feat(cli): --entrypoint-rules for user rule packs (#27)

Author: rahlk

codeanalyzer/__main__.py

@@ -2,7 +2,7 @@
 import sys
 from importlib.metadata import version as _pkg_version, PackageNotFoundError
 from pathlib import Path
-from typing import Optional, Annotated
+from typing import List, Optional, Annotated
 
 import typer
 
@@ -299,6 +299,14 @@ def main(
             min=-1,
         ),
     ] = 50,
+    entrypoint_rules: Annotated[
+        Optional[List[Path]],
+        typer.Option(
+            "--entrypoint-rules",
+            help="Extra entrypoint rules file (YAML). Repeatable; merges with "
+            "the shipped rules. A malformed file is an error.",
+        ),
+    ] = None,
 ):
     # Determinism: pin the interpreter hash seed before any analysis (no-op
     # when PYTHONHASHSEED is already set; --version exits before this).
@@ -385,6 +393,7 @@ def main(
         pycg_shard_timeout=pycg_shard_timeout,
         pycg_shard_strategy=pycg_shard_strategy,
         pycg_max_iter=pycg_max_iter,
+        entrypoint_rules=tuple(entrypoint_rules or ()),
     )
 
     _set_log_level(options.verbosity)

test/test_entrypoint_rules.py

@@ -39,3 +39,38 @@ def test_well_formed_disable_list_removes_the_shipped_rule(tmp_path):
     rs = load_rules([user])
     flask = rs.frameworks["flask"]
     assert all(r.id != "flask.route" for r in flask.decorators)
+
+
+def test_user_rules_merge_additively_with_shipped(tmp_path):
+    extra = tmp_path / "mine.yml"
+    extra.write_text(
+        "version: 1\n"
+        "frameworks:\n"
+        "  inhouse:\n"
+        "    detect: [inhouse]\n"
+        "    decorators:\n"
+        "      - id: inhouse.handler\n"
+        "        match: 'inhouse.app.handler'\n"
+    )
+    rs = load_rules([extra])
+    assert "flask" in rs.frameworks          # shipped survives
+    assert "inhouse" in rs.frameworks        # user added
+    assert rs.rulesets == ["shipped", f"user:{extra}"]
+
+
+def test_user_file_can_disable_a_shipped_rule(tmp_path):
+    off = tmp_path / "off.yml"
+    off.write_text("version: 1\ndisable: [flask.route]\n")
+    rs = load_rules([off])
+    assert not any(r.id == "flask.route" for r in rs.frameworks["flask"].decorators)
+    assert any(r.id == "flask.bp-verb" for r in rs.frameworks["flask"].decorators)
+
+
+def test_bad_confidence_value_is_rejected(tmp_path):
+    bad = tmp_path / "c.yml"
+    bad.write_text(
+        "version: 1\nframeworks:\n  x:\n    decorators:\n"
+        "      - id: x.y\n        match: 'x.y'\n        confidence: probably\n"
+    )
+    with pytest.raises(RulesError):
+        load_rules([bad])