@critiq/rules 0.3.0 → 0.4.0

package/rules/ruby/ruby.bug-risk.symbol-boolean-name.rule.yaml

@@ -0,0 +1,44 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.symbol-boolean-name
+  title: Avoid :true and :false symbols
+  summary: >-
+    `:true` and `:false` symbols are usually typos for boolean literals.
+  rationale: >-
+    Using `:true` or `:false` where a boolean is intended suggests a mistake
+    that can lead to unexpected behavior in conditionals.
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.symbol-boolean-name
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.95
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: "`${captures.issue.text}` matches `ruby.bug-risk.symbol-boolean-name`."
+  remediation:
+    summary: >-
+      Replace `:true` with `true` and `:false` with `false` if a boolean literal
+      was intended.

package/rules/ruby/ruby.bug-risk.table-without-timestamps.rule.yaml

@@ -0,0 +1,53 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.table-without-timestamps
+  title: Tables should be created with timestamps
+  summary: >-
+    Add `t.timestamps` to `create_table` blocks to include `created_at` and
+    `updated_at` columns.
+  rationale: >-
+    Rails conventions expect all tables to include `created_at` and
+    `updated_at` timestamp columns. Skipping timestamps can break conventions
+    and make auditing record changes more difficult.
+  aliases:
+    - RB-RL1013
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+    - migration
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.table-without-timestamps
+    bind: issue
+emit:
+  finding:
+    category: correctness.convention
+    severity: medium
+    confidence: 0.9
+    tags:
+      - ruby
+      - rails
+      - migration
+  message:
+    title: "`${captures.issue.text}` is missing timestamps"
+    summary: >-
+      "`${captures.issue.text}` does not include `t.timestamps`. Add timestamp
+      columns to follow Rails conventions."
+  remediation:
+    summary: >-
+      Add `t.timestamps` inside the `create_table` block.

package/rules/ruby/ruby.bug-risk.time-without-zone.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.time-without-zone
+  title: Time should be used with zone in Rails apps
+  summary: >-
+    `Time.now`, `Time.parse`, `Time.current`, `Time.at`, or `Time.new` is used
+    without a zone wrapper. Use `Time.zone.now` to respect the configured time zone.
+  rationale: >-
+    In Rails applications, using `Time.now` returns the system time in the
+    server's local time zone, which may differ from the application's configured
+    time zone. This can lead to inconsistent time handling. Always use
+    `Time.zone.now`, `Time.zone.parse`, or similar zone-aware alternatives.
+  aliases:
+    - RB-RL1054
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.time-without-zone
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.9
+    tags:
+      - ruby
+  message:
+    title: "Use `Time.zone` instead of bare `Time`"
+    summary: "'${captures.issue.text}' uses bare `Time` without zone. Use `Time.zone.now` or similar zone-aware alternatives."
+  remediation:
+    summary: >-
+      Replace `Time.now` with `Time.zone.now`, `Time.parse(...)` with
+      `Time.zone.parse(...)`, and similar patterns to respect the application's
+      configured time zone.

package/rules/ruby/ruby.bug-risk.to-json-without-argument.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.to-json-without-argument
+  title: '#to_json requires an optional argument'
+  summary: >-
+    Calling `to_json` with no arguments was deprecated in older Ruby JSON
+    versions. The method now requires an argument (or uses the JSON
+    generator state from the wrapper).
+  rationale: >-
+    In Ruby's JSON library, `to_json` without an argument may produce
+    unexpected results or compatibility issues across Ruby versions. Pass
+    the generator state explicitly or use `JSON.generate`.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1069
+  tags:
+    - rules-catalog
+    - ruby
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.to-json-without-argument
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: medium
+    confidence: 0.8
+    tags:
+      - ruby
+  message:
+    title: Pass an argument to `to_json`
+    summary: >-
+      "`#{captures.issue.text}` calls `to_json` without the required
+      argument."
+  remediation:
+    summary: >-
+      Pass the options or generator state argument to `to_json`, or use
+      `JSON.generate(value)` instead.

package/rules/ruby/ruby.bug-risk.trailing-comma-attribute.rule.yaml

@@ -0,0 +1,50 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.trailing-comma-attribute
+  title: Trailing comma in attribute declaration detected
+  summary: >-
+    An `attr_reader`, `attr_writer`, or `attr_accessor` declaration has a
+    trailing comma after the last symbol. This does not cause a syntax error
+    but may indicate an incomplete declaration.
+  rationale: >-
+    A trailing comma in attribute declarations suggests the developer
+    intended to add more attributes but stopped prematurely or forgot to
+    complete the list.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1099
+  tags:
+    - rules-catalog
+    - ruby
+  stability: experimental
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.trailing-comma-attribute
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.90
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.trailing-comma-attribute`."
+  remediation:
+    summary: >-
+      Remove the trailing comma or add the intended attributes after it.

package/rules/ruby/ruby.bug-risk.undefined-action-filter.rule.yaml

@@ -0,0 +1,53 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.undefined-action-filter
+  title: Action filter is not defined in the scope it is used in
+  summary: >-
+    A `before_action` references a method that is not defined in the
+    current controller scope.
+  rationale: >-
+    When `before_action` refers to a method name that has no matching
+    `def` in the controller, a `NameError` will occur at runtime if the
+    method is not inherited. This check finds typos or missing method
+    definitions in the current file.
+  aliases:
+    - RB-RL1032
+  detection:
+    kind: pattern
+  tags:
+    - rules-catalog
+    - ruby
+    - rails
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.undefined-action-filter
+    bind: issue
+emit:
+  finding:
+    category: correctness.bug
+    severity: high
+    confidence: 0.7
+    tags:
+      - ruby
+      - rails
+  message:
+    title: "`${captures.issue.text}` has no matching method"
+    summary: >-
+      "`${captures.issue.text}` references an action filter method that is
+      not defined in this file. Verify the method exists or check for typos."
+  remediation:
+    summary: >-
+      Define the missing method or correct the `before_action` reference
+      to match an existing method name.

package/rules/ruby/ruby.bug-risk.unintended-string-concatenation.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.unintended-string-concatenation
+  title: Possible unintended string concatenation
+  summary: >-
+    Adjacent string literals without a comma or operator between them are
+    concatenated, which is likely a missing comma in an array or method
+    argument.
+  rationale: >-
+    Ruby concatenates adjacent string literals at parse time. When used in an
+    array literal or method argument list, the coder likely intended a comma
+    separator.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1027
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.unintended-string-concatenation
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.9
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.unintended-string-concatenation`."
+  remediation:
+    summary: >-
+      If this is intended concatenation, use an explicit `+` operator. If
+      elements in an array or arguments, insert the missing comma.

package/rules/ruby/ruby.bug-risk.unnecessary-require.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.unnecessary-require
+  title: Unnecessary require statement
+  summary: >-
+    A `require` or `require_relative` statement that duplicates an earlier one
+    is unnecessary. Requiring `rubygems` is also unnecessary in modern Ruby.
+  rationale: >-
+    Duplicate `require` statements waste load time and may indicate confused
+    dependencies. Requiring `rubygems` is redundant since Ruby 1.9+ as it is
+    auto-loaded.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1049
+    - RB-LI1096
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.unnecessary-require
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.90
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.unnecessary-require`."
+  remediation:
+    summary: >-
+      Remove the duplicate `require` statement. For `require 'rubygems'`, this
+      is auto-loaded in Ruby 1.9+.

package/rules/ruby/ruby.bug-risk.unnecessary-splat.rule.yaml

@@ -0,0 +1,50 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.unnecessary-splat
+  title: Unnecessary splat expression
+  summary: >-
+    Using the splat operator `*` on an array inside `[...]` or in a method
+    argument is redundant when the array could be used directly.
+  rationale: >-
+    `[*array]` creates a shallow copy of the array. `array` is equivalent and
+    clearer. `foo(*[a, b])` can be written as `foo(a, b)`. Redundant splats
+    add cognitive overhead without benefit.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1050
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.unnecessary-splat
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.85
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.unnecessary-splat`."
+  remediation:
+    summary: >-
+      Replace `[*array]` with `array` (or `array.dup` if you need a copy).
+      Replace `foo(*[a, b])` with `foo(a, b)`.

package/rules/ruby/ruby.bug-risk.unqualified-constant.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.unqualified-constant
+  title: Use qualified constant reference in module context
+  summary: >-
+    A bare constant reference is used where a qualified constant (prefixed with
+    the module namespace) may be expected. This may reference an unexpected
+    constant.
+  rationale: >-
+    Using bare constants in a module context can unintentionally reference
+    constants from the enclosing scope rather than the intended fully-qualified
+    constant. This is a common source of subtle bugs.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1085
+  tags:
+    - rules-catalog
+    - ruby
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.unqualified-constant
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.5
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.unqualified-constant`."
+  remediation:
+    summary: >-
+      Prefix the constant with the module namespace to ensure the correct
+      constant is resolved.

package/rules/ruby/ruby.bug-risk.unreachable-code.rule.yaml

@@ -0,0 +1,49 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.unreachable-code
+  title: Unreachable code detected
+  summary: >-
+    Code following `return`, `raise`, `exit`, `abort`, `throw`, or `fail`
+    at the same indentation level will never execute.
+  rationale: >-
+    Statements after a control-flow-terminating keyword are unreachable.
+    They likely indicate dead code or a missing conditional guard.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1072
+  tags:
+    - rules-catalog
+    - ruby
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.unreachable-code
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.7
+    tags:
+      - ruby
+  message:
+    title: Review unreachable code after `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` follows a `return`, `raise`, or similar
+      keyword and will never execute."
+  remediation:
+    summary: >-
+      Remove the unreachable code or restructure with a conditional
+      guard.

package/rules/ruby/ruby.bug-risk.unreachable-loop.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.unreachable-loop
+  title: Avoid unconditional exit as first statement in loop
+  summary: >-
+    A loop body starts with an unconditional return, break, or raise. This
+    causes the loop to execute at most once and the remaining loop body is
+    unreachable.
+  rationale: >-
+    An unconditional exit statement (return, break, raise, throw, exit, abort,
+    or fail) as the first statement in a loop body means the loop will never
+    iterate more than once, making the loop structure misleading.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1090
+  tags:
+    - rules-catalog
+    - ruby
+  stability: experimental
+  appliesTo: function
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.unreachable-loop
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.7
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.unreachable-loop`."
+  remediation:
+    summary: >-
+      Move the exit statement to after the loop body, or add a condition to
+      make it conditional.

package/rules/ruby/ruby.bug-risk.unsafe-number-conversion.rule.yaml

@@ -0,0 +1,51 @@
+apiVersion: critiq.dev/v1alpha1
+kind: Rule
+metadata:
+  id: ruby.bug-risk.unsafe-number-conversion
+  title: Unsafe number conversion
+  summary: >-
+    `Integer()`, `Float()`, `Rational()`, and `Complex()` can raise
+    `ArgumentError` on invalid input. Prefer safe alternatives or wrap in a
+    rescue block.
+  rationale: >-
+    Kernel conversion methods raise `ArgumentError` when the input is invalid.
+    Using `to_i` or `to_f` returns 0.0 for invalid input, and wrapping
+    `Integer(str)` in a rescue block provides explicit error handling.
+  detection:
+    kind: pattern
+  aliases:
+    - RB-LI1041
+  tags:
+    - rules-catalog
+    - ruby
+  stability: stable
+  appliesTo: block
+scope:
+  languages:
+    - ruby
+  paths:
+    include:
+      - "**/*.rb"
+    exclude:
+      - "**/vendor/**"
+      - "**/node_modules/**"
+match:
+  fact:
+    kind: ruby.bug-risk.unsafe-number-conversion
+    bind: issue
+emit:
+  finding:
+    category: correctness.language
+    severity: high
+    confidence: 0.85
+    tags:
+      - ruby
+  message:
+    title: Review `${captures.issue.text}`
+    summary: >-
+      "`${captures.issue.text}` matches
+      `ruby.bug-risk.unsafe-number-conversion`."
+  remediation:
+    summary: >-
+      Use `String#to_i` / `String#to_f` for lossy conversion, or wrap
+      `Integer(str)` in a `rescue ArgumentError` block for strict parsing.