quality_gate 0.2.2 → 0.3.0

data/lib/quality_gate/config.rb

@@ -22,20 +22,23 @@ module QualityGate
       adapters: {
         fast: ["rubocop"].freeze,
         verify: %w[reek test_suite undercover].map!(&:freeze).freeze,
-        audit: %w[brakeman bundler_audit].map!(&:freeze).freeze
+        audit: %w[brakeman bundler_audit].map!(&:freeze).freeze,
+        deep: ["rubycritic"].freeze
       }.freeze,
       commands: {
         fast: {}.freeze,
         verify: { test_suite: %w[bin/rails test].map!(&:freeze).freeze }.freeze,
-        audit: {}.freeze
+        audit: {}.freeze,
+        deep: {}.freeze
       }.freeze,
       timeouts: { default: 120, rubocop: 10, test_suite: 120, undercover: 120 }.freeze,
       coverage: nil,
       compare_point: nil,
-      rubocop_config: nil
+      rubocop_config: nil,
+      baseline: {}.freeze
     }.freeze
     FORMATS = %w[text json markdown].map!(&:freeze).freeze
-    ADAPTER_LAYERS = %i[fast verify audit].freeze
+    ADAPTER_LAYERS = %i[fast verify audit deep].freeze
     COVERAGE_KEYS = %i[minimum_line minimum_branch].freeze
     private_constant :ADAPTER_LAYERS, :COVERAGE_KEYS
 
@@ -69,6 +72,7 @@ module QualityGate
         validate_document(document, path)
         overrides = symbolize_keys(document || {})
         validate_known_settings(overrides, path)
+        validate_baseline(overrides[:baseline], path) if overrides.key?(:baseline)
 
         new(
           deep_merge(DEFAULTS, known_overrides(overrides)),
@@ -121,7 +125,7 @@ module QualityGate
 
         invalid_keys = adapters.keys - ADAPTER_LAYERS
         if invalid_keys.any?
-          fail ConfigError.new(path: path, cause_message: "adapters keys must be fast, verify, or audit") # rubocop:disable Style/SignalException
+          fail ConfigError.new(path: path, cause_message: "adapters keys must be fast, verify, audit, or deep") # rubocop:disable Style/SignalException
         end
 
         adapters.each do |layer, adapter_names|
@@ -160,7 +164,7 @@ module QualityGate
 
         return if (value.keys - ADAPTER_LAYERS).empty?
 
-        cause = "#{setting} keys must be fast, verify, or audit"
+        cause = "#{setting} keys must be fast, verify, audit, or deep"
         fail ConfigError.new(path: path, cause_message: cause) # rubocop:disable Style/SignalException
       end
 
@@ -220,6 +224,16 @@ module QualityGate
         fail ConfigError.new(path: path, cause_message: "rubocop_config must be nil or a non-empty String") # rubocop:disable Style/SignalException
       end
 
+      def validate_baseline(baseline, path)
+        unless baseline.is_a?(Hash) && (baseline.keys - %i[fast verify]).empty?
+          raise ConfigError.new(path: path, cause_message: "baseline must map only fast and verify")
+        end
+
+        return if baseline.all? { |gate, file| %i[fast verify].include?(gate) && file.is_a?(String) && !file.empty? }
+
+        raise ConfigError.new(path: path, cause_message: "baseline paths must be non-empty strings")
+      end
+
       def validate_document(document, path)
         unless document.nil? || document.is_a?(Hash)
           cause = "expected a mapping, got #{document.class}"

data/lib/quality_gate/database_consistency_runner.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require "json"
+require "rubygems"
+
+module QualityGate
+  # Runs database_consistency inside the target application's Bundler/Rails context.
+  class DatabaseConsistencyRunner
+    ENVELOPE_VERSION = 1
+    SUPPORTED_ANALYZER_VERSION = Gem::Requirement.new("~> 3.0.14")
+    REPORT_FIELDS = %i[
+      checker_name table_or_model_name column_or_attribute_name status error_slug error_message
+    ].freeze
+    private_constant :REPORT_FIELDS
+
+    class << self
+      def run(stdout: $stdout, stderr: $stderr, cwd: Dir.pwd)
+        with_redirected_stdout(stderr) { execute(stdout, cwd) }
+      rescue StandardError, LoadError => e
+        diagnostic(stderr, e)
+        2
+      end
+
+      private
+
+      def load_project!(cwd)
+        require "bundler/setup"
+        require_project_files(cwd)
+        rails_application.eager_load!
+      end
+
+      def require_project_files(cwd)
+        require_project_file(cwd, "boot")
+        require_project_file(cwd, "environment")
+      end
+
+      def load_analyzer!
+        require "database_consistency"
+        spec = Gem.loaded_specs["database_consistency"]
+        validate_analyzer_version!(spec)
+        spec.version.to_s
+      end
+
+      def collect_reports
+        configuration = DatabaseConsistency::Configuration.new
+        reports = DatabaseConsistency::Processors.reports(configuration)
+        ensure_no_rescued_checker_errors!
+        serialize_reports(reports)
+      end
+
+      def serialize_report(report)
+        report_fields(report).merge(report_source_location(report))
+      end
+
+      def report_fields(report)
+        REPORT_FIELDS.to_h { |field| [field, report.public_send(field)] }
+      end
+
+      def report_source_location(report)
+        return {} unless report.respond_to?(:source_location)
+
+        { source_location: report.source_location }
+      end
+
+      def write_envelope(stdout, analyzer_version, reports)
+        stdout.puts(JSON.generate(version: ENVELOPE_VERSION, analyzer_version:, reports:))
+      end
+
+      def diagnostic(stderr, error)
+        stderr.puts("database_consistency: #{error.class}: #{error.message}")
+      rescue StandardError
+        nil
+      end
+
+      def with_redirected_stdout(stderr)
+        previous_stdout = $stdout
+        $stdout = stderr
+        yield
+      ensure
+        $stdout = previous_stdout
+      end
+
+      def execute(stdout, cwd)
+        load_project!(cwd)
+        analyzer_version = load_analyzer!
+        write_envelope(stdout, analyzer_version, collect_reports)
+        0
+      end
+
+      def require_project_file(cwd, section)
+        path = File.join(cwd, "config", "#{section}.rb")
+        raise LoadError, "Rails #{section} file not found at #{path}" unless File.file?(path)
+
+        require path
+      end
+
+      def rails_application
+        return Rails.application if defined?(Rails) && Rails.respond_to?(:application) && Rails.application
+
+        raise LoadError, "Rails.application is unavailable after loading config/environment.rb"
+      end
+
+      def validate_analyzer_version!(spec)
+        raise LoadError, "database_consistency gem did not register a loaded gemspec" unless spec
+        return if SUPPORTED_ANALYZER_VERSION.satisfied_by?(spec.version)
+
+        raise LoadError,
+              "database_consistency #{spec.version} is unsupported; install ~> 3.0.14 (>= 3.0.14, < 3.1)"
+      end
+
+      def ensure_no_rescued_checker_errors!
+        return if DatabaseConsistency::RescueError.empty?
+
+        raise "database_consistency rescued a checker error; see its diagnostic file in the project root"
+      end
+
+      def serialize_reports(reports)
+        reports.map { serialize_report(_1) }
+      end
+    end
+  end
+end
+
+exit QualityGate::DatabaseConsistencyRunner.run if $PROGRAM_NAME == __FILE__

data/lib/quality_gate/doctor.rb

@@ -0,0 +1,217 @@
+# frozen_string_literal: true
+
+require "rbconfig"
+require_relative "config"
+require_relative "doctor_report"
+require_relative "doctor_launchers"
+require_relative "doctor_git"
+require_relative "doctor_coverage"
+require_relative "doctor_hooks"
+
+module QualityGate
+  class DoctorRuntimeCheck
+    def call
+      defined?(Bundler::VERSION) ? bundled_check : unbundled_check
+    rescue StandardError
+      check("unchecked", "Ruby and Bundler runtime context could not be fully inspected.")
+    end
+
+    private
+
+    def bundled_check
+      context = ENV["BUNDLE_GEMFILE"] || "default bundle context"
+      message = "#{ruby_message} Bundler #{Bundler::VERSION} is loaded (#{context}); no application code was run."
+      check("ready", message)
+    end
+
+    def unbundled_check
+      message = "#{ruby_message} Bundler is not loaded; invoke through bundle exec to inspect bundle context."
+      check("unchecked", message)
+    end
+
+    def ruby_message = "Ruby #{RUBY_VERSION} at #{RbConfig.ruby}."
+
+    def check(status, message)
+      DoctorReport.check(id: "runtime", status:, message:)
+    end
+  end
+
+  class DoctorConfiguration
+    def initialize(config, registry:, dir:)
+      @config = config
+      @registry = registry
+      @dir = dir
+    end
+
+    def checks
+      [configuration_check, *DoctorAdapterChecks.new(config:, registry:, dir:).call]
+    end
+
+    def self.failure_checks
+      [blocked_config_check, configured_default_checks]
+    end
+
+    private
+
+    attr_reader :config, :registry, :dir
+
+    def configuration_check
+      keys = config.unknown_keys
+      warning = keys.any?
+      status = warning ? "warning" : "ready"
+      message = configuration_message(keys, warning)
+      DoctorReport.check(id: "configuration", status:, message:)
+    end
+
+    def configuration_message(keys, warning)
+      return "Configuration loaded; application checks were not run." unless warning
+
+      "Configuration loaded with unknown keys: #{keys.join(", ")}; review .quality_gate.yml."
+    end
+
+    def self.blocked_config_check
+      message = "Could not load .quality_gate.yml; fix its syntax or values before rerunning Doctor."
+      DoctorReport.check(id: "configuration", status: "blocked", message:)
+    end
+
+    def self.configured_default_checks
+      message = "Configured adapters were not inspected because configuration could not be loaded."
+      DoctorReport.check(id: "configured_checks", status: "unchecked", message:)
+    end
+    private_class_method :blocked_config_check, :configured_default_checks
+  end
+
+  class DoctorAdapterChecks
+    GATES = %i[fast verify audit].freeze
+
+    def initialize(config:, registry:, dir:)
+      @config = config
+      @registry = registry
+      @launchers = DoctorLaunchers.new(dir:)
+    end
+
+    def call
+      GATES.flat_map { checks_for_gate(_1) }
+    end
+
+    private
+
+    attr_reader :config, :launchers, :registry
+
+    def checks_for_gate(gate)
+      names = config.fetch(:adapters).fetch(gate)
+      return [empty_gate_check(gate)] if names.empty?
+
+      names.map { adapter_check(gate, _1) }
+    end
+
+    def adapter_check(gate, name)
+      adapter_class = registry.fetch(name) { return unknown_adapter(gate, name) }
+      return simplecov_check(gate) if name == "simplecov"
+
+      inspect_adapter(gate, name, adapter_class)
+    rescue StandardError
+      blocked_adapter(gate, name, "Could not safely inspect this adapter's timeout or argv configuration.")
+    end
+
+    def inspect_adapter(gate, name, adapter_class)
+      adapter = adapter_class.new(config:, files: [])
+      return invalid_timeout_check(gate, name) unless valid_timeout?(adapter.timeout)
+
+      argv = name == "undercover" ? ["undercover"] : adapter.command
+      launchers.check(adapter: name, gate:, argv:)
+    end
+
+    def invalid_timeout_check(gate, name)
+      blocked_adapter(gate, name, "Adapter timeout must be a positive Integer.")
+    end
+
+    def simplecov_check(gate)
+      return blocked_adapter(gate, "simplecov", threshold_message) unless coverage_budget?
+
+      ready_simplecov_check(gate)
+    end
+
+    def threshold_message
+      "SimpleCov requires a configured coverage threshold; add " \
+        "coverage.minimum_line and/or coverage.minimum_branch."
+    end
+
+    def ready_simplecov_check(gate)
+      message = "SimpleCov is internal and has a configured threshold; no external launcher is required."
+      DoctorReport.check(id: "command.#{gate}.simplecov", status: "ready", message:)
+    end
+
+    def coverage_budget?
+      coverage = config.fetch(:coverage)
+      coverage.is_a?(Hash) && %i[minimum_line minimum_branch].any? { coverage.key?(_1) }
+    end
+
+    def valid_timeout?(timeout)
+      timeout.is_a?(Integer) && timeout.positive?
+    end
+
+    def empty_gate_check(gate)
+      message = "No adapters are configured for this gate."
+      DoctorReport.check(id: "command.#{gate}", status: "not_applicable", message:)
+    end
+
+    def unknown_adapter(gate, name)
+      blocked_adapter(gate, name, "Unknown adapter #{name}; remove it or use a registered adapter.")
+    end
+
+    def blocked_adapter(gate, name, message)
+      DoctorReport.check(id: "command.#{gate}.#{name}", status: "blocked", message:)
+    end
+  end
+
+  # Coordinates read-only runtime, configuration, and launch probes.
+  class Doctor
+    def initialize(dir:, registry:)
+      @dir = File.expand_path(dir)
+      @registry = registry
+    end
+
+    def call
+      DoctorReport.new(checks: checks)
+    rescue ConfigError
+      DoctorReport.new(checks: [runtime_check, *DoctorConfiguration.failure_checks])
+    rescue StandardError
+      DoctorReport.new(checks: [runtime_check, doctor_failure_check])
+    end
+
+    private
+
+    attr_reader :dir, :registry
+
+    def checks
+      config = Config.load(dir:)
+      configuration_checks = DoctorConfiguration.new(config, registry:, dir:).checks
+      [runtime_check, *configuration_checks, *probe_checks(config)]
+    end
+
+    def probe_checks(config)
+      safe_probe("comparison") { DoctorGit.new(dir:, config:).call } +
+        safe_probe("coverage") { DoctorCoverage.new(dir:, config:).call } +
+        safe_probe("hooks") { DoctorHooks.new(dir:).call }
+    end
+
+    def safe_probe(id)
+      yield
+    rescue StandardError
+      message = "This bounded observation could not be completed; inspect its local setup."
+      [DoctorReport.check(id:, status: "unchecked", message:)]
+    end
+
+    def runtime_check
+      DoctorRuntimeCheck.new.call
+    end
+
+    def doctor_failure_check
+      message = "Doctor could not complete its bounded preflight checks."
+      DoctorReport.check(id: "doctor", status: "blocked", message:)
+    end
+  end
+
+  private_constant :DoctorRuntimeCheck, :DoctorConfiguration, :DoctorAdapterChecks
+end

data/lib/quality_gate/doctor_bounded_file.rb

@@ -0,0 +1,74 @@
+# frozen_string_literal: true
+
+module QualityGate
+  # Reads a small regular file without following links or blocking on special files.
+  class DoctorBoundedFile
+    Result = Data.define(:status, :contents)
+    MAX_BYTES = 1024 * 1024
+
+    def self.read(path:, max_bytes: MAX_BYTES)
+      new(path:, max_bytes:).read
+    end
+
+    def initialize(path:, max_bytes:)
+      @path = path
+      @max_bytes = max_bytes
+    end
+
+    def read
+      read_expected_file
+    rescue SystemCallError, IOError => e
+      read_error(e)
+    end
+
+    private
+
+    def read_expected_file
+      expected = File.lstat(@path)
+      return Result.new(:unsafe, nil) unless expected.file?
+
+      read_open_file(expected)
+    end
+
+    def read_error(error)
+      status = error.is_a?(Errno::ENOENT) ? :missing : :unreadable
+      Result.new(status, nil)
+    end
+
+    def read_flags
+      %i[NONBLOCK NOFOLLOW].reduce(File::RDONLY) do |flags, name|
+        File.const_defined?(name) ? flags | File.const_get(name) : flags
+      end
+    end
+
+    def read_open_file(expected)
+      File.open(@path, read_flags) { |io| read_checked_io(io, expected) }
+    end
+
+    def read_checked_io(io, expected)
+      return Result.new(:unsafe, nil) unless same_file?(io.stat, expected, File.lstat(@path))
+      return Result.new(:oversized, nil) if io.stat.size > @max_bytes
+
+      read_contents(io, expected)
+    end
+
+    def read_contents(io, expected)
+      bytes = io.read(@max_bytes) || "".b
+      validate_contents(io, expected, bytes)
+    end
+
+    def validate_contents(io, expected, bytes)
+      opened = io.stat
+      return Result.new(:unsafe, nil) unless same_file?(opened, expected, File.lstat(@path))
+      return Result.new(:oversized, nil) if opened.size > @max_bytes || bytes.bytesize > @max_bytes
+
+      Result.new(:ok, bytes.force_encoding(Encoding::UTF_8).freeze)
+    end
+
+    def same_file?(opened, expected, current)
+      [opened, expected, current].all?(&:file?) &&
+        [opened.dev, opened.ino] == [expected.dev, expected.ino] &&
+        [opened.dev, opened.ino] == [current.dev, current.ino]
+    end
+  end
+end

data/lib/quality_gate/doctor_command.rb

@@ -0,0 +1,130 @@
+# frozen_string_literal: true
+
+require "optparse"
+
+module QualityGate
+  # Parses Doctor-specific options and renders a read-only preflight report.
+  class DoctorCommand
+    HELP = "Usage: quality_gate doctor [--format text|json] [--help]\n" \
+      "Read-only preflight; configured gates and application code are not run.\n" \
+      "Exit status: 0 ready, 1 warning or unchecked, 2 blocked or input/output failure."
+
+    def initialize(dir:, registry:)
+      @dir = dir
+      @registry = registry
+    end
+
+    def run(arguments, stdout:, stderr:)
+      run_options(parse(arguments), stdout:, stderr:)
+    rescue StandardError => e
+      render_failure(failure_check("input", e), requested_format(arguments), stdout:, stderr:)
+    end
+
+    private
+
+    attr_reader :dir, :registry
+
+    def parse(arguments)
+      options = { format: "text", help: false }
+      remaining = arguments.dup
+      parser(options).parse!(remaining)
+      reject_positionals(remaining)
+      options
+    end
+
+    def reject_positionals(arguments)
+      raise OptionParser::InvalidOption, arguments.join(" ") unless arguments.empty?
+    end
+
+    def run_options(options, stdout:, stderr:)
+      return print_help(stdout, stderr) if options.fetch(:help)
+
+      run_report(options, stdout)
+    rescue StandardError => e
+      render_failure(failure_check("doctor", e), options.fetch(:format), stdout:, stderr:)
+    end
+
+    def run_report(options, stdout)
+      report = Doctor.new(dir:, registry:).call
+      Reporters::Doctor.new(io: stdout).call(report, format: options.fetch(:format))
+      report.exit_code
+    end
+
+    def parser(options)
+      OptionParser.new(HELP) { register_options(_1, options) }
+    end
+
+    def register_options(parser, options)
+      parser.on("--format FORMAT") { |format| select_format(format, options) }
+      parser.on("-h", "--help") { options[:help] = true }
+    end
+
+    def select_format(format, options)
+      raise OptionParser::InvalidArgument, format unless %w[text json].include?(format)
+
+      options[:format] = format
+    end
+
+    def requested_format(arguments)
+      arguments.take_while { _1 != "--" }.each_with_index.filter_map do |argument, index|
+        format_option(argument, arguments[index + 1])
+      end.last || "text"
+    end
+
+    def format_option(argument, next_argument)
+      return next_argument if argument == "--format"
+
+      argument.delete_prefix("--format=") if argument.start_with?("--format=")
+    end
+
+    def failure_check(id, error)
+      DoctorReport.check(id:, status: "blocked", message: safe_message(error))
+    end
+
+    def render_failure(check, format, stdout:, stderr:)
+      return report_json_failure(check, stdout, stderr) if format == "json"
+
+      write_error(stderr, check.fetch("message"))
+      ExitCode::TOOL_FAILURE
+    end
+
+    def report_json_failure(check, stdout, stderr)
+      write_json_failure(check, stdout)
+    rescue StandardError => e
+      write_error(stderr, e)
+      ExitCode::TOOL_FAILURE
+    end
+
+    def write_json_failure(check, stdout)
+      report = DoctorReport.new(checks: [check])
+      Reporters::Doctor.new(io: stdout).call(report, format: "json")
+      ExitCode::TOOL_FAILURE
+    end
+
+    def safe_message(error)
+      message = error.is_a?(String) ? error : error.message
+      sanitize_message(message)
+    rescue StandardError
+      "quality_gate doctor failed"
+    end
+
+    def sanitize_message(message)
+      message.to_s.encode(Encoding::UTF_8, invalid: :replace, undef: :replace, replace: "�")
+             .gsub(/[[:cntrl:]\u2028\u2029]+/, " ").strip
+    end
+
+    def write_error(io, error)
+      io.puts "Error: #{safe_message(error)}"
+    rescue StandardError
+      false
+    end
+
+    def print_help(stdout, stderr)
+      stdout.puts parser({}).to_s
+      ExitCode::CLEAN
+    rescue StandardError => e
+      write_error(stderr, e)
+      ExitCode::TOOL_FAILURE
+    end
+  end
+end