[EE] Add a 'custom cop' to RuboCop that bans ENV assignment

See https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14810.
Signed-off-by: Rémy Coutable <remy@rymai.me>

lib/backup/manager.rb

@@ -101,50 +101,50 @@ module Backup
     end
 
     def unpack
-      Dir.chdir(backup_path)
-
-      # check for existing backups in the backup dir
-      if backup_file_list.empty?
-        $progress.puts "No backups found in #{backup_path}"
-        $progress.puts "Please make sure that file name ends with #{FILE_NAME_SUFFIX}"
-        exit 1
-      elsif backup_file_list.many? && ENV["BACKUP"].nil?
-        $progress.puts 'Found more than one backup, please specify which one you want to restore:'
-        $progress.puts 'rake gitlab:backup:restore BACKUP=timestamp_of_backup'
-        exit 1
-      end
+      Dir.chdir(backup_path) do
+        # check for existing backups in the backup dir
+        if backup_file_list.empty?
+          $progress.puts "No backups found in #{backup_path}"
+          $progress.puts "Please make sure that file name ends with #{FILE_NAME_SUFFIX}"
+          exit 1
+        elsif backup_file_list.many? && ENV["BACKUP"].nil?
+          $progress.puts 'Found more than one backup, please specify which one you want to restore:'
+          $progress.puts 'rake gitlab:backup:restore BACKUP=timestamp_of_backup'
+          exit 1
+        end
 
-      tar_file = if ENV['BACKUP'].present?
-                   "#{ENV['BACKUP']}#{FILE_NAME_SUFFIX}"
-                 else
-                   backup_file_list.first
-                 end
+        tar_file = if ENV['BACKUP'].present?
+                     "#{ENV['BACKUP']}#{FILE_NAME_SUFFIX}"
+                   else
+                     backup_file_list.first
+                   end
 
-      unless File.exist?(tar_file)
-        $progress.puts "The backup file #{tar_file} does not exist!"
-        exit 1
-      end
+        unless File.exist?(tar_file)
+          $progress.puts "The backup file #{tar_file} does not exist!"
+          exit 1
+        end
 
-      $progress.print 'Unpacking backup ... '
+        $progress.print 'Unpacking backup ... '
 
-      unless Kernel.system(*%W(tar -xf #{tar_file}))
-        $progress.puts 'unpacking backup failed'.color(:red)
-        exit 1
-      else
-        $progress.puts 'done'.color(:green)
-      end
+        unless Kernel.system(*%W(tar -xf #{tar_file}))
+          $progress.puts 'unpacking backup failed'.color(:red)
+          exit 1
+        else
+          $progress.puts 'done'.color(:green)
+        end
 
-      ENV["VERSION"] = "#{settings[:db_version]}" if settings[:db_version].to_i > 0
-
-      # restoring mismatching backups can lead to unexpected problems
-      if settings[:gitlab_version] != Gitlab::VERSION
-        $progress.puts 'GitLab version mismatch:'.color(:red)
-        $progress.puts "  Your current GitLab version (#{Gitlab::VERSION}) differs from the GitLab version in the backup!".color(:red)
-        $progress.puts '  Please switch to the following version and try again:'.color(:red)
-        $progress.puts "  version: #{settings[:gitlab_version]}".color(:red)
-        $progress.puts
-        $progress.puts "Hint: git checkout v#{settings[:gitlab_version]}"
-        exit 1
+        ENV["VERSION"] = "#{settings[:db_version]}" if settings[:db_version].to_i > 0
+
+        # restoring mismatching backups can lead to unexpected problems
+        if settings[:gitlab_version] != Gitlab::VERSION
+          $progress.puts 'GitLab version mismatch:'.color(:red)
+          $progress.puts "  Your current GitLab version (#{Gitlab::VERSION}) differs from the GitLab version in the backup!".color(:red)
+          $progress.puts '  Please switch to the following version and try again:'.color(:red)
+          $progress.puts "  version: #{settings[:gitlab_version]}".color(:red)
+          $progress.puts
+          $progress.puts "Hint: git checkout v#{settings[:gitlab_version]}"
+          exit 1
+        end
       end
     end
 

rubocop/cop/rspec/env_assignment.rb

+require 'rubocop-rspec'
+require_relative '../../spec_helpers'
+
+module RuboCop
+  module Cop
+    module RSpec
+      # This cop checks for ENV assignment in specs
+      #
+      # @example
+      #
+      #   # bad
+      #   before do
+      #     ENV['FOO'] = 'bar'
+      #   end
+      #
+      #   # good
+      #   before do
+      #     stub_env('FOO', 'bar')
+      #   end
+      class EnvAssignment < Cop
+        include SpecHelpers
+
+        MESSAGE = "Don't assign to ENV, use `stub_env` instead.".freeze
+
+        def_node_search :env_assignment?, <<~PATTERN
+          (send (const nil? :ENV) :[]= ...)
+        PATTERN
+
+        # Following is what node.children looks like on a match
+        # [s(:const, nil, :ENV), :[]=, s(:str, "key"), s(:str, "value")]
+        def on_send(node)
+          return unless in_spec?(node)
+          return unless env_assignment?(node)
+
+          add_offense(node, :expression, MESSAGE)
+        end
+
+        def autocorrect(node)
+          lambda do |corrector|
+            corrector.replace(node.loc.expression, stub_env(env_key(node), env_value(node)))
+          end
+        end
+
+        def env_key(node)
+          node.children[2].source
+        end
+
+        def env_value(node)
+          node.children[3].source
+        end
+
+        def stub_env(key, value)
+          "stub_env(#{key}, #{value})"
+        end
+      end
+    end
+  end
+end

rubocop/rubocop.rb

+require_relative 'cop/active_record_dependent'
+require_relative 'cop/active_record_serialize'
 require_relative 'cop/custom_error_class'
 require_relative 'cop/gem_fetcher'
-require_relative 'cop/active_record_serialize'
-require_relative 'cop/redirect_with_status'
+require_relative 'cop/in_batches'
 require_relative 'cop/polymorphic_associations'
 require_relative 'cop/project_path_helper'
-require_relative 'cop/active_record_dependent'
-require_relative 'cop/in_batches'
+require_relative 'cop/redirect_with_status'
 require_relative 'cop/migration/add_column'
 require_relative 'cop/migration/add_column_with_default_to_large_table'
 require_relative 'cop/migration/add_concurrent_foreign_key'
@@ -13,12 +13,13 @@ require_relative 'cop/migration/add_concurrent_index'
 require_relative 'cop/migration/add_index'
 require_relative 'cop/migration/add_timestamps'
 require_relative 'cop/migration/datetime'
-require_relative 'cop/migration/safer_boolean_column'
 require_relative 'cop/migration/hash_index'
 require_relative 'cop/migration/remove_concurrent_index'
 require_relative 'cop/migration/remove_index'
 require_relative 'cop/migration/reversible_add_column_with_default'
+require_relative 'cop/migration/safer_boolean_column'
 require_relative 'cop/migration/timestamps'
 require_relative 'cop/migration/update_column_in_batches'
+require_relative 'cop/rspec/env_assignment'
 require_relative 'cop/rspec/single_line_hook'
 require_relative 'cop/rspec/verbose_include_metadata'

rubocop/spec_helpers.rb

+module RuboCop
+  module SpecHelpers
+    SPEC_HELPERS = %w[spec_helper.rb rails_helper.rb].freeze
+
+    # Returns true if the given node originated from the spec directory.
+    def in_spec?(node)
+      path = node.location.expression.source_buffer.name
+
+      !SPEC_HELPERS.include?(File.basename(path)) && path.start_with?(File.join(Dir.pwd, 'spec'))
+    end
+  end
+end

spec/lib/gitlab/backup/manager_spec.rb

@@ -172,10 +172,6 @@ describe Backup::Manager do
   end
 
   describe '#unpack' do
-    before do
-      allow(Dir).to receive(:chdir)
-    end
-
     context 'when there are no backup files in the directory' do
       before do
         allow(Dir).to receive(:glob).and_return([])

spec/rubocop/cop/rspec/env_assignment_spec.rb

+require 'spec_helper'
+
+require 'rubocop'
+require 'rubocop/rspec/support'
+
+require_relative '../../../../rubocop/cop/rspec/env_assignment'
+
+describe RuboCop::Cop::RSpec::EnvAssignment do
+  include CopHelper
+
+  OFFENSE_CALL_SINGLE_QUOTES_KEY = %(ENV['FOO'] = 'bar').freeze
+  OFFENSE_CALL_DOUBLE_QUOTES_KEY = %(ENV["FOO"] = 'bar').freeze
+
+  let(:source_file) { 'spec/foo_spec.rb' }
+
+  subject(:cop) { described_class.new }
+
+  shared_examples 'an offensive ENV#[]= call' do |content|
+    it "registers an offense for `#{content}`" do
+      inspect_source(cop, content, source_file)
+
+      expect(cop.offenses.size).to eq(1)
+      expect(cop.offenses.map(&:line)).to eq([1])
+      expect(cop.highlights).to eq([content])
+    end
+  end
+
+  shared_examples 'an autocorrected ENV#[]= call' do |content, autocorrected_content|
+    it "registers an offense for `#{content}` and autocorrects it to `#{autocorrected_content}`" do
+      autocorrected = autocorrect_source(cop, content, source_file)
+
+      expect(autocorrected).to eql(autocorrected_content)
+    end
+  end
+
+  context 'in a spec file' do
+    before do
+      allow(cop).to receive(:in_spec?).and_return(true)
+    end
+
+    context 'with a key using single quotes' do
+      it_behaves_like 'an offensive ENV#[]= call', OFFENSE_CALL_SINGLE_QUOTES_KEY
+      it_behaves_like 'an autocorrected ENV#[]= call', OFFENSE_CALL_SINGLE_QUOTES_KEY, %(stub_env('FOO', 'bar'))
+    end
+
+    context 'with a key using double quotes' do
+      it_behaves_like 'an offensive ENV#[]= call', OFFENSE_CALL_DOUBLE_QUOTES_KEY
+      it_behaves_like 'an autocorrected ENV#[]= call', OFFENSE_CALL_DOUBLE_QUOTES_KEY, %(stub_env("FOO", 'bar'))
+    end
+  end
+
+  context 'outside of a spec file' do
+    it "does not register an offense for `#{OFFENSE_CALL_SINGLE_QUOTES_KEY}` in a non-spec file" do
+      inspect_source(cop, OFFENSE_CALL_SINGLE_QUOTES_KEY)
+
+      expect(cop.offenses.size).to eq(0)
+    end
+  end
+end

spec/tasks/gitlab/gitaly_rake_spec.rb

@@ -43,15 +43,8 @@ describe 'gitlab:gitaly namespace rake task' do
     describe 'gmake/make' do
       let(:command_preamble) { %w[/usr/bin/env -u RUBYOPT -u BUNDLE_GEMFILE] }
 
-      before(:all) do
-        @old_env_ci = ENV.delete('CI')
-      end
-
-      after(:all) do
-        ENV['CI'] = @old_env_ci if @old_env_ci
-      end
-
       before do
+        stub_env('CI', false)
         FileUtils.mkdir_p(clone_path)
         expect(Dir).to receive(:chdir).with(clone_path).and_call_original
         allow(Bundler).to receive(:bundle_path).and_return('/fake/bundle_path')

spec/tasks/gitlab/ldap_rake_spec.rb

@@ -4,7 +4,7 @@ describe 'gitlab:ldap:rename_provider rake task' do
   it 'completes without error' do
     Rake.application.rake_require 'tasks/gitlab/ldap'
     stub_warn_user_is_not_gitlab
-    ENV['force'] = 'yes'
+    stub_env('force', 'yes')
 
     create(:identity) # Necessary to prevent `exit 1` from the task.