@intentius/chant-lexicon-terraform 0.57.0 → 0.58.0

package/src/lint/post-synth/tf024.test.ts

@@ -0,0 +1,42 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf024 } from "./tf024";
+import { parseTerraformRootDir } from "../../hcl/parse";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF024");
+
+async function ctxFor(fixture: string, root = "estate"): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(join(fixtures, fixture), root, undefined, { binary: "choudoufu" });
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF024: live root declares a backend or cloud block", () => {
+  test("flags a live root with a backend block", async () => {
+    const diags = tf024.check(await ctxFor("live-with-backend"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF024");
+    expect(diags[0].message).toContain("backend");
+    expect(diags[0].message).toContain("Both a backend and a live");
+  });
+
+  test("flags a live root with a cloud block", async () => {
+    const diags = tf024.check(await ctxFor("live-with-cloud"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain("cloud");
+  });
+
+  test("passes a live root with neither block", async () => {
+    const diags = tf024.check(await ctxFor("live-clean"));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not fire on a stock root with a backend block (that is TF001's territory)", async () => {
+    const entities = await parseTerraformRootDir(join(fixtures, "live-with-backend"), "estate", undefined, {
+      binary: "terraform", // no estate takes effect: this root stays state mode
+    });
+    const ctx = { outputs: new Map(), entities } as unknown as PostSynthContext;
+    expect(tf024.check(ctx)).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/tf024.ts

@@ -0,0 +1,70 @@
+/**
+ * TF024: a live root declares a `backend` or `cloud` block.
+ *
+ * choudoufu refuses this combination at `init`, before any command runs,
+ * naming both blocks that collide: "Both a backend and a live configuration
+ * are present" (a `backend` block) or "Both a cloud and a live configuration
+ * are present" (a `cloud` block). A live root keeps no state to store, since
+ * prior state is a projection rebuilt from the live system every run, so
+ * either block is a contradiction about where the truth lives, not a
+ * redundant setting.
+ *
+ * TF001 is the equivalent check for a stock root (no remote backend is
+ * configured); it explicitly does not fire on a live root, and this check is
+ * why: the two are mutually exclusive by construction; a root is flagged by
+ * at most one of them.
+ *
+ * Scope: root modules only (#2112). A child module's backend or cloud block
+ * is TF015's finding, whatever binary the root runs.
+ *
+ * One diagnostic per root, fired from the root's `terraform` block.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { TERRAFORM_TYPE, type BlockBody } from "../../hcl/parse";
+import { hasBlock } from "./tf001";
+import { isRootScoped } from "./scope";
+
+export const tf024: PostSynthCheck = {
+  id: "TF024",
+  description: "Live root declares a backend or cloud block, which choudoufu refuses",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== TERRAFORM_TYPE) continue;
+      if (!isResourceDeclarable(entity) || !isRootScoped(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown; mode?: unknown };
+      if (props.mode !== "live") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const hasBackend = hasBlock(body, "backend");
+      const hasCloud = hasBlock(body, "cloud");
+      if (!hasBackend && !hasCloud) continue;
+
+      flagged.add(root);
+      const blockKind = hasBackend ? "backend" : "cloud";
+      diagnostics.push({
+        checkId: "TF024",
+        severity: "error",
+        message:
+          `Root module "${root}" runs choudoufu with a declared estate and also declares a ` +
+          `${blockKind} block. choudoufu refuses this at init: "Both a ${blockKind} and a live ` +
+          `configuration are present." Remove the ${blockKind} block; a live root keeps no state to store.`,
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf025.test.ts

@@ -0,0 +1,46 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf025 } from "./tf025";
+import { parseTerraformRootDir, type TerraformRootModeOptions } from "../../hcl/parse";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF025");
+
+async function ctxFor(
+  fixture: string,
+  modeOptions: TerraformRootModeOptions = { binary: "choudoufu" },
+  root = "estate",
+): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(join(fixtures, fixture), root, undefined, modeOptions);
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF025: live root references a non-default terraform.workspace", () => {
+  test("flags a `${terraform.workspace}` reference in a live root's HCL", async () => {
+    const diags = tf025.check(await ctxFor("live-with-workspace-ref"));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF025");
+    expect(diags[0].message).toContain("terraform.workspace");
+  });
+
+  test("passes a live root with no reference and no configured workspace", async () => {
+    expect(tf025.check(await ctxFor("live-clean"))).toHaveLength(0);
+  });
+
+  test("flags a live root whose terraform.roots entry configures a non-default workspace", async () => {
+    const diags = tf025.check(await ctxFor("live-clean", { binary: "choudoufu", workspace: "prod" }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('workspace "prod"');
+  });
+
+  test("a workspace of \"default\" is not flagged", async () => {
+    const diags = tf025.check(await ctxFor("live-clean", { binary: "choudoufu", workspace: "default" }));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("does not fire on a stock root (no estate takes effect under a non-choudoufu binary)", async () => {
+    const diags = tf025.check(await ctxFor("live-with-workspace-ref", { binary: "terraform", workspace: "prod" }));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/tf025.ts

@@ -0,0 +1,101 @@
+/**
+ * TF025: a live root reads a non-default `terraform.workspace`, or configures
+ * one through `terraform.roots`.
+ *
+ * choudoufu refuses any workspace but `default` on a live root, and refuses
+ * `workspace new`/`workspace select` outright: only the default workspace
+ * exists there ("How you run it" in choudoufu's compatibility reference).
+ * Two independent ways a configuration ends up asking for one:
+ *
+ *   - `terraform.roots.<name>.workspace` in `chant.config.*` selects a
+ *     workspace via `TF_WORKSPACE` before any HCL is even read, chant's own
+ *     equivalent of `workspace select`, so it is flagged the same way.
+ *   - A `"${terraform.workspace}"` interpolation anywhere in a block's body
+ *     reads the (necessarily `"default"`) workspace name in configuration,
+ *     which is not itself refused by choudoufu but is dead code on a live
+ *     root and a sign the configuration was written for a workspace-per-
+ *     environment layout that live mode does not support.
+ *
+ * The first fires once per root (it names a root-level config field, not a
+ * particular block); the second fires once per block that contains the
+ * reference, since each is its own thing to fix.
+ *
+ * Scope: the config half is root-only, since it reads a root-level config
+ * field; the reference half reads any block of a live root, a descended child
+ * module's included, and names the call chain that reached it (#2112).
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { isRootScoped } from "./scope";
+
+/** Recursively search a parsed HCL body for a `terraform.workspace` reference, un-evaluated interpolations included. */
+function containsWorkspaceRef(value: unknown): boolean {
+  if (typeof value === "string") return /\bterraform\.workspace\b/.test(value);
+  if (Array.isArray(value)) return value.some(containsWorkspaceRef);
+  if (value !== null && typeof value === "object") return Object.values(value).some(containsWorkspaceRef);
+  return false;
+}
+
+export const tf025: PostSynthCheck = {
+  id: "TF025",
+  description: "Live root references a non-default terraform.workspace, which choudoufu refuses",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flaggedRootWorkspace = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as {
+        root?: unknown;
+        body?: unknown;
+        mode?: unknown;
+        workspace?: unknown;
+        address?: unknown;
+      };
+      if (props.mode !== "live") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+
+      if (
+        typeof props.workspace === "string" &&
+        props.workspace !== "" &&
+        props.workspace !== "default" &&
+        isRootScoped(entity) &&
+        !flaggedRootWorkspace.has(root)
+      ) {
+        flaggedRootWorkspace.add(root);
+        diagnostics.push({
+          checkId: "TF025",
+          severity: "error",
+          message:
+            `Root module "${root}" runs choudoufu with a declared estate and configures workspace ` +
+            `"${props.workspace}" in terraform.roots.${root}. choudoufu refuses any workspace but ` +
+            '"default" on a live root. Remove `workspace` from this root\'s config (or set it to "default").',
+          entity: name,
+          lexicon: "terraform",
+        });
+      }
+
+      if (containsWorkspaceRef(props.body)) {
+        const address = typeof props.address === "string" ? props.address : name;
+        diagnostics.push({
+          checkId: "TF025",
+          severity: "error",
+          message:
+            `"${address}" in root module "${root}" references \`terraform.workspace\`. choudoufu refuses ` +
+            'any workspace but "default" on a live root, so this always resolves to "default" there. ' +
+            "Remove the reference.",
+          entity: name,
+          lexicon: "terraform",
+        });
+      }
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/post-synth/tf026.test.ts

@@ -0,0 +1,56 @@
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { describe, expect, test } from "vitest";
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+import { tf026 } from "./tf026";
+import { parseTerraformRootDir } from "../../hcl/parse";
+import type { TerraformDeleteMode } from "../../config";
+
+const fixtures = join(dirname(fileURLToPath(import.meta.url)), "fixtures", "TF026");
+
+async function ctxFor(
+  fixture: string,
+  opts: { binary?: string; delete?: TerraformDeleteMode } = {},
+  root = "estate",
+): Promise<PostSynthContext> {
+  const entities = await parseTerraformRootDir(join(fixtures, fixture), root, undefined, {
+    binary: opts.binary ?? "choudoufu",
+    delete: opts.delete,
+  });
+  return { outputs: new Map(), entities } as unknown as PostSynthContext;
+}
+
+describe("TF026: delete: \"never\" onto the policy block", () => {
+  test('fires when the policy block is absent (undeclared_tagged defaults to "delete")', async () => {
+    const diags = tf026.check(await ctxFor("live-default", { delete: "never" }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].checkId).toBe("TF026");
+    expect(diags[0].message).toContain("unset");
+    expect(diags[0].message).toContain("undeclared_tagged");
+  });
+
+  test('fires when undeclared_tagged is explicitly "delete"', async () => {
+    const diags = tf026.check(await ctxFor("live-explicit-delete", { delete: "never" }));
+    expect(diags).toHaveLength(1);
+    expect(diags[0].message).toContain('undeclared_tagged = "delete"');
+  });
+
+  test('passes when undeclared_tagged is "keep"', async () => {
+    const diags = tf026.check(await ctxFor("live-keep", { delete: "never" }));
+    expect(diags).toHaveLength(0);
+  });
+
+  test("passes when delete is not \"never\" at all", async () => {
+    const diags = tf026.check(await ctxFor("live-default", { delete: "owned-only" }));
+    expect(diags).toHaveLength(0);
+    const diagsGated = tf026.check(await ctxFor("live-default", { delete: "gated" }));
+    expect(diagsGated).toHaveLength(0);
+    const diagsUnset = tf026.check(await ctxFor("live-default", {}));
+    expect(diagsUnset).toHaveLength(0);
+  });
+
+  test("does not fire on a stock root even with delete: \"never\" recorded (inert off choudoufu)", async () => {
+    const diags = tf026.check(await ctxFor("live-default", { binary: "terraform", delete: "never" }));
+    expect(diags).toHaveLength(0);
+  });
+});

package/src/lint/post-synth/tf026.ts

@@ -0,0 +1,80 @@
+/**
+ * TF026: a live root declares `delete: "never"` but its `policy` block still
+ * deletes an orphaned marked resource.
+ *
+ * chant's cross-lexicon delete-mode vocabulary (`terraform.roots.<name>.delete`,
+ * `../../config.ts`'s `TerraformDeleteMode`) maps onto choudoufu's `policy`
+ * block: `undeclared_tagged` governs what happens to a resource this estate
+ * marked that the configuration no longer declares, and defaults to
+ * `"delete"` when the `policy` block omits it, or the root declares no
+ * `policy` block at all. `delete: "never"` promises that `TerraformApplyOp`
+ * never proposes deleting a resource it owns, so a root making that promise
+ * has to have actually turned the quadrant's default off — `"keep"`,
+ * `"untag"` or `"report"` all satisfy it; anything else (the unset default,
+ * or an explicit `"delete"`) does not.
+ *
+ * One diagnostic per root, fired from the root's `Terraform::Live` entity —
+ * the same entity TF024 and TF025 fire from.
+ */
+
+import type {
+  PostSynthCheck,
+  PostSynthContext,
+  PostSynthDiagnostic,
+} from "@intentius/chant/lint/post-synth";
+import { isResourceDeclarable } from "@intentius/chant/declarable";
+import { LIVE_TYPE, type BlockBody } from "../../hcl/parse";
+
+/** Verbs that satisfy `delete: "never"` for the `undeclared_tagged` quadrant. */
+const SATISFIES_NEVER = new Set(["keep", "untag", "report"]);
+
+/** The `policy { }` block nested in a `live { }` block's body, hcl2json's own "one block, wrapped in an array" shape. */
+function policyBlockOf(liveBody: BlockBody): BlockBody | undefined {
+  const policy = liveBody["policy"];
+  return Array.isArray(policy) && policy.length > 0 && typeof policy[0] === "object" && policy[0] !== null
+    ? (policy[0] as BlockBody)
+    : undefined;
+}
+
+export const tf026: PostSynthCheck = {
+  id: "TF026",
+  description: "Live root declares delete: \"never\" but its policy leaves undeclared_tagged at \"delete\"",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const diagnostics: PostSynthDiagnostic[] = [];
+    const flagged = new Set<string>();
+
+    for (const [name, entity] of ctx.entities) {
+      if (entity.entityType !== LIVE_TYPE) continue;
+      if (!isResourceDeclarable(entity)) continue;
+      const props = entity.props as { root?: unknown; body?: unknown; mode?: unknown; delete?: unknown };
+      if (props.mode !== "live") continue;
+      if (props.delete !== "never") continue;
+      const root = typeof props.root === "string" ? props.root : "";
+      if (flagged.has(root)) continue;
+
+      const body = (typeof props.body === "object" && props.body !== null ? props.body : {}) as BlockBody;
+      const policy = policyBlockOf(body);
+      const undeclaredTagged = policy && typeof policy["undeclared_tagged"] === "string" ? (policy["undeclared_tagged"] as string) : undefined;
+      if (undeclaredTagged !== undefined && SATISFIES_NEVER.has(undeclaredTagged)) continue;
+
+      flagged.add(root);
+      const found =
+        undeclaredTagged === undefined
+          ? "leaves undeclared_tagged unset, which defaults to \"delete\""
+          : `sets undeclared_tagged = "${undeclaredTagged}"`;
+      diagnostics.push({
+        checkId: "TF026",
+        severity: "error",
+        message:
+          `Root module "${root}" declares delete: "never" (terraform.roots.${root}.delete), but its ` +
+          `policy block ${found}. Add undeclared_tagged = "keep" (or "untag" or "report") to the live ` +
+          "block's policy block, or change this root's delete mode.",
+        entity: name,
+        lexicon: "terraform",
+      });
+    }
+
+    return diagnostics;
+  },
+};

package/src/lint/presets.test.ts

@@ -0,0 +1,72 @@
+/**
+ * `terraformPlugin.lintPresets()` (chant #2113): `recommended`/`all`, and
+ * that `lint.presets` + core's `resolvePresetIds`/`applyConfiguredPreset`
+ * filter a terraform post-synth finding end to end: a report-only rule is
+ * not reported under `recommended` and is reported under `all`.
+ *
+ * The terraform lexicon ships no report-only post-synth check yet (TF001,
+ * TF024, TF025 are all merge-worthy. The report-only rules land in
+ * #2109/#2110/#2112, in parallel with this issue), so the "report-only rule
+ * excluded under recommended, included under all" half uses a synthetic
+ * diagnostic and a preset id set widened with a made-up id alongside the
+ * plugin's real `recommended` set, rather than inventing a permanent public
+ * TF id this issue doesn't own.
+ */
+import { describe, test, expect } from "vitest";
+import type { PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { resolvePresetIds, applyConfiguredPreset } from "@intentius/chant/lint/config";
+import { terraformPlugin } from "../plugin";
+
+describe("terraformPlugin.lintPresets()", () => {
+  const presets = terraformPlugin.lintPresets?.();
+
+  test("is defined and exports recommended + all", () => {
+    expect(presets).toBeDefined();
+    expect(presets?.recommended).toBeDefined();
+    expect(presets?.all).toBeDefined();
+  });
+
+  test("recommended is exactly the catalog's merge-worthy ids, and all is exactly every catalog id (derived, not hand-kept)", async () => {
+    const { terraformAuditCatalog } = await import("./audit-catalog");
+    const expectedRecommended = Object.values(terraformAuditCatalog)
+      .filter((m) => m.tier === "merge-worthy")
+      .map((m) => m.id)
+      .sort();
+    expect(presets?.recommended.slice().sort()).toEqual(expectedRecommended);
+    expect(presets?.all.slice().sort()).toEqual(Object.keys(terraformAuditCatalog).sort());
+  });
+
+  test("all is a superset of recommended", () => {
+    for (const id of presets?.recommended ?? []) {
+      expect(presets?.all).toContain(id);
+    }
+  });
+});
+
+describe("lint.presets end to end: a report-only rule is excluded under recommended, included under all (chant #2113)", () => {
+  const recommendedIds = terraformPlugin.lintPresets?.().recommended ?? [];
+  // Widened with a made-up report-only id, not a real TF id this issue owns,
+  // see this file's header comment.
+  const allIds = [...(terraformPlugin.lintPresets?.().all ?? []), "TFZZZ"];
+
+  function diags(): PostSynthDiagnostic[] {
+    return [
+      { checkId: "TF001", severity: "warning", message: "a real merge-worthy TF001 finding", lexicon: "terraform" },
+      { checkId: "TFZZZ", severity: "info", message: "a hypothetical report-only finding", lexicon: "terraform" },
+    ];
+  }
+
+  test("under `recommended`, the report-only finding is not reported (merge-worthy TF001 still is)", () => {
+    const presetIds = resolvePresetIds({ recommended: recommendedIds, all: allIds }, "recommended");
+    const result = applyConfiguredPreset(diags(), presetIds, undefined);
+    expect(result.diagnostics.map((d) => d.checkId)).toEqual(["TF001"]);
+    expect(result.suppressed.map((d) => d.checkId)).toEqual(["TFZZZ"]);
+  });
+
+  test("under `all`, the report-only finding IS reported", () => {
+    const presetIds = resolvePresetIds({ recommended: recommendedIds, all: allIds }, "all");
+    const result = applyConfiguredPreset(diags(), presetIds, undefined);
+    expect(result.diagnostics.map((d) => d.checkId).sort()).toEqual(["TF001", "TFZZZ"]);
+    expect(result.suppressed).toEqual([]);
+  });
+});

package/src/lint/rules/fixtures/TF101/negative-op.ts

@@ -0,0 +1,2 @@
+const plan = terraformPlan("app", { id: "plan" });
+const apply = terraformApply("app", { planFile: stepOutput(plan, "planFile") });

package/src/lint/rules/fixtures/TF101/positive-op.ts

@@ -0,0 +1,2 @@
+const plan = terraformPlan("app", { id: "plan" });
+const apply = terraformApply("app", { planFile: "/tmp/plan.out" });

package/src/lint/rules/fixtures/load.ts

@@ -0,0 +1,53 @@
+/**
+ * Shared lint-rule fixture loader, the `lint/rules/` sibling of
+ * `../../post-synth/fixtures/load.ts`.
+ *
+ * A post-synth check's fixtures are `.tf`, a real Terraform root. A lint
+ * rule's fixtures are Op-shaped source, the kind `chant lint` runs a rule's
+ * `check(context)` against directly. TF101's live under
+ * `fixtures/TF101/positive-op.ts` (triggers) and `negative-op.ts` (passes),
+ * deliberately unimported and unresolved at the identifier level: TF101
+ * itself matches purely on callee name (see `plan-before-apply.ts`'s doc
+ * comment), so a fixture that only needs to parse, not typecheck or run as a
+ * standalone program, stays honest about what the rule actually reads.
+ *
+ * On disk these are named `<name>-op.ts`, not `<name>.op.ts`: a real
+ * `*.op.ts` file is exactly what `packages/core/src/op/discover.ts`'s
+ * `discoverOps()` walks the whole repository (down from the git root, absent
+ * a `chant.config.*`) to find and `import()`, and it does that unconditionally
+ * in tests like `generate-pipeline.test.ts` that exercise real discovery. A
+ * fixture named `positive.op.ts` would be swept into that scan, imported,
+ * and fail at the top-level `const plan = terraformPlan(...)` reference,
+ * turning into a discovery error that breaks an unrelated, already-passing
+ * test. `loadRuleFixture` still hands the rule a logical `.op.ts` filename
+ * (below) so parsing and diagnostics see the file the way a real one would
+ * appear; only the on-disk name dodges the scan. Both physical files are
+ * also excluded from every tsconfig that would otherwise try to compile them
+ * as real source (root `tsconfig.json`, `tsconfig.typecheck.json`, and this
+ * lexicon's `tsconfig.build.json`).
+ */
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import * as ts from "typescript";
+import type { LintContext } from "@intentius/chant/lint/rule";
+
+const FIXTURES_DIR = dirname(fileURLToPath(import.meta.url));
+
+/**
+ * Parse `fixtures/<ruleId>/<name>-op.ts` into a {@link LintContext} whose
+ * `filePath` is the logical `<name>.op.ts` a real Op file would carry.
+ *
+ * Three lines per fixture in a test:
+ * ```ts
+ * const diags = planBeforeApplyRule.check(loadRuleFixture("TF101", "positive"));
+ * expect(diags).toHaveLength(1);
+ * ```
+ */
+export function loadRuleFixture(ruleId: string, name: string): LintContext {
+  const onDisk = `${name}-op.ts`;
+  const logical = `${name}.op.ts`;
+  const code = readFileSync(join(FIXTURES_DIR, ruleId, onDisk), "utf-8");
+  const sourceFile = ts.createSourceFile(logical, code, ts.ScriptTarget.Latest, true);
+  return { sourceFile, entities: [], filePath: logical };
+}