rubocop 0.93.1 → 1.79.2

data/lib/rubocop/cop/bundler/duplicated_group.rb

@@ -0,0 +1,127 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Bundler
+      # A Gem group, or a set of groups, should be listed only once in a Gemfile.
+      #
+      # For example, if the values of `source`, `git`, `platforms`, or `path`
+      # surrounding `group` are different, no offense will be registered:
+      #
+      # [source,ruby]
+      # -----
+      # platforms :ruby do
+      #   group :default do
+      #     gem 'openssl'
+      #   end
+      # end
+      #
+      # platforms :jruby do
+      #   group :default do
+      #     gem 'jruby-openssl'
+      #   end
+      # end
+      # -----
+      #
+      # @example
+      #   # bad
+      #   group :development do
+      #     gem 'rubocop'
+      #   end
+      #
+      #   group :development do
+      #     gem 'rubocop-rails'
+      #   end
+      #
+      #   # bad (same set of groups declared twice)
+      #   group :development, :test do
+      #     gem 'rubocop'
+      #   end
+      #
+      #   group :test, :development do
+      #     gem 'rspec'
+      #   end
+      #
+      #   # good
+      #   group :development do
+      #     gem 'rubocop'
+      #   end
+      #
+      #   group :development, :test do
+      #     gem 'rspec'
+      #   end
+      #
+      #   # good
+      #   gem 'rubocop', groups: [:development, :test]
+      #   gem 'rspec', groups: [:development, :test]
+      #
+      class DuplicatedGroup < Base
+        include RangeHelp
+
+        MSG = 'Gem group `%<group_name>s` already defined on line ' \
+              '%<line_of_first_occurrence>d of the Gemfile.'
+        SOURCE_BLOCK_NAMES = %i[source git platforms path].freeze
+
+        # @!method group_declarations(node)
+        def_node_search :group_declarations, '(send nil? :group ...)'
+
+        def on_new_investigation
+          return if processed_source.blank?
+
+          duplicated_group_nodes.each do |nodes|
+            nodes[1..].each do |node|
+              group_name = node.arguments.map(&:source).join(', ')
+
+              register_offense(node, group_name, nodes.first.first_line)
+            end
+          end
+        end
+
+        private
+
+        def duplicated_group_nodes
+          group_declarations = group_declarations(processed_source.ast)
+          group_keys = group_declarations.group_by do |node|
+            source_key = find_source_key(node)
+            group_attributes = group_attributes(node).sort.join
+
+            "#{source_key}#{group_attributes}"
+          end
+
+          group_keys.values.select { |nodes| nodes.size > 1 }
+        end
+
+        def register_offense(node, group_name, line_of_first_occurrence)
+          line_range = node.loc.column...node.loc.last_column
+          offense_location = source_range(processed_source.buffer, node.first_line, line_range)
+          message = format(
+            MSG,
+            group_name: group_name,
+            line_of_first_occurrence: line_of_first_occurrence
+          )
+          add_offense(offense_location, message: message)
+        end
+
+        def find_source_key(node)
+          source_block = node.each_ancestor(:block).find do |block_node|
+            SOURCE_BLOCK_NAMES.include?(block_node.method_name)
+          end
+
+          return unless source_block
+
+          "#{source_block.method_name}#{source_block.send_node.first_argument&.source}"
+        end
+
+        def group_attributes(node)
+          node.arguments.map do |argument|
+            if argument.hash_type?
+              argument.pairs.map(&:source).sort.join(', ')
+            else
+              argument.respond_to?(:value) ? argument.value.to_s : argument.source
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/bundler/gem_comment.rb

@@ -3,15 +3,24 @@
 module RuboCop
   module Cop
     module Bundler
-      # Add a comment describing each gem in your Gemfile.
+      # Each gem in the Gemfile should have a comment explaining
+      # its purpose in the project, or the reason for its version
+      # or source.
       #
-      # Optionally, the "OnlyFor" configuration
+      # The optional "OnlyFor" configuration array
       # can be used to only register offenses when the gems
       # use certain options or have version specifiers.
-      # Add "version_specifiers" and/or the gem option names
-      # you want to check.
       #
-      # A useful use-case is to enforce a comment when using
+      # When "version_specifiers" is included, a comment
+      # will be enforced if the gem has any version specifier.
+      #
+      # When "restrictive_version_specifiers" is included, a comment
+      # will be enforced if the gem has a version specifier that
+      # holds back the version of the gem.
+      #
+      # For any other value in the array, a comment will be enforced for
+      # a gem if an option by the same name is present.
+      # A useful use case is to enforce a comment when using
       # options that change the source of a gem:
       #
       # - `bitbucket`
@@ -21,7 +30,8 @@ module RuboCop
       # - `source`
       #
       # For a full list of options supported by bundler,
-      # you can check the https://bundler.io/man/gemfile.5.html[official documentation].
+      # see https://bundler.io/man/gemfile.5.html
+      # .
       #
       # @example OnlyFor: [] (default)
       #   # bad
@@ -43,6 +53,18 @@ module RuboCop
       #   # Version 2.1 introduces breaking change baz
       #   gem 'foo', '< 2.1'
       #
+      # @example OnlyFor: ['restrictive_version_specifiers']
+      #   # bad
+      #
+      #   gem 'foo', '< 2.1'
+      #
+      #   # good
+      #
+      #   gem 'foo', '>= 1.0'
+      #
+      #   # Version 2.1 introduces breaking change baz
+      #   gem 'foo', '< 2.1'
+      #
       # @example OnlyFor: ['version_specifiers', 'github']
       #   # bad
       #
@@ -58,16 +80,17 @@ module RuboCop
       #   # Version 2.1 introduces breaking change baz
       #   gem 'bar', '< 2.1'
       #
-      class GemComment < Cop
+      class GemComment < Base
         include DefNode
+        include GemDeclaration
 
         MSG = 'Missing gem description comment.'
         CHECKED_OPTIONS_CONFIG = 'OnlyFor'
         VERSION_SPECIFIERS_OPTION = 'version_specifiers'
+        RESTRICTIVE_VERSION_SPECIFIERS_OPTION = 'restrictive_version_specifiers'
+        RESTRICTIVE_VERSION_PATTERN = /\A\s*(?:<|~>|\d|=)/.freeze
         RESTRICT_ON_SEND = %i[gem].freeze
 
-        def_node_matcher :gem_declaration?, '(send nil? :gem str ...)'
-
         def on_send(node)
           return unless gem_declaration?(node)
           return if ignored_gem?(node)
@@ -101,8 +124,7 @@ module RuboCop
         end
 
         def preceding_comment?(node1, node2)
-          node1 && node2 && precede?(node2, node1) &&
-            comment_line?(node2.loc.expression.source)
+          node1 && node2 && precede?(node2, node1) && comment_line?(node2.source)
         end
 
         def ignored_gem?(node)
@@ -113,6 +135,8 @@ module RuboCop
         def checked_options_present?(node)
           (cop_config[CHECKED_OPTIONS_CONFIG].include?(VERSION_SPECIFIERS_OPTION) &&
             version_specified_gem?(node)) ||
+            (cop_config[CHECKED_OPTIONS_CONFIG].include?(RESTRICTIVE_VERSION_SPECIFIERS_OPTION) &&
+              restrictive_version_specified_gem?(node)) ||
             contains_checked_options?(node)
         end
 
@@ -123,14 +147,23 @@ module RuboCop
           node.arguments[1]&.str_type?
         end
 
+        # Version specifications that restrict all updates going forward. This excludes versions
+        # like ">= 1.0" or "!= 2.0.3".
+        def restrictive_version_specified_gem?(node)
+          return false unless version_specified_gem?(node)
+
+          node.arguments[1..]
+              .any? { |arg| arg&.str_type? && RESTRICTIVE_VERSION_PATTERN.match?(arg.value) }
+        end
+
         def contains_checked_options?(node)
           (Array(cop_config[CHECKED_OPTIONS_CONFIG]) & gem_options(node).map(&:to_s)).any?
         end
 
         def gem_options(node)
-          return [] unless node.arguments.last&.type == :hash
+          return [] unless node.last_argument&.hash_type?
 
-          node.arguments.last.keys.map(&:value)
+          node.last_argument.keys.map(&:value)
         end
       end
     end

data/lib/rubocop/cop/bundler/gem_filename.rb

@@ -0,0 +1,102 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Bundler
+      # Verifies that a project contains Gemfile or gems.rb file and correct
+      # associated lock file based on the configuration.
+      #
+      # @example EnforcedStyle: Gemfile (default)
+      #   # bad
+      #   Project contains gems.rb and gems.locked files
+      #
+      #   # bad
+      #   Project contains Gemfile and gems.locked file
+      #
+      #   # good
+      #   Project contains Gemfile and Gemfile.lock
+      #
+      # @example EnforcedStyle: gems.rb
+      #   # bad
+      #   Project contains Gemfile and Gemfile.lock files
+      #
+      #   # bad
+      #   Project contains gems.rb and Gemfile.lock file
+      #
+      #   # good
+      #   Project contains gems.rb and gems.locked files
+      class GemFilename < Base
+        include ConfigurableEnforcedStyle
+
+        MSG_GEMFILE_REQUIRED = '`gems.rb` file was found but `Gemfile` is required ' \
+                               '(file path: %<file_path>s).'
+        MSG_GEMS_RB_REQUIRED = '`Gemfile` was found but `gems.rb` file is required ' \
+                               '(file path: %<file_path>s).'
+        MSG_GEMFILE_MISMATCHED = 'Expected a `Gemfile.lock` with `Gemfile` but found ' \
+                                 '`gems.locked` file (file path: %<file_path>s).'
+        MSG_GEMS_RB_MISMATCHED = 'Expected a `gems.locked` file with `gems.rb` but found ' \
+                                 '`Gemfile.lock` (file path: %<file_path>s).'
+        GEMFILE_FILES = %w[Gemfile Gemfile.lock].freeze
+        GEMS_RB_FILES = %w[gems.rb gems.locked].freeze
+
+        def on_new_investigation
+          file_path = processed_source.file_path
+          basename = File.basename(file_path)
+          return if expected_gemfile?(basename)
+
+          register_offense(file_path, basename)
+        end
+
+        private
+
+        def register_offense(file_path, basename)
+          register_gemfile_offense(file_path, basename) if gemfile_offense?(basename)
+          register_gems_rb_offense(file_path, basename) if gems_rb_offense?(basename)
+        end
+
+        def register_gemfile_offense(file_path, basename)
+          message = case basename
+                    when 'gems.rb'
+                      MSG_GEMFILE_REQUIRED
+                    when 'gems.locked'
+                      MSG_GEMFILE_MISMATCHED
+                    end
+
+          add_global_offense(format(message, file_path: file_path))
+        end
+
+        def register_gems_rb_offense(file_path, basename)
+          message = case basename
+                    when 'Gemfile'
+                      MSG_GEMS_RB_REQUIRED
+                    when 'Gemfile.lock'
+                      MSG_GEMS_RB_MISMATCHED
+                    end
+
+          add_global_offense(format(message, file_path: file_path))
+        end
+
+        def gemfile_offense?(basename)
+          gemfile_required? && GEMS_RB_FILES.include?(basename)
+        end
+
+        def gems_rb_offense?(basename)
+          gems_rb_required? && GEMFILE_FILES.include?(basename)
+        end
+
+        def expected_gemfile?(basename)
+          (gemfile_required? && GEMFILE_FILES.include?(basename)) ||
+            (gems_rb_required? && GEMS_RB_FILES.include?(basename))
+        end
+
+        def gemfile_required?
+          style == :Gemfile
+        end
+
+        def gems_rb_required?
+          style == :'gems.rb'
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/bundler/gem_version.rb

@@ -0,0 +1,132 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Bundler
+      # Enforce that Gem version specifications or a commit reference (branch,
+      # ref, or tag) are either required or forbidden.
+      #
+      # @example EnforcedStyle: required (default)
+      #  # bad
+      #  gem 'rubocop'
+      #
+      #  # good
+      #  gem 'rubocop', '~> 1.12'
+      #
+      #  # good
+      #  gem 'rubocop', '>= 1.10.0'
+      #
+      #  # good
+      #  gem 'rubocop', '>= 1.5.0', '< 1.10.0'
+      #
+      #  # good
+      #  gem 'rubocop', branch: 'feature-branch'
+      #
+      #  # good
+      #  gem 'rubocop', ref: '74b5bfbb2c4b6fd6cdbbc7254bd7084b36e0c85b'
+      #
+      #  # good
+      #  gem 'rubocop', tag: 'v1.17.0'
+      #
+      # @example EnforcedStyle: forbidden
+      #  # good
+      #  gem 'rubocop'
+      #
+      #  # bad
+      #  gem 'rubocop', '~> 1.12'
+      #
+      #  # bad
+      #  gem 'rubocop', '>= 1.10.0'
+      #
+      #  # bad
+      #  gem 'rubocop', '>= 1.5.0', '< 1.10.0'
+      #
+      #  # bad
+      #  gem 'rubocop', branch: 'feature-branch'
+      #
+      #  # bad
+      #  gem 'rubocop', ref: '74b5bfbb2c4b6fd6cdbbc7254bd7084b36e0c85b'
+      #
+      #  # bad
+      #  gem 'rubocop', tag: 'v1.17.0'
+      #
+      class GemVersion < Base
+        include ConfigurableEnforcedStyle
+        include GemDeclaration
+
+        REQUIRED_MSG = 'Gem version specification is required.'
+        FORBIDDEN_MSG = 'Gem version specification is forbidden.'
+        RESTRICT_ON_SEND = %i[gem].freeze
+        VERSION_SPECIFICATION_REGEX = /^\s*[~<>=]*\s*[0-9.]+/.freeze
+
+        # @!method includes_version_specification?(node)
+        def_node_matcher :includes_version_specification?, <<~PATTERN
+          (send nil? :gem <(str #version_specification?) ...>)
+        PATTERN
+
+        # @!method includes_commit_reference?(node)
+        def_node_matcher :includes_commit_reference?, <<~PATTERN
+          (send nil? :gem <(hash <(pair (sym {:branch :ref :tag}) (str _)) ...>) ...>)
+        PATTERN
+
+        def on_send(node)
+          return unless gem_declaration?(node)
+          return if allowed_gem?(node)
+
+          if offense?(node)
+            add_offense(node)
+            opposite_style_detected
+          else
+            correct_style_detected
+          end
+        end
+
+        private
+
+        def allowed_gem?(node)
+          allowed_gems.include?(node.first_argument.value)
+        end
+
+        def allowed_gems
+          Array(cop_config['AllowedGems'])
+        end
+
+        def message(_range)
+          if required_style?
+            REQUIRED_MSG
+          elsif forbidden_style?
+            FORBIDDEN_MSG
+          end
+        end
+
+        def offense?(node)
+          required_offense?(node) || forbidden_offense?(node)
+        end
+
+        def required_offense?(node)
+          return false unless required_style?
+
+          !includes_version_specification?(node) && !includes_commit_reference?(node)
+        end
+
+        def forbidden_offense?(node)
+          return false unless forbidden_style?
+
+          includes_version_specification?(node) || includes_commit_reference?(node)
+        end
+
+        def forbidden_style?
+          style == :forbidden
+        end
+
+        def required_style?
+          style == :required
+        end
+
+        def version_specification?(expression)
+          expression.match?(VERSION_SPECIFICATION_REGEX)
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/bundler/insecure_protocol_source.rb

@@ -3,18 +3,21 @@
 module RuboCop
   module Cop
     module Bundler
-      # The symbol argument `:gemcutter`, `:rubygems`, and `:rubyforge`
-      # are deprecated. So please change your source to URL string that
-      # 'https://rubygems.org' if possible, or 'http://rubygems.org' if not.
+      # Passing symbol arguments to `source` (e.g. `source :rubygems`) is
+      # deprecated because they default to using HTTP requests. Instead, specify
+      # `'https://rubygems.org'` if possible, or `'http://rubygems.org'` if not.
       #
-      # This autocorrect will replace these symbols with 'https://rubygems.org'.
-      # Because it is secure, HTTPS request is strongly recommended. And in
-      # most use cases HTTPS will be fine.
+      # When autocorrecting, this cop will replace symbol arguments with
+      # `'https://rubygems.org'`.
       #
-      # However, it don't replace all `sources` of `http://` with `https://`.
-      # For example, when specifying an internal gem server using HTTP on the
-      # intranet, a use case where HTTPS cannot be specified was considered.
-      # Consider using HTTP only if you cannot use HTTPS.
+      # This cop will not replace existing sources that use `http://`. This may
+      # be necessary where HTTPS is not available. For example, where using an
+      # internal gem server via an intranet, or where HTTPS is prohibited.
+      # However, you should strongly prefer `https://` where possible, as it is
+      # more secure.
+      #
+      # If you don't allow `http://`, please set `false` to `AllowHttpProtocol`.
+      # This option is `true` by default for safe autocorrection.
       #
       # @example
       #   # bad
@@ -24,37 +27,58 @@ module RuboCop
       #
       #   # good
       #   source 'https://rubygems.org' # strongly recommended
+      #
+      # @example AllowHttpProtocol: true (default)
+      #
+      #   # good
+      #   source 'http://rubygems.org' # use only if HTTPS is unavailable
+      #
+      # @example AllowHttpProtocol: false
+      #
+      #   # bad
       #   source 'http://rubygems.org'
+      #
       class InsecureProtocolSource < Base
-        include RangeHelp
         extend AutoCorrector
 
         MSG = 'The source `:%<source>s` is deprecated because HTTP requests ' \
               'are insecure. ' \
               "Please change your source to 'https://rubygems.org' " \
               "if possible, or 'http://rubygems.org' if not."
+        MSG_HTTP_PROTOCOL = 'Use `https://rubygems.org` instead of `http://rubygems.org`.'
 
         RESTRICT_ON_SEND = %i[source].freeze
 
+        # @!method insecure_protocol_source?(node)
         def_node_matcher :insecure_protocol_source?, <<~PATTERN
           (send nil? :source
-            $(sym ${:gemcutter :rubygems :rubyforge}))
+            ${(sym :gemcutter) (sym :rubygems) (sym :rubyforge) (:str "http://rubygems.org")})
         PATTERN
 
         def on_send(node)
-          insecure_protocol_source?(node) do |source_node, source|
-            message = format(MSG, source: source)
-
-            add_offense(
-              source_node,
-              message: message
-            ) do |corrector|
-              corrector.replace(
-                source_node, "'https://rubygems.org'"
-              )
+          insecure_protocol_source?(node) do |source_node|
+            source = source_node.value
+            use_http_protocol = source == 'http://rubygems.org'
+
+            return if allow_http_protocol? && use_http_protocol
+
+            message = if use_http_protocol
+                        MSG_HTTP_PROTOCOL
+                      else
+                        format(MSG, source: source)
+                      end
+
+            add_offense(source_node, message: message) do |corrector|
+              corrector.replace(source_node, "'https://rubygems.org'")
             end
           end
         end
+
+        private
+
+        def allow_http_protocol?
+          cop_config.fetch('AllowHttpProtocol', true)
+        end
       end
     end
   end

data/lib/rubocop/cop/bundler/ordered_gems.rb

@@ -19,43 +19,39 @@ module RuboCop
       #
       #   gem 'rspec'
       #
-      #   # good only if TreatCommentsAsGroupSeparators is true
+      # @example TreatCommentsAsGroupSeparators: true (default)
+      #   # good
       #   # For code quality
       #   gem 'rubocop'
       #   # For tests
       #   gem 'rspec'
-      class OrderedGems < Cop
-        include ConfigurableEnforcedStyle
+      #
+      # @example TreatCommentsAsGroupSeparators: false
+      #   # bad
+      #   # For code quality
+      #   gem 'rubocop'
+      #   # For tests
+      #   gem 'rspec'
+      class OrderedGems < Base
+        extend AutoCorrector
         include OrderedGemNode
 
-        MSG = 'Gems should be sorted in an alphabetical order within their '\
-              'section of the Gemfile. '\
+        MSG = 'Gems should be sorted in an alphabetical order within their ' \
+              'section of the Gemfile. ' \
               'Gem `%<previous>s` should appear before `%<current>s`.'
 
-        def investigate(processed_source)
+        def on_new_investigation
           return if processed_source.blank?
 
           gem_declarations(processed_source.ast)
             .each_cons(2) do |previous, current|
-            next unless consecutive_lines(previous, current)
-            next unless case_insensitive_out_of_order?(
-              gem_name(current),
-              gem_name(previous)
-            )
+            next unless consecutive_lines?(previous, current)
+            next unless case_insensitive_out_of_order?(gem_name(current), gem_name(previous))
 
             register_offense(previous, current)
           end
         end
 
-        def autocorrect(node)
-          OrderedGemCorrector.correct(
-            processed_source,
-            node,
-            previous_declaration(node),
-            treat_comments_as_separators
-          )
-        end
-
         private
 
         def previous_declaration(node)
@@ -64,6 +60,7 @@ module RuboCop
           declarations.to_a[node_index - 1]
         end
 
+        # @!method gem_declarations(node)
         def_node_search :gem_declarations, <<~PATTERN
           (:send nil? :gem str ...)
         PATTERN