cuke-dedup 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -3,6 +3,45 @@
 All notable changes to CukeDedup are documented in this file. The project follows
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [Unreleased]
+
+## [0.3.0] - 2026-09-14
+
+### Added
+
+- `--baseline-from-ref` and the matching Action input compare against a fetched Git revision
+  with the current analysis policy, reusing `--fail-on-new` without a committed baseline file.
+  Incomplete historical scans are rejected rather than treated as clean baselines.
+
+## [0.2.1] - 2026-09-13
+
+### Changed
+
+- Release binaries abort on panic and ship without a symbol table, which reduces the published
+  archive for each platform by about 21 percent, from 2,499,615 to 1,972,110 bytes on
+  `aarch64-apple-darwin`, with no measured analysis slowdown. Only the binaries this project
+  distributes are affected; a crate depending on CukeDedup keeps its own release profile.
+- Handlers whose behavior is a parameterized inline invocation, such as
+  `((value) => check(value))(compute())`, are excluded from handler comparison. The arguments
+  are not substituted, so the body is never read and two such handlers are not claimed to be
+  equivalent. Version 0.2.0 reported a byte-identical pair of that shape as a duplicate; it is
+  no longer reported. Zero-parameter invocations are unaffected and still compare normally.
+
+### Fixed
+
+- Preserve callback call evidence in near-duplicate analysis without promoting deferred assertions
+  to executed behavior, preventing unrelated callback bodies from appearing identical.
+- Clarify that parameterization suggestions preserve expected assertion values and polarity.
+- Near-duplicate analysis now distinguishes assertions targeting different properties, expecting
+  different inline or immutable local values, or using opposite chains such as `expect(...).not`,
+  while retaining assertion-only duplicate candidates and avoiding misleading handler-overlap
+  warnings. Assertion provenance now also respects TypeScript runtime namespaces, erased
+  declarations, namespace bindings, and wrapped assertion expressions.
+- Changed-files mode no longer inherits the caller's Git environment. `GIT_DIR`, `GIT_WORK_TREE`,
+  `GIT_INDEX_FILE`, and related variables outrank the repository selected per invocation, so
+  running CukeDedup from another repository's Git hook resolved revisions, ignore rules, and the
+  changed set against the hook's repository instead of the analyzed root.
+
 ## [0.2.0] - 2026-09-10
 
 ### Changed
@@ -120,6 +159,8 @@ Initial public release.
 - Native Cargo and npm distributions for eight supported targets.
 - A checksum-verified GitHub Action and an agent-oriented CukeDedup skill.
 
+[0.3.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.2.1...v0.3.0
+[0.2.1]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.2.0...v0.2.1
 [0.2.0]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.1.1...v0.2.0
 [0.1.1]: https://github.com/figueiredoluiz/cuke-dedup/compare/v0.1.0...v0.1.1
 [0.1.0]: https://github.com/figueiredoluiz/cuke-dedup/releases/tag/v0.1.0

package/README.md

@@ -136,7 +136,7 @@ steps:
     with:
       fetch-depth: 0
       persist-credentials: false
-  - uses: figueiredoluiz/cuke-dedup@v0.2.0
+  - uses: figueiredoluiz/cuke-dedup@v0.3.0
     with:
       path: .
       threshold: 5

package/THIRD-PARTY-LICENSES.md

@@ -18,9 +18,11 @@ regenerated whenever `Cargo.lock` changes.
 | anstyle-query | 1.1.5 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-cli/anstyle.git |
 | anstyle-wincon | 3.0.11 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-cli/anstyle.git |
 | anyhow | 1.0.104 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/anyhow |
+| bitflags | 2.13.1 | MIT OR Apache-2.0 | The Rust Project Developers | https://github.com/bitflags/bitflags |
 | bstr | 1.13.1 | MIT OR Apache-2.0 | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/bstr |
 | bytecount | 0.6.9 | Apache-2.0/MIT | Andre Bogus <bogusandre@gmail.de>, Joshua Landau <joshua@landau.ws> | https://github.com/llogiq/bytecount |
 | cc | 1.4.4 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-lang/cc-rs |
+| cfg-if | 1.0.4 | MIT OR Apache-2.0 | Alex Crichton <alex@alexcrichton.com> | https://github.com/rust-lang/cfg-if |
 | clap | 4.6.6 | MIT OR Apache-2.0 | Not declared | https://github.com/clap-rs/clap |
 | clap_builder | 4.6.6 | MIT OR Apache-2.0 | Not declared | https://github.com/clap-rs/clap |
 | clap_derive | 4.6.4 | MIT OR Apache-2.0 | Not declared | https://github.com/clap-rs/clap |
@@ -35,7 +37,10 @@ regenerated whenever `Cargo.lock` changes.
 | derive_more-impl | 2.1.1 | MIT | Jelte Fennema <github-tech@jeltef.nl> | https://github.com/JelteF/derive_more |
 | either | 1.18.0 | MIT OR Apache-2.0 | Not declared | https://github.com/rayon-rs/either |
 | equivalent | 1.0.2 | Apache-2.0 OR MIT | Not declared | https://github.com/indexmap-rs/equivalent |
+| errno | 0.3.14 | MIT OR Apache-2.0 | Chris Wong <lambda.fairy@gmail.com>, Dan Gohman <dev@sunfishcode.online> | https://github.com/lambda-fairy/rust-errno |
+| fastrand | 2.5.0 | Apache-2.0 OR MIT | Stjepan Glavina <stjepang@gmail.com> | https://github.com/smol-rs/fastrand |
 | find-msvc-tools | 0.1.11 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-lang/cc-rs |
+| getrandom | 0.4.3 | MIT OR Apache-2.0 | The Rand Project Developers | https://github.com/rust-random/getrandom |
 | gherkin | 0.16.0 | MIT OR Apache-2.0 | Brendan Molloy <brendan@bbqsrc.net> | https://github.com/cucumber-rs/gherkin |
 | globset | 0.4.20 | Unlicense OR MIT | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/ripgrep/tree/master/crates/globset |
 | hashbrown | 0.17.1 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-lang/hashbrown |
@@ -44,21 +49,26 @@ regenerated whenever `Cargo.lock` changes.
 | indexmap | 2.14.1 | Apache-2.0 OR MIT | Not declared | https://github.com/indexmap-rs/indexmap |
 | is_terminal_polyfill | 1.70.2 | MIT OR Apache-2.0 | Not declared | https://github.com/polyfill-rs/is_terminal_polyfill |
 | itoa | 1.0.18 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/itoa |
+| libc | 0.2.189 | MIT OR Apache-2.0 | Not declared | https://github.com/rust-lang/libc |
 | libyaml-rs | 0.3.0 | MIT | David Tolnay <dtolnay@gmail.com>, YAML Organization <noreply@yaml.org> | https://github.com/yaml/libyaml-rs |
+| linux-raw-sys | 0.12.1 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | Dan Gohman <dev@sunfishcode.online> | https://github.com/sunfishcode/linux-raw-sys |
 | log | 0.4.34 | MIT OR Apache-2.0 | The Rust Project Developers | https://github.com/rust-lang/log |
 | memchr | 2.8.3 | Unlicense OR MIT | Andrew Gallant <jamslam@gmail.com>, bluss | https://github.com/BurntSushi/memchr |
 | nom | 8.0.0 | MIT | contact@geoffroycouprie.com | https://github.com/rust-bakery/nom |
 | nom_locate | 5.0.0 | MIT | Florent FAYOLLE <florent.fayolle69@gmail.com>, Christopher Durham <cad97@cad97.com>, Valentin Lorentz <progval+git@progval.net> | https://github.com/fflorent/nom_locate |
+| once_cell | 1.21.4 | MIT OR Apache-2.0 | Aleksey Kladov <aleksey.kladov@gmail.com> | https://github.com/matklad/once_cell |
 | once_cell_polyfill | 1.70.2 | MIT OR Apache-2.0 | Not declared | https://github.com/polyfill-rs/once_cell_polyfill |
 | peg | 0.6.3 | MIT | Kevin Mehall <km@kevinmehall.net> | https://github.com/kevinmehall/rust-peg |
 | peg-macros | 0.6.3 | MIT | Kevin Mehall <km@kevinmehall.net> | https://github.com/kevinmehall/rust-peg |
 | peg-runtime | 0.6.3 | MIT | Kevin Mehall <km@kevinmehall.net> | https://github.com/kevinmehall/rust-peg |
 | proc-macro2 | 1.0.107 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com>, Alex Crichton <alex@alexcrichton.com> | https://github.com/dtolnay/proc-macro2 |
 | quote | 1.0.47 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/quote |
+| r-efi | 6.0.0 | MIT OR Apache-2.0 OR LGPL-2.1-or-later | Not declared | https://github.com/r-efi/r-efi |
 | regex | 1.13.1 | MIT OR Apache-2.0 | The Rust Project Developers, Andrew Gallant <jamslam@gmail.com> | https://github.com/rust-lang/regex |
 | regex-automata | 0.4.18 | MIT OR Apache-2.0 | The Rust Project Developers, Andrew Gallant <jamslam@gmail.com> | https://github.com/rust-lang/regex |
 | regex-syntax | 0.8.11 | MIT OR Apache-2.0 | The Rust Project Developers, Andrew Gallant <jamslam@gmail.com> | https://github.com/rust-lang/regex |
 | rustc_version | 0.4.1 | MIT OR Apache-2.0 | Not declared | https://github.com/djc/rustc-version-rs |
+| rustix | 1.1.4 | Apache-2.0 WITH LLVM-exception OR Apache-2.0 OR MIT | Dan Gohman <dev@sunfishcode.online>, Jakub Konka <kubkon@jakubkonka.com> | https://github.com/bytecodealliance/rustix |
 | ryu | 1.0.23 | Apache-2.0 OR BSL-1.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/ryu |
 | same-file | 1.0.6 | Unlicense/MIT | Andrew Gallant <jamslam@gmail.com> | https://github.com/BurntSushi/same-file |
 | semver | 1.0.28 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/semver |
@@ -72,6 +82,7 @@ regenerated whenever `Cargo.lock` changes.
 | strsim | 0.11.1 | MIT | Danny Guo <danny@dannyguo.com>, maxbachmann <oss@maxbachmann.de> | https://github.com/rapidfuzz/strsim-rs |
 | syn | 2.0.119 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/syn |
 | syn | 3.0.4 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/syn |
+| tempfile | 3.27.0 | MIT OR Apache-2.0 | Steven Allen <steven@stebalien.com>, The Rust Project Developers, Ashley Mannix <ashleymannix@live.com.au>, Jason White <me@jasonwhite.io> | https://github.com/Stebalien/tempfile |
 | textwrap | 0.16.2 | MIT | Martin Geisler <martin@geisler.net> | https://github.com/mgeisler/textwrap |
 | thiserror | 2.0.20 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/thiserror |
 | thiserror-impl | 2.0.20 | MIT OR Apache-2.0 | David Tolnay <dtolnay@gmail.com> | https://github.com/dtolnay/thiserror |

package/docs/ci-and-baselines.md

@@ -18,7 +18,7 @@ steps:
       fetch-depth: 0
       persist-credentials: false
 
-  - uses: figueiredoluiz/cuke-dedup@v0.2.0
+  - uses: figueiredoluiz/cuke-dedup@v0.3.0
     id: cuke-dedup
     with:
       path: .
@@ -95,9 +95,9 @@ cuke-dedup . --baseline .cuke-dedup-baseline.json --fail-on-new
 cuke-dedup . --baseline .cuke-dedup-baseline.json --fail-on-new 3
 ```
 
-`--fail-on-new` defaults to zero when no count is supplied. It and `--update-baseline` both require
-`--baseline` and cannot be combined. The Action exposes the same behavior through `baseline` and
-`fail-on-new` inputs.
+`--fail-on-new` defaults to zero when no count is supplied and requires `--baseline` or
+`--baseline-from-ref`. `--update-baseline` requires the file form and cannot be combined with
+`--fail-on-new`. The Action exposes `baseline`, `baseline-from-ref`, and `fail-on-new` inputs.
 
 Baselines store sorted semantic fingerprints with multiplicity counts. Renames and unrelated line
 changes do not make a finding new, while an additional occurrence beyond the recorded count does.
@@ -107,6 +107,48 @@ Version `1` baselines from CukeDedup 0.1 can be replaced by running the version
 Updates reject `--changed-since` and are skipped after incomplete analysis or an operational error,
 preventing a partial scan from erasing accepted findings.
 
+### Compare against a Git revision (next release)
+
+Instead of committing a baseline file, compare with a revision that is already fetched locally:
+
+```sh
+cuke-dedup . --baseline-from-ref origin/main --fail-on-new
+```
+
+The corresponding Action inputs are:
+
+```yaml
+with:
+  baseline-from-ref: ${{ github.event.pull_request.base.sha }}
+  fail-on-new: "0"
+```
+
+This requires an Action/binary version containing this feature; v0.2.1 does not include it.
+Use checkout with `fetch-depth: 0`, or explicitly fetch the desired revision before analysis.
+The tool does not fetch revisions, initialize submodules, install dependencies, or run project code.
+
+The base is scanned in a temporary independent Git checkout using the **current effective
+CukeDedup configuration**, including rule overrides, patterns and suppressions. Historical
+project module metadata and ignore files remain historical inputs. The same repository-relative
+analysis directory must exist in both trees. Missing refs/directories, unsupported submodules,
+base extraction errors, unresolved registrations, zero extraction from discovered sources,
+definitions without a feature corpus, and truncated base comparisons fail with exit code `2`;
+none become an empty accepted baseline. A genuinely empty historical suite is allowed.
+Hooks and configured checkout filters are disabled, so Git LFS content is not hydrated.
+The full repository snapshot is limited to 512 MiB of tracked content and 100,000 files;
+larger repositories can use a committed baseline instead. Git submodules anywhere in that
+snapshot are rejected because their content is not materialized.
+
+Matching findings are suppressed using the existing semantic fingerprints and multiplicity
+rules. Current modified/untracked files are analyzed normally. `--baseline-from-ref` conflicts
+with `--baseline` and `--update-baseline`; it writes no baseline file or base reports and leaves
+the current index, branch and worktree registration untouched. Temporary files are removed after
+success or failure. This costs a second scan, not a changed-files-only optimization.
+
+The new-finding allowance is an additional gate: it does not disable the duplication threshold
+or independent error rules. Use `--fail-on-incomplete` if incomplete current analysis must also
+fail instead of retaining the normal partial-report behavior.
+
 ## Exit codes
 
 | Code | Meaning |

package/docs/rules.md

@@ -48,6 +48,8 @@ other pair rules and retains at most 10,000 findings. Reaching a limit marks ana
 
 Different effective matchers use the same non-trivial handler after parameter and local-variable
 normalization. Empty, pending, unresolved, and otherwise non-comparable handlers are excluded.
+Exact handler matches also require equal behavior signatures. Handlers whose assertion arguments
+reference unresolved external values are excluded from handler comparisons; matcher checks still run.
 Consider one parameterized definition, but retain separate definitions when shared implementation
 is intentional domain vocabulary.
 
@@ -57,8 +59,17 @@ Matcher wording is close and meaningful handlers share at least 50% ordered beha
 compatible structural or canonical-call evidence. Similar prose alone and unrelated actions do
 not qualify. Review the pair and consolidate only when both definitions express the same behavior.
 
-When handlers are not structurally equivalent, they must share a canonical call action, including
-direct and fluent forms such as `page.click()` and `page.locator(...).click()`.
+When handlers are not structurally equivalent, they must share canonical action evidence: either
+a call action, including direct and fluent forms such as `page.click()` and
+`page.locator(...).click()`, or an assertion with the same matcher and subject shape. Expected
+assertion values and polarity remain semantic during final similarity verification.
+Decorated class methods must also have compatible runtime-affecting semantics: async versus sync,
+static versus instance, generator, getter, and setter differences veto a near-duplicate match.
+Call evidence includes inline callback bodies syntactically; deferred assertions are not treated as
+directly executed assertions.
+Deferred assertion sequences must match in value, polarity, and order for a near-duplicate finding.
+Shared wrapper calls cannot compensate for different deferred assertions. This conservatively skips
+fuzzy matches when one callback adds or reorders assertions; exact matcher checks still run.
 
 ### parameterization-candidate
 
@@ -67,6 +78,10 @@ texts are sufficiently similar. Findings remain pair-specific so reports retain
 literals and matcher text. Replace repeated literals with a parameter when it makes the test
 vocabulary clearer.
 
+Expected assertion values and polarity are not erased for this rule. For example,
+`expect(state).toBe('ready')` and `expect(state).toBe('idle')` express distinct expectations and
+do not produce a parameterization suggestion solely because their expected literals differ.
+
 ### unused-definition
 
 No successfully parsed concrete feature step matches a definition. This rule is disabled when the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cuke-dedup",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Static analysis for duplicate and reusable Cucumber step definitions",
   "type": "module",
   "bin": {
@@ -21,6 +21,7 @@
     "test": "node --test npm/test/*.test.mjs",
     "skills:check": "node scripts/check/check-agent-skills.mjs",
     "check:versions": "node scripts/check/check-release-version.mjs",
+    "bump:version": "node scripts/release/bump-version.mjs",
     "pack:check": "npm pack --dry-run",
     "corpus:check": "node scripts/check/check-corpus.mjs",
     "benchmark": "node scripts/benchmark/benchmark-analysis.mjs"
@@ -46,13 +47,13 @@
     "npm/platforms/*"
   ],
   "optionalDependencies": {
-    "cuke-dedup-darwin-arm64": "0.2.0",
-    "cuke-dedup-darwin-x64": "0.2.0",
-    "cuke-dedup-linux-arm64-gnu": "0.2.0",
-    "cuke-dedup-linux-arm64-musl": "0.2.0",
-    "cuke-dedup-linux-x64-gnu": "0.2.0",
-    "cuke-dedup-linux-x64-musl": "0.2.0",
-    "cuke-dedup-windows-arm64-msvc": "0.2.0",
-    "cuke-dedup-windows-x64-msvc": "0.2.0"
+    "cuke-dedup-darwin-arm64": "0.3.0",
+    "cuke-dedup-darwin-x64": "0.3.0",
+    "cuke-dedup-linux-arm64-gnu": "0.3.0",
+    "cuke-dedup-linux-arm64-musl": "0.3.0",
+    "cuke-dedup-linux-x64-gnu": "0.3.0",
+    "cuke-dedup-linux-x64-musl": "0.3.0",
+    "cuke-dedup-windows-arm64-msvc": "0.3.0",
+    "cuke-dedup-windows-x64-msvc": "0.3.0"
   }
 }