puppet-lint-roles-profiles 0.0.1

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: 8b945872a2eb66807e4b1d9ecb5f96ad20dc03ce
+  data.tar.gz: e5c4b11b9c66a5b85581a3bc7ae48780670d3823
+SHA512:
+  metadata.gz: 9e40e268d84f92c85cca3ed00402e02c4a1a6c594e975908e44bcbbaa77406c3bd647c5b2a8afd5b53b8dd59a5d2010c87b8839877ddce048282634976a6ce08
+  data.tar.gz: df7b1bdbad9ba0810c5027b7c058c5dbf8e6e135a42cb77a244d0c3aef421459a3ee0fe4e4c6ef20660b9e221491edcb317276de79a7ac3e8667582b40369fb9

data/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Tim Sharpe
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,77 @@
+# puppet-lint-roles-profiles
+
+This plugin validates that the code base adheres to the roles and profiles
+workflow[1].
+
+## Installation
+
+To use this plugin, add the following line to the Gemfile in your Puppet code
+base and run `bundle install`.
+
+```ruby
+gem 'puppet-lint-roles-profiles'
+```
+
+## Usage
+
+### roles_include_profiles
+
+**--fix-support: No**
+
+Will raise a warning if a roles does anything other than `include` `profile`s.
+Resource like class definitions will also raise an error.
+
+```
+WARNING: roles must only include profiles
+```
+
+What you did:
+
+```puppet
+class role::foo {
+  class { 'ssh': }
+```
+
+or:
+
+```puppet
+class role::foo {
+  class { 'profile::ssh': }
+}
+```
+
+What you should have done:
+
+```
+class role::foo {
+  include profile::ssh
+}
+```
+
+### roles_with_params
+
+**--fix-support: No**
+
+Will raise a warning when a role has class parameters
+
+```
+Warning: roles must not have any parameters
+```
+
+### roles_inherits_roles
+
+**--fix-support: No**
+
+Will raise a warning when a role inherits something other than a role
+
+### nodes_include_one_role
+
+**--fix-support: No**
+
+Will raise a warning when a node definition contains more than one role
+`include` (except comments).
+
+## References
+
+[1] https://puppet.com/docs/pe/2017.2/r_n_p_full_example.html
+

data/lib/puppet-lint/plugins/check_roles_profiles.rb

@@ -0,0 +1,86 @@
+PuppetLint.new_check(:roles_with_params) do
+  def check
+    class_indexes.select { |c| c[:name_token].value =~ /^roles?(::|$)/ }.each do |c|
+      next if c[:param_tokens].nil?
+      # breaks when roles have params that have variables as defaults
+      c[:param_tokens].select { |t| t.type == :VARIABLE }.each do |t|
+        notify :warning, {
+          :message => 'roles must not have parameters',
+          :line => t.line,
+          :column => t.column,
+        }
+      end
+    end
+  end
+end
+
+PuppetLint.new_check(:roles_include_profiles) do
+  def check
+    class_indexes.select { |c| c[:name_token].value =~ /^roles?(::|$)/ }.each do |c|
+      # As only `include profile` is allowed any resource is bad
+      resource_indexes.select { |r| r[:start] >= c[:start] and r[:end] <= c[:end] }.each do |r|
+        notify :warning, {
+          :message => "Roles must only `include profiles`",
+          :line => r[:type].line,
+          :column => r[:type].column,
+        }
+      end
+      # each include must be followed with a profile
+      tokens[c[:start]..c[:end]].select { |t| t.value == 'include' }.each do |t|
+        unless t.next_code_token.value =~ /^(::)?profiles?(::|$)/
+          notify :warning, {
+            :message => "Roles must only `include profiles`",
+            :line => t.line,
+            :column => t.column
+          }
+        end
+      end
+      # Conditional logic should be avoided
+      tokens[c[:start]..c[:end]].select { |t| [ :IF, :ELSE, :ELSIF, :UNLESS, :CASE].include?(t.type) }.each do |t|
+        notify :warning, {
+          :message => "Roles must only `include profiles`",
+          :line => t.line,
+          :column => t.column
+        }
+      end
+    end
+  end
+end
+
+PuppetLint.new_check(:roles_inherits_roles) do
+  def check
+    class_indexes.select { |c| c[:name_token].value =~ /^roles?(::|$)/ }.each do |c|
+      if c[:inherited_token] and ! (c[:inherited_token].value =~ /^(::)?roles?(::|$)/)
+        notify :warning, {
+          :message => "Roles must only inherit other roles",
+          :line => c[:inherited_token].line,
+          :column => c[:inherited_token].column
+        }
+      end
+    end
+  end
+end
+
+PuppetLint.new_check(:nodes_include_one_role) do
+  def check
+    node_indexes.each do |n|
+      tokens = n[:tokens].select { |t|
+        ![ :NEWLINE, :WHITESPACE, :INDENT, :COMMENT, :MLCOMMENT, :SLASH_COMMENT].include?(t.type)
+      }
+      ibs = tokens.find_index { |t| t.type == :LBRACE }
+      # as we have filtered out all whitespace and only allow one role include per node def
+      # the only option for the token serie is: [ '{', 'include', 'role', '}' ] and everything
+      # else is an error
+      unless (tokens[ibs].type == :LBRACE and
+        tokens[ibs+1].value == 'include' and
+        tokens[ibs+2].type == :NAME and tokens[ibs+2].value =~ /^(::)?roles?(::|$)/ and
+        tokens[ibs+3].type == :RBRACE)
+          notify :warning, {
+            :message => "Nodes must only include roles",
+            :line => tokens[ibs+1].line,
+            :column => tokens[ibs+1].column,
+          }
+      end
+    end
+  end
+end

data/spec/puppet-lint/plugins/check_nodes_include_one_role_spec.rb

@@ -0,0 +1,64 @@
+require 'spec_helper'
+
+describe 'nodes_include_one_role' do
+  let(:msg) { 'nodes must only include roles' }
+  context 'node with role' do
+    let(:code) { 'node /some.machine/ { include role::ssh }' }
+    it 'should not be a problem' do
+      expect(problems).to have(0).problem
+    end
+  end
+  context 'node with profile' do
+    let(:code) { 'node /some.machine/ { include profile::ssh }' }
+    it 'should be a problem' do
+      expect(problems).to have(1).problem
+    end
+  end
+  context "node with multiple roles" do
+    let(:code) do
+      <<-EOL
+node 'somemachine' {
+  include role::ssh
+  include role::ssh2
+}
+EOL
+    end
+    it 'should be a problem' do
+      expect(problems).to have(1).problem
+    end
+  end
+  context "node with multiple inline comments" do
+    let(:code) do
+      <<-EOL
+node 'somemachine' {
+# good descriptions
+# go here
+  include role::ssh
+# and here
+# more
+}
+EOL
+    end
+    it 'should not be a problem' do
+      expect(problems).to have(0).problem
+    end
+  end
+  context "node with comments and multiple includes" do
+    let(:code) do
+      <<-EOL
+# comments
+node 'somemachine' {
+# good descriptions
+# go here
+  include role::ssh
+# and here
+  include profile::ssh
+# more
+}
+EOL
+    end
+    it 'should be a problem' do
+      expect(problems).to have(1).problem
+    end
+  end
+end

data/spec/puppet-lint/plugins/check_roles_include_profiles_spec.rb

@@ -0,0 +1,86 @@
+require 'spec_helper'
+
+describe 'roles_include_profiles' do
+  let(:msg) { 'roles must only `include profiles`' }
+  [ 'role', 'roles' ].each do | rt |
+    context "#{rt} without body" do
+      let(:code) { "class #{rt}() {}" }
+      it 'should not be a problem' do
+        expect(problems).to have(0).problem
+      end
+    end
+    context "nested #{rt} without body" do
+      let(:code) { "class #{rt}::example() {}" }
+      it 'should not be a problem' do
+        expect(problems).to have(0).problem
+      end
+    end
+    context "#{rt} including a profile" do
+      let(:code) { "class #{rt}() { include profile::example }" }
+      it 'should not be a problem' do
+        expect(problems).to have(0).problem
+      end
+    end
+    context "#{rt} including a topscope profile" do
+      let(:code) { "class #{rt}() { include ::profile::example }" }
+      it 'should not be a problem' do
+        expect(problems).to have(0).problem
+      end
+    end
+    context "#{rt} resource like profile" do
+      let(:code) { "class #{rt}() { class { 'profile::example': } }" }
+      it 'should be a problem' do
+        expect(problems).to have(1).problem
+      end
+    end
+    context "#{rt} with profiles mixed include and resource-like" do
+      let(:code) do
+        <<-EOL
+class role::test {
+  include profile::abc
+  class { 'profile::def': }
+  include profile::xyz
+}
+EOL
+      end
+      it 'should be a problem' do
+        expect(problems).to have(1).problem
+      end
+    end
+    context "#{rt} with non profiles mixed include and resource-like" do
+      let(:code) do
+        <<-EOL
+class role::test {
+  include profile::ssh
+  include ssh::abc
+  class { 'mysql::def': }
+  include profile::xyz
+  # include xyz
+}
+EOL
+      end
+      it 'should be a problem' do
+        expect(problems).to have(2).problem
+      end
+    end
+    context "#{rt} with conditional logic" do
+      let(:code) do
+        <<-EOL
+class role::test {
+  if $x == 1 {
+    include profile::ssh
+  } else {
+    include ssh::abc
+  }
+  class { 'mysql::def': }
+  include profile::xyz
+  # include xyz
+}
+EOL
+      end
+      it 'should be a problem' do
+        expect(problems).to have(4).problem
+      end
+    end
+  end
+end

data/spec/puppet-lint/plugins/check_roles_inherits_roles_spec.rb

@@ -0,0 +1,28 @@
+require 'spec_helper'
+
+describe 'roles_inherits_roles' do
+  let(:msg) { 'roles must only `include profiles`' }
+  [ 'role', 'roles' ].each do | rt |
+    context "#{rt} without inherit" do
+      let(:code) { "class #{rt}() {}" }
+      it 'should not be a problem' do
+        expect(problems).to have(0).problem
+      end
+    end
+    [
+      [ "role", 0 ],
+      [ "roles", 0 ],
+      [ "profile", 1 ],
+      [ "ssh", 1 ],
+      [ "::role", 0 ],
+      [ "::roles", 0 ],
+      [ "::role::ssh", 0 ],
+      [ "rolex", 1 ],
+    ].each do | data |
+      context "#{rt} with inherit #{data[0]}" do
+        let(:code) { "class #{rt} inherits #{data[0]}{}" }
+        it { expect(problems).to have(data[1]).problem }
+      end 
+    end
+  end
+end

data/spec/puppet-lint/plugins/check_roles_with_params_spec.rb

@@ -0,0 +1,44 @@
+require 'spec_helper'
+
+describe 'roles_with_params' do
+  let(:msg) { 'roles must not have parameters' }
+  [ 'role', 'roles' ].each do | rt |
+    context "#{rt} without body" do
+      let(:code) { "class #{rt}() {}" }
+      it 'should not be a problem' do
+        expect(problems).to have(0).problem
+      end
+    end
+    context "#{rt} with attr" do
+      let(:code) { "class #{rt}($er) {}" }
+      it 'should be a problem' do
+        expect(problems).to have(1).problem
+        expect(problems).to contain_warning(msg).on_line(1)
+      end
+    end
+    context "#{rt} without body" do
+      let(:code) { "class #{rt}($er, $er2) {}" }
+      it 'should be a problem' do
+        expect(problems).to have(2).problem
+      end
+    end
+    context "#{rt} with typed and default attrs" do
+      let(:code) do
+        <<-EOL
+class role::test (
+  $attr,
+  String $attr2,
+  Optional[Variant[Integer,String]] $attr3 = 'test',
+) {
+}
+EOL
+      end
+      it 'should be a problem' do
+        expect(problems).to have(3).problem
+        expect(problems).to contain_warning(msg).on_line(2)
+        expect(problems).to contain_warning(msg).on_line(3)
+        expect(problems).to contain_warning(msg).on_line(4)
+      end
+    end
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,3 @@
+require 'puppet-lint'
+
+PuppetLint::Plugins.load_spec_helper

metadata

@@ -0,0 +1,137 @@
+--- !ruby/object:Gem::Specification
+name: puppet-lint-roles-profiles
+version: !ruby/object:Gem::Version
+  version: 0.0.1
+platform: ruby
+authors:
+- Hostnet
+autorequire: 
+bindir: bin
+cert_chain: []
+date: 2018-03-07 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: puppet-lint
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '1.1'
+    - - "<"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+- !ruby/object:Gem::Dependency
+  name: rspec-its
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: rspec-collection_matchers
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+description: |2
+      This puppet-lint extension validates that:
+      - node definitions only `include` a single role
+      - roles only `include` profiles and have no class parameters
+      - roles only `inherit` other roles
+email: opensource@hostnet.nl
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- LICENSE
+- README.md
+- lib/puppet-lint/plugins/check_roles_profiles.rb
+- spec/puppet-lint/plugins/check_nodes_include_one_role_spec.rb
+- spec/puppet-lint/plugins/check_roles_include_profiles_spec.rb
+- spec/puppet-lint/plugins/check_roles_inherits_roles_spec.rb
+- spec/puppet-lint/plugins/check_roles_with_params_spec.rb
+- spec/spec_helper.rb
+homepage: https://github.com/hostnet/puppet-lint-roles-profiles
+licenses:
+- MIT
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.2.5
+signing_key: 
+specification_version: 4
+summary: puppet-lint check to validate that the codebase adheres to the roles and
+  profiles workflow
+test_files:
+- spec/puppet-lint/plugins/check_nodes_include_one_role_spec.rb
+- spec/puppet-lint/plugins/check_roles_include_profiles_spec.rb
+- spec/puppet-lint/plugins/check_roles_inherits_roles_spec.rb
+- spec/puppet-lint/plugins/check_roles_with_params_spec.rb
+- spec/spec_helper.rb