@mmerterden/multi-agent-pipeline 13.1.0 → 13.2.0

package/pipeline/skills/shared/external/ios-coding-standard/references/lint-local.sh

@@ -0,0 +1,160 @@
+#!/usr/bin/env bash
+# Local-only lint runner for the iOS coding standard.
+#
+# Nothing is written inside the repository. The config, the resolved config, the baseline and
+# every report live under $WORK_ROOT, outside any git working tree. Adding SwiftLint to the
+# project (a committed .swiftlint.yml, a build phase, a CI job) is a separate decision and this
+# script deliberately does not take it.
+#
+#   ./lint-local.sh <module-path> [--write-baseline] [--strict] [--report json|xcode|emoji]
+#
+# First run for a module:
+#   ./lint-local.sh Domains/<Module> --write-baseline     # grandfather what exists today
+# Then:
+#   ./lint-local.sh Domains/<Module> --strict             # only new violations surface
+
+set -euo pipefail
+
+SKILL_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+WORK_ROOT="${IOS_STANDARD_WORK_ROOT:-$HOME/.claude/local/ios-coding-standard}"
+DRAFT_CONFIG="$SKILL_DIR/swiftlint.draft.yml"
+
+MODULE_PATH="${1:-}"
+shift || true
+
+STRICT=""
+WRITE_BASELINE=""
+REPORTER="xcode"
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --strict) STRICT="--strict" ;;
+    --write-baseline) WRITE_BASELINE="1" ;;
+    --report) shift; REPORTER="${1:-xcode}" ;;
+    *) echo "unknown option: $1" >&2; exit 2 ;;
+  esac
+  shift
+done
+
+if [ -z "$MODULE_PATH" ] || [ ! -d "$MODULE_PATH" ]; then
+  echo "usage: $(basename "$0") <module-path> [--write-baseline] [--strict] [--report <kind>]" >&2
+  exit 2
+fi
+
+if ! command -v swiftlint >/dev/null 2>&1; then
+  cat >&2 <<'EOF'
+swiftlint is not installed.
+
+Install it for your user only — this does not touch the project:
+
+    brew install swiftlint
+
+If Homebrew is unavailable, a pinned local copy also works:
+
+    mkdir -p ~/.local/bin && cd ~/.local/bin
+    curl -sL https://github.com/realm/SwiftLint/releases/latest/download/portable_swiftlint.zip -o sl.zip
+    unzip -o sl.zip && rm sl.zip && chmod +x swiftlint
+    # then add ~/.local/bin to PATH
+
+EOF
+  exit 127
+fi
+
+REPO_ROOT="$(cd "$MODULE_PATH" && git rev-parse --show-toplevel)"
+MODULE_ABS="$(cd "$MODULE_PATH" && pwd)"
+MODULE_NAME="$(basename "$MODULE_ABS")"
+MODULE_WORK="$WORK_ROOT/$MODULE_NAME"
+mkdir -p "$MODULE_WORK"
+
+case "$MODULE_WORK" in
+  "$REPO_ROOT"/*) echo "refusing to write inside the repository: $MODULE_WORK" >&2; exit 1 ;;
+esac
+
+# ── Placeholder resolution ────────────────────────────────────────────────
+# Per-module inventory, produced by the audit's Phase 2d. Optional: without it the
+# sensitive-data rules fall back to a conservative generic pattern.
+INVENTORY="$MODULE_WORK/inventory.env"
+if [ -f "$INVENTORY" ]; then
+  # shellcheck disable=SC1090
+  . "$INVENTORY"
+fi
+
+# SENSITIVE / TRANSIENT: alternations of the module's own symbol names.
+: "${SENSITIVE:=token|password|passcode|secret|credential|passport|nationalId|identityNumber|pnr|reservationCode|ticketNumber|membershipNumber|cardNumber|cvv|dateOfBirth}"
+: "${TRANSIENT:=oneTimeCode|otp|verificationCode|draft}"
+
+# SIBLINGS: every other module that lives beside this one — the MOD-01 import guard.
+if [ -z "${SIBLINGS:-}" ]; then
+  PARENT="$(dirname "$MODULE_ABS")"
+  SIBLINGS="$(find "$PARENT" -mindepth 1 -maxdepth 1 -type d ! -name "$MODULE_NAME" -exec basename {} \; \
+              | sort | paste -sd'|' -)"
+fi
+[ -n "$SIBLINGS" ] || SIBLINGS="__none__"
+
+# LOGIC: the paths where TEST-01/03/05 and CONC-04 apply.
+# Logic paths only. A Scene is NOT logic: `Task { await viewModel.action() }` in a button
+# closure is the idiomatic sync->async bridge, and flagging it buries the real finding.
+: "${LOGIC:=.*(ViewModel|UseCase|Repository|Mapper)[^/]*\\.swift}"
+
+RESOLVED="$MODULE_WORK/swiftlint.resolved.yml"
+# Substituted with python rather than sed: every replacement is a regex alternation full of
+# delimiter characters, and sed has no delimiter that is safe against all of them.
+SENSITIVE="$SENSITIVE" TRANSIENT="$TRANSIENT" SIBLINGS="$SIBLINGS" LOGIC="$LOGIC" \
+python3 -c '
+import os, sys
+src, dst = sys.argv[1], sys.argv[2]
+text = open(src).read()
+for key in ("SENSITIVE", "TRANSIENT", "SIBLINGS"):
+    # Wrapped in a non-capturing group: these values are alternations, and "|" binds looser than
+    # concatenation. Substituting them bare turns "prefix\bA|B|C" into "(prefix\bA) or (B) or (C)",
+    # which matches every line containing any bare term — the whole pattern silently collapses.
+    text = text.replace("((%s))" % key, "(?:%s)" % os.environ[key])
+text = text.replace("((LOGIC))", os.environ["LOGIC"])
+open(dst, "w").write(text)
+' "$DRAFT_CONFIG" "$RESOLVED"
+
+BASELINE="$MODULE_WORK/baseline.json"
+
+echo "module    : $MODULE_ABS"
+echo "config    : $RESOLVED"
+echo "workdir   : $MODULE_WORK   (outside the repo)"
+echo "siblings  : $SIBLINGS"
+[ -f "$INVENTORY" ] && echo "inventory : $INVENTORY" || echo "inventory : (none — using the generic fallback pattern)"
+echo
+
+cd "$MODULE_ABS"
+
+if [ -n "$WRITE_BASELINE" ]; then
+  echo "writing baseline -> $BASELINE"
+  BL_PATHS=()
+  for d in Sources Tests; do [ -d "$d" ] && BL_PATHS+=("$d"); done
+  [ ${#BL_PATHS[@]} -gt 0 ] || BL_PATHS=(.)
+  swiftlint lint --config "$RESOLVED" --write-baseline "$BASELINE" --quiet "${BL_PATHS[@]}" || true
+  echo
+  echo "baseline written. from now on run without --write-baseline; only new violations surface."
+  exit 0
+fi
+
+LINT_PATHS=()
+for d in Sources Tests; do [ -d "$d" ] && LINT_PATHS+=("$d"); done
+[ ${#LINT_PATHS[@]} -gt 0 ] || LINT_PATHS=(.)
+
+ARGS=(lint --config "$RESOLVED" --reporter "$REPORTER" --quiet)
+[ -f "$BASELINE" ] && ARGS+=(--baseline "$BASELINE")
+[ -n "$STRICT" ] && ARGS+=("$STRICT")
+
+set +e
+# stdout is the report, stderr is progress + config diagnostics — never merge them, or a
+# machine-readable reporter comes back with progress lines spliced into it.
+swiftlint "${ARGS[@]}" "${LINT_PATHS[@]}" 2>"$MODULE_WORK/last-run.err" | tee "$MODULE_WORK/last-run.txt"
+STATUS=${PIPESTATUS[0]}
+if [ -s "$MODULE_WORK/last-run.err" ]; then
+  echo
+  echo "swiftlint diagnostics -> $MODULE_WORK/last-run.err"
+  grep -E '^(warning|error):' "$MODULE_WORK/last-run.err" | sort -u | head
+fi
+set -e
+
+echo
+echo "report: $MODULE_WORK/last-run.txt"
+[ -f "$BASELINE" ] && echo "baseline in effect: $BASELINE  (delete it to see every existing violation)"
+exit $STATUS