rubocop-gusto 11.1.1 → 11.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5ebf0dc040fba594af70d4d7f12ff478108f0194ff39648ba3d6179ecc9e090f
-  data.tar.gz: bfdd53b8165f3078c682fb08e57c124acf05996ec6bc4b8543f54b6a94931132
+  metadata.gz: 63e4d5c0598bcf51b28b73659d6ef7d2441d350b425f8d34ac4b02dc7eaaf41c
+  data.tar.gz: 0ac1b025edbc7f1add82364538074752bd47c2272d8b5fd59fc3aa90db9b052c
 SHA512:
-  metadata.gz: 68e9932597eab0c974d14c733680f1cba391c1d9203c3eb583737f21902855434a9d7f4a51bad9e15a7fee960098bf3714722063545c4dac70355c3fe212c213
-  data.tar.gz: d6439f071b56a1f9fb53e22c0964524072c88134b28439c228115217a7b91c3ad4bf82a407ebab4675c966819fa4038fa9cab5b9ada4620c74185c6217373978
+  metadata.gz: 827456db6259cd5414df4d864b65b360cf67f1ba6f8d047d4e4d5bc3374fe42f9220d7012bbf8b1f84fcbac1b5b6d675ea9bc42a77a26ef59f86a0179b92800d
+  data.tar.gz: 7543bc23e8c2aaf3747bbfe9e661fb0c83c1a62d23dad639dc95bbc60a7ecd913dce2bc3c8057f35183b8a9367105ee2b6e64821513f50d6365aa74e1935b776

data/CHANGELOG.md

@@ -3,6 +3,28 @@
 - Remove redundant `Rails: Enabled: true` from `config/rails.yml` (already set by rubocop-rails' own defaults)
 - Enable `Rails/DefaultScope` cop (disabled by default in rubocop-rails)
 
+## [11.3.0](https://github.com/Gusto/rubocop-gusto/compare/v11.2.0...v11.3.0) (2026-06-29)
+
+
+### Features
+
+* add Gusto/FeatureFlagConstants cop (RR-890) ([#144](https://github.com/Gusto/rubocop-gusto/issues/144)) ([9058e0e](https://github.com/Gusto/rubocop-gusto/commit/9058e0e3055445a6be1818f2c142013239773bb5))
+
+## [11.2.0](https://github.com/Gusto/rubocop-gusto/compare/v11.1.1...v11.2.0) (2026-06-26)
+
+
+### Features
+
+* add Gusto/PluckOnSelect cop ([#137](https://github.com/Gusto/rubocop-gusto/issues/137)) ([d87a5cc](https://github.com/Gusto/rubocop-gusto/commit/d87a5ccf45f3f0fca89ed6b6e28cd6f61fc8b023))
+* add Gusto/SmartTodoTeam cop enforcing valid team in TODOs (RR-866) ([#143](https://github.com/Gusto/rubocop-gusto/issues/143)) ([8d36bf5](https://github.com/Gusto/rubocop-gusto/commit/8d36bf58983c32d48ff90b3862eb273f543e60a7))
+* Ensure rubocop-gusto has access to CodeTeams everywhere it runs (RR-880) ([#141](https://github.com/Gusto/rubocop-gusto/issues/141)) ([b2184ba](https://github.com/Gusto/rubocop-gusto/commit/b2184ba3430359e1210206a09746c979f3826ce3))
+* replace Gusto/RailsEnv with upstream Rails/Env ([#106](https://github.com/Gusto/rubocop-gusto/issues/106)) ([7e00033](https://github.com/Gusto/rubocop-gusto/commit/7e0003347dcbed728e4346a7ec2b4f215923a69d))
+
+
+### Bug Fixes
+
+* use UTF-8 encoding when reading support files in UnreferencedLet ([#136](https://github.com/Gusto/rubocop-gusto/issues/136)) ([651dd25](https://github.com/Gusto/rubocop-gusto/commit/651dd252843a5cfd81dc72bab0abc4b57143c138))
+
 ## [11.1.1](https://github.com/Gusto/rubocop-gusto/compare/v11.1.0...v11.1.1) (2026-06-18)
 
 

data/config/gusto_cops.yml

@@ -43,6 +43,9 @@ Gusto/FactoryClassesOrModules:
   Include:
     - 'spec/**/factories/*.rb'
 
+Gusto/FeatureFlagConstants:
+  Description: 'FeatureFlag keys should be constants, not strings.'
+
 Gusto/MinByMaxBy:
   Description: 'Checks for the use of `min` or `max` with a proc. Corrects to `min_by` or `max_by`.'
   Safe: false
@@ -67,6 +70,9 @@ Gusto/PerformClassMethod:
   WorkerModules:
     - Sidekiq::Worker
 
+Gusto/PluckOnSelect:
+  Description: "Do not use `.pluck` on `.select`. Use one or the other."
+
 Gusto/PolymorphicTypeValidation:
   Description: 'Ensures that polymorphic relations include a type validation, which is necessary for generating Sorbet types.'
   Include:
@@ -80,9 +86,6 @@ Gusto/RablExtends:
   Include:
     - '**/*.json.rabl'
 
-Gusto/RailsEnv:
-  Description: 'Use Feature Flags or config instead of `Rails.env`.'
-
 Gusto/RakeConstants:
   Description: 'Do not define a constant in rake file, because they are sometimes `load`ed, instead of `require`d which can lead to warnings about redefining constants.'
   Include:
@@ -104,6 +107,10 @@ Gusto/RspecDateTimeMock:
 Gusto/SidekiqParams:
   Description: 'Sidekiq perform methods cannot take keyword arguments.'
 
+Gusto/SmartTodoTeam:
+  Description: 'TODO comments must be SmartTodo-formatted and target a valid team (CodeTeams).'
+  Enabled: false
+
 Gusto/ToplevelConstants:
   Description: 'Prevents top-level constants from being defined outside of initializers.'
   Include:
@@ -133,3 +140,7 @@ Gusto/UsePaintNotColorize:
 
 Gusto/VcrRecordings:
   Description: 'VCR should be set to not record in tests. Use vcr: {record: :none}.'
+
+# We extend this via Gusto/SmartTodoTeam; don't let the upstream cop run standalone.
+SmartTodo/SmartTodoCop:
+  Enabled: false

data/config/rails.yml

@@ -18,6 +18,9 @@ Gusto/DiscouragedGem:
   Gems:
     timecop: "Use Rails' time helpers (e.g., freeze_time, travel_to) instead of Timecop."
 
+Gusto/PluckOnSelect:
+  Description: "Do not use `.pluck` on `.select`. Use one or the other."
+
 Performance/DoubleStartEndWith:
   IncludeActiveSupportAliases: true
 
@@ -55,6 +58,9 @@ Rails/EnumHash:
   Include:
     - '**/app/models/**/*'
 
+Rails/Env:
+  Enabled: true
+
 Rails/Exit:
   Include:
     - app/**/*

data/lib/rubocop/cop/gusto/feature_flag_constants.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Gusto
+      # Enforces that `FeatureFlag.active?` is called with a constant rather than a
+      # string literal. Defining flag keys as constants keeps them in one place,
+      # makes typos a load-time error instead of a silent always-off flag, and lets
+      # tools find every reference to a flag.
+      #
+      # `FeatureFlag` is a constant, so it is never nil and safe navigation
+      # (`FeatureFlag&.active?`) is never used; the cop only handles `on_send`.
+      #
+      # @example
+      #   # bad
+      #   FeatureFlag.active?("some_feature_flag")
+      #
+      #   # good
+      #   FeatureFlag.active?(SomeModule::SOME_FEATURE_FLAG)
+      class FeatureFlagConstants < Base
+        MSG = "FeatureFlag keys should be constants, not strings"
+        RESTRICT_ON_SEND = %i(active?).freeze
+
+        # @!method feature_flag_with_string?(node)
+        def_node_matcher :feature_flag_with_string?, <<~PATTERN
+          (send (const nil? :FeatureFlag) :active? (str _) ...)
+        PATTERN
+
+        def on_send(node)
+          add_offense(node) if feature_flag_with_string?(node)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/gusto/pluck_on_select.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Gusto
+      # Do not use `.pluck` on `.select`.
+      #
+      # `.select` returns an ActiveRecord relation with only the selected columns marked for
+      # retrieval. `.pluck` returns an array of column values. When chained, `.pluck` is unaware
+      # of any directive passed to `.select` (e.g. column aliases or a DISTINCT clause), which
+      # can cause unexpected behavior.
+      #
+      # @example Redundant select
+      #   # bad
+      #   User.select(:id).pluck(:id)
+      #
+      #   # good
+      #   User.pluck(:id)
+      #
+      # @example Column alias: .pluck raises "Unknown column" because it ignores the alias
+      #   # bad
+      #   User.select('id AS id2').pluck('id2')
+      #
+      #   # good: use .select alone if you need the alias
+      #   User.select(:id, 'id AS id2')
+      #
+      #   # good: use .pluck alone if you don't need the alias
+      #   User.pluck(:id)
+      #
+      # @example DISTINCT: .pluck loads all rows, ignoring the DISTINCT from .select
+      #   # bad
+      #   User.select('DISTINCT email').pluck(:email)
+      #
+      #   # good
+      #   User.distinct.pluck(:email)
+      #
+      class PluckOnSelect < Base
+        RESTRICT_ON_SEND = %i(pluck).freeze
+        MSG = "Do not use `.pluck` on `.select`."
+
+        def on_send(node)
+          return unless node.receiver
+
+          receiver_node = node.receiver
+          while receiver_node
+            if receiver_node.call_type? && receiver_node.method?(:select)
+              add_offense(node)
+              break
+            end
+            receiver_node = receiver_node.receiver
+          end
+        end
+        alias_method :on_csend, :on_send
+      end
+    end
+  end
+end

data/lib/rubocop/cop/gusto/smart_todo_team.rb

@@ -0,0 +1,50 @@
+# frozen_string_literal: true
+
+require "smart_todo_cop" # defines RuboCop::Cop::SmartTodo::SmartTodoCop (also requires "smart_todo")
+require "code_teams"
+
+module RuboCop
+  module Cop
+    module Gusto
+      # Enforces SmartTodo syntax (via the upstream `SmartTodo/SmartTodoCop`) and,
+      # in addition, requires every TODO's `to:` assignee to name a valid team as
+      # defined by CodeTeams (`config/teams/**/*.yml`).
+      #
+      # All of the upstream cop's failure modes are preserved verbatim via `super`.
+      # The only additional offense is raised when an otherwise-valid SmartTodo
+      # comment is assigned to an unknown team.
+      #
+      # @example
+      #   # bad - assigned to an unknown team
+      #   # TODO(on: date('2025-01-01'), to: 'NotATeam')
+      #   #   Remove this
+      #
+      #   # good - assigned to a team in config/teams
+      #   # TODO(on: date('2025-01-01'), to: 'Payroll')
+      #   #   Remove this
+      class SmartTodoTeam < ::RuboCop::Cop::SmartTodo::SmartTodoCop
+        TEAM_HELP = "TODO `to:` must name a valid team (see config/teams).  Match the human readable `name:` key (ex: 'Benefits Admin Transfers'), *not* a sluggified form."
+
+        # @param processed_source [RuboCop::ProcessedSource]
+        # @return [void]
+        def on_new_investigation
+          # Registers every existing SmartTodo offense. RuboCop dedupes offenses by
+          # source range (see Cop::Base#add_offense), so any comment flagged here
+          # silently swallows the duplicate team offense we might add below.
+          super
+
+          processed_source.comments.each do |comment|
+            next unless TODO_PATTERN.match?(comment.text)
+
+            # `is_a?(String)` guards CodeTeams.find's Sorbet signature, which raises on a
+            # non-string. Such assignees are already flagged by `super` (invalid assignee).
+            unknown = metadata(comment.text).assignees.select { |assignee| assignee.is_a?(String) && !CodeTeams.find(assignee) }
+            next if unknown.empty?
+
+            add_offense(comment, message: "Unknown team(s): #{unknown.join(', ')}. #{TEAM_HELP}")
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/gusto/unreferenced_let.rb

@@ -126,7 +126,7 @@ module RuboCop
           def read_source(path)
             return "" unless ::File.file?(path)
 
-            ::File.read(path)
+            ::File.read(path, encoding: "UTF-8")
           end
         end
 

data/lib/rubocop/gusto/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module Gusto
-    VERSION = "11.1.1"
+    VERSION = "11.3.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-gusto
 version: !ruby/object:Gem::Version
-  version: 11.1.1
+  version: 11.3.0
 platform: ruby
 authors:
 - Gusto Engineering
@@ -9,6 +9,20 @@ bindir: exe
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: code_teams
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: lint_roller
   requirement: !ruby/object:Gem::Requirement
@@ -93,6 +107,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: smart_todo
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
@@ -132,20 +160,22 @@ files:
 - lib/rubocop/cop/gusto/discouraged_gem.rb
 - lib/rubocop/cop/gusto/execute_migration.rb
 - lib/rubocop/cop/gusto/factory_classes_or_modules.rb
+- lib/rubocop/cop/gusto/feature_flag_constants.rb
 - lib/rubocop/cop/gusto/min_by_max_by.rb
 - lib/rubocop/cop/gusto/no_metaprogramming.rb
 - lib/rubocop/cop/gusto/no_rescue_error_message_checking.rb
 - lib/rubocop/cop/gusto/no_send.rb
 - lib/rubocop/cop/gusto/paperclip_or_attachable.rb
 - lib/rubocop/cop/gusto/perform_class_method.rb
+- lib/rubocop/cop/gusto/pluck_on_select.rb
 - lib/rubocop/cop/gusto/polymorphic_type_validation.rb
 - lib/rubocop/cop/gusto/prefer_process_last_status.rb
 - lib/rubocop/cop/gusto/rabl_extends.rb
-- lib/rubocop/cop/gusto/rails_env.rb
 - lib/rubocop/cop/gusto/rake_constants.rb
 - lib/rubocop/cop/gusto/regexp_bypass.rb
 - lib/rubocop/cop/gusto/rspec_date_time_mock.rb
 - lib/rubocop/cop/gusto/sidekiq_params.rb
+- lib/rubocop/cop/gusto/smart_todo_team.rb
 - lib/rubocop/cop/gusto/toplevel_constants.rb
 - lib/rubocop/cop/gusto/unreferenced_let.rb
 - lib/rubocop/cop/gusto/use_paint_not_colorize.rb

data/lib/rubocop/cop/gusto/rails_env.rb

@@ -1,77 +0,0 @@
-# frozen_string_literal: true
-
-module RuboCop
-  module Cop
-    module Gusto
-      # NOTE: Being pushed upstream here: https://github.com/rubocop/rubocop-rails/pull/1375
-      # Checks for usage of `Rails.env` which can be replaced with Feature Flags
-      #
-      # Although `local?` is a form of an environment-specific check, it is allowed because
-      # it cannot be used to control overall environment rollout, but it can be helpful to
-      # distinguish or protect code that is explicitly written to only ever execute in a
-      # dev or test environment. `local?` is also a form of a feature flag.
-      #
-      # @example
-      #
-      #   # bad
-      #   Rails.env.production? || Rails.env.demo?
-      #
-      #   # good
-      #   if FeatureFlag.enabled?(:new_feature)
-      #     # new feature code
-      #   end
-      #
-      #   # good
-      #   raise unless Rails.env.local?
-      #
-      #   # good
-      #   abort ("The Rails environment is running in production mode!") unless Rails.env.local?
-      #
-      class RailsEnv < Base
-        # This allow list is derived from:
-        # (Rails.env.methods - Object.instance_methods).select { |m| m.to_s.end_with?('?') }
-        # and then removing the environment specific methods like development?, test?, production?
-        ALLOWED_LIST = Set.new(
-          %i(
-            unicode_normalized?
-            exclude?
-            empty?
-            acts_like_string?
-            include?
-            is_utf8?
-            casecmp?
-            match?
-            starts_with?
-            ends_with?
-            start_with?
-            end_with?
-            valid_encoding?
-            ascii_only?
-            between?
-            local?
-          )
-        ).freeze
-        MSG = "Use Feature Flags or config instead of `Rails.env`."
-        RESTRICT_ON_SEND = %i(env).freeze
-
-        # @!method prohibited_rails_env?(node)
-        def_node_matcher :prohibited_rails_env?, <<~PATTERN
-          (send
-            (send (const _ :Rails) :env)
-            #prohibited_predicate?
-          )
-        PATTERN
-
-        def on_send(node)
-          add_offense(node.parent) if prohibited_rails_env?(node.parent)
-        end
-
-        private
-
-        def prohibited_predicate?(name)
-          name.to_s.end_with?("?") && !ALLOWED_LIST.include?(name)
-        end
-      end
-    end
-  end
-end