rail_verdict 1.0.0

data/lib/rail_verdict/analyzers/rubocop.rb

@@ -0,0 +1,289 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "_shared"
+
+module RailVerdict
+  module Analyzers
+    class RuboCop
+      ANALYZER_ID = "rubocop"
+      SUPPORTED_VERSIONS = Gem::Requirement.new(">= 1.72", "< 2")
+      SEVERITY_MAP = {
+        "info" => "info",
+        "refactor" => "low",
+        "convention" => "low",
+        "warning" => "medium",
+        "error" => "high",
+        "fatal" => "critical"
+      }.freeze
+
+      Probe = Struct.new(:status, :version, :message, :rubocop_rails_version, :rubocop_config_digest, keyword_init: true)
+
+      class MalformedOutput < StandardError; end
+
+      def initialize(command_resolver: nil)
+        @command_resolver = command_resolver || method(:default_command)
+      end
+
+      def probe(repository_root, runner: ProcessRunner, timeout_seconds: 15.0)
+        command = @command_resolver.call(repository_root)
+        invocation = invocation_for(command, ["--version"])
+        result = runner.run(
+          command.fetch(:executable),
+          invocation.fetch("argv"),
+          chdir: repository_root,
+          timeout_seconds: timeout_seconds
+        )
+
+        return Probe.new(status: "unavailable", message: detail_for(result)) if result.status == :spawn_failed
+        return Probe.new(status: "timed_out", message: detail_for(result)) if result.status == :timed_out
+        return Probe.new(status: "signaled", message: detail_for(result)) if result.status == :signaled
+        return Probe.new(status: "truncated", message: detail_for(result)) if truncated?(result)
+        return Probe.new(status: "unavailable", message: detail_for(result)) unless result.exit_code == 0
+
+        version = parse_version(result.stdout)
+        return Probe.new(status: "unsupported", message: "RuboCop version could not be parsed") unless version
+        return Probe.new(status: "unsupported", version: version, message: "unsupported RuboCop version #{version}") unless SUPPORTED_VERSIONS.satisfied_by?(Gem::Version.new(version))
+
+        provenance = probe_provenance(repository_root)
+
+        Probe.new(status: "succeeded", version: version, rubocop_rails_version: provenance[:rubocop_rails_version], rubocop_config_digest: provenance[:rubocop_config_digest])
+      rescue ArgumentError
+        Probe.new(status: "unsupported", message: "RuboCop reported an invalid version")
+      rescue KeyError, ArgumentError => error
+        Probe.new(status: "malformed", message: bounded_message(error.message))
+      end
+
+      def run(repository_root, runner: ProcessRunner, timeout_seconds: 30.0, probe_result: nil)
+        command = @command_resolver.call(repository_root)
+        probe_result ||= probe(repository_root, runner: runner, timeout_seconds: timeout_seconds)
+        version_invocation = invocation_for(command, ["--version"])
+
+        unless probe_result.status == "succeeded"
+          return [failure_result(version_invocation, probe_result.status, probe_result.message, tool_version: probe_result.version), []]
+        end
+
+        invocation = invocation_for(command, ["--format", "json"])
+        result = runner.run(
+          command.fetch(:executable),
+          invocation.fetch("argv"),
+          chdir: repository_root,
+          timeout_seconds: timeout_seconds
+        )
+        tool_version = probe_result.version
+
+        if result.status == :spawn_failed
+          return [failure_result(invocation, "unavailable", detail_for(result), tool_version: tool_version), []]
+        end
+        if truncated?(result)
+          return [failure_result(invocation, "truncated", detail_for(result), tool_version: tool_version), []]
+        end
+        if result.status == :timed_out
+          return [failure_result(invocation, "timed_out", detail_for(result), tool_version: tool_version), []]
+        end
+        if result.status == :signaled
+          return [failure_result(invocation, "signaled", detail_for(result), tool_version: tool_version), []]
+        end
+        if result.exit_code && result.exit_code >= 2
+          return [failure_result(invocation, "failed", execution_message(result), tool_version: tool_version), []]
+        end
+
+        begin
+          parsed = JSON.parse(result.stdout)
+        rescue JSON::ParserError => error
+          return [failure_result(invocation, "parse_failed", bounded_message(error.message), tool_version: tool_version), []]
+        end
+
+        findings = normalize_findings(parsed)
+        evidence_summary = build_evidence_summary(probe_result)
+        analyzer_result = AnalyzerResult.new(
+          analyzer: ANALYZER_ID,
+          tool_version: tool_version,
+          invocation: invocation,
+          execution_status: "succeeded",
+          finding_ids: findings.map(&:id),
+          evidence_summary: evidence_summary.empty? ? nil : evidence_summary
+        )
+        [analyzer_result, findings]
+      rescue MalformedOutput => error
+        [failure_result(invocation || { "executable" => "rubocop", "argv" => [] }, "malformed", bounded_message(error.message)), []]
+      end
+
+      private
+
+      def default_command(repository_root)
+        if File.file?(File.join(repository_root, "Gemfile"))
+          { executable: "bundle", args_prefix: ["exec", "rubocop"] }
+        else
+          { executable: "rubocop", args_prefix: [] }
+        end
+      end
+
+      def invocation_for(command, arguments)
+        Shared.invocation_for(command, arguments)
+      end
+
+      def parse_version(output)
+        Shared.parse_semver(output)
+      end
+
+      def truncated?(result)
+        Shared.truncated?(result)
+      end
+
+      def detail_for(result)
+        Shared.detail_for(result)
+      end
+
+      def execution_message(result)
+        message = result.stderr.to_s.lines.first.to_s.strip
+        message = "RuboCop exited with status #{result.exit_code}" if message.empty?
+        Shared.bounded_message(message)
+      end
+
+      def bounded_message(message)
+        Shared.bounded_message(message)
+      end
+
+      def build_evidence_summary(probe_result)
+        summary = {}
+        if probe_result.respond_to?(:rubocop_rails_version) && probe_result.rubocop_rails_version
+          summary["rubocop_rails_version"] = probe_result.rubocop_rails_version.to_s[0, 64]
+        end
+        if probe_result.respond_to?(:rubocop_config_digest) && probe_result.rubocop_config_digest
+          summary["rubocop_config_digest"] = probe_result.rubocop_config_digest.to_s[0, 64]
+        end
+        summary
+      end
+
+      def probe_provenance(repository_root)
+        rubocop_rails_version = parse_gem_version_from_lockfile(repository_root, "rubocop-rails")
+        rubocop_config_digest = digest_file(File.join(repository_root, ".rubocop.yml"))
+        { rubocop_rails_version: rubocop_rails_version, rubocop_config_digest: rubocop_config_digest }
+      end
+
+      def parse_gem_version_from_lockfile(repository_root, gem_name)
+        lockfile = File.join(repository_root, "Gemfile.lock")
+        return nil unless File.file?(lockfile)
+
+        text = File.binread(lockfile).force_encoding(Encoding::UTF_8)
+        return nil unless text.valid_encoding?
+
+        text.each_line do |line|
+          stripped = line.strip
+          next unless stripped.start_with?("#{gem_name} (")
+
+          match = stripped.match(/\A#{Regexp.escape(gem_name)} \(([^)]+)\)/)
+          return match[1] if match
+        end
+        nil
+      rescue StandardError
+        nil
+      end
+
+      def digest_file(path)
+        return nil unless File.file?(path)
+
+        require "digest"
+        text = File.binread(path)
+        Digest::SHA256.hexdigest(text)
+      rescue StandardError
+        nil
+      end
+
+      def failure_result(invocation, status, message, tool_version: nil)
+        Shared.failure_result(
+          analyzer_id: ANALYZER_ID,
+          invocation: invocation,
+          status: status,
+          message: message,
+          tool_version: tool_version
+        )
+      end
+
+      def normalize_findings(document)
+        raise MalformedOutput, "RuboCop JSON root must be an object" unless document.is_a?(Hash)
+
+        files = document["files"]
+        raise MalformedOutput, "RuboCop JSON is missing files array" unless files.is_a?(Array)
+
+        findings = files.each_with_index.flat_map do |file, file_index|
+          normalize_file(file, file_index)
+        end
+        findings.uniq { |finding| finding.fingerprint }.sort_by(&:sort_key)
+      end
+
+      def normalize_file(file, file_index)
+        raise MalformedOutput, "RuboCop file entry #{file_index} must be an object" unless file.is_a?(Hash)
+
+        path = normalize_path(file["path"])
+        offenses = file["offenses"]
+        raise MalformedOutput, "RuboCop file #{path} is missing offenses array" unless offenses.is_a?(Array)
+
+        offenses.each_with_index.map do |offense, offense_index|
+          normalize_offense(offense, path, file_index, offense_index)
+        end
+      end
+
+      def normalize_path(path)
+        raise MalformedOutput, "RuboCop path must be a string" unless path.is_a?(String) && !path.empty?
+
+        normalized = path.delete_prefix("./")
+        unless normalized.match?(Finding::LOCATION_PATH_PATTERN)
+          raise MalformedOutput, "RuboCop emitted unsafe path"
+        end
+        normalized
+      end
+
+      def normalize_offense(offense, path, file_index, offense_index)
+        raise MalformedOutput, "RuboCop offense must be an object" unless offense.is_a?(Hash)
+
+        rule_id = offense["cop_name"]
+        severity = SEVERITY_MAP.fetch(offense["severity"]) do
+          raise MalformedOutput, "RuboCop emitted unknown severity"
+        end
+        category = rule_id.to_s.split("/", 2).first
+        raise MalformedOutput, "RuboCop cop name has no department" unless rule_id.is_a?(String) && rule_id.include?("/") && !category.empty?
+
+        location = offense["location"]
+        raise MalformedOutput, "RuboCop offense location is invalid" unless location.is_a?(Hash)
+
+        start_line = location["start_line"]
+        end_line = location["last_line"]
+        unless start_line.is_a?(Integer) && end_line.is_a?(Integer) && start_line >= 1 && end_line >= start_line
+          raise MalformedOutput, "RuboCop offense line range is invalid"
+        end
+
+        message = offense["message"]
+        unless message.is_a?(String) && message.valid_encoding? && !message.empty? && message.bytesize <= 4096
+          raise MalformedOutput, "RuboCop offense message is invalid"
+        end
+
+        fingerprint = Finding.fingerprint_for(
+          analyzer: ANALYZER_ID,
+          rule_id: rule_id,
+          path: path,
+          message: message
+        )
+        Finding.new(
+          fingerprint: fingerprint,
+          origin: "deterministic",
+          analyzer: ANALYZER_ID,
+          rule_id: rule_id,
+          category: category.downcase,
+          severity: severity,
+          confidence: "high",
+          state: "observed",
+          evidence_ref: "native:rubocop:#{fingerprint.delete_prefix("sha256:")[0, 12]}",
+          location: { "path" => path, "start_line" => start_line, "end_line" => end_line },
+          message: message
+        )
+      rescue KeyError
+        raise MalformedOutput, "RuboCop offense has unknown severity"
+      rescue ArgumentError => error
+        raise MalformedOutput, "RuboCop offense #{file_index}:#{offense_index} is malformed: #{error.message}"
+      end
+    end
+  end
+end

data/lib/rail_verdict/analyzers/simplecov.rb

@@ -0,0 +1,178 @@
+# frozen_string_literal: true
+
+require "json"
+
+require_relative "_shared"
+
+module RailVerdict
+  module Analyzers
+    class SimpleCov
+      ANALYZER_ID = "simplecov"
+      DEFAULT_COVERAGE_PATH = "coverage/coverage.json"
+      DEFAULT_FRESHNESS_WINDOW_SECONDS = 86_400
+      SUPPORTED_VERSION_RANGE = Gem::Requirement.new(">= 1", "< 2")
+
+      Probe = Struct.new(:status, :version, :message, keyword_init: true)
+
+      class MalformedOutput < StandardError; end
+
+      def probe(repository_root, runner: nil, timeout_seconds: 5.0)
+        config = load_config(repository_root)
+        coverage_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
+        full_path = File.expand_path(coverage_path, repository_root)
+        return Probe.new(status: "unavailable", message: "coverage file is absent: #{coverage_path}") unless File.file?(full_path)
+
+        text = File.binread(full_path).force_encoding(Encoding::UTF_8)
+        return Probe.new(status: "parse_failed", message: "coverage file is not valid UTF-8") unless text.valid_encoding?
+
+        document = JSON.parse(text)
+        return Probe.new(status: "unsupported", message: "coverage document has no version") unless document["version"].is_a?(String)
+
+        version = document["version"]
+        return Probe.new(status: "unsupported", message: "unsupported SimpleCov version #{version}") unless version.start_with?("1")
+
+        Probe.new(status: "succeeded", version: version)
+      rescue JSON::ParserError => error
+        Probe.new(status: "parse_failed", message: Shared.bounded_message(error.message))
+      rescue MalformedOutput => error
+        Probe.new(status: "malformed", message: Shared.bounded_message(error.message))
+      rescue SystemCallError, ArgumentError => error
+        Probe.new(status: "unavailable", message: Shared.bounded_message(error.message))
+      end
+
+      def run(repository_root, runner: nil, timeout_seconds: 10.0, probe_result: nil, configuration: nil)
+        config = load_config(repository_root, configuration: configuration)
+        coverage_path = config.fetch("coverage_path") { DEFAULT_COVERAGE_PATH }
+        freshness_window = config.fetch("freshness_window_seconds") { DEFAULT_FRESHNESS_WINDOW_SECONDS }
+        invocation = { "executable" => "simplecov", "argv" => ["read", coverage_path] }
+        full_path = File.expand_path(coverage_path, repository_root)
+
+        unless File.file?(full_path)
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unavailable", message: "coverage file is absent: #{coverage_path}"), []]
+        end
+
+        begin
+          bytes = File.binread(full_path)
+        rescue SystemCallError => error
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unavailable", message: Shared.bounded_message(error.message)), []]
+        end
+
+        if bytes.bytesize > 8 * 1024 * 1024
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "truncated", message: "coverage file exceeds 8 MiB"), []]
+        end
+
+        text = bytes.dup.force_encoding(Encoding::UTF_8)
+        unless text.valid_encoding?
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "parse_failed", message: "coverage file is not valid UTF-8"), []]
+        end
+
+        begin
+          document = JSON.parse(text)
+        rescue JSON::ParserError => error
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "parse_failed", message: Shared.bounded_message(error.message)), []]
+        end
+
+        version = document["version"].to_s
+        probe_result ||= probe(repository_root, timeout_seconds: timeout_seconds)
+        unless version.start_with?("1")
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "unsupported", message: "unsupported SimpleCov version #{version}", tool_version: probe_result.version || version), []]
+        end
+
+        errors = validate_coverage_schema(document)
+        unless errors.empty?
+          return [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: invocation, status: "malformed", message: errors.first, tool_version: probe_result.version || version), []]
+        end
+
+        mtime = File.mtime(full_path)
+        stale = (Time.now - mtime) > freshness_window
+
+        covered, executable = coverage_totals(document)
+
+        summary = {
+          "covered_lines" => covered,
+          "executable_lines" => executable,
+          "percent" => executable == 0 ? 100.0 : ((covered.to_f / executable) * 100).round(2),
+          "stale" => stale,
+          "freshness_window_seconds" => Integer(freshness_window),
+          "coverage_path" => coverage_path.to_s[0, 512],
+          "files" => document["files"]
+        }
+
+        result = AnalyzerResult.new(
+          analyzer: ANALYZER_ID,
+          tool_version: version,
+          invocation: invocation,
+          execution_status: "succeeded",
+          finding_ids: [],
+          evidence_summary: summary
+        )
+
+        [result, []]
+      rescue StandardError => error
+        [Shared.failure_result(analyzer_id: ANALYZER_ID, invocation: { "executable" => "simplecov", "argv" => ["read", DEFAULT_COVERAGE_PATH] }, status: "malformed", message: Shared.bounded_message(error.message)), []]
+      end
+
+      private
+
+      def load_config(repository_root, configuration: nil)
+        if configuration
+          sel = configuration.analyzers["simplecov"]
+          return {} unless sel
+
+          return {
+            "coverage_path" => sel["coverage_path"],
+            "freshness_window_seconds" => sel["freshness_window_seconds"]
+          }.compact
+        end
+
+        path = File.join(repository_root, ".railverdict.yml")
+        return {} unless File.file?(path)
+
+        bytes = File.binread(path) rescue nil
+        return {} unless bytes
+
+        text = bytes.dup.force_encoding(Encoding::UTF_8)
+        return {} unless text.valid_encoding?
+
+        data = RailVerdict::StrictYaml.parse(text, path) rescue nil
+        return {} unless data.is_a?(Hash) && data["analyzers"].is_a?(Hash)
+
+        sel = data["analyzers"]["simplecov"]
+        return {} unless sel.is_a?(Hash)
+
+        { "coverage_path" => sel["coverage_path"], "freshness_window_seconds" => sel["freshness_window_seconds"] }.compact
+      rescue StandardError
+        {}
+      end
+
+      def validate_coverage_schema(document)
+        schema_path = File.expand_path("../../../schemas/coverage-v1.schema.json", __dir__)
+        schema = JSON.parse(File.read(schema_path))
+        JSONSchemer.schema(schema).validate(document).map { |err|
+          pointer = err["data_pointer"].to_s
+          location = pointer.empty? ? "$" : "$#{pointer.gsub('/', '.')}"
+          "#{location}: #{err["error"]}"
+        }
+      rescue StandardError => error
+        ["schema validation error: #{error.message}"]
+      end
+
+      def coverage_totals(document)
+        covered = 0
+        executable = 0
+        document.fetch("files", []).each do |file|
+          lines = file.dig("coverage", "lines")
+          next unless lines.is_a?(Array)
+
+          lines.each do |hit|
+            next if hit.nil?
+
+            executable += 1
+            covered += 1 if hit.to_i > 0
+          end
+        end
+        [covered, executable]
+      end
+    end
+  end
+end

data/lib/rail_verdict/baseline.rb

@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require "digest"
+require "fileutils"
+require "json"
+require "pathname"
+require "securerandom"
+require "tempfile"
+require "time"
+
+module RailVerdict
+  class Baseline
+    SCHEMA_VERSION = "1.0"
+    DEFAULT_FILENAME = ".railverdict-baseline.json"
+
+    class IncompatibleError < RailVerdict::Error; end
+
+    attr_reader :hash, :entries, :created_at, :configuration_digest, :analyzer_versions
+
+    def initialize(hash)
+      @hash = hash.freeze
+      @entries = hash.fetch("entries").freeze
+      @created_at = hash.fetch("created_at").freeze
+      @configuration_digest = hash.fetch("configuration_digest").freeze
+      @analyzer_versions = hash.fetch("analyzer_versions").freeze
+      freeze
+    end
+
+    def to_h
+      @hash
+    end
+
+    def fingerprint_set
+      @fingerprint_set ||= Set.new(@entries.map { |entry| entry.fetch("fingerprint") }).freeze
+    end
+
+    def entry_by_fingerprint
+      @entry_by_fingerprint ||= @entries.to_h { |entry| [entry.fetch("fingerprint"), entry] }.freeze
+    end
+
+    def self.create(findings:, configuration:, analyzer_versions:, clock: Time.now.utc)
+      created_at = clock.utc.iso8601
+      entries = findings.sort_by(&:sort_key).map do |finding|
+        {
+          "fingerprint" => finding.fingerprint,
+          "analyzer" => finding.analyzer,
+          "rule_id" => finding.rule_id,
+          "path" => finding.location.fetch("path"),
+          "message" => finding.message,
+          "first_seen" => created_at
+        }
+      end
+      entries = entries.uniq { |entry| entry.fetch("fingerprint") }.sort_by { |entry| entry.fetch("fingerprint") }
+      hash = {
+        "schema_version" => SCHEMA_VERSION,
+        "fingerprint_version" => Fingerprint::VERSION,
+        "algorithm" => Fingerprint::ALGORITHM,
+        "payload_schema" => Fingerprint::PAYLOAD_SCHEMA,
+        "created_at" => created_at,
+        "created_by" => "railverdict #{RailVerdict::VERSION}",
+        "configuration_digest" => configuration.digest,
+        "analyzer_versions" => analyzer_versions.transform_keys(&:to_s).sort.to_h,
+        "entries" => entries
+      }
+      errors = SchemaValidator.validate_baseline(hash)
+      raise IncompatibleError, "baseline validation failed: #{errors.join('; ')}" unless errors.empty?
+
+      new(hash)
+    end
+
+    def self.default_path(repository_root)
+      File.join(File.realpath(repository_root), DEFAULT_FILENAME)
+    end
+
+    def self.resolve_path(repository_root:, configuration:, output_override: nil)
+      root = File.realpath(repository_root)
+      if output_override && !output_override.to_s.strip.empty?
+        path = output_override.to_s
+        return Pathname.new(path).absolute? ? path : File.expand_path(path, root)
+      end
+      if configuration.respond_to?(:baseline_path) && configuration.baseline_path
+        configured = configuration.baseline_path.to_s
+        return Pathname.new(configured).absolute? ? configured : File.expand_path(configured, root)
+      end
+      File.join(root, DEFAULT_FILENAME)
+    end
+
+    def self.write(path:, baseline:, force: false)
+      if File.exist?(path) && !force
+        raise UsageError, "baseline already exists at #{path}; use --force to overwrite"
+      end
+      dir = File.dirname(File.expand_path(path))
+      FileUtils.mkdir_p(dir)
+      tmp = File.join(dir, ".#{File.basename(path)}.tmp.#{Process.pid}.#{SecureRandom.hex(8)}")
+      begin
+        File.open(tmp, "wb", 0o600) do |file|
+          file.write(JSON.pretty_generate(baseline.to_h) + "\n")
+          file.flush
+          file.fsync
+        end
+        errors = SchemaValidator.validate_baseline(baseline.to_h)
+        raise IncompatibleError, "baseline validation failed: #{errors.join('; ')}" unless errors.empty?
+
+        File.rename(tmp, path)
+        begin
+          dir_fd = File.open(dir, "r")
+          dir_fd.fsync
+          dir_fd.close
+        rescue StandardError
+          nil
+        end
+      ensure
+        File.unlink(tmp) if File.exist?(tmp)
+      end
+    end
+
+    def self.read(path)
+      unless File.file?(path)
+        raise IncompatibleError, "baseline not found at #{path}"
+      end
+      raw = File.binread(path)
+      begin
+        data = JSON.parse(raw)
+      rescue JSON::ParserError => error
+        raise IncompatibleError, "baseline at #{path} is corrupted: #{error.message}; re-create with `railverdict baseline create`"
+      end
+      errors = SchemaValidator.validate_baseline(data)
+      unless errors.empty?
+        raise IncompatibleError, "baseline at #{path} is incompatible: #{errors.join('; ')}; re-create with `railverdict baseline create`"
+      end
+      fingerprints = data.fetch("entries").map { |entry| entry.fetch("fingerprint") }
+      if fingerprints.uniq.length != fingerprints.length
+        raise IncompatibleError, "baseline at #{path} contains duplicate fingerprints; re-create with `railverdict baseline create`"
+      end
+      new(data)
+    end
+
+    def self.read_optional(path)
+      return nil unless File.file?(path)
+
+      read(path)
+    end
+
+    def self.validate_hash(hash)
+      errors = SchemaValidator.validate_baseline(hash)
+      raise IncompatibleError, errors.join("; ") unless errors.empty?
+
+      hash
+    end
+  end
+end