rubocop-gusto 11.9.0 → 11.9.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ae5d8c5b6e24aaf92ff21ac52781b6e6ad098d4893a0051b530d372bd6fee0d3
-  data.tar.gz: f95be1484e3291a03aa5fb2e337b18fcdcf48cb4762422bc0fc39bed4550ef6c
+  metadata.gz: 5581a398e181fa5cee526273621f36357e83dba9fe912433df5a4cbe2129b2e7
+  data.tar.gz: db3825a6506974aa565e427d2e83fa1cbb618b31136c4bdbbb13840e81dd1eb1
 SHA512:
-  metadata.gz: 5c773623cef1e70d0289490fd8409a30d05ce91c0051ac29f7be5946849d8d3087ca9edb26b90e54cb14b9afe99c26fa712063810be1ba74252010ac32d26706
-  data.tar.gz: a0e8c1775d2850925cdda007713667410a2ab32f60b73f928f372bfa24ec4fa4ab2a707466aca9ef10ce4b5e61407e0c3a9752b489ae9c9e5a8f0f92bfa57533
+  metadata.gz: '089fac7ad4fea249760ba0d5138e78a42152f198796b7f920d78ee656ba5cfb4d56b66a20918a90488431534b497110b366a66f467703c22797d5d4a51a94aba'
+  data.tar.gz: 681ef77cd2115bac46da1f0713adfa9fd05ed77204cec941c47cbe7a45d30b62d2b3128997665567923eaaa6509464f10c78867869fed7aed34d9b7bc3870f21

data/CHANGELOG.md

@@ -3,6 +3,13 @@
 - Remove redundant `Rails: Enabled: true` from `config/rails.yml` (already set by rubocop-rails' own defaults)
 - Enable `Rails/DefaultScope` cop (disabled by default in rubocop-rails)
 
+## [11.9.1](https://github.com/Gusto/rubocop-gusto/compare/v11.9.0...v11.9.1) (2026-09-28)
+
+
+### Bug Fixes
+
+* port upstream review of Gusto/HardcodedAbsentRecordId ([#180](https://github.com/Gusto/rubocop-gusto/issues/180)) ([6198928](https://github.com/Gusto/rubocop-gusto/commit/6198928187db6920c18c882c3167a1cf8edeccf1))
+
 ## [11.9.0](https://github.com/Gusto/rubocop-gusto/compare/v11.8.1...v11.9.0) (2026-09-24)
 
 

data/config/gusto_cops.yml

@@ -32,9 +32,14 @@ Gusto/DescribedClassConstantReference:
     - '**/spec/**/*'
 
 Gusto/DiscouragedGem:
-  Description: 'Flags installation of discouraged gems in Gemfiles and gemspecs.'
-  Enabled: false
-  Gems: {}
+  Description: 'Flags discouraged gems in Gemfiles and gemspecs, including ones pulled in transitively per the lockfile.'
+  Enabled: true
+  Include:
+    - '**/*.gemspec'
+    - '**/Gemfile'
+    - '**/gems.rb'
+  Gems:
+    ostruct: "OpenStruct is officially discouraged (slow, and defeats method caching); use Struct, Data, a Hash, or T::Struct. See https://forum.exercism.org/t/openstruct-is-now-officially-discouraged/17490"
 
 Gusto/ExecuteMigration:
   Description: "Don't use `execute` in migrations. Use a backfill rake task instead."

data/config/rails.yml

@@ -11,10 +11,6 @@ AllCops:
   TargetRubyVersion: <%= RbConfig::CONFIG['RUBY_API_VERSION'] %>
 
 Gusto/DiscouragedGem:
-  Enabled: true
-  Include:
-    - '**/*.gemspec'
-    - '**/Gemfile'
   Gems:
     timecop: "Use Rails' time helpers (e.g., freeze_time, travel_to) instead of Timecop."
 

data/lib/rubocop/cop/gusto/discouraged_gem.rb

@@ -1,27 +1,57 @@
 # frozen_string_literal: true
 
+require "bundler"
+require "digest"
+
 module RuboCop
   module Cop
     module Gusto
-      # Flag installation of discouraged gems (e.g. timecop) in Gemfiles and
-      # gemspecs. The discouraged gems an advice about alternatives are configured under
-      # `Gems:`; intended to be enabled in Rails projects via config/rails.yml.
+      # Flag installation of discouraged gems (e.g. ostruct) in Gemfiles and gemspecs. The
+      # discouraged gems and advice about alternatives are configured under `Gems:`.
+      #
+      # When a Gemfile has a lockfile beside it, discouraged gems pulled in transitively are
+      # flagged on the line of the Gemfile dependency that pulls them in, so each existing case
+      # can be exempted with its own inline `rubocop:todo` and any new one still fails.
       #
-      # @example Gems: { timecop: "Use Rails' time helpers instead of Timecop." }
+      # @example Gems: { ostruct: "Use Struct or Data instead of OpenStruct." }
       #   # bad
-      #   gem "timecop"
+      #   gem "ostruct"
       #
-      #   # good
-      #   # Use Rails' time helpers (freeze_time, travel_to) instead.
+      #   # bad - Gemfile.lock resolves slack-ruby-client -> gli -> ostruct
+      #   gem "slack-ruby-client"
       class DiscouragedGem < Base
         MSG = "Avoid using the '%{gem}' gem. %{advice}"
+        MSG_TRANSITIVE = "Avoid using the '%{gem}' gem, pulled in via %{path}. %{advice}"
+        MSG_UNREADABLE_LOCKFILE = "Could not parse %{lockfile} to check for discouraged gems."
+        LOCKFILES = { "Gemfile" => "Gemfile.lock", "gems.rb" => "gems.locked" }.freeze
 
         RESTRICT_ON_SEND = %i(gem add_dependency add_development_dependency).freeze
 
+        # @!method gem_declaration(node)
+        def_node_matcher :gem_declaration, "(send nil? :gem ({str sym} $_) ...)"
+
+        # @!method gemspec_declaration?(node)
+        def_node_matcher :gemspec_declaration?, "(send nil? :gemspec ...)"
+
+        def on_new_investigation
+          return if discouraged_gems.empty? || processed_source.ast.nil?
+
+          lockfile = lockfile_path
+          check_lockfile(lockfile) if lockfile && ::File.file?(lockfile)
+        end
+
         def on_send(node)
           check_gem_usage(node)
         end
 
+        # Asked once per run, so only a lockfile-only change at the project root busts the cache.
+        def external_dependency_checksum
+          lockfiles = LOCKFILES.values.select { |path| ::File.file?(path) }
+          return if lockfiles.empty?
+
+          Digest::SHA256.hexdigest(lockfiles.map { |path| ::File.read(path) }.join)
+        end
+
         private
 
         def check_gem_usage(node)
@@ -32,6 +62,84 @@ module RuboCop
           # No autocorrect: removing dependencies is a project decision.
         end
 
+        def lockfile_path
+          file_path = processed_source.file_path.to_s
+          lockfile = LOCKFILES[::File.basename(file_path)]
+          ::File.join(::File.dirname(file_path), lockfile) if lockfile
+        end
+
+        def check_lockfile(lockfile)
+          parser = ::Bundler::LockfileParser.new(::File.read(lockfile))
+        rescue ::Bundler::LockfileError
+          add_offense(fallback_location, message: format(MSG_UNREADABLE_LOCKFILE, lockfile: ::File.basename(lockfile)))
+        else
+          graph = dependency_graph(parser.specs)
+          declared = declared_gems
+          paths_by_location = Hash.new { |hash, location| hash[location] = [] }
+          parser.dependencies.each_key do |root|
+            discouraged_paths(root, graph).each do |path|
+              # A declared discouraged gem is already flagged by on_send.
+              next if path.one? && declared.key?(root)
+
+              paths_by_location[declared.fetch(root) { fallback_location }] << path
+            end
+          end
+          # RuboCop keeps only the first offense per location, so they are combined.
+          paths_by_location.each do |location, paths|
+            add_offense(location, message: paths.map { |path| message_for_path(path) }.join(" "))
+          end
+        end
+
+        # Platform-specific specs share a name, so their dependencies are merged.
+        def dependency_graph(specs)
+          specs.each_with_object({}) do |spec, graph|
+            (graph[spec.name] ||= []).concat(spec.dependencies.map(&:name)).uniq!
+          end
+        end
+
+        # Breadth-first, so each discouraged gem is reported via its shortest path from root.
+        def discouraged_paths(root, graph)
+          parents = { root => nil }
+          queue = [root]
+          found = []
+          until queue.empty?
+            name = queue.shift
+            found << name if discouraged_gems.include?(name)
+            graph.fetch(name, []).each do |dependency|
+              next if parents.key?(dependency)
+
+              parents[dependency] = name
+              queue << dependency
+            end
+          end
+          found.map { |name| path_to(name, parents) }
+        end
+
+        def path_to(name, parents)
+          path = [name]
+          path.unshift(parents[path.first]) while parents[path.first]
+          path
+        end
+
+        def declared_gems
+          processed_source.ast.each_node(:send).with_object({}) do |node, declared|
+            name = gem_declaration(node)
+            declared[name.to_s] ||= node if name
+          end
+        end
+
+        # Dependencies that come from a gemspec, eval_gemfile, or similar have no `gem` line.
+        def fallback_location
+          processed_source.ast.each_node(:send).find { |node| gemspec_declaration?(node) } ||
+            processed_source.buffer.line_range(1)
+        end
+
+        def message_for_path(path)
+          return message_for(path.first) if path.one?
+
+          format(MSG_TRANSITIVE, gem: path.last, path: path.join(" -> "), advice: advice_for(path.last))
+        end
+
         def discouraged_gems
           @discouraged_gems ||= gems_config.keys.map(&:to_s)
         end

data/lib/rubocop/cop/gusto/hardcoded_absent_record_id.rb

@@ -22,7 +22,15 @@ module RuboCop
       # In a list, a literal sitting beside a real `record.id` also qualifies on its own: you
       # would write another `record.id` if you wanted one that exists. That matters because
       # those groups are usually named for the plural ("with multiple bank account IDs") rather
-      # than for the gap.
+      # than for the gap. Several literals each correct to their own negative (`-1`, `-2`), so
+      # the count the example asserts is preserved. A list only reads as record ids when every
+      # member is one: `['story', '123', '']` enumerates the shapes an id parser must reject,
+      # so its numeric member is a format, not a primary key.
+      #
+      # The description vocabulary is wider than "does not exist" on purpose. "Invalid company
+      # id", "belongs to another company" and "for a different employee" are, in practice,
+      # how specs name an id that matches no row -- and a positive literal there collides with
+      # the example's own record as soon as the counter reaches it.
       #
       # Five shapes are deliberately not offenses, because in none of them can the counter reach
       # the literal, or a single replacement would change what the example asserts:
@@ -91,14 +99,13 @@ module RuboCop
           (does|do|did)\s*n[o']?t\s+exist | \bnot\s+exist |
           \bnot\s+found\b | (cannot|can\s*not|can't|couldn't)\s+be\s+found |
           is\s*n[o']?t\s+found | non-?\s?existent | no\s+such |
-          invalid\s+\w*\s*\bid\b | \bid\b\s+is\s+invalid |
+          invalid\s+(\w+\s+)?ids?\b | \bids?\s+(is|are)\s+invalid |
           does\s*n[o']?t\s+belong | not\s+belong\s+to | unauthorized\s+access |
           (another|other|different)\s+(account|company|customer|employee|member|org|person|user)
         /xi
 
         NOT_FOUND = /RecordNotFound/
         NOT_FOUND_STATUS = /\A:?(not_found|404)\z/
-        BUILDERS = %i(build build! build_list build_stubbed build_stubbed_list create create! create_list).freeze
         DEFAULT_MAX_ID = 1_000_000
 
         # @!method let_definition(node)
@@ -147,19 +154,32 @@ module RuboCop
           register(literal)
         end
 
-        # Only a lone literal qualifies. Two would both correct to `-1`, and a duplicated id in
-        # a list collapses on lookup, changing the count the example asserts.
         def check_id_list(node, name, array)
-          literals = array.children.select { |item| collidable_id(item) }
-          return unless literals.one?
+          return if format_fixture?(array)
 
+          literals = array.children.select { |item| collidable_id(item) }
           group = enclosing_example_group(node)
-          return unless list_qualifies?(array, group)
+          return if literals.empty? || !list_qualifies?(array, group)
+
+          register_list(literals, group, name)
+        end
 
-          literal = literals.first
-          return if group && built_with?(group, name, collidable_id(literal))
+        # Each literal gets its own negative: a duplicated id collapses on lookup, which would
+        # change the count the example asserts.
+        def register_list(literals, group, name)
+          literals.each_with_index do |literal, index|
+            next if group && built_with?(group, name, collidable_id(literal))
 
-          register(literal)
+            register(literal, -(index + 1))
+          end
+        end
+
+        # `['story', 'story-', '123', '']` lists the shapes an id parser has to reject, so its
+        # numeric member is a format, not a primary key.
+        def format_fixture?(array)
+          array.children.any? do |item|
+            item.type?(:str, :sym) && Integer(item.value.to_s, exception: false).nil?
+          end
         end
 
         def list_qualifies?(array, group)
@@ -168,9 +188,9 @@ module RuboCop
           !group.nil? && absent_context?(group)
         end
 
-        def register(literal)
+        def register(literal, replacement = -1)
           add_offense(literal) do |corrector|
-            corrector.replace(literal, literal.str_type? ? "'-1'" : "-1")
+            corrector.replace(literal, literal.str_type? ? "'#{replacement}'" : replacement.to_s)
           end
         end
 
@@ -228,6 +248,12 @@ module RuboCop
             (any_block (send nil? {:let :let!} (sym $_) ...) _ $_)
           PATTERN
 
+          # @!method builder_calls(node)
+          def_node_search :builder_calls, <<~PATTERN
+            $(send _ {:build :build! :build_list :build_pair :build_stubbed :build_stubbed_list
+                      :create :create! :create_list :create_pair} ...)
+          PATTERN
+
           def initialize(group, max_id)
             @group = group
             @max_id = max_id
@@ -240,9 +266,11 @@ module RuboCop
           # A group that builds a record carrying this id means the row is meant to exist, so
           # the absence the group describes is about something else.
           def builds?(name, value)
-            group.each_descendant(:send).any? do |send_node|
-              BUILDERS.include?(send_node.method_name) &&
-                send_node.each_descendant.any? { |arg| references?(arg, name) || same_id_value?(arg, value) }
+            builder_calls(group).any? do |call|
+              factory = factory_name(call)
+              call.each_descendant(:send, :pair).any? do |node|
+                references?(node, name) || own_attribute?(node, factory, value)
+              end
             end
           end
 
@@ -307,11 +335,23 @@ module RuboCop
             node.send_type? && node.receiver.nil? && node.method?(name)
           end
 
-          # `create(:evaluation, company_id: 1)` beside `let(:company_id) { 1 }` builds the row
-          # this id selects, even though the example inlined the literal rather than the `let`.
-          def same_id_value?(node, value)
-            node.pair_type? && node.key.type?(:sym, :str) &&
-              node.key.value.to_s.match?(ID_NAME) && collidable_id(node.value) == value
+          def factory_name(call)
+            first_argument = call.first_argument
+            first_argument.value.to_s if first_argument&.sym_type?
+          end
+
+          # The built record carries the id when the key is its own primary key, or when the
+          # attribute is named for the factory, as in `create(:card, corepro_card_id: 123)`. A key
+          # naming another table is a foreign key: `create(:evaluation, company_id: 1)` points at
+          # the companies row the example says is absent rather than creating it, so it is not
+          # treated as building it.
+          def own_attribute?(node, factory, value)
+            return false unless node.pair_type? && node.key.type?(:sym, :str)
+
+            key = node.key.value.to_s
+            return false unless key.match?(ID_NAME) && collidable_id(node.value) == value
+
+            key == "id" || (!factory.nil? && key.include?(factory))
           end
 
           def own_lets(node, found = [])

data/lib/rubocop/gusto/version.rb

@@ -2,6 +2,6 @@
 
 module RuboCop
   module Gusto
-    VERSION = "11.9.0"
+    VERSION = "11.9.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-gusto
 version: !ruby/object:Gem::Version
-  version: 11.9.0
+  version: 11.9.1
 platform: ruby
 authors:
 - Gusto Engineering