@critiq/rules 0.2.0 → 0.4.0

package/rules/ruby/ruby.bug-risk.active-record-method-override.rule.yaml

@@ -0,0 +1,55 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.active-record-method-override
+  title: Override of built-in ActiveRecord methods
+  summary: >-
+    An ActiveRecord model overrides a built-in ActiveRecord method such as
+    `save`, `create`, `destroy`, or `update`. This can cause subtle bugs when
+    ActiveRecord lifecycle expects the original behavior.
+  rationale: >-
+    Overriding built-in AR methods like `save`, `destroy`, or `create` is risky
+    because callbacks, transactions, and other lifecycle guarantees depend on
+    the original implementation. Consider using `before_*` / `after_*` callbacks
+    instead.
+  aliases:
+    - RB-RL1003
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-record
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.active-record-method-override
+    bind: issue
+emit:
+  finding:
+    category: correctness.bug-risk
+    severity: medium
+    confidence: 0.65
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` overrides a built-in ActiveRecord method"
+    summary: >-
+      "`${captures.issue.text}` is a built-in ActiveRecord method. Overriding
+      it in a model subclass can cause unexpected behavior. Prefer callbacks."
+  remediation:
+    summary: >-
+      Replace method overrides with ActiveRecord callbacks (`before_save`,
+      `after_destroy`, etc.) wherever possible.

package/rules/ruby/ruby.bug-risk.active-support-alias.rule.yaml

@@ -0,0 +1,52 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.active-support-alias
+  title: Use of ActiveSupport alias instead of core Ruby method
+  summary: >-
+    An ActiveSupport alias method (`starts_with?`, `ends_with?`, `append`,
+    `prepend`) is used instead of the core Ruby equivalent.
+  rationale: >-
+    ActiveSupport provides aliases for Ruby core methods. Using the core
+    equivalents (`start_with?`, `end_with?`, `<<`, `unshift`) reduces
+    dependencies and improves portability.
+  aliases:
+    - RB-RL1004
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-support
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.active-support-alias
+    bind: issue
+emit:
+  finding:
+    category: correctness.deprecation
+    severity: medium
+    confidence: 0.8
+    tags:
+      - ruby
+  message:
+    title: "Prefer Ruby core method over ActiveSupport alias `${captures.issue.text}`"
+    summary: >-
+      "`${captures.issue.text}` is an ActiveSupport alias. Use the core Ruby
+      equivalent instead."
+  remediation:
+    summary: >-
+      Replace `starts_with?` with `start_with?`, `ends_with?` with `end_with?`,
+      `append` with `<<`, and `prepend` with `unshift`.

package/rules/ruby/ruby.bug-risk.all-each-to-find-each.rule.yaml

@@ -0,0 +1,55 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.all-each-to-find-each
+  title: Replace Model.all.each with find_each
+  summary: >-
+    `Model.all.each` loads all records into memory. Use `find_each` for
+    batch processing.
+  rationale: >-
+    `Model.all.each` loads the entire result set into memory at once, which
+    can exhaust memory for large tables. `find_each` uses
+    `find_in_batches` internally to load records in batches of 1000,
+    keeping memory usage constant regardless of table size.
+  aliases:
+    - RB-RL1024
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - active-record
+    - performance
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.all-each-to-find-each
+    bind: issue
+emit:
+  finding:
+    category: correctness.performance
+    severity: medium
+    confidence: 0.85
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "Use `find_each` instead of `${captures.issue.text}`"
+    summary: >-
+      "`${captures.issue.text}` loads all records into memory. Use
+      `find_each` for batch iteration."
+  remediation:
+    summary: >-
+      Replace `Model.all.each { |r| ... }` with
+      `Model.all.find_each { |r| ... }` to batch-process records.

package/rules/ruby/ruby.bug-risk.allow-blank-with-delegate.rule.yaml

@@ -0,0 +1,52 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.allow-blank-with-delegate
+  title: Avoid allow_blank with delegate
+  summary: >-
+    Use `allow_nil` instead of `allow_blank` in `delegate` declarations.
+  rationale: >-
+    `allow_blank: true` in a `delegate` call silently swallows blank
+    (including falsey) values from the delegated method, which can mask bugs.
+    Prefer `allow_nil: true` to only suppress nil values.
+  aliases:
+    - RB-RL1016
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.allow-blank-with-delegate
+    bind: issue
+emit:
+  finding:
+    category: correctness.bug-risk
+    severity: medium
+    confidence: 0.9
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` uses `allow_blank: true`"
+    summary: >-
+      "`${captures.issue.text}` delegates with `allow_blank: true`. This
+      masks blank values. Consider `allow_nil: true` instead, which only
+      suppresses nil values."
+  remediation:
+    summary: >-
+      Replace `allow_blank: true` with `allow_nil: true` in the delegate
+      declaration.

package/rules/ruby/ruby.bug-risk.alter-queries-combine.rule.yaml

@@ -0,0 +1,54 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.alter-queries-combine
+  title: Combine alter queries in migrations
+  summary: >-
+    Prefer `change_table` with multiple column changes over repeated
+    `change_column` calls.
+  rationale: >-
+    Combining column alterations in a single `change_table` block groups
+    related schema changes and reduces the number of database round-trips
+    during migration execution.
+  aliases:
+    - RB-RL1012
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - migration
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.alter-queries-combine
+    bind: issue
+emit:
+  finding:
+    category: performance.database
+    severity: low
+    confidence: 0.8
+    tags:
+      - ruby
+      - rails
+      - migration
+  message:
+    title: "`${captures.issue.text}` can be combined"
+    summary: >-
+      "`${captures.issue.text}` alters a column individually. Consider grouping
+      multiple column changes into a single `change_table` block."
+  remediation:
+    summary: >-
+      Replace multiple `change_column` calls with a `change_table` block that
+      contains all column changes.

package/rules/ruby/ruby.bug-risk.ambiguous-block-association.rule.yaml

@@ -0,0 +1,49 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.ambiguous-block-association
+  title: Ambiguous association of block with method
+  summary: >-
+    A block is attached to a method call that already has arguments, but the
+    intended receiver of the block is ambiguous. Add parentheses to clarify
+    whether the block belongs to the outer or inner method.
+  rationale: >-
+    Without parentheses, `foo bar { |x| x }` could mean `foo(bar) { |x| x }`
+    (block on outer method) or `foo(bar { |x| x })` (block on inner method).
+    Adding parentheses removes the ambiguity.
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.ambiguous-block-association
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.8
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.ambiguous-block-association`."
+  remediation:
+    summary: >-
+      Add parentheses to disambiguate the block binding, e.g.
+      `method(arg) { |x| x }` or `method(arg { |x| x })`.

package/rules/ruby/ruby.bug-risk.ambiguous-operator-argument.rule.yaml

@@ -0,0 +1,48 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.ambiguous-operator-argument
+  title: Ambiguous operators in first arg of method invocation
+  summary: >-
+    The first argument to a method call starts with a unary operator, which
+    can be ambiguous. For example, `foo +bar` could be parsed as `foo(+bar)`
+    or `foo() + bar` by readers.
+  rationale: >-
+    Unary operators in method arguments without parentheses create readability
+    ambiguity. Adding parentheses clarifies developer intent.
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.ambiguous-operator-argument
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.8
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.ambiguous-operator-argument`."
+  remediation:
+    summary: >-
+      Wrap the argument in parentheses to disambiguate, e.g.
+      `method(+arg)` instead of `method +arg`.

package/rules/ruby/ruby.bug-risk.ambiguous-regexp-literal.rule.yaml

@@ -0,0 +1,49 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.ambiguous-regexp-literal
+  title: Ambiguous regular expression literal in method invocation
+  summary: >-
+    A regex literal `/pattern/` is used as a method argument without
+    parentheses. This can be confused with the division operator by
+    readers.
+  rationale: >-
+    `foo /bar/` could be parsed as `foo(/bar/)` (regex argument) or
+    `foo() / bar /` (division). Adding parentheses removes the ambiguity
+    for human readers.
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.ambiguous-regexp-literal
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.75
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.ambiguous-regexp-literal`."
+  remediation:
+    summary: >-
+      Wrap the regex literal in parentheses to disambiguate, e.g.
+      `method(/pattern/)` instead of `method /pattern/`.

package/rules/ruby/ruby.bug-risk.argument-overwritten-before-use.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.argument-overwritten-before-use
+  title: Function argument overwritten before use
+  summary: >-
+    A method parameter is reassigned on the first line of the method body
+    before any read. This discards the caller's value and likely indicates
+    a bug or unintended shadowing.
+  rationale: >-
+    When a method parameter is immediately overwritten, the value passed by
+    the caller is silently discarded. This often happens when a default
+    value expression is intended but the assignment is unconditional.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1064
+  tags:
+    - rules-catalog
+    - ruby
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.argument-overwritten-before-use
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.7
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` assigns to a method parameter before the
+      parameter is read."
+  remediation:
+    summary: >-
+      Remove the assignment or change the parameter name. If you need a
+      default, use a default parameter value instead.

package/rules/ruby/ruby.bug-risk.assert-not-usage.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.assert-not-usage
+  title: Use assert_not instead of assert with negation
+  summary: >-
+    Replace `assert !` with `assert_not` for clearer test assertions.
+  rationale: >-
+    `assert_not` provides a clearer intent than `assert !` and produces better
+    failure messages when the assertion fails.
+  aliases:
+    - RB-RL1009
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - testing
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.assert-not-usage
+    bind: issue
+emit:
+  finding:
+    category: correctness.testing
+    severity: low
+    confidence: 0.95
+    tags:
+      - ruby
+      - rails
+      - testing
+  message:
+    title: "`${captures.issue.text}` uses `assert !`"
+    summary: >-
+      "`${captures.issue.text}` negates with `!` instead of using `assert_not`.
+      Prefer `assert_not` for clearer test intent."
+  remediation:
+    summary: >-
+      Replace `assert !condition` with `assert_not condition`.

package/rules/ruby/ruby.bug-risk.assignment-in-condition.rule.yaml

@@ -0,0 +1,42 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.assignment-in-condition
+  title: Avoid assignment inside conditionals
+  summary: >-
+    Extract assignments from if, unless, while, and until conditions.
+  rationale: >-
+    Assignment in conditions is easy to mistake for comparison.
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.assignment-in-condition
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: medium
+    confidence: 0.9
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: "`${captures.issue.text}` matches `ruby.bug-risk.assignment-in-condition`."
+  remediation:
+    summary: >-
+      Extract assignments from if, unless, while, and until conditions.

package/rules/ruby/ruby.bug-risk.bad-date-usage.rule.yaml

@@ -0,0 +1,55 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.bad-date-usage
+  title: Use zone-aware date methods instead of Date/DateTime
+  summary: >-
+    Prefer `Time.zone` or `Date.current` over `Date.today`, `Date.parse`,
+    `DateTime.now`, or `DateTime.current`.
+  rationale: >-
+    Rails provides time-zone-aware helpers through `Time.zone` and
+    `Date.current`. Using `Date.today` or `DateTime.now` bypasses the
+    configured time zone, leading to incorrect dates in multi-timezone
+    applications.
+  aliases:
+    - RB-RL1014
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.bad-date-usage
+    bind: issue
+emit:
+  finding:
+    category: correctness.bug-risk
+    severity: medium
+    confidence: 0.85
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` may bypass time zone configuration"
+    summary: >-
+      "`${captures.issue.text}` uses a date method that ignores the configured
+      Rails time zone. Use `Time.zone.today`, `Date.current`, or
+      `Time.zone.parse` instead."
+  remediation:
+    summary: >-
+      Replace `Date.today` with `Date.current`, `DateTime.now` with
+      `Time.zone.now`, and `Date.parse` with `Date.parse` or
+      `Time.zone.parse`.

package/rules/ruby/ruby.bug-risk.bad-magic-comment-order.rule.yaml

@@ -0,0 +1,50 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.bad-magic-comment-order
+  title: Bad ordering of magic comments
+  summary: >-
+    Magic comments like `# frozen_string_literal: true` must appear before any
+    code in the file. When placed after code, they are ignored.
+  rationale: >-
+    Ruby interprets magic comments (frozen_string_literal, encoding, etc.) only
+    when they appear before any non-comment code. Placing them after code
+    silently disables the intended behavior.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1042
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.bad-magic-comment-order
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.95
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.bad-magic-comment-order`."
+  remediation:
+    summary: >-
+      Move the magic comment to the first line of the file (or second, after a
+      shebang line).