rigortype 0.1.16 → 0.1.18

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2fb4015697adf7cbc9d65b2ca6ff954c8cac5f784ffb9616153d4af8d2505ccc
-  data.tar.gz: 52ee5acb7d233c0e86c8cdca45151c5f745b4c13d7155fcb15fafdaaed1d6dc9
+  metadata.gz: 02ca1aeff8df7e80afcbc2f1fb03a808466dd307e1a935c68c4af7055dfa975b
+  data.tar.gz: 2a7b829348f75fe48bf3741a691fcfb1aa67b863675384feffe91a6fabb6ee6b
 SHA512:
-  metadata.gz: 4f4b64afe3dbca26f6224762a2f1a3dd0bd4cade2ea9a61a30e2fba28ed29d3bb6d68bdfa73fb450536e5c7fef45e07a10a6fd0cec693ad228a828ff30905f8e
-  data.tar.gz: 4b5faa0d8c7295067f5a0f3d335c1800f22659e47b0428942405b07c1d38649163090f3a461e942a82aecaab6172e774ef88ca44f9a569b1392cdeee0be04086
+  metadata.gz: f1dfc043a607024bc46987acf0fc925b7926294a6e46b668793bc03fa88e0b1066bea51db5e80a038483b602ad59e788269ac8baa5615a1694cbc8afd90614c4
+  data.tar.gz: 894eccadf5220d1c9b16d09e07f799e1104265a1e3cbedb9a738330441d931a77eb24314e63768a24da2e4d179221c34f297c32c82e905dcfce749b36264c94c

data/README.md

@@ -265,12 +265,14 @@ In-source suppression: `# rigor:disable <rule>` silences a single line;
 
 ## Status
 
-Current released version: **`v0.1.15`** (2026-05-29). The analyzer is
+Current released version: **`v0.1.18`** (2026-06-11). The analyzer is
 usable on real Ruby code today; the rule catalogue is deliberately
 conservative — Rigor's stance is to surface zero false positives while
 the inference surface stabilises. The `0.1.x` preview line has been
 hardened against real OSS Rails codebases (Mastodon / Redmine / GitLab
-FOSS); `v0.2.0` will open the first evaluation release.
+FOSS) and wired for CI — `rigor check` emits SARIF / GitHub / GitLab /
+Checkstyle / JUnit / TeamCity output and auto-detects the CI environment;
+`v0.2.0` will open the first evaluation release.
 
 Release history: [`CHANGELOG.md`](CHANGELOG.md). Forward-looking
 commitments: [Roadmap](https://rigor.typedduck.fail/reference/roadmap/).

data/lib/rigor/analysis/check_rules/always_truthy_condition_collector.rb

@@ -56,6 +56,10 @@ module Rigor
 
         Result = Data.define(:node, :polarity)
 
+        # ADR-53 Track B — the node classes the shared {RuleWalk}
+        # dispatches to this collector (outside loop / block bodies).
+        NODE_CLASSES = [Prism::IfNode, Prism::UnlessNode].freeze
+
         # @return [Array<Result>] one entry per qualifying
         #   predicate. Empty when the tree carries no firing
         #   predicates.
@@ -64,17 +68,30 @@ module Rigor
           @results = []
         end
 
+        # Legacy single-collector walk — kept as the oracle the
+        # ADR-53 Track B equivalence harness compares {RuleWalk}
+        # against; deleted when Track B completes.
         def collect(root)
           walk(root, in_loop_or_block: false)
           @results.freeze
         end
 
+        # {RuleWalk} entry point: the per-node logic of the legacy walk,
+        # invoked under the same traversal contract.
+        def visit(node)
+          collect_predicate(node)
+        end
+
+        def results
+          @results.freeze
+        end
+
         private
 
         def walk(node, in_loop_or_block:)
           return unless node.is_a?(Prism::Node)
 
-          collect_predicate(node) if conditional_node?(node) && !in_loop_or_block
+          visit(node) if conditional_node?(node) && !in_loop_or_block
 
           child_in_loop_or_block = in_loop_or_block || enters_loop_or_block?(node)
           node.compact_child_nodes.each { |child| walk(child, in_loop_or_block: child_in_loop_or_block) }

data/lib/rigor/analysis/check_rules/rule_walk.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # ADR-53 Track B — the engine-owned AST walk that hosts CheckRules'
+      # per-node collectors, so a file is traversed once for all of them
+      # instead of once per collector (the ADR-52 WD4 model applied to
+      # the built-in rules; this walk and {Plugin::NodeRuleWalk} converge
+      # in slice B4).
+      #
+      # Slice B2 hosts the two flow collectors
+      # ({AlwaysTruthyConditionCollector} / {UnreachableClauseCollector}),
+      # whose hand-rolled walks shared this exact traversal contract:
+      # visit-before-descend DFS over `compact_child_nodes`, with
+      # collection suppressed anywhere inside a loop / block body
+      # (mutation tracking through those is incomplete — each collector's
+      # envelope documents why). A collector joins the walk by declaring
+      # `NODE_CLASSES` and exposing `#visit(node)` with its per-node logic
+      # transplanted verbatim; a collector with a different traversal
+      # contract (class-nesting prefix, def-scoped scanning) stays on its
+      # own walk until a later slice threads the context it needs.
+      #
+      # Equivalence is load-bearing: every hosted collector keeps its
+      # legacy single-collector `#collect` walk as the oracle, compared
+      # against this walk by the permanent `rule_walk_equivalence_spec`
+      # and, over whole corpora, by `RIGOR_SHADOW_RULE_WALK=1`
+      # (see `CheckRules.flow_collector_results`).
+      module RuleWalk
+        LOOP_OR_BLOCK_NODE_CLASSES = [
+          Prism::WhileNode, Prism::UntilNode, Prism::ForNode, Prism::BlockNode
+        ].freeze
+
+        class << self
+          # Walks `root` once, dispatching each visited node to every
+          # collector whose `NODE_CLASSES` covers the node's class.
+          # Dispatch keys on the exact node class — Prism node classes
+          # are leaves, so this matches the collectors' `is_a?` gates.
+          def run(root, collectors)
+            hooks = {}
+            collectors.each do |collector|
+              collector.class::NODE_CLASSES.each do |node_class|
+                (hooks[node_class] ||= []) << collector
+              end
+            end
+            walk(root, hooks, in_loop_or_block: false)
+            collectors
+          end
+
+          private
+
+          def walk(node, hooks, in_loop_or_block:)
+            return unless node.is_a?(Prism::Node)
+
+            hooks[node.class]&.each { |collector| collector.visit(node) } unless in_loop_or_block
+
+            child_in_loop_or_block =
+              in_loop_or_block || LOOP_OR_BLOCK_NODE_CLASSES.any? { |klass| node.is_a?(klass) }
+            node.compact_child_nodes.each { |child| walk(child, hooks, in_loop_or_block: child_in_loop_or_block) }
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/self_closedness_scanner.rb

@@ -0,0 +1,100 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # ADR-24 slice 4 — read-side companion to `call.self-undefined-method`.
+      # Walks a file's parse tree once and collects the qualified names of
+      # declarations that are NOT confidently closed for self-call
+      # undefined-method analysis, so the rule can exclude them:
+      #
+      # - **Modules** — a `module M` is a mixin contract; its methods may be
+      #   provided by includers (template-method pattern), so an unresolved
+      #   self-call inside it is not provably a typo.
+      # - **Classes with a dynamic `attr_*` accessor** — `attr_reader(*NAMES)`
+      #   / `attr_accessor(:a, SOME_CONST)` synthesizes readers whose names
+      #   are not statically decidable, so the class's method surface cannot
+      #   be enumerated from source.
+      #
+      # The enclosing declaration of a self-call is always in the same file
+      # as the call (even a reopened class restates `class Foo`), so a
+      # per-file AST scan suffices — no cross-file plumbing. Names are built
+      # to match the engine's qualified `self` type (`Module.nesting`-style
+      # `A::B::C`).
+      class SelfClosednessScanner
+        ATTR_MACROS = %i[attr_reader attr_accessor attr_writer].freeze
+        private_constant :ATTR_MACROS
+
+        def initialize(root)
+          @root = root
+        end
+
+        # @return [Set<String>] qualified names to exclude from the rule.
+        def open_class_names
+          names = Set.new
+          walk(@root, [], names)
+          names
+        end
+
+        private
+
+        def walk(node, prefix, names)
+          return unless node.is_a?(Prism::Node)
+
+          case node
+          when Prism::ModuleNode
+            name = constant_path_name(node.constant_path)
+            child_prefix = name ? prefix + [name] : prefix
+            names << child_prefix.join("::") if name
+            walk(node.body, child_prefix, names) if node.body
+          when Prism::ClassNode
+            name = constant_path_name(node.constant_path)
+            child_prefix = name ? prefix + [name] : prefix
+            names << child_prefix.join("::") if name && dynamic_attr_class?(node)
+            walk(node.body, child_prefix, names) if node.body
+          else
+            node.compact_child_nodes.each { |child| walk(child, prefix, names) }
+          end
+        end
+
+        # True when the class body directly invokes an `attr_*` macro with a
+        # non-literal argument (a splat, a constant, a method call) — the
+        # synthesized accessor names are then not statically knowable.
+        def dynamic_attr_class?(class_node)
+          body = class_node.body
+          return false unless body.is_a?(Prism::StatementsNode)
+
+          body.body.any? do |stmt|
+            stmt.is_a?(Prism::CallNode) &&
+              stmt.receiver.nil? &&
+              ATTR_MACROS.include?(stmt.name) &&
+              dynamic_attr_arguments?(stmt)
+          end
+        end
+
+        def dynamic_attr_arguments?(call_node)
+          args = call_node.arguments&.arguments
+          return false if args.nil? || args.empty?
+
+          args.any? { |arg| !arg.is_a?(Prism::SymbolNode) && !arg.is_a?(Prism::StringNode) }
+        end
+
+        # Renders a class/module path node to its source-qualified name
+        # (`Foo`, `Foo::Bar`, leading `::` stripped); nil for a dynamic
+        # constant path the scanner cannot name statically.
+        def constant_path_name(node)
+          case node
+          when Prism::ConstantReadNode
+            node.name.to_s
+          when Prism::ConstantPathNode
+            parent = node.parent ? constant_path_name(node.parent) : nil
+            child = node.name.to_s
+            node.parent.nil? ? child : (parent && "#{parent}::#{child}")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rigor/analysis/check_rules/unreachable_clause_collector.rb

@@ -0,0 +1,226 @@
+# frozen_string_literal: true
+
+require "prism"
+
+module Rigor
+  module Analysis
+    module CheckRules
+      # ADR-47 — collects `case`/`when` clauses proven unreachable. The flow
+      # engine already narrows the case subject across `when` branches
+      # (`Narrowing.case_when_scopes`), and the per-clause `body_scope` it
+      # produces is recorded in `scope_index` keyed on the `WhenNode` (the
+      # evaluator enters the clause under that scope). So a clause whose
+      # narrowed subject local is `Type::Bot` is one the engine's own
+      # narrowing proves no reaching value can match — a stale `when`,
+      # mis-ordered clauses, or a type that moved out from under a branch.
+      #
+      # WD1 (per-clause disjointness) — the narrow, high-value core. Fires
+      # ONLY on the safe shape:
+      #
+      # - the subject is a `case <local>` (a `LocalVariableReadNode`, the
+      #   only shape `case_when_scopes` narrows — no narrowing ⇒ no firing),
+      # - every `when` condition is a class/module constant (`when String` /
+      #   `when MyClass`), the shape the narrowing recognises — `when nil` /
+      #   ranges / regexps / arbitrary expressions are out of scope here,
+      # - the subject's type at case entry is a concrete carrier, never
+      #   `Type::Dynamic` (disjointness is never provable under gradual
+      #   `Dynamic`, preserving the gradual guarantee) and never already
+      #   `Type::Bot` (dead code, not a clause error),
+      # - and the clause's narrowed `body_scope` subject is `Type::Bot`.
+      #
+      # The false-positive envelope mirrors `flow.always-truthy-condition`:
+      # clauses inside loops / blocks are skipped (mutation tracking through
+      # those is incomplete), and the rule reads the engine's own narrowing
+      # rather than recomputing it, so the diagnostic and the body typing
+      # can never diverge.
+      class UnreachableClauseCollector
+        LOOP_OR_BLOCK_NODE_CLASSES = [
+          Prism::WhileNode, Prism::UntilNode, Prism::ForNode, Prism::BlockNode
+        ].freeze
+
+        # A trailing `else` whose body only re-raises / aborts is a
+        # deliberate defensive guard ("this should be unreachable — shout
+        # if it ever isn't"), NOT dead code the author wants removed.
+        # Flagging it would push the author to delete a safety net, which
+        # the false-positive discipline forbids. WD1's `when` shapes don't
+        # carry this idiom (a stale `when` is a real redundancy), so the
+        # skip is `else`-only.
+        DEFENSIVE_EXIT_CALLS = %i[raise fail throw abort exit].freeze
+
+        # @!attribute kind
+        #   @return [Symbol] `:disjoint` (this clause's type is disjoint
+        #     from the still-possible subject), `:prior_exhaustion` (an
+        #     earlier clause already covered the subject), or
+        #     `:exhausted_else` (every subject value is covered, so the
+        #     `else` never runs).
+        Result = Data.define(:clause, :body, :subject_name, :condition_source, :kind, :keyword)
+
+        # ADR-53 Track B — the node classes the shared {RuleWalk}
+        # dispatches to this collector (outside loop / block bodies).
+        NODE_CLASSES = [Prism::CaseNode, Prism::CaseMatchNode].freeze
+
+        def initialize(scope_index)
+          @scope_index = scope_index
+          @results = []
+        end
+
+        # Legacy single-collector walk — kept as the oracle the
+        # ADR-53 Track B equivalence harness compares {RuleWalk}
+        # against; deleted when Track B completes.
+        # @return [Array<Result>] one entry per provably-dead `when` clause.
+        def collect(root)
+          walk(root, in_loop_or_block: false)
+          @results.freeze
+        end
+
+        # {RuleWalk} entry point: the per-node logic of the legacy walk,
+        # invoked under the same traversal contract.
+        def visit(node)
+          collect_case(node)
+        end
+
+        def results
+          @results.freeze
+        end
+
+        private
+
+        def walk(node, in_loop_or_block:)
+          return unless node.is_a?(Prism::Node)
+
+          visit(node) if case_like?(node) && !in_loop_or_block
+
+          child_in_loop_or_block = in_loop_or_block || enters_loop_or_block?(node)
+          node.compact_child_nodes.each { |child| walk(child, in_loop_or_block: child_in_loop_or_block) }
+        end
+
+        # `case/when` is a `CaseNode`; `case/in` is a `CaseMatchNode`. Both
+        # carry `predicate` + `conditions` + `else_clause` and the engine
+        # narrows both through `eval_case_when_branches`.
+        def case_like?(node)
+          node.is_a?(Prism::CaseNode) || node.is_a?(Prism::CaseMatchNode)
+        end
+
+        def enters_loop_or_block?(node)
+          LOOP_OR_BLOCK_NODE_CLASSES.any? { |klass| node.is_a?(klass) }
+        end
+
+        def collect_case(node)
+          subject = node.predicate
+          return unless subject.is_a?(Prism::LocalVariableReadNode)
+
+          entry_type = entry_subject_type(node, subject.name)
+          # Only meaningful for a concrete subject type: a `Dynamic` subject
+          # can never be proven disjoint (the gradual guarantee), and an
+          # already-`Bot` subject is dead code, not a clause-ordering error.
+          return if entry_type.nil? || entry_type.is_a?(Type::Bot) || entry_type.is_a?(Type::Dynamic)
+
+          keyword = node.is_a?(Prism::CaseMatchNode) ? "in" : "when"
+          node.conditions.each do |clause|
+            case clause
+            when Prism::WhenNode then collect_when(clause, subject.name)
+            when Prism::InNode then collect_in(clause, subject.name)
+            end
+          end
+          collect_else(node.else_clause, subject.name, keyword)
+        end
+
+        def entry_subject_type(case_node, subject_name)
+          scope = @scope_index[case_node]
+          scope&.local(subject_name)
+        end
+
+        def collect_when(clause, subject_name)
+          return if clause.statements.nil? # empty body → no useful location
+          return unless all_constant_conditions?(clause)
+
+          scope = @scope_index[clause]
+          return if scope.nil?
+          return unless scope.local(subject_name).is_a?(Type::Bot)
+
+          @results << Result.new(
+            clause: clause, body: clause.statements, subject_name: subject_name,
+            condition_source: clause.conditions.map(&:slice).join(", "),
+            kind: when_clause_kind(clause, subject_name), keyword: "when"
+          )
+        end
+
+        # A dead `when` is `:prior_exhaustion` when the subject was
+        # already narrowed to `bot` BEFORE this clause (an earlier clause
+        # covered it) — read from the entry scope the engine recorded on
+        # the clause's first condition node (ADR-47 WD2). Otherwise the
+        # subject was still concrete entering the clause and THIS clause's
+        # type is disjoint from it.
+        def when_clause_kind(clause, subject_name)
+          entry = @scope_index[clause.conditions.first]
+          return :prior_exhaustion if entry && entry.local(subject_name).is_a?(Type::Bot)
+
+          :disjoint
+        end
+
+        # ADR-47 WD3a — a dead `case/in` clause. The body scope reaches
+        # `bot` either because a bare class pattern (`in C` / `in C => x`)
+        # is disjoint from the still-possible subject (the engine narrows
+        # those soundly, like `when C`), or because an earlier clause
+        # already exhausted the subject (prior-exhaustion — true for ANY
+        # pattern downstream of a covering set). Non-bare patterns are not
+        # narrowed, so their body is `bot` ONLY under prior-exhaustion;
+        # they never produce a spurious `:disjoint`.
+        def collect_in(clause, subject_name)
+          return if clause.statements.nil?
+
+          scope = @scope_index[clause]
+          return if scope.nil?
+          return unless scope.local(subject_name).is_a?(Type::Bot)
+
+          @results << Result.new(
+            clause: clause, body: clause.statements, subject_name: subject_name,
+            condition_source: clause.pattern.slice,
+            kind: in_clause_kind(clause, subject_name), keyword: "in"
+          )
+        end
+
+        def in_clause_kind(clause, subject_name)
+          entry = @scope_index[clause.pattern]
+          return :prior_exhaustion if entry && entry.local(subject_name).is_a?(Type::Bot)
+
+          :disjoint
+        end
+
+        # The trailing `else` is dead when every subject value is covered
+        # by the `when` clauses — the final falsey scope (recorded on the
+        # `else` node) narrows the subject to `bot`. Defensive `else`
+        # bodies (a bare `raise` / `fail` / `throw`) are deliberate
+        # guards, not removable dead code, so they are skipped.
+        def collect_else(else_clause, subject_name, keyword)
+          return if else_clause.nil? || else_clause.statements.nil?
+          return if defensive_else?(else_clause)
+
+          scope = @scope_index[else_clause]
+          return if scope.nil?
+          return unless scope.local(subject_name).is_a?(Type::Bot)
+
+          @results << Result.new(
+            clause: else_clause, body: else_clause.statements, subject_name: subject_name,
+            condition_source: nil, kind: :exhausted_else, keyword: keyword
+          )
+        end
+
+        def defensive_else?(else_clause)
+          body = else_clause.statements.body
+          return false unless body.size == 1
+
+          stmt = body.first
+          stmt.is_a?(Prism::CallNode) && stmt.receiver.nil? &&
+            DEFENSIVE_EXIT_CALLS.include?(stmt.name)
+        end
+
+        def all_constant_conditions?(clause)
+          conditions = clause.conditions
+          !conditions.empty? &&
+            conditions.all? { |c| c.is_a?(Prism::ConstantReadNode) || c.is_a?(Prism::ConstantPathNode) }
+        end
+      end
+    end
+  end
+end