quality_gate 0.2.2 → 0.3.0

data/lib/quality_gate/adapters/rubycritic.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+require "json"
+require "tmpdir"
+require_relative "rubycritic_report"
+
+module QualityGate
+  module Adapters
+    # Runs RubyCritic and normalizes its JSON report into warnings.
+    class RubyCritic < Adapter
+      DEFAULT_LAUNCHER = ["rubycritic"].freeze
+      REPRESENTATIVE_REPORT_DIRECTORY = File.join(Dir.tmpdir, "quality-gate-rubycritic-report").freeze
+      private_constant :DEFAULT_LAUNCHER, :REPRESENTATIVE_REPORT_DIRECTORY
+
+      def name = "rubycritic"
+
+      def command = command_for(REPRESENTATIVE_REPORT_DIRECTORY)
+
+      def call
+        tool = name
+        stderr = +""
+        findings_in_temp_directory(tool) { stderr = _1 }
+      rescue StandardError => e
+        [failure_finding(tool, e, stderr)]
+      end
+
+      def parse(json)
+        RubyCriticReport.new(json).findings
+      rescue JSON::ParserError, KeyError, TypeError, ArgumentError => e
+        raise ParseError.new(tool: name, reason: e.message)
+      end
+
+      private
+
+      def command_for(report_directory)
+        launcher = config.fetch(:commands).fetch(:deep, {}).fetch(:rubycritic, DEFAULT_LAUNCHER)
+        launcher.dup.concat(
+          ["--format", "json", "--no-browser", "--minimum-score", "0", "--path", report_directory, "."]
+        )
+      end
+
+      def findings_in_temp_directory(tool, &on_stderr)
+        Dir.mktmpdir("quality-gate-rubycritic-") do |directory|
+          findings_at(directory, tool, &on_stderr)
+        end
+      end
+
+      def findings_at(directory, tool)
+        stderr, status = capture_report(directory, tool)
+        yield stderr
+        validate_successful_exit!(status)
+        parse(read_report(directory, tool))
+      end
+
+      def capture_report(directory, tool)
+        _stdout, stderr, status = capture(command_for(directory), resolved_timeout(tool))
+        [stderr, status]
+      end
+
+      def read_report(directory, tool)
+        report_path = File.join(directory, "report.json")
+        raise ParseError.new(tool:, reason: "report file is missing") unless File.file?(report_path)
+
+        File.read(report_path)
+      end
+
+      def validate_successful_exit!(status)
+        return if status&.exited? && status.exitstatus.zero?
+
+        raise ParseError.new(tool: name, reason: "process did not exit normally with status 0")
+      end
+    end
+  end
+end

data/lib/quality_gate/adapters/rubycritic_report.rb

@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require "json"
+
+module QualityGate
+  module Adapters
+    # Validates RubyCritic's JSON document and converts smells to findings.
+    class RubyCriticReport
+      def initialize(json)
+        @report = JSON.parse(json)
+      end
+
+      def findings
+        validate_report!
+        analysed_modules.flat_map { module_findings(_1) }.uniq
+      end
+
+      private
+
+      def validate_report!
+        raise TypeError, "report must be a JSON object" unless @report.is_a?(Hash)
+
+        validate_metadata!(@report.fetch("metadata"))
+        validate_score!(@report.fetch("score"))
+      end
+
+      def validate_metadata!(metadata)
+        raise TypeError, "metadata must be a JSON object" unless metadata.is_a?(Hash)
+
+        rubycritic = metadata.fetch("rubycritic")
+        raise TypeError, "metadata.rubycritic must be a JSON object" unless rubycritic.is_a?(Hash)
+
+        required_string(rubycritic.fetch("version"), "RubyCritic version")
+      end
+
+      def validate_score!(score)
+        return if score.is_a?(Numeric) && score.finite? && score.between?(0, 100)
+
+        raise TypeError, "score must be a finite number within 0..100"
+      end
+
+      def analysed_modules
+        modules = @report.fetch("analysed_modules")
+        return modules if modules.is_a?(Array) && !modules.empty?
+
+        raise TypeError, "analysed_modules must be a non-empty array"
+      end
+
+      def module_findings(entry)
+        raise TypeError, "module must be an object" unless entry.is_a?(Hash)
+
+        required_string(entry.fetch("path"), "module path")
+        smells = entry.fetch("smells")
+        raise TypeError, "smells must be an array" unless smells.is_a?(Array)
+
+        smells.flat_map { smell_findings(_1) }
+      end
+
+      def smell_findings(smell)
+        raise TypeError, "smell must be an object" unless smell.is_a?(Hash)
+
+        type, context, message = smell_attributes(smell)
+        locations = smell.fetch("locations")
+        raise TypeError, "locations must be a non-empty array" unless locations.is_a?(Array) && !locations.empty?
+
+        locations.map { finding_for(_1, type, context, message) }
+      end
+
+      def smell_attributes(smell)
+        [
+          required_string(smell.fetch("type"), "smell type"),
+          required_string(smell.fetch("context"), "smell context", allow_empty: true),
+          required_string(smell.fetch("message"), "smell message", allow_empty: true)
+        ]
+      end
+
+      def finding_for(location, type, context, message)
+        Finding.new(
+          tool: "rubycritic", file: location_path(location), line: location_line(location),
+          rule: type, severity: :warning,
+          message: "#{context} #{message}".strip
+        )
+      end
+
+      def location_path(location)
+        raise TypeError, "location must be an object" unless location.is_a?(Hash)
+
+        required_string(location.fetch("path"), "location path")
+      end
+
+      def location_line(location)
+        line = location.fetch("line")
+        validate_line!(line)
+        line
+      end
+
+      def validate_line!(line)
+        return if line.is_a?(Integer) && line >= 0
+
+        raise TypeError, "location line must be an Integer greater than or equal to 0"
+      end
+
+      def required_string(value, field, allow_empty: false)
+        valid = value.is_a?(String) && (allow_empty || !value.empty?)
+        raise TypeError, "#{field} must be a #{allow_empty ? "String" : "non-empty String"}" unless valid
+
+        value
+      end
+    end
+    private_constant :RubyCriticReport
+  end
+end

data/lib/quality_gate/adapters/test_suite.rb

@@ -26,7 +26,9 @@ module QualityGate
         tool = name
         stderr = +""
         argv = validated_command
-        stdout, stderr, status = capture(argv, resolved_timeout(tool), env:, combine_output: true)
+        timeout_seconds = resolved_timeout(tool)
+        invalidate_stale_simplecov_summary if simplecov_configured_for_verify?
+        stdout, stderr, status = capture(argv, timeout_seconds, env:, combine_output: true)
         return [] if status.success?
 
         [failed_test_finding(stdout, stderr)]
@@ -38,6 +40,15 @@ module QualityGate
 
       private
 
+      def simplecov_configured_for_verify?
+        config.fetch(:adapters).fetch(:verify).any? { _1.to_s == "simplecov" }
+      end
+
+      def invalidate_stale_simplecov_summary
+        path = Adapters::SimpleCov::COVERAGE_PATH
+        File.delete(path) if File.file?(path)
+      end
+
       def failed_test_finding(stdout, stderr)
         test_failure(stdout, stderr, log_path: write_failure_log(stdout, stderr))
       rescue StandardError => e

data/lib/quality_gate/baseline.rb

@@ -0,0 +1,269 @@
+# frozen_string_literal: true
+
+require "json"
+require "tempfile"
+
+module QualityGate
+  class BaselineError < Error; end
+
+  module BaselineSchema
+    VERSION = 1
+    GATES = %w[fast verify].freeze
+    TOOLS = %w[rubocop reek herb].freeze
+    ROOT_KEYS = %w[schema_version gate tools findings].freeze
+    ENTRY_KEYS = %w[tool file rule severity message count].freeze
+    private_constant :VERSION, :GATES, :TOOLS, :ROOT_KEYS, :ENTRY_KEYS
+
+    module_function
+
+    def validate(document)
+      validate_root(document)
+      validate_entries(document)
+    end
+
+    def validate_root(document)
+      validate_root_keys(document)
+      validate_gate(document["gate"])
+      validate_context_tools(document["tools"])
+    end
+
+    def validate_root_keys(document)
+      valid = document.is_a?(Hash) && keys_match?(document, ROOT_KEYS)
+      invalid("document must have exactly the snapshot keys") unless valid
+      version = document["schema_version"]
+      invalid("unsupported schema version") unless version.is_a?(Integer) && version == VERSION
+    end
+
+    def validate_gate(gate)
+      invalid("gate must be fast or verify") unless GATES.include?(gate)
+    end
+
+    def validate_context_tools(tools)
+      validate_tools(tools)
+      invalid("at least one eligible analyzer is required") unless analyzer?(tools)
+    end
+
+    def validate_entries(document)
+      entries = document["findings"]
+      invalid("findings must be an array") unless entries.is_a?(Array)
+      entries.each { validate_entry(_1, document["tools"]) }
+      identities = entries.map { identity(_1) }
+      invalid("duplicate finding identity") unless identities.uniq == identities
+    end
+
+    def validate_entry(entry, tools)
+      valid = entry.is_a?(Hash) && keys_match?(entry, ENTRY_KEYS)
+      invalid("finding entry must have exactly the entry keys") unless valid
+      invalid("finding tool is invalid") unless TOOLS.include?(entry["tool"]) && tools.include?(entry["tool"])
+      invalid("finding file is not canonical") unless BaselinePaths.stored?(entry["file"])
+      validate_entry_fields(entry)
+    end
+
+    def validate_entry_fields(entry)
+      invalid("finding rule must be a non-empty string") unless nonempty_string?(entry["rule"])
+      invalid("tool failure findings cannot be stored") if entry["rule"] == "tool_failure"
+      invalid("finding severity must be warning or info") unless %w[warning info].include?(entry["severity"])
+      invalid("finding message must be a string") unless entry["message"].is_a?(String)
+      validate_count(entry["count"])
+    end
+
+    def validate_count(count)
+      invalid("finding count must be a positive integer") unless count.is_a?(Integer) && count.positive?
+    end
+
+    def validate_context(gate, tools)
+      validate_gate(gate)
+      validate_context_tools(tools)
+    end
+
+    def validate_tools(tools)
+      valid = tools.is_a?(Array) && tools.all? { nonempty_string?(_1) } && tools.uniq == tools
+      invalid("tools must be an array of unique non-empty strings") unless valid
+    end
+
+    def identity(entry) = ENTRY_KEYS.first(5).map { entry.fetch(_1) }
+
+    def eligible?(finding)
+      TOOLS.include?(finding.tool) && %i[warning info].include?(finding.severity) && !finding.tool_failure?
+    end
+
+    def nonempty_string?(value) = value.is_a?(String) && !value.empty?
+
+    def analyzer?(tools) = tools.any? { TOOLS.include?(_1) }
+
+    def keys_match?(hash, keys) = hash.keys.all? { _1.is_a?(String) } && hash.keys.sort == keys.sort
+
+    def invalid(message) = raise(BaselineError, message)
+  end
+
+  module BaselinePaths
+    module_function
+
+    def canonical(file, root)
+      return unless file.is_a?(String) && !file.empty?
+
+      project = File.expand_path(root)
+      relative_path(file, project)
+    rescue ArgumentError, TypeError => e
+      raise BaselineError, "invalid project root or finding path: #{e.message}"
+    end
+
+    def relative_path(file, project)
+      absolute = File.expand_path(file, project)
+      prefix = project.end_with?(File::SEPARATOR) ? project : "#{project}#{File::SEPARATOR}"
+      absolute.delete_prefix(prefix) if absolute.start_with?(prefix)
+    end
+
+    def stored?(file)
+      return false unless file.is_a?(String) && !file.empty?
+
+      !file.start_with?(File::SEPARATOR) && !file.include?("\0") && canonical_segments?(file)
+    end
+
+    def canonical_segments?(file)
+      segments = file.split(File::SEPARATOR)
+      valid = !segments.include?("..") && segments.none? { |part| part.empty? || part == "." }
+      valid && segments.join(File::SEPARATOR) == file
+    end
+  end
+
+  module BaselinePersistence
+    module_function
+
+    def read(path)
+      Baseline.from_h(JSON.parse(File.read(path)))
+    rescue JSON::ParserError, SystemCallError, IOError => e
+      raise BaselineError, "cannot read baseline: #{e.message}"
+    end
+
+    def write(path, document, create:)
+      bytes = serialize(document)
+      create ? create_file(path, bytes) : replace_file(path, bytes)
+    rescue SystemCallError, IOError, JSON::GeneratorError => e
+      raise BaselineError, "cannot write baseline: #{e.message}"
+    end
+
+    def serialize(document) = "#{JSON.pretty_generate(document, indent: "  ")}\n"
+
+    def create_file(path, bytes)
+      File.open(path, File::WRONLY | File::CREAT | File::EXCL) { _1.write(bytes) }
+    end
+
+    def replace_file(path, bytes) = replace_with_mode(path, bytes, file_mode(path))
+
+    def file_mode(path) = File.stat(path).mode & 0o777
+
+    def replace_with_mode(path, bytes, mode)
+      Tempfile.create([".quality-gate-baseline-", ".tmp"], File.dirname(path)) do |file|
+        write_temp(file, bytes, mode)
+        File.rename(file.path, path)
+      end
+    end
+
+    def write_temp(file, bytes, mode)
+      file.write(bytes)
+      file.flush
+      File.chmod(mode, file.path)
+    end
+  end
+
+  class Baseline
+    Match = Data.define(:findings, :accepted)
+    private_constant :Match
+
+    def self.capture(gate:, tools:, findings:, root:)
+      BaselineSchema.validate_context(gate, tools)
+      new(gate:, tools:, entries: capture_entries(findings, root, tools))
+    end
+
+    def self.read(path) = BaselinePersistence.read(path)
+
+    def self.from_h(document)
+      BaselineSchema.validate(document)
+      new(gate: document.fetch("gate"), tools: document.fetch("tools"), entries: document.fetch("findings"))
+    end
+
+    def self.capture_entries(findings, root, tools)
+      raise BaselineError, "findings must be an array" unless findings.is_a?(Array)
+
+      counts = Hash.new(0)
+      findings.each { increment_count(counts, _1, root, tools) }
+      counts.sort.map { entry_from(_1) }
+    end
+
+    def self.increment_count(counts, finding, root, tools)
+      return unless tools.include?(finding.tool) && BaselineSchema.eligible?(finding)
+
+      file = BaselinePaths.canonical(finding.file, root)
+      return unless file
+
+      counts[[finding.tool, file, finding.rule, finding.severity.to_s, finding.message]] += 1
+    end
+
+    def self.entry_from(pair)
+      key, count = pair
+      Hash[%w[tool file rule severity message].zip(key).push(["count", count])]
+    end
+    private_class_method :capture_entries, :increment_count, :entry_from
+
+    def initialize(gate:, tools:, entries:)
+      BaselineSchema.validate(snapshot_document(gate, tools, entries))
+      @gate = gate.dup.freeze
+      @tools = tools.map { _1.dup.freeze }.freeze
+      @entries = entries.sort_by { BaselineSchema.identity(_1) }.map { copy_entry(_1) }.freeze
+      freeze
+    end
+
+    def validate_context!(gate:, tools:)
+      BaselineSchema.validate_context(gate, tools)
+      raise BaselineError, "baseline gate does not match configured gate" unless gate == @gate
+      raise BaselineError, "baseline tools do not match configured tools" unless tools == @tools
+
+      self
+    end
+
+    def match(findings, root:)
+      remaining = @entries.to_h { [BaselineSchema.identity(_1), _1.fetch("count")] }
+      lists = [[], []]
+      findings.each { consume(_1, root, remaining, lists) }
+      Match.new(findings: lists.last.freeze, accepted: lists.first.freeze)
+    end
+
+    def write(path, create:) = BaselinePersistence.write(path, to_h, create:)
+    def count = @entries.sum { _1.fetch("count") }
+
+    def to_h
+      { "schema_version" => 1, "gate" => @gate.dup, "tools" => @tools.map(&:dup),
+        "findings" => @entries.map { copy_entry(_1, frozen: false) } }
+    end
+
+    private
+
+    def snapshot_document(gate, tools, entries)
+      { "schema_version" => 1, "gate" => gate, "tools" => tools, "findings" => entries }
+    end
+
+    def consume(finding, root, remaining, lists)
+      identity = match_identity(finding, root)
+      accepted = identity && remaining.fetch(identity, 0).positive?
+      list = accepted ? lists.first : lists.last
+      remaining[identity] -= 1 if accepted
+      list << finding
+    end
+
+    def match_identity(finding, root)
+      return unless BaselineSchema.eligible?(finding)
+
+      file = BaselinePaths.canonical(finding.file, root)
+      [finding.tool, file, finding.rule, finding.severity.to_s, finding.message] if file
+    end
+
+    def copy_entry(entry, frozen: true)
+      copy = entry.transform_values { _1.is_a?(String) ? _1.dup : _1 }
+      copy.each_value(&:freeze) if frozen
+      frozen ? copy.freeze : copy
+    end
+  end
+
+  private_constant :BaselineSchema, :BaselinePaths, :BaselinePersistence
+end

data/lib/quality_gate/baseline_run.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+module QualityGate
+  # Applies one baseline operation to a completed adapter result.
+  class BaselineRun
+    def initialize(operation:, gate:, tools:)
+      @operation = operation
+      @gate = gate
+      @tools = tools.map(&:to_s).freeze
+    end
+
+    def call(result)
+      snapshot, match = snapshot_and_match(result)
+      apply(result, snapshot, match)
+    rescue BaselineError, SystemCallError, IOError => e
+      result.with(findings: result.findings + [Finding.tool_failure(tool: "baseline", message: e.message)])
+    end
+
+    private
+
+    attr_reader :operation, :gate, :tools
+
+    def snapshot_and_match(result)
+      snapshot = snapshot_for(result)
+      snapshot.validate_context!(gate:, tools:) unless operation.fetch(:mode) == :create
+      [snapshot, snapshot.match(result.findings, root: operation.fetch(:root))]
+    end
+
+    def snapshot_for(result)
+      return Baseline.read(operation.fetch(:path)) unless operation.fetch(:mode) == :create
+
+      Baseline.capture(gate:, tools:, findings: result.findings, root: operation.fetch(:root))
+    end
+
+    def apply(result, snapshot, match)
+      mode = operation.fetch(:mode)
+      return compare(result, match) if mode == :compare
+      return create(result, snapshot, match) if mode == :create
+      return ratchet(result, snapshot, match) if mode == :ratchet
+
+      raise BaselineError, "unsupported baseline mode #{mode}"
+    end
+
+    def compare(result, match)
+      result.with(findings: match.findings, baseline: metadata(:compare, match.accepted))
+    end
+
+    def create(result, snapshot, match)
+      return blocked(result, :create, match) if match.findings.any?
+
+      snapshot.write(operation.fetch(:path), create: true)
+      result.with(findings: match.findings, baseline: metadata(:create, match.accepted, written: true))
+    end
+
+    def ratchet(result, snapshot, match)
+      return blocked(result, :ratchet, match) if match.findings.any?
+
+      removed = write_reduced_snapshot(result, snapshot)
+      result.with(findings: match.findings, baseline: metadata(:ratchet, match.accepted, removed:, written: true))
+    end
+
+    def write_reduced_snapshot(result, snapshot)
+      reduced = Baseline.capture(gate:, tools:, findings: result.findings, root: operation.fetch(:root))
+      reduced.write(operation.fetch(:path), create: false)
+      snapshot.count - reduced.count
+    end
+
+    def blocked(result, mode, match)
+      findings = mode == :ratchet ? match.findings : result.findings
+      result.with(findings:, baseline: metadata(mode, match.accepted, status: "blocked"))
+    end
+
+    def metadata(mode, accepted, options = {})
+      { mode:, status: options.fetch(:status, "applied"), accepted_findings: accepted,
+        accepted_count: accepted.length, removed_count: options.fetch(:removed, 0),
+        written: options.fetch(:written, false) }
+    end
+  end
+  private_constant :BaselineRun
+end