rubocop-gusto 11.8.1 → 11.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 51513bd8e37d74a7df172f0f418d71dc91dfa804f94b8d771b48dc5b21b18e04
-  data.tar.gz: 01af10674be546cc67050bad71849a846c3ed018c6e3c963b3d70109cc4015dc
+  metadata.gz: 5581a398e181fa5cee526273621f36357e83dba9fe912433df5a4cbe2129b2e7
+  data.tar.gz: db3825a6506974aa565e427d2e83fa1cbb618b31136c4bdbbb13840e81dd1eb1
 SHA512:
-  metadata.gz: 12e87528f2d9f51b6c5ee50dd3a1af68d919027ada144710a5e4eb87c71a80e3c525b3697936a2f8faeebbb8ea785c2d8182dfb75494e033e49205e0f5f361d7
-  data.tar.gz: e6cc1a36174b943a266646c76ebaeba03e384432d5edd457d3c7a93c5a844aeba22e67847b72a3cd0489099e30eb73d0355ee923ee16a085c10a47c8a825a39a
+  metadata.gz: '089fac7ad4fea249760ba0d5138e78a42152f198796b7f920d78ee656ba5cfb4d56b66a20918a90488431534b497110b366a66f467703c22797d5d4a51a94aba'
+  data.tar.gz: 681ef77cd2115bac46da1f0713adfa9fd05ed77204cec941c47cbe7a45d30b62d2b3128997665567923eaaa6509464f10c78867869fed7aed34d9b7bc3870f21

data/CHANGELOG.md

@@ -3,6 +3,23 @@
 - Remove redundant `Rails: Enabled: true` from `config/rails.yml` (already set by rubocop-rails' own defaults)
 - Enable `Rails/DefaultScope` cop (disabled by default in rubocop-rails)
 
+## [11.9.1](https://github.com/Gusto/rubocop-gusto/compare/v11.9.0...v11.9.1) (2026-09-28)
+
+
+### Bug Fixes
+
+* port upstream review of Gusto/HardcodedAbsentRecordId ([#180](https://github.com/Gusto/rubocop-gusto/issues/180)) ([6198928](https://github.com/Gusto/rubocop-gusto/commit/6198928187db6920c18c882c3167a1cf8edeccf1))
+
+## [11.9.0](https://github.com/Gusto/rubocop-gusto/compare/v11.8.1...v11.9.0) (2026-09-24)
+
+
+### Features
+
+* add Gusto/HardcodedAbsentRecordId cop ([#166](https://github.com/Gusto/rubocop-gusto/issues/166)) ([f38282a](https://github.com/Gusto/rubocop-gusto/commit/f38282af1034a9d286a77ff8291bb551c91239ea))
+* add Gusto/HardcodedId cop ([#167](https://github.com/Gusto/rubocop-gusto/issues/167)) ([4cf3fff](https://github.com/Gusto/rubocop-gusto/commit/4cf3fff30192582cc7f19542172ab435b39c4839))
+* enforce with_fixed_indentation for Layout/ArgumentAlignment ([#165](https://github.com/Gusto/rubocop-gusto/issues/165)) ([2e4d8e7](https://github.com/Gusto/rubocop-gusto/commit/2e4d8e73c3f4f50b0a7ea1c32261beccac1bc4d5))
+* flag have_received and allow and_raise in Sidekiq/PerformAsyncStub ([#174](https://github.com/Gusto/rubocop-gusto/issues/174)) ([f6e2289](https://github.com/Gusto/rubocop-gusto/commit/f6e2289f2052a41d9387a481616e6c22b45004f2))
+
 ## [11.8.1](https://github.com/Gusto/rubocop-gusto/compare/v11.8.0...v11.8.1) (2026-09-22)
 
 

data/config/default.yml

@@ -32,6 +32,9 @@ Gemspec/RequiredRubyVersion:
   # We manage our Ruby version in our version file and import that to our Gemfile.
   Enabled: false
 
+Layout/ArgumentAlignment:
+  EnforcedStyle: with_fixed_indentation
+
 Layout/BlockAlignment:
   EnforcedStyleAlignWith: start_of_block
 
@@ -267,7 +270,9 @@ Sidekiq/PerformAsyncStub:
   Enabled: false
   SafeAutoCorrect: false # Autocorrect appends `.and_call_original`, which runs real `perform_async` during the example
   Include:
-    - '**/spec/**/*_spec.rb'
+    # Not just `*_spec.rb`: shared contexts, support files and system-spec helpers install these
+    # stubs on behalf of the specs that include them, which is where they are hardest to spot.
+    - '**/spec/**/*'
 
 Sorbet/ForbidTUnsafe:
   # T.unsafe completely disables typechecking. Prefer T.cast, shims, or

data/config/gusto_cops.yml

@@ -32,9 +32,14 @@ Gusto/DescribedClassConstantReference:
     - '**/spec/**/*'
 
 Gusto/DiscouragedGem:
-  Description: 'Flags installation of discouraged gems in Gemfiles and gemspecs.'
-  Enabled: false
-  Gems: {}
+  Description: 'Flags discouraged gems in Gemfiles and gemspecs, including ones pulled in transitively per the lockfile.'
+  Enabled: true
+  Include:
+    - '**/*.gemspec'
+    - '**/Gemfile'
+    - '**/gems.rb'
+  Gems:
+    ostruct: "OpenStruct is officially discouraged (slow, and defeats method caching); use Struct, Data, a Hash, or T::Struct. See https://forum.exercism.org/t/openstruct-is-now-officially-discouraged/17490"
 
 Gusto/ExecuteMigration:
   Description: "Don't use `execute` in migrations. Use a backfill rake task instead."
@@ -90,6 +95,23 @@ Gusto/Graphql/TypeVariables:
   Description: 'Requires `type_member` and `type_template` in GraphQL objects to name a type rather than `T.untyped`.'
   Enabled: false
 
+Gusto/HardcodedAbsentRecordId:
+  Description: 'Flags a hardcoded positive id standing in for a record an example expects to be absent.'
+  Include:
+    - '**/spec/**/*_spec.rb'
+  # Names of `*_id` fields holding a third-party identifier rather than a primary key the
+  # auto-increment counter can reach. Prefer adding a name here over a file-path exclude.
+  AllowedNames: []
+  MaxId: 1000000
+  SafeAutoCorrect: false
+
+Gusto/HardcodedId:
+  Description: 'Bans passing a hardcoded `id:` to create, which forces a primary key.'
+  Include:
+    - '**/spec/**/*_spec.rb'
+  AllowedFactories: []
+  AllowedReceivers: []
+
 Gusto/MinByMaxBy:
   Description: 'Checks for the use of `min` or `max` with a proc. Corrects to `min_by` or `max_by`.'
   Safe: false

data/config/rails.yml

@@ -11,10 +11,6 @@ AllCops:
   TargetRubyVersion: <%= RbConfig::CONFIG['RUBY_API_VERSION'] %>
 
 Gusto/DiscouragedGem:
-  Enabled: true
-  Include:
-    - '**/*.gemspec'
-    - '**/Gemfile'
   Gems:
     timecop: "Use Rails' time helpers (e.g., freeze_time, travel_to) instead of Timecop."
 

data/lib/rubocop/cop/gusto/discouraged_gem.rb

@@ -1,27 +1,57 @@
 # frozen_string_literal: true
 
+require "bundler"
+require "digest"
+
 module RuboCop
   module Cop
     module Gusto
-      # Flag installation of discouraged gems (e.g. timecop) in Gemfiles and
-      # gemspecs. The discouraged gems an advice about alternatives are configured under
-      # `Gems:`; intended to be enabled in Rails projects via config/rails.yml.
+      # Flag installation of discouraged gems (e.g. ostruct) in Gemfiles and gemspecs. The
+      # discouraged gems and advice about alternatives are configured under `Gems:`.
+      #
+      # When a Gemfile has a lockfile beside it, discouraged gems pulled in transitively are
+      # flagged on the line of the Gemfile dependency that pulls them in, so each existing case
+      # can be exempted with its own inline `rubocop:todo` and any new one still fails.
       #
-      # @example Gems: { timecop: "Use Rails' time helpers instead of Timecop." }
+      # @example Gems: { ostruct: "Use Struct or Data instead of OpenStruct." }
       #   # bad
-      #   gem "timecop"
+      #   gem "ostruct"
       #
-      #   # good
-      #   # Use Rails' time helpers (freeze_time, travel_to) instead.
+      #   # bad - Gemfile.lock resolves slack-ruby-client -> gli -> ostruct
+      #   gem "slack-ruby-client"
       class DiscouragedGem < Base
         MSG = "Avoid using the '%{gem}' gem. %{advice}"
+        MSG_TRANSITIVE = "Avoid using the '%{gem}' gem, pulled in via %{path}. %{advice}"
+        MSG_UNREADABLE_LOCKFILE = "Could not parse %{lockfile} to check for discouraged gems."
+        LOCKFILES = { "Gemfile" => "Gemfile.lock", "gems.rb" => "gems.locked" }.freeze
 
         RESTRICT_ON_SEND = %i(gem add_dependency add_development_dependency).freeze
 
+        # @!method gem_declaration(node)
+        def_node_matcher :gem_declaration, "(send nil? :gem ({str sym} $_) ...)"
+
+        # @!method gemspec_declaration?(node)
+        def_node_matcher :gemspec_declaration?, "(send nil? :gemspec ...)"
+
+        def on_new_investigation
+          return if discouraged_gems.empty? || processed_source.ast.nil?
+
+          lockfile = lockfile_path
+          check_lockfile(lockfile) if lockfile && ::File.file?(lockfile)
+        end
+
         def on_send(node)
           check_gem_usage(node)
         end
 
+        # Asked once per run, so only a lockfile-only change at the project root busts the cache.
+        def external_dependency_checksum
+          lockfiles = LOCKFILES.values.select { |path| ::File.file?(path) }
+          return if lockfiles.empty?
+
+          Digest::SHA256.hexdigest(lockfiles.map { |path| ::File.read(path) }.join)
+        end
+
         private
 
         def check_gem_usage(node)
@@ -32,6 +62,84 @@ module RuboCop
           # No autocorrect: removing dependencies is a project decision.
         end
 
+        def lockfile_path
+          file_path = processed_source.file_path.to_s
+          lockfile = LOCKFILES[::File.basename(file_path)]
+          ::File.join(::File.dirname(file_path), lockfile) if lockfile
+        end
+
+        def check_lockfile(lockfile)
+          parser = ::Bundler::LockfileParser.new(::File.read(lockfile))
+        rescue ::Bundler::LockfileError
+          add_offense(fallback_location, message: format(MSG_UNREADABLE_LOCKFILE, lockfile: ::File.basename(lockfile)))
+        else
+          graph = dependency_graph(parser.specs)
+          declared = declared_gems
+          paths_by_location = Hash.new { |hash, location| hash[location] = [] }
+          parser.dependencies.each_key do |root|
+            discouraged_paths(root, graph).each do |path|
+              # A declared discouraged gem is already flagged by on_send.
+              next if path.one? && declared.key?(root)
+
+              paths_by_location[declared.fetch(root) { fallback_location }] << path
+            end
+          end
+          # RuboCop keeps only the first offense per location, so they are combined.
+          paths_by_location.each do |location, paths|
+            add_offense(location, message: paths.map { |path| message_for_path(path) }.join(" "))
+          end
+        end
+
+        # Platform-specific specs share a name, so their dependencies are merged.
+        def dependency_graph(specs)
+          specs.each_with_object({}) do |spec, graph|
+            (graph[spec.name] ||= []).concat(spec.dependencies.map(&:name)).uniq!
+          end
+        end
+
+        # Breadth-first, so each discouraged gem is reported via its shortest path from root.
+        def discouraged_paths(root, graph)
+          parents = { root => nil }
+          queue = [root]
+          found = []
+          until queue.empty?
+            name = queue.shift
+            found << name if discouraged_gems.include?(name)
+            graph.fetch(name, []).each do |dependency|
+              next if parents.key?(dependency)
+
+              parents[dependency] = name
+              queue << dependency
+            end
+          end
+          found.map { |name| path_to(name, parents) }
+        end
+
+        def path_to(name, parents)
+          path = [name]
+          path.unshift(parents[path.first]) while parents[path.first]
+          path
+        end
+
+        def declared_gems
+          processed_source.ast.each_node(:send).with_object({}) do |node, declared|
+            name = gem_declaration(node)
+            declared[name.to_s] ||= node if name
+          end
+        end
+
+        # Dependencies that come from a gemspec, eval_gemfile, or similar have no `gem` line.
+        def fallback_location
+          processed_source.ast.each_node(:send).find { |node| gemspec_declaration?(node) } ||
+            processed_source.buffer.line_range(1)
+        end
+
+        def message_for_path(path)
+          return message_for(path.first) if path.one?
+
+          format(MSG_TRANSITIVE, gem: path.last, path: path.join(" -> "), advice: advice_for(path.last))
+        end
+
         def discouraged_gems
           @discouraged_gems ||= gems_config.keys.map(&:to_s)
         end

data/lib/rubocop/cop/gusto/hardcoded_absent_record_id.rb

@@ -0,0 +1,370 @@
+# frozen_string_literal: true
+
+require "rubocop-rspec"
+
+module RuboCop
+  module Cop
+    module Gusto
+      # Flags a hardcoded positive id standing in for a record an example expects to be absent.
+      #
+      # Auto-increment climbs across every example on a test node and is not reclaimed by
+      # transactional rollback, so the counter eventually reaches the literal. From then on a
+      # real row occupies it, the lookup succeeds, and the example stops testing absence --
+      # passing locally, where the counter is low, and failing in CI. A negative id cannot
+      # collide, because auto-increment never emits one.
+      #
+      # An id counts as standing in for an absent record when its own example group either
+      # asserts absence (`ActiveRecord::RecordNotFound`, a `:not_found` response) or says so in
+      # its description. Both are read from the group the `let` is written in, not the whole
+      # file, so a shared id in an outer group is not attributed to a nested example that never
+      # uses it.
+      #
+      # In a list, a literal sitting beside a real `record.id` also qualifies on its own: you
+      # would write another `record.id` if you wanted one that exists. That matters because
+      # those groups are usually named for the plural ("with multiple bank account IDs") rather
+      # than for the gap. Several literals each correct to their own negative (`-1`, `-2`), so
+      # the count the example asserts is preserved. A list only reads as record ids when every
+      # member is one: `['story', '123', '']` enumerates the shapes an id parser must reject,
+      # so its numeric member is a format, not a primary key.
+      #
+      # The description vocabulary is wider than "does not exist" on purpose. "Invalid company
+      # id", "belongs to another company" and "for a different employee" are, in practice,
+      # how specs name an id that matches no row -- and a positive literal there collides with
+      # the example's own record as soon as the counter reaches it.
+      #
+      # Five shapes are deliberately not offenses, because in none of them can the counter reach
+      # the literal, or a single replacement would change what the example asserts:
+      #
+      # - a group that builds a record carrying that id -- the row is meant to exist, so the
+      #   absence the group describes is about something else, a cache or a header;
+      # - an `ActiveRecord::RecordNotFound` raised by reloading a row the example just deleted,
+      #   which is a statement about that object rather than about the literal;
+      # - a literal above `MaxId`, which is a deliberate never-collides sentinel;
+      # - a group pinning two ids, which are usually pinned to differ from each other, and one
+      #   shared replacement collapses that and inverts the example; and
+      # - an example group under VCR, whose cassette matches on the id in the request URI.
+      #
+      # @safety
+      #   Autocorrection is unsafe. `-1` is right for a primary key, but it also changes the
+      #   value the example feeds to everything else, so an id matched against a stubbed request
+      #   URI or an asserted error message needs those updated to match. `-1` is not free
+      #   everywhere either: a codebase may reserve it as a sentinel of its own, and an unsigned
+      #   column or protobuf field rejects it outright. Where a negative will not do, a sentinel
+      #   above `MaxId` is the sanctioned alternative.
+      #
+      # @example
+      #   # bad
+      #   context 'when the company does not exist' do
+      #     let(:company_id) { 123 }
+      #
+      #     it { expect { subject }.to raise_error(ActiveRecord::RecordNotFound) }
+      #   end
+      #
+      #   # bad - the literal is there precisely because no record has it
+      #   let(:bank_account_ids) { [bank_account.id, other_account.id, 999_999] }
+      #
+      #   # good - auto-increment never emits a negative id
+      #   context 'when the company does not exist' do
+      #     let(:company_id) { -1 }
+      #
+      #     it { expect { subject }.to raise_error(ActiveRecord::RecordNotFound) }
+      #   end
+      #
+      #   # good - a deleted record's id is a reference, not a magic constant
+      #   context 'when the company does not exist' do
+      #     let(:company_id) { deleted_company.id }
+      #   end
+      #
+      # @example AllowedNames: ['wise_id'] (default: [])
+      #   # good - a third-party identifier, not a primary key the counter can reach
+      #   context 'when the transfer does not exist' do
+      #     let(:wise_id) { 5678 }
+      #   end
+      #
+      # @example MaxId: 1000000 (default)
+      #   # good - above MaxId the literal is a deliberate never-collides sentinel
+      #   let(:company_id) { 9_999_999_999 }
+      class HardcodedAbsentRecordId < ::RuboCop::Cop::RSpec::Base
+        extend AutoCorrector
+
+        MSG = "Use a negative id for a record expected to be absent."
+        RESTRICT_ON_SEND = %i(let let!).freeze
+
+        # `id` itself, or any `<something>_id`, singular or plural.
+        ID_NAME = /\A(ids?|.+_ids?)\z/
+
+        # Each phrase is unambiguous on its own: a bare "missing" or "unknown" reads just as
+        # naturally about a header or a flag, so neither is here.
+        ABSENT_DESCRIPTION = /
+          (does|do|did)\s*n[o']?t\s+exist | \bnot\s+exist |
+          \bnot\s+found\b | (cannot|can\s*not|can't|couldn't)\s+be\s+found |
+          is\s*n[o']?t\s+found | non-?\s?existent | no\s+such |
+          invalid\s+(\w+\s+)?ids?\b | \bids?\s+(is|are)\s+invalid |
+          does\s*n[o']?t\s+belong | not\s+belong\s+to | unauthorized\s+access |
+          (another|other|different)\s+(account|company|customer|employee|member|org|person|user)
+        /xi
+
+        NOT_FOUND = /RecordNotFound/
+        NOT_FOUND_STATUS = /\A:?(not_found|404)\z/
+        DEFAULT_MAX_ID = 1_000_000
+
+        # @!method let_definition(node)
+        def_node_matcher :let_definition, <<~PATTERN
+          (any_block (send nil? {:let :let!} (sym $_) ...) _ $_)
+        PATTERN
+
+        # @!method vcr_metadata?(node)
+        def_node_matcher :vcr_metadata?, <<~PATTERN
+          {(sym :vcr) (hash <(pair {(sym :vcr) (str "vcr")} _) ...>)}
+        PATTERN
+
+        def on_send(node)
+          return unless node.parent&.type?(:any_block)
+
+          name, body = let_definition(node.parent)
+          return unless body && id_name?(name)
+          return if cassette_controlled?(node)
+
+          if body.array_type?
+            check_id_list(node, name, body)
+          else
+            check_id_literal(node, name, body)
+          end
+        end
+
+        private
+
+        # A third-party identifier stored in a `*_id` field is not a primary key the
+        # auto-increment counter can reach, so a name listed in `AllowedNames` is skipped
+        # outright -- a named exception in config beats a file-path exclude or a disable.
+        def id_name?(name)
+          name.to_s.match?(ID_NAME) && !allowed_names.include?(name.to_s)
+        end
+
+        def allowed_names
+          @allowed_names ||= Array(cop_config["AllowedNames"]).to_set(&:to_s)
+        end
+
+        def check_id_literal(node, name, literal)
+          value = collidable_id(literal)
+          group = value && enclosing_example_group(node)
+          return unless group && absent_context?(group)
+          return if built_with?(group, name, value) || paired_ids?(group)
+
+          register(literal)
+        end
+
+        def check_id_list(node, name, array)
+          return if format_fixture?(array)
+
+          literals = array.children.select { |item| collidable_id(item) }
+          group = enclosing_example_group(node)
+          return if literals.empty? || !list_qualifies?(array, group)
+
+          register_list(literals, group, name)
+        end
+
+        # Each literal gets its own negative: a duplicated id collapses on lookup, which would
+        # change the count the example asserts.
+        def register_list(literals, group, name)
+          literals.each_with_index do |literal, index|
+            next if group && built_with?(group, name, collidable_id(literal))
+
+            register(literal, -(index + 1))
+          end
+        end
+
+        # `['story', 'story-', '123', '']` lists the shapes an id parser has to reject, so its
+        # numeric member is a format, not a primary key.
+        def format_fixture?(array)
+          array.children.any? do |item|
+            item.type?(:str, :sym) && Integer(item.value.to_s, exception: false).nil?
+          end
+        end
+
+        def list_qualifies?(array, group)
+          return true if array.children.any? { |item| item.send_type? && item.method?(:id) }
+
+          !group.nil? && absent_context?(group)
+        end
+
+        def register(literal, replacement = -1)
+          add_offense(literal) do |corrector|
+            corrector.replace(literal, literal.str_type? ? "'#{replacement}'" : replacement.to_s)
+          end
+        end
+
+        # A string id reaches the same column as an integer one, so both count; only the sign
+        # and the magnitude matter.
+        def collidable_id(node)
+          value = case node.type
+          when :int then node.value
+          when :str then Integer(node.value, exception: false)
+          end
+          value if value&.positive? && value <= max_id
+        end
+
+        def max_id
+          cop_config.fetch("MaxId", DEFAULT_MAX_ID)
+        end
+
+        def enclosing_example_group(node)
+          node.each_ancestor(:any_block).find { |ancestor| example_group?(ancestor) }
+        end
+
+        def absent_context?(group)
+          inspect_group(group).absent?
+        end
+
+        def built_with?(group, name, value)
+          inspect_group(group).builds?(name, value)
+        end
+
+        def paired_ids?(group)
+          inspect_group(group).paired_ids?
+        end
+
+        def inspect_group(group)
+          GroupInspector.new(group, max_id)
+        end
+
+        # A cassette keys its recorded interactions off the request URI, so an id in the path is
+        # what tells two same-route requests apart. Rewriting it makes the example miss the
+        # recording rather than assert absence, and `record: :none` then fails it outright.
+        def cassette_controlled?(node)
+          node.each_ancestor(:any_block).any? do |ancestor|
+            example_group?(ancestor) && ancestor.send_node.arguments.any? { |arg| vcr_metadata?(arg) }
+          end
+        end
+
+        # Answers the group-level questions: does this group say the record is absent, does it
+        # build the record, and does it pin two ids that are meant to differ?
+        class GroupInspector
+          include ::RuboCop::RSpec::Language
+          extend ::RuboCop::AST::NodePattern::Macros
+
+          # @!method let_definition(node)
+          def_node_matcher :let_definition, <<~PATTERN
+            (any_block (send nil? {:let :let!} (sym $_) ...) _ $_)
+          PATTERN
+
+          # @!method builder_calls(node)
+          def_node_search :builder_calls, <<~PATTERN
+            $(send _ {:build :build! :build_list :build_pair :build_stubbed :build_stubbed_list
+                      :create :create! :create_list :create_pair} ...)
+          PATTERN
+
+          def initialize(group, max_id)
+            @group = group
+            @max_id = max_id
+          end
+
+          def absent?
+            absent_description? || not_found_assertion?(group.body)
+          end
+
+          # A group that builds a record carrying this id means the row is meant to exist, so
+          # the absence the group describes is about something else.
+          def builds?(name, value)
+            builder_calls(group).any? do |call|
+              factory = factory_name(call)
+              call.each_descendant(:send, :pair).any? do |node|
+                references?(node, name) || own_attribute?(node, factory, value)
+              end
+            end
+          end
+
+          # Two ids pinned in one group are usually pinned to differ from each other -- a record
+          # and the "other company" it must not match. One shared replacement collapses that.
+          def paired_ids?
+            own_lets(group.body).count { |_name, body| collidable_id(body) } > 1
+          end
+
+          private
+
+          attr_reader :group, :max_id
+
+          # Matched against the source rather than the value so an interpolated description
+          # ("when #{model} does not exist") still reads as one.
+          def absent_description?
+            description = group.send_node.first_argument
+            return false unless description&.type?(:str, :dstr, :sym)
+
+            ABSENT_DESCRIPTION.match?(description.source)
+          end
+
+          # Scoped to this group: the walk stops at a nested example group, whose assertions
+          # belong to whatever that group redefines rather than to this `let`.
+          def not_found_assertion?(node)
+            return false if node.type?(:any_block) && example_group?(node)
+            return true if node.send_type? && not_found_matcher?(node)
+
+            node.each_child_node.any? { |child| not_found_assertion?(child) }
+          end
+
+          def not_found_matcher?(node)
+            case node.method_name
+            when :raise_error, :raise_exception
+              node.arguments.any? { |arg| NOT_FOUND.match?(arg.source) } && !deleted_record_assertion?(node)
+            when :have_http_status
+              NOT_FOUND_STATUS.match?(node.first_argument&.source.to_s)
+            when :be_not_found then true
+            else false
+            end
+          end
+
+          # `expect { record.reload }.to raise_error(ActiveRecord::RecordNotFound)` asserts that
+          # a row the example already holds was deleted by the code under test. That is about
+          # the object, not about the literal -- which is usually what selected it for deletion.
+          def deleted_record_assertion?(node)
+            subject = node.each_ancestor(:send).first&.receiver
+            return false unless subject&.type?(:any_block)
+
+            subject.body&.send_type? && subject.body.method?(:reload)
+          end
+
+          def collidable_id(node)
+            value = case node.type
+            when :int then node.value
+            when :str then Integer(node.value, exception: false)
+            end
+            value if value&.positive? && value <= max_id
+          end
+
+          def references?(node, name)
+            node.send_type? && node.receiver.nil? && node.method?(name)
+          end
+
+          def factory_name(call)
+            first_argument = call.first_argument
+            first_argument.value.to_s if first_argument&.sym_type?
+          end
+
+          # The built record carries the id when the key is its own primary key, or when the
+          # attribute is named for the factory, as in `create(:card, corepro_card_id: 123)`. A key
+          # naming another table is a foreign key: `create(:evaluation, company_id: 1)` points at
+          # the companies row the example says is absent rather than creating it, so it is not
+          # treated as building it.
+          def own_attribute?(node, factory, value)
+            return false unless node.pair_type? && node.key.type?(:sym, :str)
+
+            key = node.key.value.to_s
+            return false unless key.match?(ID_NAME) && collidable_id(node.value) == value
+
+            key == "id" || (!factory.nil? && key.include?(factory))
+          end
+
+          def own_lets(node, found = [])
+            return found if node.type?(:any_block) && example_group?(node)
+
+            definition = let_definition(node)
+            body = definition&.last
+            found << definition if body && !body.array_type?
+            node.each_child_node { |child| own_lets(child, found) }
+            found
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/gusto/hardcoded_id.rb

@@ -0,0 +1,110 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Gusto
+      # Flags a hardcoded `id:` passed to `create`/`create!`/`create_list`.
+      #
+      # Forcing a primary key in a spec collides with whatever else occupies that row --
+      # fixtures, parallel workers, the table's auto-increment sequence -- and is a common
+      # source of flaky, order-dependent failures. Let the database assign the id and reference
+      # the returned record.
+      #
+      # Only the persisting builders are flagged: they insert a row, so a forced primary key is
+      # an outright collision risk. `create_list` is worse still, forcing the identical id onto
+      # every generated record, which is a guaranteed unique-constraint failure. `build` and
+      # `build_stubbed` never insert, so they are left alone.
+      #
+      # Both `id:` and `'id' =>` are flagged: FactoryBot symbolizes override keys and
+      # ActiveRecord treats string and symbol attribute keys identically on mass-assignment, so
+      # a string-rocket key forces the same primary key.
+      #
+      # Only literal values are flagged. A value read from another record or a variable
+      # (`id: company.id`, `id: company_id`) is a reference, not a magic constant.
+      #
+      # Two shapes are configured away rather than disabled per site, because in neither is the
+      # literal a database primary key:
+      #
+      # - `AllowedFactories` -- factories that build a value object instead of inserting a row
+      #   (`skip_create` / `initialize_with`), so `id:` is the object's own identity; plus the
+      #   rare table declared `create_table ..., id: false`, whose column has no auto-increment
+      #   and so requires an explicit id.
+      # - `AllowedReceivers` -- constants whose `create` is not ActiveRecord's, such as a
+      #   `T::Struct` whose `id:` is a required keyword argument.
+      #
+      # @example
+      #   # bad
+      #   create(:company, id: 123)
+      #   create(:company, 'id' => 123)
+      #   create_list(:company, 3, id: 123)
+      #   Company.create!(id: '123456789')
+      #
+      #   # good - let the database assign the id
+      #   company = create(:company)
+      #
+      #   # good - a transitive record id is a reference, not a magic constant
+      #   create(:employee, id: company.id)
+      #
+      #   # better - pass the association so the child's own id is never forced
+      #   create(:employee, company:)
+      #
+      # @example AllowedFactories: ['money'] (default: [])
+      #   # good - a factory that builds a value object rather than inserting a row
+      #   create(:money, id: 123)
+      #
+      # @example AllowedReceivers: ['Reporting::Row'] (default: [])
+      #   # good - a constant whose `create` is not ActiveRecord's
+      #   Reporting::Row.create(id: 123)
+      class HardcodedId < Base
+        MSG = "Do not pass a hardcoded `id:` to `create`/`create!`/`create_list`; let the database assign it."
+        RESTRICT_ON_SEND = %i(create create! create_list).freeze
+
+        def on_send(node)
+          return if allowed_receiver?(node) || allowed_factory?(node)
+
+          node.arguments.each do |argument|
+            # Every call shape (bare trailing kwargs, braced hash, positional hash) parses to a
+            # plain `hash` node.
+            next unless argument.hash_type?
+
+            argument.pairs.each { |pair| add_offense(pair) if hardcoded_id?(pair) }
+          end
+        end
+        alias_method :on_csend, :on_send
+
+        private
+
+        def hardcoded_id?(pair)
+          key = pair.key
+          return false unless key.type?(:sym, :str) && key.value.to_s == "id"
+
+          pair.value.type?(:int, :str)
+        end
+
+        # `::Foo::Bar` and `Foo::Bar` name the same constant, so compare without the leading
+        # scope operator.
+        def allowed_receiver?(node)
+          receiver = node.receiver
+          return false unless receiver
+
+          allowed_receivers.include?(receiver.source.delete_prefix("::"))
+        end
+
+        def allowed_factory?(node)
+          factory = node.first_argument
+          return false unless factory&.sym_type?
+
+          allowed_factories.include?(factory.value.to_s)
+        end
+
+        def allowed_receivers
+          @allowed_receivers ||= Array(cop_config["AllowedReceivers"]).to_set { |name| name.to_s.delete_prefix("::") }
+        end
+
+        def allowed_factories
+          @allowed_factories ||= Array(cop_config["AllowedFactories"]).to_set(&:to_s)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/sidekiq/perform_async_stub.rb

@@ -11,6 +11,10 @@ module RuboCop
       #   expect(Foo).to receive(:perform_async)
       #   expect(Foo).not_to receive(:perform_async)
       #
+      #   # bad - the stub it verifies is itself the offense, and it may have been
+      #   # set up in a shared context this cop cannot see
+      #   expect(Foo).to have_received(:perform_async)
+      #
       #   # good (still invokes the real method)
       #   allow(Foo).to receive(:perform_async).and_call_original
       #   expect(Foo).to receive(:perform_async).with(arg).and_call_original
@@ -21,45 +25,57 @@ module RuboCop
       #   expect { subject }.not_to change(Foo.jobs, :count)
       #   expect(Foo.jobs.count).to eq(n)
       #
-      #   # good (only checks previously pre-stubbed objects)
-      #   expect(Foo).to have_received(:perform_async)
+      #   # good - there is no other way to make an enqueue fail. Sidekiq's testing API
+      #   # pushes onto Foo.jobs and offers no failure injection, so a spec covering the
+      #   # rescue around an enqueue has to raise from the stub.
+      #   allow(Foo).to receive(:perform_async).and_raise(StandardError, "redis down")
       #
       # @safety
       #   Autocorrect is unsafe: it appends `.and_call_original` on positive `receive` only, which runs
       #   the real `perform_async` during the example (may enqueue jobs, hit external code, or
       #   change expectations vs a pure stub). There is no autocorrect for `not_to` / `to_not receive`,
-      #   since `.and_call_original` would not apply to a negative expectation. Autocorrect is also
-      #   suppressed when the expectation uses a block, since appending `.and_call_original` would
-      #   rebind the block to the wrong method.
+      #   since `.and_call_original` would not apply to a negative expectation, nor for
+      #   `have_received`, whose stub lives elsewhere. Autocorrect is also suppressed when the
+      #   expectation uses a block, since appending `.and_call_original` would rebind the block to
+      #   the wrong method.
       class PerformAsyncStub < Base
         extend AutoCorrector
 
         MSG = "Prefer checking enqueued jobs over stubbing `perform_async`."
         MSG_RECEIVE = "Prefer checking enqueued jobs over stubbing `perform_async` or add `.and_call_original`."
-        RESTRICT_ON_SEND = %i(receive).freeze
+        RESTRICT_ON_SEND = %i(receive have_received).freeze
+
+        # Chain modifiers that leave the real `perform_async` reachable, so the example is not
+        # replacing the enqueue with a canned result. `and_raise` belongs here even though it
+        # never calls the original: simulating a failed enqueue is the one thing Sidekiq's
+        # testing API cannot express, so a spec covering the rescue has no other route.
+        ALLOWED_CHAIN = %i(and_call_original and_wrap_original and_raise).freeze
 
-        # TODO: this should match on perform_async, not on receive, requires pattern update
         # @!method stub_perform_async?(node)
         def_node_matcher :stub_perform_async?, <<~PATTERN
-          (send nil? :receive (sym :perform_async))
+          (send nil? {:receive :have_received} (sym :perform_async))
         PATTERN
 
         def on_send(node)
           return unless stub_perform_async?(node)
+          # `have_received` only verifies a stub that was installed somewhere else, possibly in a
+          # shared context or support file out of this cop's reach, so it is flagged on sight and
+          # there is nothing local to autocorrect.
+          return add_offense(node) if node.method?(:have_received)
 
           negative_expectation = false
-          calls_original = false
+          allowed_chain = false
 
           current = node.parent
           while current&.call_type?
             negative_expectation = true if current.method?(:not_to) || current.method?(:to_not)
-            calls_original = true if current.method?(:and_call_original) || current.method?(:and_wrap_original)
+            allowed_chain = true if ALLOWED_CHAIN.include?(current.method_name)
 
             current = current.parent
           end
 
           return add_offense(node) if negative_expectation
-          return if calls_original # already have .and_call_original, not an offense
+          return if allowed_chain
 
           tail = message_expectation_chain_tail(node)
           return add_offense(node, message: MSG_RECEIVE) if tail.parent&.block_type?

data/lib/rubocop/gusto/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module Gusto
-    VERSION = "11.8.1"
+    VERSION = "11.9.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-gusto
 version: !ruby/object:Gem::Version
-  version: 11.8.1
+  version: 11.9.1
 platform: ruby
 authors:
 - Gusto Engineering
@@ -174,6 +174,8 @@ files:
 - lib/rubocop/cop/gusto/graphql/prevent_field_can_can_action.rb
 - lib/rubocop/cop/gusto/graphql/resolver_ignores_object.rb
 - lib/rubocop/cop/gusto/graphql/type_variables.rb
+- lib/rubocop/cop/gusto/hardcoded_absent_record_id.rb
+- lib/rubocop/cop/gusto/hardcoded_id.rb
 - lib/rubocop/cop/gusto/min_by_max_by.rb
 - lib/rubocop/cop/gusto/no_metaprogramming.rb
 - lib/rubocop/cop/gusto/no_rescue_error_message_checking.rb