quality_gate 0.1.0

data/lib/quality_gate/adapters/bundler_audit.rb

@@ -0,0 +1,235 @@
+# frozen_string_literal: true
+
+require "json"
+require "rubygems"
+
+module QualityGate
+  module Adapters
+    # Runs bundler-audit and falls back to a usable local advisory database.
+    # rubocop:disable Metrics/ClassLength
+    class BundlerAudit < Adapter
+      class InvalidReport < StandardError; end
+      class UnavailableDatabase < StandardError; end
+      private_constant :InvalidReport, :UnavailableDatabase
+
+      LOCK_FILE = "Gemfile.lock".freeze # rubocop:disable Style/RedundantFreeze
+      FALLBACK_WARNING = "bundler_audit: advisory database update failed; using cached database"
+      private_constant :FALLBACK_WARNING
+
+      def call
+        tool = name
+        argv = validated_command
+        timeout_seconds = resolved_timeout(tool)
+        deadline = monotonic_deadline(timeout_seconds)
+        updated_findings(tool, argv, deadline, timeout_seconds)
+      rescue StandardError => e
+        [failure_finding(tool, e, "")]
+      end
+
+      def name = "bundler_audit"
+
+      def command = %w[bundle-audit check --update --format json --quiet]
+
+      def parse(stdout)
+        report = parse_report(stdout)
+        results = report.fetch("results") { invalid_report!("report must include results") }
+        parse_results(results)
+      rescue JSON::ParserError, InvalidReport => e
+        raise ParseError.new(tool: name, reason: e.message)
+      end
+
+      private
+
+      def updated_findings(tool, argv, deadline, timeout_seconds)
+        stderr = +""
+        stdout, stderr, status = capture(argv, remaining_timeout(deadline, timeout_seconds))
+        findings = parse_and_validate(stdout, tool)
+        return findings if local_database?
+
+        unavailable_database_failure(tool, stderr)
+      rescue ParseError => e
+        return [failure_finding(tool, e, stderr)] if status&.success?
+
+        fallback_findings(tool, e, stderr, deadline, timeout_seconds)
+      rescue TimeoutError, SystemCallError, IOError, ThreadError => e
+        fallback_findings(tool, e, stderr, deadline, timeout_seconds)
+      end
+
+      def parse_and_validate(stdout, tool)
+        findings = parse(stdout)
+        validate_findings!(findings, expected_tool: tool)
+        findings
+      end
+
+      def fallback_findings(tool, update_error, update_stderr, deadline, timeout_seconds)
+        return [failure_finding(tool, update_error, update_stderr)] unless local_database?
+
+        cached_findings(tool, deadline, timeout_seconds)
+      end
+
+      def cached_findings(tool, deadline, timeout_seconds)
+        cached_stderr = +""
+        stdout, cached_stderr, = capture(cached_command, remaining_timeout(deadline, timeout_seconds))
+        findings = parse_and_validate(stdout, tool)
+        emit_fallback_warning(tool, findings, cached_stderr)
+      rescue ParseError, TimeoutError, SystemCallError, IOError, ThreadError => e
+        [failure_finding(tool, e, cached_stderr)]
+      end
+
+      def cached_command = %w[bundle-audit check --no-update --format json --quiet]
+
+      def remaining_timeout(deadline, timeout_seconds)
+        remaining = remaining_before(deadline)
+        return remaining if remaining.positive?
+
+        raise TimeoutError, "timeout after #{timeout_seconds} seconds"
+      end
+
+      def unavailable_database_failure(tool, stderr)
+        error = UnavailableDatabase.new("no usable advisory database is available")
+        [failure_finding(tool, error, stderr)]
+      end
+
+      def emit_fallback_warning(tool, findings, cached_stderr)
+        diagnostic_io.puts FALLBACK_WARNING
+        findings
+      rescue StandardError => e
+        [failure_finding(tool, e, cached_stderr)]
+      end
+
+      def parse_report(stdout)
+        report = JSON.parse(stdout)
+        invalid_report!("report must be a JSON object") unless report.is_a?(Hash)
+
+        report
+      end
+
+      def parse_results(results)
+        invalid_report!("results must be an array") unless results.is_a?(Array)
+
+        results.map { build_finding(_1) }
+      end
+
+      def build_finding(result)
+        invalid_report!("result must be an object") unless result.is_a?(Hash)
+        validate_result_type(result)
+
+        gem = object_field(result, "gem", owner: "result")
+        advisory = object_field(result, "advisory", owner: "result")
+        Finding.new(tool: name, **finding_attributes(gem, advisory))
+      end
+
+      def validate_result_type(result)
+        type = string_field(result, "type", owner: "result")
+        return if type == "unpatched_gem"
+
+        invalid_report!("unsupported result type #{type.inspect}")
+      end
+
+      def finding_attributes(gem, advisory)
+        gem_name = nonempty_string_field(gem, "name", owner: "gem")
+        installed_version = nonempty_string_field(gem, "version", owner: "gem")
+        patches = patched_versions(advisory)
+
+        {
+          file: LOCK_FILE,
+          line: 0,
+          rule: advisory_rule(advisory),
+          severity: :error,
+          message: advisory_message(gem_name, installed_version, patches.first)
+        }
+      end
+
+      def advisory_rule(advisory)
+        cve = optional_identifier(advisory, "cve")
+        ghsa = optional_identifier(advisory, "ghsa")
+        advisory_id = nonempty_string_field(advisory, "id", owner: "advisory")
+
+        return prefixed_identifier(cve, "CVE-") if cve
+        return prefixed_identifier(ghsa, "GHSA-") if ghsa
+
+        advisory_id
+      end
+
+      def advisory_message(gem_name, installed_version, patched_version)
+        subject = "#{gem_name} #{installed_version} is vulnerable"
+        return "#{subject}; update to #{patched_version}" if patched_version
+
+        "#{subject}; no patched version exists"
+      end
+
+      def patched_versions(advisory)
+        patches = advisory.fetch("patched_versions") do
+          invalid_report!("advisory must include patched_versions")
+        end
+        unless patches.is_a?(Array) && patches.all?(String)
+          invalid_report!("patched_versions must be an array of strings")
+        end
+
+        patches
+      end
+
+      def prefixed_identifier(identifier, prefix)
+        identifier.start_with?(prefix) ? identifier : "#{prefix}#{identifier}"
+      end
+
+      def optional_identifier(advisory, field)
+        value = advisory.fetch(field, nil)
+        return if value.nil?
+
+        invalid_report!("#{field} must be nil or a non-empty String") unless value.is_a?(String) && !value.empty?
+
+        value
+      end
+
+      def object_field(object, field, owner:)
+        value = object.fetch(field) { invalid_report!("#{owner} must include #{field}") }
+        invalid_report!("#{field} must be an object") unless value.is_a?(Hash)
+
+        value
+      end
+
+      def string_field(object, field, owner:)
+        value = object.fetch(field) { invalid_report!("#{owner} must include #{field}") }
+        invalid_report!("#{field} must be a String") unless value.is_a?(String)
+
+        value
+      end
+
+      def nonempty_string_field(object, field, owner:)
+        value = string_field(object, field, owner:)
+        invalid_report!("#{field} must not be empty") if value.empty?
+
+        value
+      end
+
+      def local_database?
+        gems_path = File.join(advisory_database_path, "gems")
+        return false unless File.directory?(gems_path)
+
+        Dir.children(gems_path).any? { advisory_directory?(File.join(gems_path, _1)) }
+      rescue SystemCallError
+        false
+      end
+
+      def advisory_directory?(path)
+        return false unless File.directory?(path)
+
+        Dir.children(path).any? do |entry|
+          File.extname(entry) == ".yml" && File.file?(File.join(path, entry))
+        end
+      end
+
+      def advisory_database_path
+        ENV.fetch("BUNDLER_AUDIT_DB") do
+          File.join(Gem.user_home, ".local", "share", "ruby-advisory-db")
+        end
+      end
+
+      def invalid_report!(reason)
+        raise InvalidReport, reason
+      end
+    end
+    # rubocop:enable Metrics/ClassLength
+  end
+end

data/lib/quality_gate/adapters/reek.rb

@@ -0,0 +1,108 @@
+# frozen_string_literal: true
+
+require "json"
+require "pathname"
+
+module QualityGate
+  module Adapters
+    # Runs Reek with project-aware configuration and normalizes its JSON report.
+    class Reek < Adapter
+      CONFIG_PATH = File.expand_path("../../../config/reek.yml", __dir__).freeze
+
+      HOST_CONFIG_FILE = ".reek.yml"
+      PROJECT_ROOT_FILES = %w[Gemfile gems.rb].freeze
+      SMELL_KEYS = %w[context lines message smell_type source].freeze
+      private_constant :HOST_CONFIG_FILE, :PROJECT_ROOT_FILES, :SMELL_KEYS
+
+      def initialize(config:, files: [], diagnostic_io: $stderr)
+        @call_lock = Mutex.new
+        super
+      end
+
+      def call
+        @call_lock.synchronize do
+          resolved_paths = existing_paths
+          next [] if files.any? && resolved_paths.empty?
+
+          @resolved_paths_for_call = resolved_paths
+          begin
+            super()
+          ensure
+            @resolved_paths_for_call = nil
+          end
+        end
+      end
+
+      def name = "reek"
+
+      def command
+        argv = ["reek", "--format", "json"]
+        argv.concat(["--config", CONFIG_PATH]) unless host_config?
+        argv.concat(resolved_paths_for_command)
+      end
+
+      def parse(stdout)
+        smells = JSON.parse(stdout)
+        raise TypeError, "report must be a JSON array" unless smells.is_a?(Array)
+
+        smells.map { |smell| build_finding(smell) }
+      rescue JSON::ParserError, KeyError, TypeError, ArgumentError => e
+        raise ParseError.new(tool: name, reason: e.message)
+      end
+
+      private
+
+      def existing_paths
+        files.filter_map { |path| positional_path(path) if File.exist?(path) }.freeze
+      end
+
+      def positional_path(path) = path.start_with?("-") ? File.join(".", path) : path
+
+      def resolved_paths_for_command = @resolved_paths_for_call || existing_paths
+
+      def host_config?
+        config_search_directories(inferred_project_root).any? do |dir|
+          File.file?(dir.join(HOST_CONFIG_FILE))
+        end
+      end
+
+      def inferred_project_root
+        PROJECT_ROOT_FILES.lazy.filter_map { |file| last_ancestor_containing(file) }.first
+      end
+
+      def last_ancestor_containing(file)
+        Pathname(Dir.pwd).expand_path.ascend.select { |directory| directory.join(file).exist? }.last
+      end
+
+      def config_search_directories(project_root)
+        directories = Pathname(Dir.pwd).expand_path.ascend
+        return directories.to_a unless project_root
+
+        directories.take_while { |directory| directory != project_root }.push(project_root)
+      end
+
+      def build_finding(smell)
+        raise TypeError, "smell entry must be an object" unless smell.is_a?(Hash)
+
+        context, lines, message, smell_type, source = smell.values_at(*SMELL_KEYS)
+        validate_smell!(context, lines, message, smell_type, source)
+
+        Finding.new(
+          tool: name,
+          file: source, line: lines.first,
+          rule: smell_type,
+          severity: :warning,
+          message: "#{context} #{message}"
+        )
+      end
+
+      def validate_smell!(context, lines, message, smell_type, source)
+        %w[context message smell_type source].zip([context, message, smell_type, source]) do |key, value|
+          raise TypeError, "smell #{key} must be a String" unless value.is_a?(String)
+        end
+        raise TypeError, "smell lines must be a non-empty array" if !lines.is_a?(Array) || lines.empty?
+        raise TypeError, "smell lines must contain Integers" unless lines.first.is_a?(Integer)
+      end
+    end
+  end
+end

data/lib/quality_gate/adapters/rubocop.rb

@@ -0,0 +1,142 @@
+# frozen_string_literal: true
+
+require "json"
+require "pathname"
+
+module QualityGate
+  module Adapters
+    # Runs RuboCop with project-aware configuration and normalizes its JSON report.
+    class RuboCop < Adapter
+      SEVERITY_MAP = {
+        "info" => :info,
+        "refactor" => :info,
+        "convention" => :warning,
+        "warning" => :warning,
+        "error" => :error,
+        "fatal" => :error
+      }.freeze
+
+      CONFIG_PATH = File.expand_path("../../../config/rubocop.yml", __dir__).freeze
+
+      PROJECT_CONFIG_PATHS = %w[.config/.rubocop.yml .config/rubocop/config.yml].freeze
+      PROJECT_ROOT_FILES = %w[Gemfile gems.rb].freeze
+      private_constant :PROJECT_CONFIG_PATHS, :PROJECT_ROOT_FILES
+
+      def initialize(config:, files: [], diagnostic_io: $stderr)
+        @call_lock = Mutex.new
+        super
+      end
+
+      def call
+        @call_lock.synchronize do
+          resolved_paths = existing_paths
+          next [] if files.any? && resolved_paths.empty?
+
+          @resolved_paths_for_call = resolved_paths
+          begin
+            super()
+          ensure
+            @resolved_paths_for_call = nil
+          end
+        end
+      end
+
+      def name = "rubocop"
+
+      def command
+        argv = ["rubocop", "--format", "json", "--force-exclusion"]
+        explicit_config = config.to_h.fetch(:rubocop_config, nil)
+
+        if explicit_config
+          argv.concat(["--config", explicit_config])
+        elsif !host_config?
+          argv.concat(["--config", CONFIG_PATH])
+        end
+
+        argv.concat(resolved_paths_for_command)
+      end
+
+      def parse(stdout)
+        report = parse_report(stdout)
+        parse_files(report.fetch("files"))
+      rescue JSON::ParserError, KeyError, TypeError, ArgumentError => e
+        raise ParseError.new(tool: name, reason: e.message)
+      end
+
+      private
+
+      def existing_paths
+        files.filter_map { |path| positional_path(path) if File.exist?(path) }.freeze
+      end
+
+      def positional_path(path) = path.start_with?("-") ? File.join(".", path) : path
+
+      def host_config?
+        project_root = inferred_project_root
+        return true if config_search_directories(project_root).any? { |dir| File.file?(dir.join(".rubocop.yml")) }
+        return false unless project_root
+
+        PROJECT_CONFIG_PATHS.any? { |path| File.file?(project_root.join(path)) }
+      end
+
+      def inferred_project_root
+        PROJECT_ROOT_FILES.lazy.filter_map { |file| last_ancestor_containing(file) }.first
+      end
+
+      def last_ancestor_containing(file)
+        Pathname(Dir.pwd).expand_path.ascend.select { |directory| directory.join(file).exist? }.last
+      end
+
+      def config_search_directories(project_root)
+        directories = Pathname(Dir.pwd).expand_path.ascend
+        return directories.to_a unless project_root
+
+        directories.take_while { |directory| directory != project_root }.push(project_root)
+      end
+
+      def resolved_paths_for_command = @resolved_paths_for_call || existing_paths
+
+      def parse_report(stdout)
+        report = JSON.parse(stdout)
+        raise TypeError, "report must be a JSON object" unless report.is_a?(Hash)
+
+        report
+      end
+
+      def parse_files(entries)
+        raise TypeError, "files must be an array" unless entries.is_a?(Array)
+
+        entries.flat_map { |entry| parse_file(entry) }
+      end
+
+      def parse_file(entry)
+        raise TypeError, "file entry must be an object" unless entry.is_a?(Hash)
+
+        path = entry.fetch("path")
+        offenses = entry.fetch("offenses")
+        raise TypeError, "file path must be a String" unless path.is_a?(String)
+        raise TypeError, "offenses must be an array" unless offenses.is_a?(Array)
+
+        offenses.map { |offense| build_finding(path, offense) }
+      end
+
+      def build_finding(path, offense)
+        Finding.new(tool: name, file: path, **offense_attributes(offense))
+      end
+
+      def offense_attributes(offense)
+        raise TypeError, "offense must be an object" unless offense.is_a?(Hash)
+
+        location = offense.fetch("location")
+        raise TypeError, "location must be an object" unless location.is_a?(Hash)
+
+        {
+          line: location.fetch("start_line"),
+          rule: offense.fetch("cop_name"),
+          severity: SEVERITY_MAP.fetch(offense.fetch("severity")),
+          message: offense.fetch("message")
+        }
+      end
+    end
+  end
+end

data/lib/quality_gate/adapters/simplecov.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require "json"
+
+module QualityGate
+  module Adapters
+    # Evaluates the most recent SimpleCov summary against configured budgets.
+    class SimpleCov < Adapter
+      COVERAGE_PATH = "coverage/.last_run.json"
+
+      class InvalidRecord < StandardError; end
+      private_constant :InvalidRecord
+
+      def name = "simplecov"
+
+      def call
+        result = result_from_record
+        findings = line_findings(result)
+        findings.concat(branch_findings(result))
+        validate_findings!(findings, expected_tool: name)
+        findings
+      rescue JSON::ParserError, SystemCallError, InvalidRecord
+        [simplecov_wiring_failure]
+      end
+
+      private
+
+      def result_from_record
+        record = JSON.parse(File.read(COVERAGE_PATH))
+        invalid_record! unless record.is_a?(Hash)
+        result = record["result"]
+        invalid_record! unless result.is_a?(Hash)
+        percentage(result["line"])
+
+        result
+      end
+
+      def line_findings(result)
+        minimum = coverage.fetch(:minimum_line, nil)
+        return [] unless minimum
+
+        budget_finding("line", percentage(result["line"]), minimum)
+      end
+
+      def branch_findings(result)
+        minimum = coverage.fetch(:minimum_branch, nil)
+        return [] unless minimum
+
+        actual = result["branch"]
+        return [branch_wiring_failure] unless valid_percentage?(actual)
+
+        budget_finding("branch", actual, minimum)
+      end
+
+      def budget_finding(kind, actual, minimum)
+        return [] unless actual < minimum
+
+        [
+          Finding.new(
+            tool: name, file: "", line: 0,
+            severity: :error,
+            rule: "#{kind}_coverage_below_minimum",
+            message: "#{kind} coverage #{actual}% is below configured minimum #{minimum}%"
+          )
+        ]
+      end
+
+      def coverage
+        config.fetch(:coverage)
+      end
+
+      def percentage(value)
+        invalid_record! unless valid_percentage?(value)
+
+        value
+      end
+
+      def valid_percentage?(value)
+        value.is_a?(Numeric) && value.finite? && value.between?(0, 100)
+      end
+
+      def invalid_record!
+        raise InvalidRecord
+      end
+
+      def simplecov_wiring_failure
+        Finding.tool_failure(
+          tool: name,
+          message: "#{COVERAGE_PATH} is missing or unusable; require \"simplecov\" and call " \
+                   "SimpleCov.start before loading application code"
+        )
+      end
+
+      def branch_wiring_failure
+        Finding.tool_failure(
+          tool: name,
+          message: "#{COVERAGE_PATH} has no usable branch percentage; add " \
+                   "enable_coverage :branch inside SimpleCov.start"
+        )
+      end
+    end
+  end
+end

data/lib/quality_gate/adapters/test_suite.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "tempfile"
+
+module QualityGate
+  module Adapters
+    # Runs the project's full test suite with coverage recording enabled.
+    class TestSuite < Adapter
+      TAIL_LINES = 20
+      LOG_DIRECTORY = File.join("log", "quality_gate").freeze
+
+      DEFAULT_COMMAND = %w[bin/rails test].map!(&:freeze).freeze
+      ENVIRONMENT = { "COVERAGE" => "1" }.freeze
+      private_constant :DEFAULT_COMMAND, :ENVIRONMENT, :LOG_DIRECTORY
+
+      def name = "test_suite"
+
+      def command
+        config.fetch(:commands).fetch(:verify).fetch(:test_suite, DEFAULT_COMMAND)
+      end
+
+      def env = ENVIRONMENT
+
+      def call
+        tool = name
+        stderr = +""
+        argv = validated_command
+        stdout, stderr, status = capture(argv, resolved_timeout(tool), env:, combine_output: true)
+        return [] if status.success?
+
+        [failed_test_finding(stdout, stderr)]
+      # capture raises on a timeout before returning buffered output, so those
+      # failures retain the standard adapter diagnostic without a test log.
+      rescue StandardError => e
+        [failure_finding(tool, e, stderr)]
+      end
+
+      private
+
+      def failed_test_finding(stdout, stderr)
+        test_failure(stdout, stderr, log_path: write_failure_log(stdout, stderr))
+      rescue StandardError => e
+        test_failure(stdout, stderr, log_error: e)
+      end
+
+      def test_failure(stdout, stderr, log_path: nil, log_error: nil)
+        message = output_tail(stdout, stderr)
+        message = "#{message}\nFull test output: #{log_path}" if log_path
+        if log_error
+          message = "#{message}\nCould not write full test output log: " \
+                    "#{log_error.class}: #{log_error.message}"
+        end
+
+        Finding.new(
+          tool: name,
+          file: "",
+          line: 0,
+          rule: "test_failure",
+          severity: :error,
+          message:
+        )
+      end
+
+      def write_failure_log(stdout, stderr)
+        FileUtils.mkdir_p(LOG_DIRECTORY)
+        log = Tempfile.create(["test-suite-", ".log"], LOG_DIRECTORY)
+        log.write(stdout.to_s)
+        log.write(stderr.to_s)
+        log.flush
+        log.path
+      ensure
+        log&.close
+      end
+
+      def output_tail(*streams)
+        streams.flat_map(&:lines).last(TAIL_LINES).join.chomp
+      end
+    end
+  end
+end