fix: make release lint baseline-aware (#10678)

* fix: make release lint baseline-aware

* style: format baseline-aware lint changes

Author: chubes4

crates/homeboy-extension/src/lint/run/exit_code.rs

@@ -42,9 +42,13 @@ pub(super) fn normalize_producer_exit_code(
     }
 }
 
-pub(super) fn effective_lint_exit_code(exit_code: i32, baseline_exit_override: Option<i32>) -> i32 {
+pub(super) fn effective_lint_exit_code(
+    exit_code: i32,
+    baseline_exit_override: Option<i32>,
+    hard_error: bool,
+) -> i32 {
     match baseline_exit_override {
-        Some(0) if exit_code >= 2 => exit_code,
+        Some(0) if hard_error => exit_code.max(1),
         Some(override_code) => override_code,
         None => exit_code,
     }

crates/homeboy-extension/src/lint/run/scoping.rs

@@ -39,6 +39,7 @@ pub(super) fn resolve_scoped_lint_runs(
             files
         };
 
+        let changed_files = component_relative_changed_files(component, changed_files);
         if changed_files.is_empty() {
             println!("No files in working tree changes");
             return Ok(Some(Vec::new()));
@@ -56,6 +57,7 @@ pub(super) fn resolve_scoped_lint_runs(
             None => git::get_files_changed_since(&component.local_path, git_ref)?,
         };
 
+        let changed_files = component_relative_changed_files(component, changed_files);
         if changed_files.is_empty() {
             println!("No files changed since {}", git_ref);
             return Ok(Some(Vec::new()));
@@ -67,6 +69,21 @@ pub(super) fn resolve_scoped_lint_runs(
     }
 }
 
+fn component_relative_changed_files(
+    component: &Component,
+    changed_files: Vec<String>,
+) -> Vec<String> {
+    let Some(prefix) = git::get_component_path_prefix(&component.local_path) else {
+        return changed_files;
+    };
+    let prefix = format!("{}/", prefix.trim_end_matches('/'));
+
+    changed_files
+        .into_iter()
+        .filter_map(|file| file.strip_prefix(&prefix).map(str::to_string))
+        .collect()
+}
+
 pub(super) fn build_changed_lint_runs(
     component: &Component,
     changed_files: &[String],

crates/homeboy-extension/src/lint/run/tests/exit_code.rs

@@ -66,6 +66,8 @@ fn crashed_zero_finding_producer_remains_failure() {
 
 #[test]
 fn baseline_clean_override_honors_known_findings_but_not_infrastructure_errors() {
-    assert_eq!(effective_lint_exit_code(1, Some(0)), 0);
-    assert_eq!(effective_lint_exit_code(2, Some(0)), 2);
+    assert_eq!(effective_lint_exit_code(1, Some(0), false), 0);
+    assert_eq!(effective_lint_exit_code(2, Some(0), true), 2);
+    assert_eq!(effective_lint_exit_code(1, Some(0), true), 1);
+    assert_eq!(effective_lint_exit_code(0, Some(0), true), 1);
 }

crates/homeboy-extension/src/lint/run/tests/workflow.rs

@@ -2,8 +2,10 @@ use super::super::workflow::{
     finish_scoped_lint_run_dir, run_main_lint_workflow, run_self_check_lint_workflow,
 };
 use super::{component, lint_args};
-use homeboy_core::component::{Component, ComponentScriptsConfig};
+use homeboy_core::component::{Component, ComponentScriptsConfig, ScopedExtensionConfig};
 use homeboy_core::engine::run_dir::RunDir;
+use std::collections::HashMap;
+use std::path::Path;
 
 #[test]
 fn test_run_self_check_lint_workflow() {
@@ -60,6 +62,271 @@ fn test_run_main_lint_workflow() {
     assert!(result.findings.is_none());
 }
 
+fn routed_lint_component(home: &Path, source: &Path, script: &str) -> Component {
+    let extension_dir = home.join(".config/homeboy/extensions/routed-lint-fixture");
+    std::fs::create_dir_all(&extension_dir).expect("extension dir");
+    std::fs::write(
+        extension_dir.join("routed-lint-fixture.json"),
+        r#"{
+            "name":"Routed lint fixture",
+            "version":"1.0.0",
+            "lint":{
+                "extension_script":"lint.sh",
+                "changed_file_routes":[
+                    {"extensions":["php"],"step":"php"},
+                    {"extensions":["js"],"step":"js"}
+                ]
+            }
+        }"#,
+    )
+    .expect("extension manifest");
+    std::fs::write(extension_dir.join("lint.sh"), script).expect("lint script");
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let script_path = extension_dir.join("lint.sh");
+        let mut permissions = std::fs::metadata(&script_path)
+            .expect("script metadata")
+            .permissions();
+        permissions.set_mode(0o755);
+        std::fs::set_permissions(script_path, permissions).expect("executable script");
+    }
+
+    Component {
+        id: "fixture".to_string(),
+        local_path: source.to_string_lossy().to_string(),
+        extensions: Some(HashMap::from([(
+            "routed-lint-fixture".to_string(),
+            ScopedExtensionConfig::default(),
+        )])),
+        ..Default::default()
+    }
+}
+
+fn routed_lint_args() -> super::super::types::LintRunWorkflowArgs {
+    let mut args = lint_args();
+    args.changed_since = Some("v1.0.0".to_string());
+    args.precomputed_changed_files =
+        Some(vec!["legacy.php".to_string(), "assets/app.js".to_string()]);
+    args.json_summary = true;
+    args
+}
+
+fn producer_sidecar_paths(
+    workflow: &super::super::types::LintRunWorkflowResult,
+) -> Vec<std::path::PathBuf> {
+    workflow
+        .producer_summaries
+        .iter()
+        .filter_map(|producer| producer.source.as_ref()?.path.as_ref())
+        .map(std::path::PathBuf::from)
+        .collect()
+}
+
+#[test]
+fn multi_route_lint_aggregates_later_route_findings() {
+    homeboy_core::test_support::with_isolated_home(|home| {
+        let source = tempfile::tempdir().expect("source dir");
+        let component = routed_lint_component(
+            home.path(),
+            source.path(),
+            r#"#!/bin/sh
+if [ "$HOMEBOY_STEP" = "php" ]; then
+  printf '[]' > "$HOMEBOY_LINT_FINDINGS_FILE"
+  exit 0
+fi
+printf '[{"tool":"eslint","message":"later route finding","fingerprint":"later","file":"assets/app.js"}]' > "$HOMEBOY_LINT_FINDINGS_FILE"
+exit 1
+"#,
+        );
+        let run_dir = RunDir::create().expect("run dir");
+
+        let workflow =
+            run_main_lint_workflow(&component, source.path(), routed_lint_args(), &run_dir)
+                .expect("workflow result");
+
+        assert_eq!(workflow.status, "failed");
+        assert_eq!(workflow.exit_code, 1);
+        let findings = workflow.findings.as_ref().expect("findings");
+        assert_eq!(findings.len(), 1);
+        assert_eq!(findings[0].message, "later route finding");
+        assert_eq!(workflow.producer_summaries[1].step.as_deref(), Some("js"));
+        assert!(producer_sidecar_paths(&workflow)
+            .iter()
+            .all(|path| path.is_file()));
+    });
+}
+
+#[test]
+fn multi_route_failure_retains_later_success_evidence() {
+    homeboy_core::test_support::with_isolated_home(|home| {
+        let source = tempfile::tempdir().expect("source dir");
+        let component = routed_lint_component(
+            home.path(),
+            source.path(),
+            r#"#!/bin/sh
+if [ "$HOMEBOY_STEP" = "php" ]; then
+  printf '[{"tool":"phpcs","message":"first route finding","fingerprint":"first","file":"legacy.php"}]' > "$HOMEBOY_LINT_FINDINGS_FILE"
+  exit 1
+fi
+printf '[]' > "$HOMEBOY_LINT_FINDINGS_FILE"
+exit 0
+"#,
+        );
+        let run_dir = RunDir::create().expect("run dir");
+
+        let workflow =
+            run_main_lint_workflow(&component, source.path(), routed_lint_args(), &run_dir)
+                .expect("workflow result");
+
+        assert_eq!(workflow.status, "failed");
+        assert_eq!(workflow.findings.as_ref().map(Vec::len), Some(1));
+        let paths = producer_sidecar_paths(&workflow);
+        assert_eq!(paths.len(), 2);
+        assert!(paths.iter().all(|path| path.is_file()));
+    });
+}
+
+#[test]
+fn successful_multi_route_lint_cleans_child_route_evidence() {
+    homeboy_core::test_support::with_isolated_home(|home| {
+        let source = tempfile::tempdir().expect("source dir");
+        let component = routed_lint_component(
+            home.path(),
+            source.path(),
+            r#"#!/bin/sh
+printf '[]' > "$HOMEBOY_LINT_FINDINGS_FILE"
+exit 0
+"#,
+        );
+        let run_dir = RunDir::create().expect("run dir");
+
+        let workflow =
+            run_main_lint_workflow(&component, source.path(), routed_lint_args(), &run_dir)
+                .expect("workflow result");
+
+        assert_eq!(workflow.status, "passed");
+        let paths = producer_sidecar_paths(&workflow);
+        assert_eq!(paths.len(), 2);
+        assert!(
+            paths[0].is_file(),
+            "primary run evidence remains caller-owned"
+        );
+        assert!(!paths[1].exists(), "successful child route must be cleaned");
+    });
+}
+
+#[test]
+fn nested_component_scope_uses_existing_component_relative_file_paths() {
+    homeboy_core::test_support::with_isolated_home(|home| {
+        let repo = tempfile::tempdir().expect("repo dir");
+        let run_git = |args: &[&str]| {
+            let output = std::process::Command::new("git")
+                .args(args)
+                .current_dir(repo.path())
+                .output()
+                .expect("git command");
+            assert!(
+                output.status.success(),
+                "git {:?} failed: {}",
+                args,
+                String::from_utf8_lossy(&output.stderr)
+            );
+        };
+        run_git(&["init", "-q"]);
+        run_git(&["config", "user.email", "homeboy@example.com"]);
+        run_git(&["config", "user.name", "Homeboy Test"]);
+        let component_path = repo.path().join("packages/fixture");
+        std::fs::create_dir_all(&component_path).expect("component dir");
+        std::fs::write(component_path.join("initial.php"), "<?php\n").expect("initial source");
+        run_git(&["add", "packages/fixture/initial.php"]);
+        run_git(&["commit", "-q", "-m", "initial"]);
+        run_git(&["tag", "fixture-v1.0.0"]);
+        std::fs::write(component_path.join("changed.php"), "<?php echo 1;\n")
+            .expect("changed source");
+        std::fs::write(repo.path().join("outside.php"), "<?php echo 2;\n").expect("outside source");
+        run_git(&["add", "packages/fixture/changed.php", "outside.php"]);
+        run_git(&["commit", "-q", "-m", "change nested and outside files"]);
+
+        let component = routed_lint_component(
+            home.path(),
+            &component_path,
+            r#"#!/bin/sh
+changed="$(cat "$HOMEBOY_LINT_CHANGED_FILES_FILE")"
+test -f "$HOMEBOY_LINT_GLOB" || exit 2
+printf '[{"tool":"fixture","message":"%s|%s","fingerprint":"scope","file":"changed.php"}]' "$HOMEBOY_LINT_GLOB" "$changed" > "$HOMEBOY_LINT_FINDINGS_FILE"
+exit 1
+"#,
+        );
+        let run_dir = RunDir::create().expect("run dir");
+        let mut args = lint_args();
+        args.changed_since = Some("fixture-v1.0.0".to_string());
+        args.json_summary = true;
+
+        let workflow = run_main_lint_workflow(&component, &component_path, args, &run_dir)
+            .expect("workflow result");
+
+        let expected_glob = component_path.join("changed.php");
+        assert!(expected_glob.is_file());
+        assert_eq!(
+            workflow.findings.as_ref().unwrap()[0].message,
+            format!("{}|changed.php", expected_glob.display())
+        );
+        let manifest = run_dir.step_file(homeboy_core::engine::run_dir::files::LINT_CHANGED_FILES);
+        assert!(manifest.is_file());
+        assert_eq!(std::fs::read_to_string(manifest).unwrap(), "changed.php\n");
+        assert!(!workflow.findings.as_ref().unwrap()[0]
+            .message
+            .contains("packages/fixture/packages/fixture"));
+    });
+}
+
+#[test]
+fn accepted_baseline_does_not_hide_later_route_producer_error() {
+    homeboy_core::test_support::with_isolated_home(|home| {
+        let source = tempfile::tempdir().expect("source dir");
+        let mut known = homeboy_core::finding::HomeboyFinding::builder("eslint", "known finding")
+            .fingerprint("known")
+            .build();
+        known.location.file = Some("assets/app.js".to_string());
+        crate::lint::baseline::save_baseline(source.path(), "fixture", &[known])
+            .expect("save baseline");
+        let component = routed_lint_component(
+            home.path(),
+            source.path(),
+            r#"#!/bin/sh
+if [ "$HOMEBOY_STEP" = "php" ]; then
+  printf '[]' > "$HOMEBOY_LINT_FINDINGS_FILE"
+  exit 0
+fi
+printf '[{"tool":"eslint","message":"known finding","fingerprint":"known","file":"assets/app.js"}]' > "$HOMEBOY_LINT_FINDINGS_FILE"
+printf '[{"tool":"eslint","status":"error","finding_count":1}]' > "$HOMEBOY_LINT_PRODUCERS_FILE"
+exit 0
+"#,
+        );
+        let run_dir = RunDir::create().expect("run dir");
+
+        let workflow =
+            run_main_lint_workflow(&component, source.path(), routed_lint_args(), &run_dir)
+                .expect("workflow result");
+
+        assert_eq!(workflow.status, "failed");
+        assert_eq!(workflow.exit_code, 1);
+        assert_eq!(workflow.findings.as_ref().map(Vec::len), Some(1));
+        assert!(workflow
+            .producer_summaries
+            .iter()
+            .any(|producer| producer.step.as_deref() == Some("js") && producer.status == "error"));
+        assert_eq!(
+            workflow
+                .baseline_comparison
+                .as_ref()
+                .map(|comparison| comparison.new_items.len()),
+            Some(0)
+        );
+    });
+}
+
 #[test]
 fn lint_config_deserializes_changed_file_routes() {
     let config: crate::LintConfig = serde_json::from_str(