fix(entrypoints): validate disable: shape; drop dead setuptools stanza (#27)

- disable: must now be a list of rule id strings; a bare-string typo or
  other malformed value raises RulesError instead of silently disabling
  nothing (set() over a string iterated its characters).
- Remove [tool.setuptools.package-data] -- this project builds with
  hatchling, which already ships entrypoints/rules.yml via its default
  whole-package inclusion (verified with uv build --wheel).

Author: rahlk

codeanalyzer/entrypoints/rules.py

@@ -76,7 +76,7 @@ def _read(path: Path) -> Dict[str, Any]:
 
 def _merge(out: RuleSet, data: Dict[str, Any], origin: str) -> None:
     out.rulesets.append(origin)
-    disabled = set(data.get("disable") or [])
+    disabled = set(_disable_list(data, origin))
     frameworks = data.get("frameworks") or {}
     if not isinstance(frameworks, dict):
         raise RulesError(f"{origin}: `frameworks` must be a mapping")
@@ -96,6 +96,13 @@ def _merge(out: RuleSet, data: Dict[str, Any], origin: str) -> None:
         fw.bases = [r for r in fw.bases if r.id not in disabled]
 
 
+def _disable_list(data: Dict[str, Any], origin: str) -> List[str]:
+    raw = data.get("disable") or []
+    if not isinstance(raw, list) or not all(isinstance(x, str) for x in raw):
+        raise RulesError(f"{origin}: `disable` must be a list of rule id strings")
+    return raw
+
+
 def _require(raw: Dict[str, Any], key: str, origin: str) -> Any:
     if key not in raw:
         raise RulesError(f"{origin}: rule {raw!r} is missing `{key}`")

pyproject.toml

@@ -59,9 +59,6 @@ neo4j = [
   "neo4j>=5.0.0,<6.0.0",
 ]
 
-[tool.setuptools.package-data]
-codeanalyzer = ["entrypoints/*.yml"]
-
 [dependency-groups]
 test = [
   "pytest>=7.0.0,<8.0.0",

test/test_entrypoint_rules.py

@@ -24,3 +24,18 @@ def test_malformed_user_file_raises_before_analysis(tmp_path):
     bad.write_text("frameworks: [this is a list not a mapping]\n")
     with pytest.raises(RulesError):
         load_rules([bad])
+
+
+def test_bare_string_disable_raises_instead_of_silently_matching_chars(tmp_path):
+    bad = tmp_path / "bad.yml"
+    bad.write_text("disable: flask.route\n")
+    with pytest.raises(RulesError):
+        load_rules([bad])
+
+
+def test_well_formed_disable_list_removes_the_shipped_rule(tmp_path):
+    user = tmp_path / "user.yml"
+    user.write_text("disable: [flask.route]\n")
+    rs = load_rules([user])
+    flask = rs.frameworks["flask"]
+    assert all(r.id != "flask.route" for r in flask.decorators)