemfile
+
 RSpec/ExpectChange:
   Enabled: false
 
@@ -77,6 +92,9 @@ RSpec/LetSetup:
 RSpec/MessageSpies:
   EnforcedStyle: receive
 
+RSpec/MultipleMemoizedHelpers:
+  Enabled: false
+
 RSpec/NamedSubject:
   Enabled: false
 
@@ -87,6 +105,12 @@ Style/Alias:
   Enabled: true
   EnforcedStyle: prefer_alias_method
 
+Style/ArrayCoercion:
+  Enabled: true
+
+Style/CaseLikeIf:
+  Enabled: true
+
 Style/Documentation:
   Enabled: false
 
@@ -102,6 +126,9 @@ Style/FormatString:
 Style/GuardClause:
   Enabled: false
 
+Style/HashAsLastArrayItem:
+  Enabled: true
+
 Style/MixinUsage:
   Exclude:
     - bin/**/*
@@ -109,6 +136,15 @@ Style/MixinUsage:
 Style/MultilineBlockChain:
   Enabled: false
 
+Style/RedundantFileExtensionInRequire:
+  Enabled: true
+
+Style/RedundantRegexpCharacterClass:
+  Enabled: true
+
+Style/RedundantRegexpEscape:
+  Enabled: true
+
 Style/RedundantReturn:
   AllowMultipleReturnValues: true
 
@@ -148,12 +184,24 @@ RSpec/MultipleExpectations:
 # following rules all mirror the default rubocop configuration, but they're here
 # just to silence the warnings. They can be removed when 1.0 comes out.
 
+Lint/DeprecatedOpenSSLConstant:
+  Enabled: true
+
+Layout/EmptyLinesAroundAttributeAccessor:
+  Enabled: true
+
+Layout/SpaceAroundMethodCallOperator:
+  Enabled: true
+
 Lint/RaiseException:
   Enabled: true
 
 Lint/StructNewOverride:
   Enabled: true
 
+Style/ExponentialNotation:
+  Enabled: true
+
 Style/HashEachMethods:
   Enabled: true
 
@@ -162,3 +210,6 @@ Style/HashTransformKeys:
 
 Style/HashTransformValues:
   Enabled: true
+
+Style/SlicingWithRange:
+  Enabled: true

data/panolint.gemspec

@@ -13,6 +13,7 @@ Gem::Specification.new do |spec|
   spec.summary       = "Rules for linting code at Panorama Education"
   spec.homepage      = "https://github.com/panorama-ed/panolint"
   spec.license       = "MIT"
+  spec.metadata      = { "rubygems_mfa_required" => "true" }
 
   spec.files         = Dir.chdir(File.expand_path(__dir__)) do
     `git ls-files -z`.split("\x0").reject do |f|
@@ -24,10 +25,12 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_dependency "rubocop", "~> 0.81"
+  spec.add_dependency "brakeman", ">= 4.8", "< 6.0"
+  spec.add_dependency "rubocop", ">= 0.83", "< 2.0"
   spec.add_dependency "rubocop-performance", "~> 1.5"
   spec.add_dependency "rubocop-rails", "~> 2.5"
-  spec.add_dependency "rubocop-rspec", "~> 1.38"
+  spec.add_dependency "rubocop-rake", "~> 0.5"
+  spec.add_dependency "rubocop-rspec", "~> 2.0"
 
   spec.add_development_dependency "bundler", "~> 2.1"
   spec.add_development_dependency "rake", "~> 13.0"

metadata

@@ -1,29 +1,55 @@
 --- !ruby/object:Gem::Specification
 name: panolint
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.4
 platform: ruby
 authors:
 - Kevin Deisz
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-04-09 00:00:00.000000000 Z
+date: 2021-12-03 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: brakeman
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4.8'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '6.0'
 - !ruby/object:Gem::Dependency
   name: rubocop
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.83'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.81'
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0.83'
+    - - "<"
       - !ruby/object:Gem::Version
-        version: '0.81'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: rubocop-performance
   requirement: !ruby/object:Gem::Requirement
@@ -52,20 +78,34 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '2.5'
+- !ruby/object:Gem::Dependency
+  name: rubocop-rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.5'
 - !ruby/object:Gem::Dependency
   name: rubocop-rspec
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.38'
+        version: '2.0'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.38'
+        version: '2.0'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -115,10 +155,13 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".github/workflows/main.yml"
+- ".dependabot/config.yml"
+- ".github/workflows/auto-approve-dependabot.yml"
+- ".github/workflows/remove-needs-qa.yml"
+- ".github/workflows/tests.yml"
 - ".gitignore"
 - ".rspec"
-- ".rubocop.yml"
+- CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
 - Gemfile.lock
@@ -127,13 +170,16 @@ files:
 - Rakefile
 - bin/console
 - bin/setup
+- brakeman.yml
 - lib/panolint.rb
 - lib/panolint/version.rb
+- panolint-rubocop.yml
 - panolint.gemspec
 homepage: https://github.com/panorama-ed/panolint
 licenses:
 - MIT
-metadata: {}
+metadata:
+  rubygems_mfa_required: 'true'
 post_install_message: 
 rdoc_options: []
 require_paths:
@@ -149,7 +195,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.0.3
 signing_key: 
 specification_version: 4
 summary: Rules for linting code at Panorama Education