Credo ratchet: promote structural checks into the gate #541

New issue

Open

opened 2026-06-15 23:07:26 +02:00 by moritz · 1 comment

moritz commented

2026-06-15 23:07:26 +02:00

Owner

Motivation

The structural Credo checks that surfaced the refactoring backlog are still disabled in the gate .credo.exs. Once the
refactoring issues have reduced the violations, these checks should be promoted into the gate so the codebase
cannot regress. Two checks are already promoted by earlier issues (Readability.StrictModuleLayout in
"Mechanical cleanup …", Warning.UnsafeToAtom in "Correctness …"); this issue handles the remaining three.

It must run last, after the god-module splits, so the violation counts are at their minimum.

Scope

Re-measure current violation counts with the harvest config:
mix credo --strict --config-file .pipeline/refactoring/baseline/credo.harvest.exs
Promote each of the following into the gate .credo.exs at the tightest threshold the post-refactor code
already passes (a ratchet floor, not necessarily the Credo default), then fix any small remaining residue to
hit that floor:
- Design.DuplicatedCode
- Refactor.ModuleDependencies (set max_deps to the current max, e.g. 20, not the default 10 — many modules
  beyond the splits will still exceed 10)
- Refactor.ABCSize
Document, as a comment in .credo.exs, the intended downward tightening over time (e.g. max_deps 20 → 15
→ 10) so future work keeps ratcheting.
Optionally evaluate the lower-priority opt-ins noted in CREDO_RECOMMENDATION.md (e.g.
Refactor.VariableRebinding, Readability.Specs) — include only if low-noise.

Acceptance criteria

The three checks are enabled in the gate .credo.exs at a threshold the code passes; mix credo --strict
(the gate) is green.
The thresholds and the planned tightening are documented inline.
just ci-dev green.

Dependencies

Run after all god-module split issues (member_live/index, Member resource, Mv.Config + join workflow,
core_components, global_settings + fees_component) so the deps/ABC/duplication counts are at their minimum.

## Motivation The structural Credo checks that surfaced the refactoring backlog are still disabled in the gate `.credo.exs`. Once the refactoring issues have reduced the violations, these checks should be promoted into the gate so the codebase cannot regress. Two checks are already promoted by earlier issues (`Readability.StrictModuleLayout` in "Mechanical cleanup …", `Warning.UnsafeToAtom` in "Correctness …"); this issue handles the remaining three. It must run **last**, after the god-module splits, so the violation counts are at their minimum. ## Scope - Re-measure current violation counts with the harvest config: `mix credo --strict --config-file .pipeline/refactoring/baseline/credo.harvest.exs` - Promote each of the following into the gate `.credo.exs` at the **tightest threshold the post-refactor code already passes** (a ratchet floor, not necessarily the Credo default), then fix any small remaining residue to hit that floor: - `Design.DuplicatedCode` - `Refactor.ModuleDependencies` (set `max_deps` to the current max, e.g. 20, not the default 10 — many modules beyond the splits will still exceed 10) - `Refactor.ABCSize` - Document, as a comment in `.credo.exs`, the intended **downward** tightening over time (e.g. `max_deps` 20 → 15 → 10) so future work keeps ratcheting. - Optionally evaluate the lower-priority opt-ins noted in `CREDO_RECOMMENDATION.md` (e.g. `Refactor.VariableRebinding`, `Readability.Specs`) — include only if low-noise. ## Acceptance criteria - The three checks are enabled in the gate `.credo.exs` at a threshold the code passes; `mix credo --strict` (the gate) is green. - The thresholds and the planned tightening are documented inline. - `just ci-dev` green. ## Dependencies Run **after** all god-module split issues (member_live/index, Member resource, Mv.Config + join workflow, core_components, global_settings + fees_component) so the deps/ABC/duplication counts are at their minimum.

moritz added this to the Code and Test Refactoring | TI I milestone

2026-06-15 23:07:26 +02:00

moritz added this to the Sprint 18: Oktober 2026 project

2026-06-15 23:07:26 +02:00

simon referenced this issue

2026-10-15 20:01:07 +02:00

Update Design Guidelines #592

simon commented

2026-10-19 13:56:28 +02:00

Owner

Related CI-gate noise: every mix sobelow --config run (part of just audit, just check, just ci-dev) prints 108 warnings found quoted keyword "…" but the quotes are not required … nofile:2:3, one per mix.lock entry. Cause: Mix writes mix.lock with quoted keys on purpose and reads it with emit_warnings: false; Sobelow 0.16.0 parses the lockfile in Sobelow.Vuln.locked_version/2 via Code.string_to_quoted/1 without emit_warnings: false. Rewriting mix.lock does not help (Mix re-adds the quotes). Proposal: report upstream (pass emit_warnings: false) and bump once released; until then the noise is harmless. When the gate is tightened here, make sure these warnings are not mistaken for real findings.

Related CI-gate noise: every `mix sobelow --config` run (part of `just audit`, `just check`, `just ci-dev`) prints 108 warnings `found quoted keyword "…" but the quotes are not required … nofile:2:3`, one per `mix.lock` entry. Cause: Mix writes `mix.lock` with quoted keys on purpose and reads it with `emit_warnings: false`; Sobelow 0.16.0 parses the lockfile in `Sobelow.Vuln.locked_version/2` via `Code.string_to_quoted/1` without `emit_warnings: false`. Rewriting `mix.lock` does not help (Mix re-adds the quotes). Proposal: report upstream (pass `emit_warnings: false`) and bump once released; until then the noise is harmless. When the gate is tightened here, make sure these warnings are not mistaken for real findings.