sequra-style 1.19.0 → 1.20.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 47e2880848be7928ef68435e320055b4d2003f4b321d172094fa77f123f5139e
-  data.tar.gz: d8ef008a1b7ba0477c45a19d52eb965d86a994fe5c7c203c67ecc2941f2ac798
+  metadata.gz: 3770f72aeb14f7c4749dfc85af3445d35a43b3b753a9ae5e4730a5059346b7da
+  data.tar.gz: 58efdf1bb4c1170f0472027750e3ab14ca743a81bb4fa05bc18af3970f716c34
 SHA512:
-  metadata.gz: 19d7b3760cf692ed282a02b99416f5d3e6f9fc288a8f5ecf8086e40459215f8665c27fc90f336183e42dcc37823668364a9d8503fa8a462b3afc5ad0d68885cb
-  data.tar.gz: 17bd16a9f9499060f4ee8e986c0f7a12e32a5a1f5d28ba494b9b5ca2d6ac8e78dda03254ea83d75c8073bc7823c60a738f171dd492e76910269fd41f1f5574da
+  metadata.gz: 991d993cc329899e2c6f1e7729d33fe52faae04060f9e6e60439e55b4f84a9d2a2d5ee7528a939dfbe4353b3374c39d93485166a388d35a0f9132fe37c88040f
+  data.tar.gz: 431c3ea441b5700236cd35fc20a14fb271b79e7713576949a428bcda995dd22921a3d3678c7047e214191896d186339a583271ad2ca4289d79731a52c5871c3f

data/.github/dependabot.yml

@@ -0,0 +1,57 @@
+version: 2
+updates:
+  - package-ecosystem: "bundler"
+    directory: "/"
+    # This gem is the shared rubocop config, so its gemspec ranges decide what every
+    # seQura Ruby repo resolves. Dependabot refreshes Gemfile.lock and never rewrites
+    # them: a cop bump landing everywhere at once stays a human decision.
+    versioning-strategy: "lockfile-only"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Madrid"
+    open-pull-requests-limit: 5
+    # PR titles are linted for conventional commits, and "chore" keeps release-please
+    # from cutting a release for a lockfile change.
+    commit-message:
+      prefix: "chore(deps)"
+      prefix-development: "chore(deps-dev)"
+    labels: ["dependencies", "ruby"]
+    # Applies to version updates only: security fixes are never held back.
+    cooldown:
+      default-days: 7
+      semver-major-days: 30
+      semver-minor-days: 7
+      semver-patch-days: 3
+    groups:
+      bundler-minor-patch:
+        dependency-type: "production"
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+      # Development dependencies never reach consumers: green CI is enough to merge.
+      bundler-dev-minor-patch:
+        dependency-type: "development"
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
+    # Majors stay ungrouped so each keeps its own reviewable PR.
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "08:00"
+      timezone: "Europe/Madrid"
+    open-pull-requests-limit: 3
+    commit-message:
+      prefix: "chore(deps)"
+    labels: ["dependencies", "github-actions"]
+    # github-actions supports default-days only: the semver tiers are documented as
+    # unsupported for it, so they would be silently ignored here.
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions-minor-patch:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]

data/.github/workflows/pr_title_validation.yml

@@ -15,6 +15,6 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

data/.github/workflows/release.yml

@@ -3,18 +3,26 @@ on:
   push:
     branches:
       - 'master'
+# Least privilege for the release job: contents, issues and pull-requests are what
+# release-please needs to open, label and tag the release PR. The gem is pushed to
+# rubygems.org with its own token, so no packages scope is needed here.
+permissions:
+  contents: write
+  issues: write
+  pull-requests: write
 jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: GoogleCloudPlatform/release-please-action@v3
+      # Release type, gem name and version file moved to release-please-config.json:
+      # v4 removed those inputs in favour of the manifest configuration, and unknown
+      # `with:` keys only warn, so stale inputs would silently stop bumping version.rb.
+      - uses: googleapis/release-please-action@v5
         id: release
         with:
-          release-type: ruby
-          package-name: sequra-style
-          bump-minor-pre-major: true
-          version-file: 'lib/sequra/style/version.rb'
-      - uses: actions/checkout@v2
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+      - uses: actions/checkout@v7
         if: ${{ steps.release.outputs.release_created }}
       - uses: ruby/setup-ruby@v1
         with:

data/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.20.0"
+}

data/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## [1.20.0](https://github.com/sequra/sequra-style/compare/v1.19.0...v1.20.0) (2026-08-26)
+
+
+### Features
+
+* [COR-2792] add Sequra/NoHelpers cop ([#91](https://github.com/sequra/sequra-style/issues/91)) ([443db77](https://github.com/sequra/sequra-style/commit/443db77b813cee105abb3d9a4ea71d54c9c221e6))
+
 ## [1.19.0](https://github.com/sequra/sequra-style/compare/v1.18.0...v1.19.0) (2026-07-29)
 
 

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    sequra-style (1.19.0)
+    sequra-style (1.20.0)
       rubocop (~> 1.75)
       rubocop-performance (~> 1.25)
       rubocop-rails (~> 2.31)
@@ -10,7 +10,7 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (8.1.3)
+    activesupport (8.1.3.1)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -25,29 +25,30 @@ GEM
       uri (>= 0.13.1)
     ast (2.4.3)
     base64 (0.3.0)
-    bigdecimal (4.0.1)
-    concurrent-ruby (1.3.6)
+    bigdecimal (4.1.2)
+    concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
     diff-lcs (1.6.2)
     drb (2.2.3)
-    i18n (1.14.8)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
-    json (2.19.8)
-    language_server-protocol (3.17.0.5)
+    json (2.21.2)
+    language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     logger (1.7.0)
-    minitest (6.0.1)
+    minitest (6.0.6)
+      drb (~> 2.0)
       prism (~> 1.5)
-    parallel (1.27.0)
-    parser (3.3.10.1)
+    parallel (2.1.0)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
     prism (1.9.0)
     racc (1.8.1)
-    rack (3.2.6)
+    rack (3.2.7)
     rainbow (3.1.1)
     rake (13.0.6)
-    regexp_parser (2.11.3)
+    regexp_parser (2.12.0)
     rspec (3.13.2)
       rspec-core (~> 3.13.0)
       rspec-expectations (~> 3.13.0)
@@ -61,33 +62,34 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
     rspec-support (3.13.7)
-    rubocop (1.84.1)
+    rubocop (1.89.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
       rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.0)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
-    rubocop-performance (1.26.1)
+    rubocop-performance (1.27.0)
       lint_roller (~> 1.1)
-      rubocop (>= 1.75.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
       rubocop-ast (>= 1.47.1, < 2.0)
-    rubocop-rails (2.34.3)
+    rubocop-rails (2.37.0)
       activesupport (>= 4.2.0)
       lint_roller (~> 1.1)
       rack (>= 1.1)
-      rubocop (>= 1.75.0, < 2.0)
+      rubocop (>= 1.89.0, < 2.0)
       rubocop-ast (>= 1.44.0, < 2.0)
-    rubocop-rspec (3.9.0)
+    rubocop-rspec (3.10.2)
       lint_roller (~> 1.1)
-      rubocop (~> 1.81)
+      regexp_parser (>= 2.0)
+      rubocop (~> 1.86, >= 1.86.2)
     ruby-progressbar (1.13.0)
     securerandom (0.4.1)
     tzinfo (2.0.6)

data/default.yml

@@ -845,6 +845,17 @@ Sequra/AsyncJobPattern:
   Exclude:
     - "**/application_job.rb"
 
+# Forbid Rails helpers. Helpers are globally mixed into every view, so they have
+# no owner, no boundary and nothing to unit test; display logic belongs to
+# presenters, formatters and calculators. Path-based at any nesting depth, so pack
+# helper directories are covered too.
+# Ships disabled so consumer repos opt in once their own `app/helpers/` is empty
+# (paired with `.rubocop_todo.yml` to grandfather the stragglers).
+Sequra/NoHelpers:
+  Enabled: false
+  Include:
+    - "**/app/helpers/**/*.rb"
+
 # Forbid stubbing/spying on Sidekiq enqueue methods in specs. Stubs bypass
 # `Sidekiq.strict_args!` validation, which has caused silent production
 # failures (COR-1923). Use `have_enqueued_sidekiq_job` or

data/lib/rubocop/cop/sequra/no_helpers.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+module RuboCop
+  module Cop
+    module Sequra
+      # Flags any module or class defined under an `app/helpers/` directory.
+      #
+      # Rails helpers are globally mixed into every view, so they have no owner, no
+      # boundary and nothing to unit test. Display logic belongs to presenters (view
+      # context), formatters (pure data transformation) and calculators (derived values).
+      #
+      # The check is path-based, not name-based: a class named `RoutingHelper` outside
+      # `app/helpers/` is fine, and anything inside it is not. Any nesting depth is
+      # covered, so pack and nested-pack helper directories are caught too.
+      #
+      # @example
+      #   # bad - app/helpers/foo_helper.rb, packs/my_pack/app/helpers/foo_helper.rb
+      #   module FooHelper
+      #     def label(order) = order.reference
+      #   end
+      #
+      #   # good - app/presenters/foo_presenter.rb
+      #   class FooPresenter
+      #     def label = order.reference
+      #   end
+      class NoHelpers < Base
+        MSG = "Do not create helpers. Use presenters, formatters, or calculators instead."
+
+        HELPER_PATH = %r{(^|/)app/helpers/}
+
+        def on_module(node)
+          add_offense(declaration_range(node)) if helper_file?
+        end
+
+        def on_class(node)
+          add_offense(declaration_range(node)) if helper_file?
+        end
+
+        private
+
+        # Keeps the highlight on the declaration instead of the whole body, which editors
+        # would otherwise underline end to end.
+        def declaration_range(node)
+          node.loc.keyword.join(node.loc.name)
+        end
+
+        def helper_file?
+          processed_source.file_path.match?(HELPER_PATH)
+        end
+      end
+    end
+  end
+end

data/lib/sequra/style/version.rb

@@ -1,5 +1,5 @@
 module Sequra
   module Style
-    VERSION = "1.19.0"
+    VERSION = "1.20.0"
   end
 end

data/lib/sequra_style.rb

@@ -1,4 +1,5 @@
 require "rubocop"
 require_relative "rubocop/cop/sequra/async_job_pattern"
+require_relative "rubocop/cop/sequra/no_helpers"
 require_relative "rubocop/cop/sequra/no_sidekiq_perform_stubs"
 require_relative "rubocop/cop/sequra/prometheus_metric_labels"

data/release-please-config.json

@@ -0,0 +1,11 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "packages": {
+    ".": {
+      "release-type": "ruby",
+      "package-name": "sequra-style",
+      "include-component-in-tag": false,
+      "version-file": "lib/sequra/style/version.rb"
+    }
+  }
+}

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: sequra-style
 version: !ruby/object:Gem::Version
-  version: 1.19.0
+  version: 1.20.0
 platform: ruby
 authors:
 - Sequra engineering
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-30 00:00:00.000000000 Z
+date: 2026-08-26 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rubocop
@@ -123,9 +123,11 @@ extra_rdoc_files: []
 files:
 - ".github/CODEOWNERS"
 - ".github/PULL_REQUEST_TEMPLATE.md"
+- ".github/dependabot.yml"
 - ".github/workflows/pr_title_validation.yml"
 - ".github/workflows/release.yml"
 - ".gitignore"
+- ".release-please-manifest.json"
 - ".rubocop.yml"
 - CHANGELOG.md
 - Gemfile
@@ -141,11 +143,13 @@ files:
 - docs/decisions/index.md
 - docs/decisions/template.md
 - lib/rubocop/cop/sequra/async_job_pattern.rb
+- lib/rubocop/cop/sequra/no_helpers.rb
 - lib/rubocop/cop/sequra/no_sidekiq_perform_stubs.rb
 - lib/rubocop/cop/sequra/prometheus_metric_labels.rb
 - lib/sequra/style.rb
 - lib/sequra/style/version.rb
 - lib/sequra_style.rb
+- release-please-config.json
 - sequra-style.gemspec
 homepage: https://github.com/sequra/sequra-style
 licenses: