quality_gate 0.1.0

data/lib/rubocop/cop/quality_gate/association_default_block_value.rb

@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module QualityGate
+      # Defers recognizable request-context defaults until association initialization.
+      class AssociationDefaultBlockValue < Base
+        MSG = "Wrap the association default in a lambda so Current is read when the record is initialized."
+        RESTRICT_ON_SEND = %i[belongs_to].freeze
+
+        def on_send(node)
+          return if node.receiver && !node.receiver.self_type?
+
+          value = default_value(node.last_argument)
+          return unless value && current_read?(value)
+
+          add_offense(value)
+        end
+
+        private
+
+        def default_value(options)
+          return unless literal_options?(options)
+
+          defaults = options.pairs.select { |pair| pair.key.sym_type? && pair.key.value == :default }
+          defaults.first.value if defaults.one?
+        end
+
+        def literal_options?(options)
+          options&.hash_type? && options.children.all?(&:pair_type?)
+        end
+
+        def current_read?(node)
+          return false unless node.send_type? || node.csend_type?
+          return false if %i[method public_method to_proc].include?(node.method_name)
+
+          receiver = node.receiver
+          return false unless receiver
+          return receiver.const_name == "Current" if receiver.const_type?
+
+          current_read?(receiver)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/quality_gate/broadcast_in_controller.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module QualityGate
+      # Opt-in convention for moving explicit broadcasts into domain behavior.
+      class BroadcastInController < Base
+        MSG = "Consider moving this broadcast from the controller into model-owned behavior."
+        BROADCAST_METHODS = %i[
+          broadcast_action broadcast_action_to broadcast_action_later broadcast_action_later_to
+          broadcast_append broadcast_append_to broadcast_append_later broadcast_append_later_to
+          broadcast_prepend broadcast_prepend_to broadcast_prepend_later broadcast_prepend_later_to
+          broadcast_replace broadcast_replace_to broadcast_replace_later broadcast_replace_later_to
+          broadcast_update broadcast_update_to broadcast_update_later broadcast_update_later_to
+          broadcast_remove broadcast_remove_to
+          broadcast_before broadcast_before_to broadcast_before_later broadcast_before_later_to
+          broadcast_after broadcast_after_to broadcast_after_later broadcast_after_later_to
+          broadcast_render broadcast_render_to broadcast_render_later broadcast_render_later_to
+          broadcast_refresh broadcast_refresh_to broadcast_refresh_later broadcast_refresh_later_to
+          broadcast_stream_to
+        ].freeze
+
+        def on_send(node)
+          return unless controller?(node)
+          return if Array(cop_config["AllowedMethods"]).include?(node.method_name.to_s)
+          return unless broadcast?(node)
+
+          add_offense(node.loc.selector)
+        end
+        alias on_csend on_send
+
+        private
+
+        def controller?(node)
+          enclosing_class = node.each_ancestor(:class).first
+          if enclosing_class
+            enclosing_class.identifier.const_name.end_with?("Controller")
+          else
+            processed_source.file_path.include?("/app/controllers/")
+          end
+        end
+
+        def broadcast?(node)
+          BROADCAST_METHODS.include?(node.method_name) || channel_broadcast?(node) || cable_broadcast?(node)
+        end
+
+        def channel_broadcast?(node)
+          node.method?(:broadcast_to) && node.receiver&.const_type? &&
+            node.receiver.const_name.end_with?("Channel")
+        end
+
+        def cable_broadcast?(node)
+          node.method?(:broadcast) && action_cable_server?(node.receiver)
+        end
+
+        def action_cable_server?(receiver)
+          receiver&.send_type? && receiver.method?(:server) &&
+            receiver.arguments.empty? && receiver.receiver&.const_type? &&
+            receiver.receiver.const_name == "ActionCable"
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/quality_gate/controller_instance_variables.rb

@@ -0,0 +1,47 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module QualityGate
+      # Sandi Metz rule four: a controller action instantiates one object.
+      # Only public instance methods of a *Controller class count as actions.
+      class ControllerInstanceVariables < Base
+        include VisibilityHelp
+        extend ExcludeLimit
+
+        MSG = "Action `%<action>s` assigns %<count>d instance variables (%<names>s); the limit is %<max>d."
+        OWNER_TYPES = %i[class sclass module def defs].freeze
+
+        exclude_limit "Max"
+
+        def on_def(node)
+          return unless action?(node)
+
+          names = assigned_names(node)
+          return if names.size <= max
+
+          add_offense(node.loc.name, message: message_for(node, names)) { self.max = names.size }
+        end
+
+        private
+
+        def action?(node) = controller?(node) && node_visibility(node) == :public
+
+        def controller?(node)
+          owner = node.each_ancestor(*OWNER_TYPES).first
+          return false unless owner&.class_type?
+
+          owner.identifier.const_name.to_s.end_with?("Controller")
+        end
+
+        def assigned_names(node) = node.each_descendant(:ivasgn).map { _1.name.to_s }.uniq
+
+        def message_for(node, names)
+          format(MSG, action: node.method_name, count: names.size, names: names.join(", "), max: max)
+        end
+
+        def max = cop_config.fetch("Max", 1)
+      end
+    end
+  end
+end

data/lib/rubocop/cop/quality_gate/prefer_after_save_commit.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module QualityGate
+      # Uses Rails' shorthand for callbacks after both creation and update commits.
+      class PreferAfterSaveCommit < Base
+        extend AutoCorrector
+
+        MSG = "Use after_save_commit for callbacks on both create and update."
+        RESTRICT_ON_SEND = %i[after_commit].freeze
+
+        def on_send(node)
+          return if node.receiver && !node.receiver.self_type?
+
+          pair = save_option(node.last_argument)
+          return unless pair
+
+          removal = option_range(node, pair)
+          add_offense(node.loc.selector) do |corrector|
+            next if commented?(removal)
+
+            corrector.replace(node.loc.selector, "after_save_commit")
+            corrector.remove(removal)
+          end
+        end
+
+        private
+
+        def save_option(options)
+          return unless literal_options?(options)
+
+          pairs = options.pairs.select { |pair| pair.key.sym_type? && pair.key.value == :on }
+          pairs.first if pairs.one? && save_events?(pairs.first.value)
+        end
+
+        def literal_options?(options)
+          options&.hash_type? && options.children.all?(&:pair_type?)
+        end
+
+        def commented?(range)
+          processed_source.comments.any? { |comment| range.overlaps?(comment.loc.expression) }
+        end
+
+        def save_events?(node)
+          node.array_type? && node.values.all?(&:sym_type?) &&
+            node.values.map(&:value).sort == %i[create update]
+        end
+
+        def option_range(node, pair)
+          options = node.last_argument
+          return argument_range(node, options) if options.pairs.one?
+
+          pair_range(options.pairs, pair)
+        end
+
+        def pair_range(pairs, pair)
+          index = pairs.index(pair)
+          following = pairs[index + 1]
+          if following
+            pair.source_range.with(end_pos: following.source_range.begin_pos)
+          else
+            pair.source_range.with(begin_pos: pairs[index - 1].source_range.end_pos)
+          end
+        end
+
+        def argument_range(node, options)
+          previous = node.arguments[-2]
+          return options.source_range.with(end_pos: node.loc.end.begin_pos) if !previous && node.parenthesized?
+
+          start = argument_start(node, options, previous)
+          options.source_range.with(begin_pos: start)
+        end
+
+        def argument_start(node, options, previous)
+          return previous.source_range.end_pos if previous
+          return node.loc.selector.end_pos unless node.parenthesized?
+
+          options.source_range.begin_pos
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/quality_gate/private_only_concern.rb

@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module QualityGate
+      # Opt-in convention: concerns should expose behavior to their consumers.
+      # Unknown declarations are deliberately exempt because they may add behavior.
+      class PrivateOnlyConcern < Base
+        MSG = "This concern only defines private instance methods; consider keeping them in its consumer."
+        VISIBILITIES = %i[public protected private].freeze
+
+        def on_module(node)
+          body = node.body
+          return unless body
+
+          statements = body.begin_type? ? body.children : [body]
+          return unless concern?(statements)
+          return unless private_methods_only?(statements)
+
+          add_offense(node.identifier)
+        end
+
+        private
+
+        def concern?(statements)
+          statements.any? { |statement| concern_extension?(statement) } ||
+            Array(cop_config["ConcernPaths"]).any? do |pattern|
+              File.fnmatch?(pattern, processed_source.file_path, File::FNM_PATHNAME | File::FNM_EXTGLOB)
+            end
+        end
+
+        def concern_extension?(node)
+          node.send_type? && node.receiver.nil? && node.method?(:extend) &&
+            node.arguments.one? && node.first_argument.const_type? &&
+            node.first_argument.const_name == "ActiveSupport::Concern"
+        end
+
+        def private_methods_only?(statements)
+          methods = {}
+          visibility = :public
+          statements.each do |statement|
+            next if concern_extension?(statement)
+
+            visibility = record_statement(statement, methods, visibility)
+            return false unless visibility
+          end
+          !methods.empty? && methods.values.all?(:private)
+        end
+
+        def record_statement(statement, methods, visibility)
+          if statement.def_type?
+            methods[statement.method_name] = visibility
+          elsif visibility_declaration?(statement) && apply_visibility(statement, methods)
+            statement.arguments.empty? ? statement.method_name : visibility
+          end
+        end
+
+        def visibility_declaration?(node)
+          node.send_type? && node.receiver.nil? && VISIBILITIES.include?(node.method_name)
+        end
+
+        def apply_visibility(node, methods)
+          node.arguments.each do |argument|
+            if argument.def_type?
+              methods[argument.method_name] = node.method_name
+            elsif argument.sym_type? && methods.key?(argument.value)
+              methods[argument.value] = node.method_name
+            else
+              return false
+            end
+          end
+          true
+        end
+      end
+    end
+  end
+end

data/llm.txt

@@ -0,0 +1,13 @@
+# Quality Gate
+
+Quality Gate provides staged Ruby code-quality checks through one CLI and
+configuration contract. See the README for installation, gate commands,
+configuration, and optional RuboCop conventions.
+
+## Documentation
+
+- [README](README.md)
+- [Codex integration](docs/codex.md)
+- [Validation and limitations](docs/dogfood-log.md)
+- [Incident workflow](docs/incidents.md)
+- [Releasing](docs/releasing.md)

data/sig/quality_gate.rbs

@@ -0,0 +1,226 @@
+module QualityGate
+  VERSION: String
+
+  interface _Output
+    def puts: (*untyped objects) -> nil
+  end
+
+  class Error < StandardError
+  end
+
+  class ParseError < Error
+    attr_reader tool: String
+
+    def initialize: (tool: String, reason: String) -> void
+  end
+
+  class ConfigError < Error
+    attr_reader path: String
+
+    def initialize: (path: String, cause_message: String) -> void
+  end
+
+  class Railtie
+  end
+
+  class InstallGenerator
+    FILES: Array[String]
+    MARKER_START: String
+    MARKER_END: String
+
+    def create_settings_file: () -> void
+    def create_rules_file: () -> void
+    def create_initializers: () -> void
+    def inject_coverage: () -> void
+    def create_agent_integration: () -> void
+    def print_summary: () -> void
+  end
+
+  class Installer
+    def initialize: (destination_root: String, ?options: Hash[Symbol, untyped], ?stdout: _Output) -> void
+    def call: () -> (0 | 1)
+  end
+
+  class RubyProfile
+    attr_reader destination_root: String
+    attr_reader test_helper: String
+    attr_reader test_command: Array[String]
+
+    def initialize: (destination_root: String, ?options: Hash[Symbol, untyped]) -> void
+    def coverage?: () -> bool
+    def template_for: (String name) -> String
+  end
+
+  class Config
+    DEFAULTS: Hash[Symbol, untyped]
+
+    def self.defaults: () -> Hash[Symbol, untyped]
+    def self.load: (dir: String) -> Config
+
+    attr_reader path: String?
+    attr_reader unknown_keys: Array[String]
+
+    def initialize: (Hash[Symbol, untyped] settings, ?path: String?, ?unknown_keys: Array[String]) -> void
+    def to_h: () -> Hash[Symbol, untyped]
+    def fetch: (Symbol key) -> untyped
+  end
+
+  class HookLog
+    DEFAULT_PATH: String
+
+    attr_reader path: String
+
+    def initialize: (path: String) -> void
+    def recent: (?limit: Integer) -> Array[Hash[String, untyped]]
+    def unavailable_count: (?limit: Integer) -> Integer
+    def warning_line: (?limit: Integer) -> String?
+  end
+
+  class Adapter
+    def initialize: (config: Config, ?files: Array[String], ?diagnostic_io: _Output) -> void
+    def call: () -> Array[Finding]
+    def name: () -> String
+    def command: () -> Array[String]
+    def parse: (String stdout) -> Array[Finding]
+    def timeout: () -> Integer
+  end
+
+  module Adapters
+    class Brakeman < Adapter
+      CONFIDENCE_MAP: Hash[String, finding_severity]
+
+      def initialize: (config: Config, ?files: Array[String], ?diagnostic_io: _Output) -> void
+      def call: () -> Array[Finding]
+      def name: () -> String
+      def command: () -> Array[String]
+      def parse: (String stdout) -> Array[Finding]
+      def timeout: () -> Integer
+    end
+
+    class BundlerAudit < Adapter
+      LOCK_FILE: String
+
+      def initialize: (config: Config, ?files: Array[String], ?diagnostic_io: _Output) -> void
+      def call: () -> Array[Finding]
+      def name: () -> String
+      def command: () -> Array[String]
+      def parse: (String stdout) -> Array[Finding]
+      def timeout: () -> Integer
+    end
+
+    class RuboCop < Adapter
+      SEVERITY_MAP: Hash[String, finding_severity]
+      CONFIG_PATH: String
+
+      def initialize: (config: Config, ?files: Array[String], ?diagnostic_io: _Output) -> void
+      def call: () -> Array[Finding]
+      def name: () -> String
+      def command: () -> Array[String]
+      def parse: (String stdout) -> Array[Finding]
+      def timeout: () -> Integer
+    end
+
+    class SimpleCov < Adapter
+      COVERAGE_PATH: String
+
+      def initialize: (config: Config, ?files: Array[String], ?diagnostic_io: _Output) -> void
+      def call: () -> Array[Finding]
+      def name: () -> String
+      def timeout: () -> Integer
+    end
+
+    class TestSuite < Adapter
+      TAIL_LINES: Integer
+
+      def initialize: (config: Config, ?files: Array[String], ?diagnostic_io: _Output) -> void
+      def call: () -> Array[Finding]
+      def name: () -> String
+      def command: () -> Array[String]
+      def env: () -> Hash[String, String]
+      def timeout: () -> Integer
+    end
+
+    class Undercover < Adapter
+      COVERAGE_PATH: String
+      SKIP_RULE: String
+
+      def initialize: (config: Config, ?files: Array[String], ?diagnostic_io: _Output) -> void
+      def call: () -> Array[Finding]
+      def name: () -> String
+      def command: () -> Array[String]
+      def compare_point: () -> String?
+      def parse: (String stdout) -> Array[Finding]
+      def timeout: () -> Integer
+    end
+  end
+
+  class Runner
+    def initialize: (adapters: Array[Adapter], config: Config, ?diagnostic_io: _Output?) -> void
+    def call: () -> Runner::Result
+
+    class Result < Data
+      attr_reader findings: Array[Finding]
+      attr_reader failed_tools: Array[String]
+      attr_reader checks: Array[Hash[Symbol, untyped]]
+
+      def initialize: (findings: Array[Finding], ?checks: Array[Hash[Symbol, untyped]]) -> void
+      def with: (?findings: Array[Finding], ?checks: Array[Hash[Symbol, untyped]]) -> Result
+      def exit_code: () -> (0 | 1 | 2)
+    end
+  end
+
+  class CLI
+    SUBCOMMANDS: Array[String]
+
+    def self.run: (Array[String] argv, ?stdout: _Output, ?stderr: _Output, ?dir: String) -> (0 | 1 | 2)
+  end
+
+  class InitCommand
+    def self.run: (Array[String] arguments, stdout: _Output, stderr: _Output, dir: String) -> (0 | 1 | 2)
+  end
+
+  module Reporters
+    class Text
+      def initialize: (io: _Output) -> void
+      def call: (Runner::Result result) -> nil
+    end
+
+    class Json
+      def initialize: (io: _Output) -> void
+      def call: (Runner::Result result) -> nil
+    end
+  end
+
+  type finding_severity = :error | :warning | :info
+
+  class Finding < Data
+    SEVERITIES: Array[finding_severity]
+    TOOL_FAILURE_RULE: String
+
+    attr_reader tool: String
+    attr_reader file: String
+    attr_reader line: Integer
+    attr_reader rule: String
+    attr_reader severity: finding_severity
+    attr_reader message: String
+
+    def initialize: (
+      tool: String,
+      file: String,
+      line: Integer,
+      rule: String,
+      severity: finding_severity,
+      message: String
+    ) -> void
+    def self.tool_failure: (tool: String, message: String) -> Finding
+    def tool_failure?: () -> bool
+  end
+
+  module ExitCode
+    CLEAN: 0
+    FINDINGS: 1
+    TOOL_FAILURE: 2
+
+    def self.all: () -> Array[0 | 1 | 2]
+  end
+end